← Back to Proof of Origin

Technical Architecture

How AI agents get birth certificates, signed inference chains, and blockchain-anchored provenance.

System Overview

The system has three components: the Desktop (signs everything with TPM-sealed keys), the Morpheus network (decentralized inference), and the Polygon blockchain (permanent record). The agent is a smart contract with identity — a Sovereign Secret — where Notes accumulate as its chain of experience.

graph TB
    subgraph Desktop["Desktop V6 (Your PC)"]
        TPM["TPM 2.0
Hardware-sealed keys"] MCP["MCP Server
Port 3021"] Archive["Archive Pipeline
Encrypt → IPFS → Chain"] end subgraph Agent["Morpheus Agent Plugin"] Birth["Birth Certificate
Note 0"] Actions["Action Chain
Hash-linked Notes"] Settle["Settlement
Merkle Root"] Channel["Secure Channel
Signed prompts/responses"] end subgraph Morpheus["Morpheus Network"] API["Inference API
api.mor.org"] Kimi["Kimi K2.5
GLM-4.7"] TEE["TEE Attestation
Intel TDX"] end subgraph Chain["Polygon Blockchain"] Secret["Sovereign Secret
Agent Identity"] Notes["Encrypted Notes
Action History"] IPFS["IPFS
Full Content"] end TPM -->|signs| MCP MCP -->|relay| Agent Agent -->|signed prompts| API API --> Kimi Kimi -->|responses| Agent Agent -->|hash-linked| Actions Actions -->|settle| Settle Settle -->|write| Archive Archive -->|encrypt + store| IPFS Archive -->|anchor| Secret Secret --- Notes TEE -.->|attestation| Channel style Desktop fill:#1e1b4b,stroke:#818cf8,color:#ffffff style Agent fill:#312e81,stroke:#818cf8,color:#ffffff style Morpheus fill:#1e3a5f,stroke:#22d3ee,color:#ffffff style Chain fill:#14532d,stroke:#4ade80,color:#ffffff

Agent Lifecycle

An agent is born, works, and settles. Every step is signed, hash-linked, and anchored on-chain.

sequenceDiagram
    participant Owner as Steven (Owner)
    participant Desktop as Desktop V6 (TPM)
    participant Agent as Morpheus Agent
    participant Morpheus as Morpheus API
    participant Polygon as Polygon Chain

    Note over Owner,Polygon: 1. BIRTH — Agent gets a birth certificate

    Owner->>Desktop: Create agent (derive key m/44'/60'/0'/1/0)
    Desktop->>Polygon: Deploy Sovereign Secret
    Desktop->>Polygon: Write Note 0: Birth Certificate
    Note right of Polygon: Parents: Morpheus/Kimi K2.5
+ Steven Sprague
Policy: 100 MOR/day Note over Owner,Polygon: 2. WORK — Every inference is recorded Agent->>Morpheus: Signed prompt hash + query Morpheus-->>Agent: Response (Kimi K2.5) Agent->>Agent: Hash response, link to previous Note Agent->>Desktop: Write action Note (via relay) Desktop->>Polygon: Encrypted Note (ECDH + AES-256-GCM) Agent->>Morpheus: Second query Morpheus-->>Agent: Response Agent->>Agent: Hash-link to previous Agent->>Desktop: Write action Note Desktop->>Polygon: Encrypted Note Note over Owner,Polygon: 3. SETTLE — One Merkle root covers all actions Agent->>Agent: Compute Merkle root of session Agent->>Desktop: Build session archive (full content) Desktop->>Polygon: Write settlement Note + archive to IPFS Note right of Polygon: Merkle root: 0xc4f3...
3 actions, 4213 tokens
Full content on IPFS (encrypted)

The Birth Certificate

Every agent has two parents. The birth certificate names both: the AI that gives it capability and the human who gives it authority. It follows the TCG DICE pattern — identity composed from layers.

graph LR
    subgraph Parents
        AI["AI Parent
Morpheus / Kimi K2.5
api.mor.org"] Human["Authorizer
Steven Sprague
0xCf31...3fDa"] end subgraph BirthCert["Birth Certificate (Note 0)"] Agent["Agent Identity
0xB29A...ffaA6
m/44'/60'/0'/1/0"] Policy["Policy
100 MOR/day
scope: research"] Key["Key Protection
TPM-sealed
NIST Level 2"] end subgraph Chain["On-Chain"] Secret["Sovereign Secret
0x70b893..."] Block["Block 84,799,553
March 28, 2026"] end AI -->|powers| Agent Human -->|authorizes| Agent Agent --- Policy Agent --- Key Agent -->|written to| Secret Secret --- Block style Parents fill:#312e81,stroke:#818cf8,color:#ffffff style BirthCert fill:#1e1b4b,stroke:#c7d2fe,color:#ffffff style Chain fill:#14532d,stroke:#4ade80,color:#ffffff

Hash-Linked Action Chain

Each Note contains the SHA-256 hash of the previous Note. This creates a tamper-evident chain — altering any entry breaks all subsequent links. The settlement Merkle root proves the entire session.

