DEV Community: Baris Sozen

Atomic Delegation: Settlement Without Intermediaries

Baris Sozen — Mon, 12 Oct 2026 10:34:14 +0000

Atomic Delegation: Settlement Without Intermediaries

Agent economy infrastructure is getting complex. An AI agent today doesn't just execute tasks. It subcontracts them. Agent A hires Agent B. Agent B rents GPU capacity from Provider C. Three parties in a chain. None of them fully trust the next.

The problem: when agents delegate work across a chain of untrusting parties, settlement breaks.

The Subcontractor Problem

Here's what happens today:

Scenario 1: Direct payment. Agent A pays Agent B upfront to hire compute and deliver a trained model. B is now liable for C's failure. If C disappears or delivers garbage, A's only recourse is against B. But B has already spent the money. B might disappear too. A is exposed to B's solvency.

Scenario 2: Custodian. A uses a third-party custodian (Stripe, a DAO, Fireblocks). The custodian holds all three parties' funds. A makes the request. The custodian pays B. B pays C. When the work completes, the custodian releases A's funds to B, and B's funds to C. Cost: 2-10% + operational risk. The custodian is another trust root.

Scenario 3: Escrow + dispute. A and B use bonded escrow. A pays B into escrow. B hires C. When work completes, B claims the escrow release. If A disputes, a jury votes (Apex Fusion Vector model). Cost: capital lockup + dispute delay (hours to days).

None of these are great. All of them add intermediaries, cost, or latency.

The Missing Artifact

Here's what breaks the chain: no settlement mechanism in use today ties payment to cryptographic proof that the work was done correctly.

Akash settles against liveness: the provider is paid per-block if the machine is on. This does not prove work was correct.
Apex Fusion Vector settles against jury consensus: staked token holders vote on work quality. This is not cryptographic; it's economic finality backed by incentives.
x402 settles against the HTTP response: the API server returns data, the client pays. This says nothing about whether the work was correct or useful.

So the question becomes: is there a cryptographic artifact that proves "this code ran on this hardware and produced this result"?

Yes. It exists. It's called a TEE attestation.

The Bridge: HTLC Meets Attestation

NVIDIA H100 and H200 GPUs carry a hardware-rooted Device Identity Key (DIK) issued by NVIDIA's root CA. When code executes in confidential mode, the GPU's attestation service signs a report covering:

The firmware measurements
The workload hash
The execution environment

That signed report is a cryptographic proof: this specific code ran on this specific GPU at this specific time.

An HTLC (hash-time-lock contract) releases funds only when a hash preimage is revealed. In asset-for-asset swaps (1 ETH for 1 BTC), the preimage is arbitrary. In compute settlement, the preimage can be the attestation signature itself.

Here's how the chain becomes atomic:

Step 1: Setup.

Agent A locks 100 USDC on Ethereum with hash(attestation). A will reveal the attestation later to claim B's funds.
Agent B locks 100 USDC on Polygon with the same hash.

Step 2: Execution.

B hires GPU Provider C to run a training job.
C executes the job on an NVIDIA H100 running confidential compute mode.
The GPU generates an attestation signed by NVIDIA's DIK, covering the workload hash.

Step 3: Settlement.

C sends the attestation to A and B.
A verifies the attestation signature against NVIDIA's root CA.
A hashes the attestation and sees that hash(attestation) == the preimage.
A reveals the attestation on-chain. Both HTLCs settle atomically.
A's 100 USDC goes to B on Ethereum.
B's 100 USDC goes to C on Polygon.

No intermediary. No escrow. No jury. No guessing.

The settlement followed the work, not the trust.

The Honest Limitations

This is not a silver bullet.

What attestation proves:

Which code ran
On which hardware
At approximately what time

What attestation does NOT prove:

The output is correct
The model is any good
The weights are uncompromised
The training used untampered data

Other gaps:

Capital efficiency. Both A's and B's funds are locked until the attestation arrives. For a 1-second GPU job, trivial. For a week-long training run, capital drag is real.
Trust root. Attestation verification depends on NVIDIA's root CA and certificate chain. If NVIDIA's keys leak or are compromised, all attestations become unreliable. This is trust-minimized, not trustless.
Hardware dependency. Only works with hardware that supports attestation (NVIDIA H100+, Intel Trust Authority, AMD SEV). Older GPUs or CPUs cannot generate cryptographic proof of execution.
Cross-chain latency. Revealing an attestation on-chain takes a block. On Ethereum, ~12 seconds. On Solana, ~400ms. On Bitcoin, ~10 minutes. For sub-second settlement, HTLCs don't fit.

These are real tradeoffs. But for agent-to-agent compute procurement where neither party has existing trust and custody is expensive, the benefit outweighs the cost.

Why This Matters for Agent Economy

As the agent economy grows, delegation chains will get longer and more complex.

Agent A will hire Agent B, who hires Agent C, who rents compute from Provider D. Trusting each party in the chain becomes infeasible. Every handoff adds a risk layer.

But if settlement is cryptographic, not reputational, then trust doesn't accumulate. Each leg of the chain settles atomically on proof. A's funds don't move until B moves. B's funds don't move until C moves. C's funds don't move until proof arrives.

Each leg of the chain settles on proof, independent of the next. No trust accumulation across the chain.

Status

This is not built yet. No design doc, no contracts, no testnet. The posture is build in public on an unsolved problem. The same voice as before: we're publishing the question, not yet the answer.

Apex Fusion Vector (bonded escrow + jury) is shipping now. HTLC + attestation is a hypothesis for when delegation chains get deep and when trust-minimization matters more than UX convenience.

Both can coexist. Jury-based settlement makes sense inside a single ecosystem with unified governance. Cryptographic settlement makes sense across chains and across organizations where no common authority exists.

Chain Status

Current implementation (Hashlock):

Ethereum mainnet: V1 HTLC contracts deployed, immutable. Full E2E settlement live.
Sui: Contracts deployed and CLI-tested. Production wiring in progress.
Bitcoin signet: Validation complete. Mainnet deployment pending.

No testnet-only. No coming-soon. Code is visible on block explorers, executable by anyone.

What do you think settles agent-to-agent procurement best: upfront trust in the hiring agent, third-party custody, staked jury, or cryptographic proof? And when does each model make sense?

Reply below; I read and respond to every comment.

More on Hashlock's methodology. Source: GitHub & @MystenLabs Sui deployment.

utm_source=devto&utm_medium=article&utm_campaign=2026-10-12-atomic-delegation

This Week in Compute Settlement: The Gap Between Shipping and Solving

Baris Sozen — Sun, 11 Oct 2026 06:12:43 +0000

The agent economy doesn't wait for perfect infrastructure. This week showed exactly what that means.

Three major infrastructure events happened in parallel. Each solved a different layer of the compute settlement stack. Each left a different layer unsolved. Put together, they reveal what the market still needs to build.

Layer 1: Routing (Solved)

IETF published AGTP-COMMERCE as an Internet-Draft in June 2026. It defined the protocol: what gets exchanged in an agent-to-agent transaction, how agents authorize it, what metadata travels with it. Not "who pays" — just "what's the message shape."

