How It Works

Every agent starts with a birth certificate — a permanent record naming two parents: the AI that gives it capability, and the key holder who gives it authority.

The birth certificate is cryptographically signed and written to the blockchain. It can't be altered, forged, or denied. Anyone can verify it.

Why This Matters

When the agent answers a question, every inference call is recorded as a signed, hash-linked entry. The prompt is hashed. The response is hashed. Both are chained to the previous action.

The content is never stored in the chain — only the hashes. The full conversation is encrypted and archived separately. The hashes prove integrity without exposing sensitive content.

Why Hashing Matters

SHA-256 has a search space of 2²⁵⁶. Finding two different prompts with the same hash would take longer than the life of the universe. If the hash matches, the content matches. No trust required — just math.

Each action links to the previous one. The second response can't be moved before the first. Alter any entry and the chain breaks. Same math as Bitcoin — applied to AI conversations.

Why Ordering Matters

AI agents don't make decisions in one shot. They reason across turns. A doctor asks a follow-up. A financial analyst refines a model. A lawyer challenges a conclusion.

Without proof of origin, each turn is independent — you can't prove the AI's second answer was informed by its first. With the hash chain, the sequence is proven. An auditor walks the chain and verifies every step.

At the end of a session, a Merkle root is computed — a single hash that covers every action in the chain. One verification proves the entire session.

The Lightning Chain Model

We don't write every action to blockchain individually. That would be expensive and slow. Instead, actions accumulate in memory during the session (free, fast). At settlement, one blockchain write covers everything.

The settlement is written to the agent's Sovereign Secret on the Polygon blockchain. The full conversation is encrypted and archived to IPFS. The agent's entire history — every session, every action — accumulates at one address.

The agent IS the wallet. Its identity is the address. Its memory is the Notes. Its history is the chain. Anyone with the share link can read it. Anyone without it sees only encrypted data.

Every action the agent takes passes through a policy engine inside a Trusted Execution Environment (TEE). The policy is set by the owner. The TEE enforces it. The agent can't bypass it — not through prompt injection, not through jailbreaking, not through any software trick. The enforcement is in the container, not in the prompt.

graph LR
    subgraph Request["AI Agent Request"]
        Action["Sign transaction
Call inference
Write data"]
    end

    subgraph TEE["Trusted Execution Environment"]
        Policy["Policy Engine
ALLOW / DENY / AUTO"]
        Chain["Internal Chain
Every decision recorded"]
    end

    subgraph Signing["Hardware Signing"]
        TPM["Desktop TPM
Hardware-sealed key"]
    end

    subgraph Result["Outcome"]
        Allow["Action executed
Recorded in chain"]
        Deny["Action blocked
Denial recorded"]
    end

    Action --> Policy
    Policy -->|ALLOW| Chain
    Policy -->|DENY| Deny
    Chain --> TPM
    TPM --> Allow

    style Request fill:#e0e7ff,stroke:#4f46e5,color:#1e1b4b
    style TEE fill:#f5f3ff,stroke:#6366f1,color:#1e1b4b
    style Signing fill:#d1fae5,stroke:#059669,color:#064e3b
    style Result fill:#dbeafe,stroke:#3b82f6,color:#1e3a5f
        

What the Policy Controls

The TEE: Container, Not Cage

graph TB
    Owner["Owner
Writes policy, can revoke"]
    PE["Policy Engine"]
    MC["Merkle Chain"]
    SL["Skill Loader"]
    Set["Settlement"]
    S1["Skill: morpheus-inference"]
    S2["Skill: payments"]
    S3["Skill: data-collection"]
    TPM["Desktop TPM / HSM"]

    Owner --> PE
    SL --> S1
    SL --> S2
    SL --> S3
    S1 --> PE
    S1 --> MC
    PE --> TPM
    MC --> Set

    style Owner fill:#d1fae5,stroke:#059669,color:#064e3b
    style PE fill:#e0e7ff,stroke:#4f46e5,color:#1e1b4b
    style MC fill:#e0e7ff,stroke:#4f46e5,color:#1e1b4b
    style SL fill:#e0e7ff,stroke:#4f46e5,color:#1e1b4b
    style Set fill:#e0e7ff,stroke:#4f46e5,color:#1e1b4b
    style S1 fill:#ede9fe,stroke:#7c3aed,color:#1e1b4b
    style S2 fill:#ede9fe,stroke:#7c3aed,color:#1e1b4b
    style S3 fill:#ede9fe,stroke:#7c3aed,color:#1e1b4b
    style TPM fill:#d1fae5,stroke:#059669,color:#064e3b
        

The owner writes the policy. The TEE enforces it. Skills execute within it. The signing key never leaves the hardware. The agent operates with authority but under control — like an employee with a corporate card and a spending limit.