graph LR
    N0["Note 0
Birth Certificate
hash: 0x039d..."] N1["Note 1
Inference: DeAI state
1,542 tokens
hash: 0x797b..."] N2["Note 2
Inference: Agent identity
1,702 tokens
hash: 0x9455..."] N3["Note 3
Inference: Enterprise impact
969 tokens
hash: 0x127b..."] N4["Note 4
Settlement
Merkle Root: 0xc4f3..."] N0 -->|previousHash| N1 N1 -->|previousHash| N2 N2 -->|previousHash| N3 N3 -->|previousHash| N4 style N0 fill:#4f46e5,stroke:#c7d2fe,color:#ffffff style N1 fill:#312e81,stroke:#818cf8,color:#ffffff style N2 fill:#312e81,stroke:#818cf8,color:#ffffff style N3 fill:#312e81,stroke:#818cf8,color:#ffffff style N4 fill:#059669,stroke:#4ade80,color:#ffffff
Tamper detection: If Note 2 is altered, its hash changes, which means Note 3's previousHash no longer matches. The chain breaks visibly. This is the same math that secures Bitcoin.

Four Layers of Trust

Each layer adds cryptographic guarantees. Each requires different infrastructure.

graph BT
    L1["Layer 1: Agent-Side Signing
Agent signs prompt hashes, hashes responses
Hash-links every action, settles Merkle root
STATUS: WORKING"] L2["Layer 2: Provider-Side Signing
Provider signs responses with registered wallet
Bilateral proof of conversation
STATUS: PATCH READY"] L3["Layer 3: Encrypted Channel
ECDH key exchange, AES-256-GCM encryption
TEE attestation proves the enclave
STATUS: DESIGNED"] L4["Layer 4: Model Provenance
Model built from signed training data
Weight hashes, build attestation (TCG RIM)
STATUS: SPEC PHASE"] L1 --> L2 L2 --> L3 L3 --> L4 style L1 fill:#059669,stroke:#4ade80,color:#ffffff style L2 fill:#b45309,stroke:#fbbf24,color:#ffffff style L3 fill:#4338ca,stroke:#c7d2fe,color:#ffffff style L4 fill:#4b5563,stroke:#d1d5db,color:#ffffff
LayerWhat It ProvesCryptoStatus
1. Agent-SideWhat was asked, what was received, in what orderSHA-256, secp256k1 ECDSA, Merkle treesWorking
2. Provider-SideProvider signed the response, bilateral proofProvider wallet secp256k1 signaturePatch ready
3. Encrypted ChannelNo eavesdropping, verified enclaveECDH + AES-256-GCM, Intel TDX attestationDesigned
4. Model ProvenanceModel weights match signed build manifestTCG RIM, Sigstore, ML-DSA (post-quantum)Spec phase

The Skill Model

Skills are signed, verified code modules loaded into the TEE runtime. Each skill declares its permissions. The TEE enforces them. Skills never touch keys — they sign through the runtime context.

graph TB
    subgraph Runtime["Agent Runtime (TEE Container)"]
        Policy["Policy Engine
ALLOW / DENY / AUTO"] Chain["Internal Chain
Merkle-linked blocks"] Signing["Key Custody
Desktop TPM relay"] Settle["Settlement
Sovereign Secret"] end subgraph Skills["Loaded Skills"] S1["Skill #1
morpheus-inference
v0.3.0"] S2["Skill #2
(future) x402-commerce"] S3["Skill #3
(future) data-collection"] end subgraph Context["Skill Context (what skills can use)"] Sign["ctx.sign()
→ policy check → TPM"] Record["ctx.recordEvent()
→ unified Merkle chain"] State["ctx.getState()
→ read-only counters"] end S1 --> Sign S1 --> Record S1 --> State Sign --> Policy Record --> Chain Policy --> Signing Chain --> Settle style Runtime fill:#1e1b4b,stroke:#c7d2fe,color:#ffffff style Skills fill:#312e81,stroke:#818cf8,color:#ffffff style Context fill:#14532d,stroke:#4ade80,color:#ffffff

Skill Manifest

Every skill has a manifest declaring what it is and what it can do. The TEE verifies the manifest before loading. Skills can only emit events they declared. Code hash is verified against the manifest.

FieldPurposeExample
nameSkill identitymorpheus-inference
versionSemver0.3.0
codeHashSHA-256 of code bundlesha256:abc123...
emitEventsAllowed event categories[skill_inference, skill_output]
externalEndpointsAPIs the skill calls[https://api.mor.org]
archiveContentCan buffer for archivingtrue
authorSignatureAuthor signs the manifest0xSig...
Why skills, not plugins? Plugins run in the host's address space — the host can inspect and tamper. TEE skills run in attested isolation — the host cannot read skill memory or modify behavior. The TEE proves cryptographically that specific, unmodified code is executing.