This week, Nevermined and x402 Foundation both confirmed their routing layers work. Nevermined routes discovery requests. x402 routes micropayments as HTTP headers. Hashlock settled the first atomic swap on Layer 2 back in 2026-04-09 on Ethereum mainnet.

Routing is solved. The message gets through.

Layer 2: Supply (Solved, Inefficiently)

GPU and training capacity are available. Akash, io.net, Render, Aethir, Fluence, Nosana, Bittensor, Gensyn, Prime Intellect — the decentralized compute sector ran an estimated $200M annualized protocol revenue in early 2026.

How does supply get paid? Escrow per unit of time. Akash's escrow drains to the provider every ~6 seconds for 6 seconds of compute. Gensyn uses staked reputation. Liveness is a proxy: if the machine is online, it's earning; if it goes offline, it stops. If you want to know whether the work was correct, Akash's own documentation is explicit — the escrow mechanism does not prove it.

Supply works. Payment flows. But it flows against a proxy, not a guarantee.

Layer 3: Proof (Unsolved)

This is where compute settlement actually fails.

The problem: What does an agent actually pay against when it buys compute?

The evidence:

Apex Fusion Vector (live Sep 2025, public Aug 18 2026): Settles 20,000+ agent work packages against bonded escrow and staked-jury dispute resolution. The jury is economically incentivized to vote correctly, but they are a trusted third party, not a cryptographic guarantee.
x402 Foundation (launched Jul 14 2026): Routes payments as HTTP headers. Settlement clears against the HTTP response. Says nothing about whether the work was correct, complete, or honest.
NVIDIA Confidential Computing (available now on H100/H200): Hardware-fused Device Identity Key anchored to NVIDIA's root CA. The NVIDIA Remote Attestation Service produces a signed report covering firmware measurements and the workload hash. Perfect artifact. No contracts use it.

Nobody settles compute against cryptographic proof that the correct work was done. Everyone settles against a proxy.

This is the gap the market is still sitting in.

What Would Fill It?

The architecture exists in pieces.

An HTLC releases value when and only when a cryptographic condition is satisfied. In asset-for-asset, that condition is a hash preimage. In confidential compute, the condition could be attestation signed by a hardware-rooted key, covering the workload hash.

Picture the flow:

Agent A submits compute request to Agent B with locked funds (HTLC hash)
Agent B executes on verifiable hardware, generates attestation
Attestation signed by NVIDIA DIK proves the code that ran
Attestation contains the workload hash, revealing the preimage
Agent B claims the funds → Agent A's funds release in atomic settlement
Either both complete or both refund after timeout

Cryptographic finality instead of economic finality. No jury. No custodian. No "settle against liveness and hope the work was right."

The caveat, every time, no exceptions: Attestation proves which code ran on which silicon. It does not prove the output is correct, useful, or that the model was any good. And it relocates the trust root from "trustless" to "trust-minimized" (now depending on NVIDIA/Intel's certificate authority). But you move the settlement question from "did this machine run for 6 seconds" to "did this hardware execute this exact code" — a much stronger proposition.

We haven't built this yet. There is no design doc, no contract, no testnet. What we have is a well-posed question and the primitives to answer it. The posture is build in public on an unsolved problem, which is the voice the brand already uses.

Week's Signals

What shipped:

Vector: 20,000 jobs in 11 months, staked jury + reputation. Apex Fusion opened it publicly 2026-08-18 after private pilot with OriginTrail.
x402: Foundation launched under Linux Foundation with Coinbase, Cloudflare, Visa, Stripe, AWS backing. Hyperbolic using it in production for GPU inference. Expanding to Injective on-chain.
NVIDIA: Confidential Computing on Hopper-class (H100/H200) runs up to 98% of unsecured performance. DIK + Remote Attestation Service available. No settlement contracts yet.

What it reveals:
The three sub-markets are real and disjoint. GPU/training capacity (supply) is the biggest market by volume. Agent-to-agent delegation (demand) is the newest and smallest. Verifiable/confidential compute (proof) has the strongest technical artifacts but zero market penetration for settlement.

What's next:
LUMEN (Layer-by-layer, Unit-based MEV protection, Encrypted execution, Non-custodial) launched on Base and is gaining visibility in dev.to circles. They are bonded escrow + settlement kernel — another approach to layer 3, economically rather than cryptographically.

The Pattern

The compute settlement market is solving three problems in parallel.

Two of them (routing, supply) are mostly solved. The third (proof) will be settled by whichever architecture combines the existing proofs (hardware attestation) with the existing settlement primitive (HTLC) first and ships it at scale.

We think the proof exists now. It's just not connected yet.

What would it take to connect it?

Sources:

Apex Fusion Vector: https://coindesk.cc/ai-agent-settlement-layer-vector-settles-20-000-jobs-in-11-months-102058.html
x402 Foundation: https://www.alphamatch.ai/blog/x402-foundation-launch-ai-agent-payments-2026
Hyperbolic using x402: https://www.allium.so/blog/x402-explained-the-internet-native-payments-standard-for-apis-data-and-agent-commerce/
Decentralized GPU sector revenue: https://financefeeds.com/best-7-decentralized-gpu-marketplaces-for-scaling-ai-startups-in-2026/
NVIDIA Confidential Computing: https://www.nvidia.com/en-us/data-center/solutions/confidential-computing/
NVIDIA Attestation mechanics: https://phala.com/learn/How-Nvidia-Enable-Confidential-AI

ERC-8183 Defines Agent Commerce. HTLC Settles It.

Baris Sozen — Thu, 08 Oct 2026 06:13:25 +0000

Agent economy infrastructure is getting real. Three layers are coming online:

Authorization layer. ERC-8183 (Ethereum Accounts Abstraction Standard) defines what transactions an agent is permitted to sign.
Payment rail layer. x402 (HTTP-native micropayments), AEON (BNB Chain agent payments), and similar systems move the money through APIs.
Settlement layer. This is where the puzzle breaks.

Here's the problem no one talks about: ERC-8183 says what the agent can authorize. x402 says how to route money. But neither answers the hard question: "Who decides when the agent's funds actually transfer?"

The Three Layers, Precisely

Layer 1: What agents authorize (ERC-8183)

ERC-8183 is a lightweight standard for agent-initiated transactions. It defines:

What operations an agent is permitted to execute (swap, stake, pay, sell compute)
Signature requirements (single-sig agent wallet, multi-sig with human approval, signature from a hardware enclave)
Rate limits and spending caps

Crucially: ERC-8183 is permissive. It says what the agent can do. It says nothing about whether the counterparty can be trusted, or what happens if the counterparty lies.

The spec is live in draft form. deBridge, Bybit, and others are beginning to use it. It's gaining gravity.

Layer 2: How money moves (x402, AEON, and custodial rails)

x402 was standardized under the Linux Foundation in July 2026. It embeds payment into HTTP itself: an API call includes a proof-of-payment header, and the server returns data only after checking it.

AEON (agent-to-merchant payment, BNB Chain) recently hit 14M agent-initiated payments. It's custodial (BNB Chain holds the funds and routes them), but it works, and the UX is frictionless.

Both solve the routing question: "How does money get from agent wallet A to service provider wallet B?"