Signing Architecture

The agent never holds a private key. Desktop V6 is the Hardware Security Module. All signing is proxied through a session token — if the agent is compromised, there is no key to steal.

graph LR
    subgraph Agent["Agent Process"]
        Token["Session Token
(32 random bytes)"] Logic["Agent Logic
No private key"] end subgraph Desktop["Desktop V6 (HSM)"] TPM["TPM 2.0
Hardware-bound key"] Validate["Validate Token
Check policy"] Sign["Sign with TPM
Return signature only"] end subgraph Output["Signed Output"] Sig["Signature
0x..."] Note["Encrypted Note
On Polygon"] end Token -->|authenticate| Validate Logic -->|sign request| Validate Validate -->|approved| Sign TPM -->|hardware signs| Sign Sign -->|signature only| Sig Sign -->|write note| Note style Agent fill:#312e81,stroke:#818cf8,color:#ffffff style Desktop fill:#1e1b4b,stroke:#c7d2fe,color:#ffffff style Output fill:#14532d,stroke:#4ade80,color:#ffffff

Key Protection Levels

LevelImplementationSecurityUse Case
ConsumerBrowser localStorage keySoftware-onlyTesting, demos
ProfessionalTPM-sealed key (Desktop V6)Hardware-boundProduction agents
EnterpriseMPC split: server + user deviceNeither party alone can signRegulated industries
GovernmentHSM + Ledger/Trezor with trusted displayFIPS hardware + visual consentHigh-assurance

On-Chain Artifacts

All data is on Polygon mainnet. The content is encrypted — only the owner can decrypt. The events (contract creation, Note writes) are publicly verifiable.

Live Contracts

Sovereign Secret (Agent): 0x70b893e3b519255166a1fb64dcde920d056a2d5c Birth Certificate TX: 0xa689ba00...6f7c Session Archive: 0x136a5ec90d58fd09506409e46edb5acf1ea34ece Signing Wallet: 0x3f07D9DE7D4f803d748f254c526Fa6F351e3f8B1 (TPM-derived) Block: 84,799,553 — March 28, 2026 Chain: Polygon Mainnet (137)

V6/V7 Infrastructure

Secret Factory: 0xC683540Ab2A9f017Ea48E044aA74f0b74D9DC4E4 Registry: 0x83B25fDD25516057AaaAf8027464C8bbb2f91d5B Identity Factory: 0xc6361e4780eb16ee8643538376600D97F9E4C9c0 Credit Purchase: 0x0D6F37Be6227D0b2C882338924CDc7063fa11346

View the Data

Birth Certificate (encrypted, shared link)  |  Session Archive (encrypted, shared link)  |  Test Report (public)

MCP + Cloud Relay

The Desktop connects outbound to a cloud relay via WebSocket. Any AI platform (Claude, ChatGPT, Grok) accesses the user's local signing infrastructure through the relay. No inbound firewall rules. No tunnel. The keys never leave the local machine.

graph LR
    subgraph AI["AI Platforms"]
        Claude["Claude Code"]
        ChatGPT["ChatGPT"]
        Grok["Grok"]
    end

    subgraph Cloud["Cloud Relay"]
        MCP_Relay["mcp.rootz.global
Wallet-authenticated
WebSocket reverse proxy"] end subgraph Local["Your Machine"] Desktop2["Desktop V6
TPM keys + MCP server"] Agent2["Morpheus Agent
Plugin"] end Claude -->|MCP calls| MCP_Relay ChatGPT -->|MCP calls| MCP_Relay Grok -->|MCP calls| MCP_Relay Desktop2 -->|outbound WebSocket| MCP_Relay Desktop2 --- Agent2 style AI fill:#312e81,stroke:#818cf8,color:#ffffff style Cloud fill:#1e3a5f,stroke:#22d3ee,color:#ffffff style Local fill:#14532d,stroke:#4ade80,color:#ffffff
Security model: The relay authenticates users via wallet signature challenges (EIP-191). No API keys — your wallet IS your credential. The relay forwards MCP requests but never sees the private key. All content is encrypted end-to-end between the AI platform and your Desktop.

Standards Alignment

This architecture applies existing trusted computing standards to AI agents — not new cryptography.

StandardApplication
TCG TPM 2.0 (ISO 11889)Hardware root of trust for agent signing keys
TCG DICELayered identity composition: hardware → platform → agent → session
NIST SP 800-193Protect/Detect/Recover for agent integrity
IETF RATS (RFC 9334)Agent = Attester, Owner = Relying Party, TEE = Evidence
TCG RIMReference Integrity Manifests for model provenance (Layer 4)
EIP-191 / EIP-712Ethereum message signing for wallet authentication
secp256k1 ECDSAAll signing operations (same curve as Bitcoin/Ethereum)
ECDH + AES-256-GCMEnd-to-end encryption for all Note content
From the NIST RFI (Docket NIST-2025-0035): "The fundamental security challenge with AI agent systems is not access control — it is message security. Every interaction between a human, an AI agent, an AI factory, and the systems they touch is a message. Today, virtually none of these messages are signed, attributed, or verifiable."