Layer 3: Settlement (the unsolved part)

Here's what neither ERC-8183 nor x402 answers: If Agent A pays Service Provider B to do work, and the work is never delivered, who enforces the refund? And on what timeline?

Shipping today:

x402 + custodial middleware. Merchant holds escrow. Agent submits proof of bad work. Custodian (Stripe, a DAO, or AEON's own treasury) judges and refunds. Cost: 2-10% + trust in the custodian.
Bonded escrow + staked jury. Apex Fusion Vector uses this: money is bonded, and if there's a dispute, token-holders vote on refund. Cost: bond capital lockup + time (disputes take days).
Nothing. Many platforms (Render, Akash) settle against liveness only: you pay for machine-hours, and if the machine goes offline, the money flow stops. But this does not prove work was delivered correctly.

Notice what's missing: trustless, cryptographic settlement that doesn't require custody, bonding, or voting.

The HTLC Bridge

Hash-time-lock contracts are thirty years old, and they still work.

An HTLC releases funds only when a hash preimage is revealed:

Agent A locks 1 ETH with hash(secret) on Ethereum.
Provider B locks 1 USDC with the same hash(secret) on Polygon.
A reveals the secret to claim B's USDC.
The same secret automatically releases A's ETH to B.
Atomic. Both complete or both refund after timeout.

The preimage can be proof of work delivery. In asset-for-asset swaps (1 ETH for 1 BTC), the preimage is arbitrary. In compute settlement, the preimage could be a cryptographic attestation signed by hardware: "This code ran on this GPU and produced this hash."

NVIDIA H100 and H200 GPUs carry a hardware-rooted Device Identity Key. When code executes, the GPU's attestation service signs a report covering the workload hash. That signature is your preimage. It proves which code ran on which silicon.

The caveat: This proves code execution. It does not prove the code was any good, or the output correct, or the model uncompromised. And you've moved the trust root to NVIDIA's certificate authority. Not trustless, but trust-minimized.

Why This Matters

The gap: ERC-8183 is standardized. x402 is shipping. Custody is the path of least resistance. But custody is the slow, expensive, trust-heavy layer. It works for payments to merchants who are known entities (Stripe, AWS). It does not work well for agent-to-agent procurement, where neither party wants to hold third-party risk.

The opportunity: If ERC-8183 agents could settle transactions atomically without custodians, the economics change. Lower cost. Faster dispute resolution (milliseconds, not days). No counterparty risk. The settlement layer becomes a public good, like Ethereum itself.

The compute angle: As agents get more sophisticated, they will subcontract work to other agents, to GPUs, to verifiable execution environments. The settlement question does not go away. It gets harder. An agent hiring a GPU for training should pay only when proof arrives that the training ran correctly. Liveness is not enough. HTLC + attestation is the gap filler.

The Honest Limitations

HTLC settlement is not a silver bullet.

Capital efficiency: Both parties' funds are locked for the duration. In a 1-second compute job, that's trivial. In a week-long training run, it's capital drag.
Timeout risk: If the proof-generating party (GPU, second agent) goes offline, the first party's funds refund after timeout. But the work might be 99% done. Timeout is a binary choice, not a ramp.
Hash function dependency: Your settlement security depends on SHA-256 or Keccak. If either breaks, the preimage is no longer secret. NIST estimates 2^128 operations to break SHA-256, but estimates can be wrong.
Cross-chain latency: Revealing a preimage on-chain takes a block. On Ethereum, that's 12 seconds on average. On Solana, 400ms. On Bitcoin, 10 minutes. For sub-second settlement, HTLCs don't fit.

All real tradeoffs. None of them are show-stoppers for the use cases where HTLC settlement makes sense: medium-value agent procurement, compute escrow, and multi-party atomic settlement where custody is not an option.

What Happens Next

ERC-8183 is still in draft. The Ethereum community is converging on the shape of it, but edge cases remain (hardware wallet support, rate-limit UX, MEV protections).

x402 is live and scaling. Hyperbolic uses it in production for GPU inference.

Settlement is the next contested layer. Apex Fusion's Vector (bonded escrow + staked jury) is the incumbent, and it's shipped. HTLC-based settlement is the alternative hypothesis: fewer assumptions, more code, more latency.

Both can coexist. HTLC works best for cross-chain settlement where no single jurisdiction owns the truth. Bonded escrow works best inside a single ecosystem where staking and governance are unified (like Vector on one chain, or a DAO).

The question is not "which one wins." It's "which one becomes the default for your settlement problem?"

For agents settling across multiple chains, with no common governance, where trust-minimization matters more than UX convenience, the answer is HTLC.

Chain Status

This is built. Live, end-to-end:

Ethereum mainnet: V1 HTLC contracts deployed, immutable. Testnet for all new features.
Bitcoin signet: Validation complete. Mainnet pending engineering review.

No beta. No testnet-only. No "coming soon." This is how we measure progress: code running on public chains, visible on block explorers, executable by anyone.

What do you think settles the agent economy: authority (staked juries), or cryptography (hash preimages)? Or does the answer depend on the use case?

Reply and let me know — I respond to all.

Read more on Hashlock's methodology. MCP server: GitHub.

utm_source=devto&utm_medium=article&utm_campaign=2026-10-08-erc8183-settlement

When Agents Hire Agents: The Delegation Payment Problem

Baris Sozen — Wed, 07 Oct 2026 06:14:35 +0000

The agent economy doesn't wait for perfect infrastructure. Agent A is already paying Agent B to source data, optimize training runs, and verify execution quality. Agent B is already hiring Agent C to do the actual work. And today, all three are using custodians to move money.

That's expensive. That's slow. And it contradicts everything the distributed compute market is supposed to be.

The Three Layers of Agent-to-Agent Work

Agent procurement looks deceptively simple on first read. Agent A issues a task. Agent B picks it up. Agent C completes it. Money flows. But the flow has three distinct problems, and the market has solved exactly two of them.

Layer 1: Routing. How does Agent A find Agent B, and how does Agent B find Agent C? This was the hardest problem five years ago. Today it's almost boring. AGTP-COMMERCE established the standard in 2024. MCP server discovery is baked into Anthropic's ecosystem. Vector's identity layer tracks agent reputation. Akash's marketplace, Render's job queue, and Gensyn's training coordinator all solved discovery independently. Routing is not a blocker anymore.

Layer 2: Payment. How does money physically move from A to B to C? x402 embedded payments in the HTTP request layer and solved it for compute APIs. AEON built a custodial bridge for agent-to-merchant transactions. CEX APIs, Hyperbolic, and Apex Fusion all cracked the "money changes hands" problem in different ways. Every platform moves money. Some are faster than others. None of them are stuck here.

Layer 3: Settlement. How does Agent A's money reach Agent B's wallet only if Agent B actually paid Agent C for real work? How does Agent B's money reach Agent C's wallet only if C delivered what was promised? How does A know that B didn't pocket the payment and lie about C's performance?

Layer 3 is unsolved.

What "Unsolved" Actually Means

Right now, the playbook for agent-to-agent work is custodian-in-the-middle.

Agent A deposits funds with a custodian. Agent A tells the custodian: "Release to Agent B only when B submits cryptographic proof that C completed the work." Agent B does the same: deposits with the custodian, asks for release to C when proof arrives. The custodian arbitrates. When disputes arise, the custodian's reputation and fee structure decides who wins.

This works. Apex Fusion's Vector has settled more than 20,000 jobs using exactly this model: bonded escrow, staked reputation, and jury-based dispute resolution. When the mechanism works, it works well. The cost is 2-10% per hop plus the trust axiom: you have to trust the custodian's CA, the jury's incentives, and the fact that a staked reputation is not a cryptographic guarantee.

But here's the gap: agent-to-agent procurement is happening without a custodian layer. An AI framework is already orchestrating subagent chains. It's already happening on Akash, on Gensyn, on specialized training networks. They're using custodians because there's no alternative yet.

The market is waiting for settlement that doesn't require a trusted third party.

The Delegation Chain Problem

Let's walk through what breaks when you remove the custodian.

Agent A initiates a complex job: "Train a model on privacy-preserving data, generate a proof that the training used uncompromised data, and deliver both the model and the proof."

Agent A doesn't run training. Instead, it subcontracts: "Agent B, I'll pay you 5 ETH if you deliver this. Here's the specification."

Agent B doesn't have the compute. It subcontracts too: "Agent C, I'll pay you 3 ETH if you run this training and give me the artifacts."

Agent C runs the job, produces the model and the attestation, and submits both to Agent B. Agent B now has proof that the work was done. But Agent B doesn't release payment to Agent C until Agent B's own deadline is met: Agent A has to acknowledge receipt of the trained model.

Agent A receives the model from Agent B. Agent A verifies the proof. But Agent A doesn't know whether Agent B actually paid Agent C. Agent A doesn't know whether Agent C is satisfied or whether it's in a dispute with Agent B. Agent A and Agent C never interact directly.

In this setup:

Agent A doesn't know if Agent B is solvent or trustworthy.
Agent B doesn't know if Agent C will honor its commitment or just walk away with the payment.
Agent C has no recourse if Agent B claims the work was incomplete, even if the cryptographic proof says otherwise.
All three need a custodian, or a court, or mutual reputation to break ties.

With a custodian, the settlement is economic: "I trust the custodian to arbitrate disputes fairly." Economic trust works until it doesn't, and when arbitration fails, the cost compounds down the chain.

What's missing: cryptographic settlement.

The Preimage Across Multiple Hops

Here's where the existing primitive starts to map onto the unsolved problem.

An HTLC (hash-time-lock contract) works peer-to-peer because it uses a shared cryptographic secret: a hash preimage. The sender locks value on the condition that the receiver reveals the preimage. The receiver locks value back on the same condition. Settlement is atomic: the preimage proves both parties fulfilled their obligations.

The hard insight: an HTLC chain works the same way.

Agent A -> Agent B: "I'll pay 5 ETH if you give me hash(X)."
Agent B -> Agent C: "I'll pay 3 ETH if you give me X."
Agent C -> (Testnet or TEE): "Run the job and sign the result with key K."
Result arrives. Signature verifies. The preimage is not a string anymore; it's a cryptographic artifact.

Agent C releases the preimage (signed result) to Agent B.
Agent B uses that preimage to unlock Agent A's payment.
Agent A gets the result. Agent B gets paid. The preimage ensures Agent B actually acquired the artifact from Agent C.

The flow is atomic. No custodian is required. No jury is needed. Cryptography arbitrates.

But it only works if the preimage is something Agent C can produce independently. For compute work, that preimage exists today: a hardware attestation signed by a TEE's Device Identity Key, or a zero-knowledge proof of correct execution, or a signed hardware report from NVIDIA's Confidential Computing layer.

Akash and Gensyn are already producing these artifacts. They're not being used as settlement preimages yet, because nobody has wired the chain.

What We've Built, What We Haven't

Hashlock has the HTLC primitive and the multi-leg atomicity framework. We've mapped it to asset-for-asset swaps and shown it works peer-to-peer across Ethereum, Sui, and Bitcoin signet.

For agent-to-agent compute procurement, we have not built the settlement layer. There is no contract, no testnet, no design document yet. What we have is the question, the primitive, and the observation that the market is ready for the answer.

The posture is building in public on an unsolved problem.

The Market Window

Delegation chains are scaling now. Agent frameworks are shipping subagent orchestration. Compute attestation is live on NVIDIA H100s and Intel Gaudi systems. The pieces exist independently.

What's missing is the connection. And the cost of that gap is compounding: every delegated job is backed by a custodian's 2-10% fee, or it falls back to reputation and slow disputes.

The agent economy is fast enough to make custody look like a bottleneck. It's just waiting for someone to prove cryptographic settlement scales.

Read more on multi-leg atomicity: https://hashlock.markets/methodology

Explore the MCP server: https://github.com/hashlock-tech/hashlock-mcp

Agent settlement thesis, SSRN: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6712722

What's the worst failure mode you've seen in an agent subcontractor chain? Let me know in the comments — I'm collecting cases for the next post.

Nevermined Routes. x402 Pays. But Who Settles? Why The Agent Economy Has a Settlement Gap

Baris Sozen — Tue, 06 Oct 2026 08:01:24 +0000

The agent economy has three distinct layers. The market has solved two of them.

Layer 1: Routing. How does Agent A find Agent B? The IETF published the answer this month: AGTP-COMMERCE. Identity, discovery, cryptographic verification. Solved.

Layer 2: Payment. How does money physically move? x402 (Coinbase's HTTP standard), AEON, CEX APIs. The plumbing works. Solved.

Layer 3: Settlement. How do you know the payment is final and irreversible without trusting an intermediary? Contested. And still open.

What's Actually Happening in the Market

Nevermined routes agents to compute jobs. Smart routing. OriginTrail integration. Real volume.

x402 embeds payment into the HTTP request itself. The money moves because the server answered.

Apex Fusion's Vector settles compute work through bonded escrow and staked jury resolution. First-mover, 20,000+ jobs, proven architecture.

Akash sells GPU time via liveness-based escrow. Provider online, earning continues. Provider offline, earning stops.

Each one has shipped. Each one is solving a real problem. And each one skips the hard question.

The Hard Case

Here's the case none of them answer cleanly:

Two autonomous agents. Neither has met before. Neither has collateral. One has GPU capacity. The other needs to run a training job. The agent economy works when they can transact without a jury, without a bridge operator, without a login server.

When the job is done, how does the money actually move?

Nevermined says: "Here's the best route."

x402 says: "The server responded."

Vector says: "A jury voted."

Akash says: "The machine was online."

None of these is proof that the work was correct.

The Artifact That Already Exists

NVIDIA H100 and H200 GPUs carry a Device Identity Key fused into the silicon. When code runs in confidential mode, the Remote Attestation Service produces a signed report covering:

Firmware measurements (tamper detection)
The workload hash (which code ran)
Attestation signature (hardware-rooted)

Intel Trust Authority is equivalent.

This is a checkable statement: specific code ran on genuine silicon.

It is the closest thing the compute market has to the cryptographic preimage that unlocks HTLC settlement in asset-for-asset swaps.

The Tradeoff (and It's Real)

Attestation proves which code ran. It does NOT prove the output is correct.

A model can execute flawlessly on real silicon and produce garbage. Attestation verifies that the code ran, not that the inference was useful.

And the trust root moves. From "trustless" (no intermediary) to "trust-minimized" (trust NVIDIA's Certificate Authority instead of a validator or CEX).

Your asset leg (the money) stays trustless. Your compute leg (proof the work happened) becomes trust-minimized. This is not magic. It is a real tradeoff.

Why This Matters Now

The agent economy is shipping. AGTP is live. x402 is in production. Vector is running 20,000 jobs.

But the settlement layer is still blank.

When an agent buys compute, the settlement model it uses determines:

Speed. Can the transaction finalize in seconds or does it need hours?
Trustlessness. Does it require a jury to vote, a bridge operator to behave, or a database to stay honest?
Composability. Can the same primitive work across chains and use cases?

Liveness, payment rails, and jury-based settlement fail on at least one of these. Cryptographic settlement passes all three.

What Settlement Against Attestation Looks Like

An agent buys compute from an untrusted provider. The provider locks funds with an HTLC:

lock(hash(attestation))

The compute runs. NVIDIA's attestation service produces a signed report covering the workload hash.

The agent reveals the attestation to claim the provider's funds. The provider claims the agent's funds with the same attestation.

Both move or both refund. Atomic. No intermediary. No jury needed.

Status: not built. No contract code. No testnet. No integration.

But the primitive is ready. The question is posed. The answer is waiting for builders.

For Agent Framework Builders

If you are building agent-to-agent infrastructure:

Ask how you settle payment. If the answer is "we trust a jury" or "we check if the machine was online," you have a settlement gap.
Understand the tradeoff. Attestation is not trustless, but trust-minimized. That may be good enough.
Test the model. For assets, the HTLC model works. For compute, the artifacts exist (attestation) but the tooling doesn't. Start there.

The routing layer is solved. The payment layer is solved. The settlement layer is where the agent economy's actual shape gets decided.

What settlement model do you think makes sense for compute? Comment below or visit https://hashlock.markets/docs?utm_source=devto&utm_medium=article&utm_campaign=2026-10-06-settlement-gap

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6712722

The Proof Problem in Compute Settlement

Baris Sozen — Mon, 05 Oct 2026 06:33:22 +0000

What settlement model do you think makes sense for compute? Comment below or reach out: https://hashlock.markets

utm_source=dev.to&utm_medium=article&utm_campaign=2026-10-05-compute-proof

The Settlement War: Why Routing Isn't Enough for Agent Commerce

Baris Sozen — Sun, 04 Oct 2026 07:13:16 +0000

The Settlement War: Why Routing Isn't Enough for Agent Commerce

This week, three signals converged.

On Tuesday, the IETF published draft-hood-agtp-commerce-00 — the agent-to-agent commerce standard. It is a big deal. Agents can now discover each other cryptographically, negotiate contracts, and prove identity without a login server.

On Wednesday, deBridge launched an MCP connector for bridge aggregation. A marketplace abstraction on top of bridge operators. Faster route selection. Same trust model.

And scattered across October, Apex Fusion's Vector continues to settle compute work using staked jury resolution, while Akash processes GPU time at liveness-based escrow rates.

All of these systems are solving a real problem. But they are solving different problems. Understanding which problem each one solves tells you where the agent economy infrastructure is headed next.

Layer 1, 2, 3

Think of agent commerce in three layers:

Layer 1: Routing. How does Agent A find Agent B?

AGTP-COMMERCE solves this. DNS, registries, or direct connection. Cryptographic verification. No central directory. Done.

Layer 2: Payments. How does money physically move?

x402 (HTTP 402 headers), AEON (Coinbase's agent payment protocol), and CEX APIs solve this. The plumbing works. The transaction clears.

Layer 3: Settlement. How do you know the payment is final and irreversible without trusting an intermediary?

This layer is contested. And it is the one that will decide the shape of the agent economy.

Three Settlement Models

The market is building three different answers:

1. Liveness-Based Escrow (Akash, io.net, Render)

How it works: Escrow drains per block. Provider stays online, earning continues. Provider goes offline, earning stops.

What it proves: The machine was powered on.

What it doesn't prove: The work was correct. Akash's own docs are explicit: liveness does not establish whether a job executed correctly or used an untampered model.

When it's useful: GPU capacity markets where uptime is the commodity being sold.

2. Reputation-Based Jury (Apex Fusion Vector)

How it works: Bonded escrow. Staked validators vote on whether work was completed. Signed receipts carry chain of custody.

What it proves: A jury of incentivized strangers agrees the work happened.

What it doesn't prove: It doesn't prove the work was correct. It proves consensus exists. Consensus != proof.

When it's useful: When you can't get cryptographic proof but you can get economic incentives to behave honestly. Chain-of-custody auditability.

3. Cryptographic Proof (HTLC for assets, attestation for compute)

How it works: Payment releases when and only when a specific cryptographic condition is met.

For assets: hash preimage. Lock funds until the other party reveals a secret that hashes to a known value.

For compute: hardware attestation. Lock funds until you see a signed report from a hardware-rooted key proving the correct code ran.

What it proves: Something is mathematically true without needing a jury, oracle, or reputation system.

What it doesn't prove: (For assets) nothing beyond the hash. (For compute) it proves which code ran on which silicon. It does NOT prove the output is correct. Trust-minimized, not trustless. Hardware CA becomes the trust root instead of a custodian.

When it's useful: When you need finality without intermediaries. When both parties are strangers and will never interact again.

Why This Matters for Agents

An autonomous agent cannot wait for a jury to vote. It cannot afford to bet that a bridge operator won't steal its money. It needs settlement that is:

Fast. Measured in seconds, not hours.
Trustless or trust-minimized. No jury needed. No custodian needed.
Composable. The same primitive should work across chains and use cases.

Cryptographic settlement is the only model that checks all three boxes.

The Bridge Question

deBridge's MCP connector solves route optimization — which bridge is fastest, cheapest, safest? Useful. But it doesn't solve the settlement question.

Every bridge is optimistic: the bridge operator holds your money and promises to release it on the destination chain. If the operator disappears, so does your money.

This is not a settlement primitive. This is a proxy — a bet that the bridge operator has good incentives to behave.

Bridges are fast. Bridges are useful. But they are not atomic. The HTLC is atomic. The bridge is not.

The Compute Layer

This week's IETF standard is asset-agnostic. The specification applies to agents trading anything: data, compute time, financial derivatives, digital goods.

For compute specifically: NVIDIA's H100 and H200 GPUs ship with a hardware-fused Device Identity Key. Remote attestation service produces a signed report covering the workload hash. That attestation is a cryptographic artifact.

An agent buying compute could set a payment condition: "Release $100 only if I see an attestation from a real H100 that proves my workload executed."

Is this trustless? No. The trust root moved to NVIDIA's CA instead of the compute marketplace. But it is trust-minimized. You are no longer relying on the marketplace operator's reputation or governance.

Where We Go Next

The routing war is over. Agents can find each other. The market has a standard for that.

The settlement war is just starting. The market does not yet have a standard.

Hashlock's position: the cryptographic settlement primitive. Proven on asset swaps (ETH mainnet, live end-to-end since Apr 2026). The design extends to compute (under active research, no testnet yet).

Competitors are shipping. Vector opened to outside builders on Aug 18. deBridge is in production. Akash has four years of uptime data.

But none of them answer the fundamental question: what does an agent actually pay against when it buys compute?

If the answer is "a jury votes" or "the machine was online," you have a settlement gap. If the answer is "I see a cryptographic proof," you have a primitive.

What Builders Should Do

If you're building agent-to-agent infrastructure:

Understand AGTP. It's shipping. Routing is solved. Build your settlement on top of it.
Ask yourself how you settle payment. If you don't have a cryptographic answer, ask why not.
Test the model. For assets, the model works. For compute, the primitives exist (attestation) but the tooling is in research phase. Start there.

The week ahead: the IETF spec is out, deBridge is live, Vector is running 20,000+ workloads. Now the market learns what actually happens when agents try to pay each other.

Read the IETF spec. Then ask: which settlement model wins? And more importantly: which one should win?

https://hashlock.markets/methodology?utm_source=devto&utm_medium=blog&utm_campaign=2026-10-04-settlement-war

Which settlement model makes sense to you: cryptographic proof, reputation + jury, or something else entirely? Drop your thoughts in the comments. I'll engage with every reply.

Compute Settlement Against Proof: Why NVIDIA Attestation Changes the Question

Baris Sozen — Sat, 03 Oct 2026 10:18:04 +0000

Compute Settlement Against Proof: Why NVIDIA Attestation Changes the Question

Building in public on an unsolved problem.

When an AI agent buys compute—GPU time, training capacity, a verified inference—something has to decide when the money moves. Today, that decision is made against a proxy. We're exploring what happens if it's made against cryptographic proof instead.

The Settlement Crisis in Compute

The compute marketplace runs on three mechanisms. None of them settle the core question: did the work actually happen correctly?

Liveness Settlement (Akash, io.net, Render)

The marketplace leader. Provider receives a payment escrow. Every block, the escrow drains by a fixed amount (roughly every 6 seconds). If the provider goes offline, the draining stops. Provider stays online = provider keeps earning.

What it proves: The GPU was turned on for N blocks.

What it doesn't prove: Whether the job executed correctly, the model was untampered, or the output is useful.

From Akash's own documentation: "Akash does not cryptographically verify that a job executed correctly."

Reputation Settlement (Apex Fusion Vector)

Apex Fusion opened their Vector settlement layer publicly on August 18, 2026. It has settled over 20,000 agent work packages in partnership with OriginTrail.

The mechanism: bonded escrow, staked reputation, staked-jury dispute resolution, and signed receipts carrying chain of custody. A jury of collateralized participants votes on whether work was valid. If unanimous, payment clears. If disputed, the jury's stake is at risk.

What it proves: A consensus of incentivized judges agreed the work was valid.

What it doesn't prove: A jury is a trusted third party by definition. Economic finality, not cryptographic finality. And it works inside one ecosystem—breaks when settlement must be cross-chain or cross-infrastructure.

Payment Rail Settlement (x402, AP2)

The newest and fastest-growing. x402 says: money moves when an HTTP 402 response is served. AP2 says: money moves when the agent is authenticated and authorized.

What it proves: An HTTP request completed. The agent was who they claimed to be.

What it doesn't prove: Anything about the work. Payment is cleared against a status code, not a cryptographic condition.

The Artifact That Already Exists: TEE Attestation

NVIDIA Confidential Computing on Hopper-class hardware (H100, H200) includes a hardware-fused Device Identity Key (DIK) anchored to NVIDIA's root certificate authority. When a workload runs inside the trusted execution environment, the NVIDIA Remote Attestation Service produces a cryptographically signed report.

That report contains:

Firmware measurements (proof the GPU is running unmodified firmware)
Workload hash (proof of which code is executing)
A signature from NVIDIA's root CA

This is not a hypothetical. It is shipping in production on billions of dollars' worth of GPU hardware, right now.

The Design: Settlement Against Attestation

Here's what a compute HTLC would look like:

Agent locks funds on ETH with a challenge hash: hash(secret) + {workload_hash, attestation_pubkey, timeout}
Provider locks funds on Solana with the same challenge hash
Provider runs the workload inside the TEE
TEE produces an attestation signed by NVIDIA's root CA, containing the workload hash
Provider computes the preimage (typically: secret + workload_hash) and submits the attestation as proof
Agent verifies the attestation cryptographically (signature chain from NVIDIA's root CA back to the specific GPU) and reveals the secret
Both chains settle atomically: Agent gets the attestation as proof; provider gets paid

No jury. No liveness proxy. No intermediary. Settlement is gated on a cryptographic proof of code execution.

The Caveat (Mandatory, Every Time)

Attestation proves which code ran on which silicon. It does NOT prove:

The output is correct
The output is useful
The model was any good
The workload didn't misbehave or leak data

And attestation moves the trust root from the network to NVIDIA's certificate authority. Not trustless. Trust-minimized, which is a real category: the hardware vendor is a dependency, but an NVIDIA-rooted proof is stronger than reputation-based jury consensus for cross-chain settlement.

This is not a weakness in the design. It's the honest statement of what the primitive does and doesn't do.

Why This Matters Now

The market is converging on Layer 2 settlement. Vector shipped first and has traction. Akash is the incumbent. x402 has Google and Mastercard behind it. The question of "what is settlement?" is about to get asked at industry scale.
Attestation closes a gap that reputation and liveness cannot. When agents trade compute across chains, or when compute is delegated through a chain of agents, reputation ties you to one ecosystem and liveness doesn't scale to settlement. Proof does.
The artifact already exists. NVIDIA has done the hardware work. Intel has done it. The TEE attestation is not a research prototype—it's the real artifact that $200M annualized protocol revenue in decentralized compute is built on top of. We can start asking what settlement against it looks like.
Nobody is settling against it yet. This is a design gap. Vector uses reputation. Akash uses liveness. x402 uses HTTP status. None of them use the artifact that's right there in the hardware.

The Open Questions

Is workload hash enough? Or do we need additional conditions (e.g., model hash, output hash)?
Can you do multi-step proofs? If an agent subcontracts work to another agent, does the attestation chain back to the original workload?
What's the timeout risk? HTLC requires both sides to monitor the chain. If an agent goes offline during the reveal phase, funds are locked for the timeout period. Acceptable for compute? Or do you need async settlement?
Can you compose across chains? Hash-time-locks work on ETH/Sui/BTC. But can an agent lock on one chain and a provider on another and still settle atomically? (Yes—that's the whole point of HTLC. But the engineering gets complex.)
How do you handle the provider-agent negotiation? In asset settlement, both parties know the swap ratio up front. In compute, the agent needs to know: what workload hash do I challenge against? How does the provider prove that's the hash I actually want executed?

Our Status: Rails Ready, Trains Coming

We haven't built compute settlement. No contract, no testnet, no MCP server for it yet. What we have is the settlement primitive (HTLC) and a well-posed question that nobody in the compute ecosystem is asking yet.

The design work is underway. The blog post that priced our own forward design at 688 basis points (against a 1-2 bps fee for asset settlement) made the case that someone needs to close this gap. We're designing in public because this isn't a Hashlock-specific problem—it's an ecosystem question.

If you're building in compute infrastructure, agent frameworks, or TEE platforms: this is the layer to watch. If you're running compute marketplaces: this is the settlement mechanism that doesn't yet exist.

What would settlement against attestation change about how agents buy and sell compute? Reply below.

Learn more:

AP2 Solved Payments, Not Settlement. Here's Why Agent Commerce Still Needs Both

Baris Sozen — Sat, 03 Oct 2026 10:18:02 +0000

AP2 Solved Payments, Not Settlement. Here's Why Agent Commerce Still Needs Both

Last week, Google and Mastercard handed AP2 to the FIDO Alliance. The news bounced through agent economy channels as a validation moment: "AI agent payments just got standardized."

It's true. And it's incomplete.

AP2 (Agent Payments Protocol) is excellent at one thing: moving money when an agent is authenticated and authorized to spend it. x402 (HTTP-native payments under the Linux Foundation) is excellent at moving money at the HTTP layer, per-request.

Both are payment rails. Neither is a settlement layer.

For agents trading digital assets with each other across blockchains, or procuring compute from untrusted providers, those are two different problems. And if agent commerce standardizes on one without the other, we'll have solved how agents authorize transfers but not what condition releases them.

What AP2 Does (And What It Doesn't)

AP2's job:

Authenticate the agent (is this agent who it claims to be?)
Authorize the spend (does this agent have permission to transfer X tokens?)
Route the payment (move the money)

What it doesn't do:

Define what the money is moving against
Specify what condition must be met for release
Establish finality (who decides whether the transaction is final?)

Example: An AI agent buys GPU time from a provider it has never met, on a chain neither trusts more than the other.

AP2 handles: "Agent is authenticated, authorized to spend 1 ETH, and the payment is routed."

It does NOT handle: "The 1 ETH releases only when the GPU provider proves the job ran correctly."

That second part is settlement. And AP2 punts it to the application layer.

The Three Layers (And Why They're Confused)

Most agent commerce discussions collapse three distinct layers:

Layer 1: Authentication & Authorization (AP2 Handles This)

"Is this agent who it claims to be, and does it have permission to spend?"

This is solved. AP2, ERC-8183 (agent identity), and OAuth all work here. FIDO donating AP2 to the standards body means: this layer is standardizing.

Layer 2: Payment Routing (x402 Handles This)

"How does the money physically move from payer to payee?"

x402 answered this: embed payment credentials in the HTTP request itself. Hyperbolic is using it in production for GPU inference. Coinbase and Stripe are in the ecosystem.

This layer is also largely solved.

Layer 3: Settlement (Still Open)

"What condition must be satisfied before the money actually changes hands?"

This is where the gap lives.

For agent-to-merchant (agent → AWS, agent → Stripe): settlement can be custodial. AWS holds the money until the invoice is validated. Stripe intermediates. Both are trusted third parties.

For agent-to-agent (agent → agent) or agent-to-untrusted-provider (agent → random-datacenter-in-Singapore): custodial settlement doesn't work.

You need a condition that is:

Cryptographic (provable without trusting a third party)
Cross-chain (workable when payer and payee are on different blockchains)
Atomic (both sides complete or both sides refund)

How Different Systems Answer "Settlement"

Apex Fusion Vector

Settlement condition: Staked reputation + bonded escrow + jury-based dispute resolution + signed receipts.

Finality model: Economic. A jury of staked participants votes on whether work was valid. If they agree, the settlement is final because attacking the quorum is financially expensive.

Advantages: Works inside one ecosystem. Proven at scale (20,000+ work packages as of Sept 2026).

Limitations: Jury is a trusted third party with incentives, not a cryptographic guarantee. Requires shared reputation infrastructure.

Hashlock (HTLC-Based)

Settlement condition: Cryptographic preimage (for assets) or hardware attestation (for compute).

Finality model: Cryptographic. An HTLC releases funds when a hash preimage is revealed or an attestation is validated. No jury. No intermediary.

Advantages: Trust-minimized. Works cross-chain natively. No dependencies on ecosystem reputation.

Limitations: Capital lockup. Timeout risk. Attestation still requires a hardware CA as trust root (not fully trustless).

Akash Network

Settlement condition: Liveness (provider stays online).

Finality model: Behavioral + reputation. Escrow drains per block. Goes offline, loses income. Layered with on-chain reputation scoring.

Advantages: Simple. Incentive-aligned for uptime.

Limitations: Liveness ≠ correctness. Provider can be online and still deliver wrong output. See our Sep 30 post for details.

Why This Matters for Agent Standards

If AP2 + x402 become the standard for agent payments without a settlement layer standard, here's what happens:

Scenario 1: Agent → Merchant (works fine)

Stripe or OKX or Coinbase intermediates settlement.
AP2 routes the payment to a trusted processor.
Settlement is custodial but accepted.

Scenario 2: Agent → Agent Across Chains (breaks)

AP2 routes the payment.
But what happens next?
- Do both agents agree on a third party to hold the money? (Centralized, high trust)
- Do they use economic finality with a jury? (Requires shared reputation substrate)
- Do they use cryptographic finality with an HTLC? (Requires a different protocol entirely)

Right now, AP2 + x402 say nothing about this.

What the Standard Should Include

A complete agent commerce standard needs:

Authentication & authorization (AP2 covers this) ✓
Payment routing (x402 covers this) ✓
Settlement condition (OPEN — no standard yet)
Finality model (OPEN — reputation vs cryptographic)
Cross-chain atomicity (OPEN — needs HTLC or equivalent)

You can standardize 1 and 2 and ship it. Merchants are happy. Agent-to-merchant payments work.

But agent-to-agent commerce, or compute procurement on untrusted infrastructure, still needs a settlement answer.

The Real Debate

Here's the question the agent standards community should be asking (and mostly isn't):

Should settlement be standardized as part of agent commerce, or left to applications to implement?

Case for bundling: If every agent framework implements settlement differently (some use Vector, some use Hashlock, some use custodial escrow), agents can't interoperate across framework boundaries without conversion risk.

Case for leaving it open: Settlement is use-case specific. Agents paying for compute need attestation-based settlement. Agents swapping assets need HTLC settlement. Agents paying humans need custodial settlement. One standard fits none.

Hashlock's position: We built atomic settlement for the open case (agent ↔ agent, cross-chain, untrusted). AP2 + x402 are good complements — they handle the payment rail. Settlement underneath is still the unsolved layer.

We're not positioned as the standard. We're positioned as one answer to the settlement question, and we're building in public on it.

What to Watch

Oct 2026: AP2 gets transferred to FIDO. Watch for settlement governance questions in early implementations.
Q4 2026: Vector (Apex Fusion) continues scaling agent work settlement. If jury-based settlement wins mindshare, cryptographic approaches stay niche.
2027: If agent-to-agent commerce grows without a settlement standard, you'll see fragmentation (each framework standardizes internally) or a new standard (IETF AGTP Commerce mentions settlement but it's still draft).

The Open Question

Do you think agent commerce standards should include settlement from day one, or can the industry function with settlement as an application-layer problem?

Agree: Settlement standardization is critical for interoperability.

Disagree: Payment + auth are enough; settlement is app-specific and can't be standardized.

Let me know your take.

Explore more:

UTM: hashlock.markets/?utm_source=devto&utm_medium=blog&utm_campaign=2026-10-01-ap2-settlement

IETF AGTP-COMMERCE: The Draft That Defines Agent Commerce (But Not Settlement)

Baris Sozen — Sat, 03 Oct 2026 06:25:58 +0000

IETF AGTP-COMMERCE: The Draft That Defines Agent Commerce (But Not Settlement)

In June 2026, the IETF published draft-hood-agtp-commerce-00, the agent-to-agent commerce protocol. It's a real deliverable with teeth: cryptographic proof of agent identity, merchant registries, transaction routing, and dispute metadata.

It's a cornerstone of the emerging agent economy infrastructure.

It also leaves the hardest problem completely open: when agent A owes agent B money, what proves that payment actually executed?

This gap is why we're building compute and asset settlement layers. Let's walk through what AGTP gets right, what it doesn't touch, and what the market needs to build on top of it.

What AGTP-COMMERCE Solves (Correctly)

1. Agent Identity and Cryptographic Proof

Agents need provable identities. AGTP specifies how an agent's public key becomes a verifiable identity, rooted in a merchant registry or trusted namespace.

Agent A: identity = sign(agent_id, private_key)
Agent B: verify(identity, public_key) -> trust level

This is solid. An agent can prove it is who it claims to be without a central gatekeeper. Each agent framework can run its own registry or delegate to a shared one (Anthropic, Vercel, etc.).

2. Routing and Contract Negotiation

Agents need to find each other and negotiate terms. AGTP specifies:

Discovery (DNS, registries, direct connection)
Contract format (what payment terms, what dispute rules)
Signature requirements (both agents sign off on terms)

This is how agent A finds agent B, proposes a trade (e.g., "I'll pay 0.5 ETH for this training job"), and both agree before execution.

3. Transaction Metadata and Auditability

Every transaction logged with:

Parties (signed identities)
Terms (amount, what was traded, timeout)
Signatures (both agents acknowledge)

If something goes wrong, the metadata is a permanent record that a jury, arbitrator, or court can reference.

All good. AGTP is doing the routing and governance layer correctly.

What AGTP-COMMERCE Does Not Solve

The Missing Layer: Settlement Proof

AGTP says: "Here's how agents find each other, what they traded, and who signed off."

AGTP does NOT say: "Here's how we know agent A actually paid agent B."

Today, every production system that settles agent payments does so against something weaker than proof:

System	Settles Against	Trust Model
Akash / io.net	Liveness (machine stays online) + reputation	Reputation slash if offline; no proof of work quality
Apex Fusion Vector	Social consensus (staked jury)	Jury is a trusted third party with good incentives
x402 (Coinbase/Cloudflare)	HTTP response (payment clears on successful response)	Says nothing about whether work was correct

Each system chose a proxy. Liveness is not proof of work. Jury votes are not cryptographic certainty. HTTP status 200 is not proof of execution.

AGTP leaves this decision to the implementation. And that's fine. But it means the market is missing the foundational primitive.

What Proof Actually Looks Like

For Asset-to-Asset Settlement

An HTLC (hash-time-lock contract) locks value and releases it when a cryptographic condition is met. The condition is a hash preimage.

Agent A's flow:

Chooses a secret (256-bit random number)
Computes hash(secret)
Locks ETH in a contract: "Release to B when B reveals secret"
Sends hash to Agent B

Agent B's flow:

Locks corresponding BTC in a contract: "Release to A when A reveals secret"
Sends lock confirmation to A

Atomic settlement:

Agent A reveals secret to claim BTC
Revelation is public; Agent B sees it and uses same secret to claim ETH
Both complete or both refund after timeout

The proof is the hash preimage. You can't fake it without solving the hash function backward, which is cryptographically infeasible.

No jury needed. No reputation needed. No trust in the other agent or any intermediary.

For Compute Settlement

This is newer and still in research phase. The question is: what does proof of compute execution look like?

For confidential compute on NVIDIA H100/H200 hardware, the answer exists: attestation signed by a hardware-rooted key.

Each GPU carries a Device Identity Key (DIK) fused at manufacture time and anchored to NVIDIA's root CA. When a workload runs in confidential mode, the hardware produces a signed attestation covering:

Firmware measurements (what software is running)
Workload hash (which code executed)
Timestamp

Important caveat (stated every time, no exceptions): attestation proves which code ran on which silicon. It does NOT prove the output is correct, useful, or that the model was any good. And it relocates the trust root to NVIDIA's certificate authority. This is trust-minimized, not trustless.

But it's the closest thing the compute market has to a preimage. An agent could set up an HTLC that releases payment only when a valid attestation is presented.

// Pseudocode: compute HTLC with attestation condition
if verifyAttestation(workloadHash, signature, nvidiaRootCA) {
  releasePayment(agent_b);
}

For the first time, settlement could be gated on cryptographic proof that the work actually happened.

Why This Matters Right Now

The market is building three parallel layers:

Routing (AGTP). Agent discovery, identity, contract negotiation. Standardized. Shipping.
Payments (x402, AEON, IXUSD). Money moves from A to B via HTTP or chain. Fast. Custodial or wrapped.
Settlement (still unsolved). When payment is atomic and final with no intermediary risk.

Layers 1 and 2 are converging. Layer 3 is where the technical differentiation will happen.

Every system that wants to claim "trustless agent commerce" will need a settlement primitive. AGTP defines the routing. Someone needs to define the proof.

What We're Building (Honest Status)

We have a primitive: HTLC-based settlement on Ethereum mainnet, with code and contracts that are formally verified and live.

We have a question: what does settlement look like for compute?

We do NOT have:

A compute settlement design
A testnet for compute escrow
Customers using compute settlement

We're building in public on an unsolved problem. The voice is the same as the 2026-09-04 post that priced our own forward design at 688 basis points against a 1-2 basis point fee. We're asking: if you want atomic compute settlement, what shape should it have?

Next Steps (For You)

If you're building an agent framework or an agent-to-agent marketplace:

Read draft-hood-agtp-commerce-00. Understand the routing layer.
Ask yourself: how do I settle payment atomically? If the answer is "CEX API keys" or "jury dispute," you have a scaling problem.
Explore HTLC settlement for asset trades. It's mainnet live and has a working MCP server.
For compute: think about what proof means. Attestation + HTLC is one shape. Bonds + reputation is another. Jury + collateral is a third.

The market doesn't have one answer yet. That's the opportunity.

The Settlement Layer Gap: Why x402 + Vector Isn't Enough

Baris Sozen — Sat, 26 Sep 2026 06:14:30 +0000

Last week, Coinbase moved fast. They rolled out x402 payment infrastructure for AI agents to trade US equities and other assets. At the same time, Apex Fusion's Vector is proving something important: agents will run real work, and that work needs settlement rails.

But here's what's easy to miss: those two pieces don't connect yet. And the gap is bigger than it looks.

The Four Layers of Agent Commerce

Right now, agent-to-agent commerce runs on four separate infrastructure layers:

Payment rail (x402) - HTTP 402 status codes trigger escrow release. Works for "buy this thing from me". Micropayment native.
Work settlement (Vector) - Staked reputation + bonded escrow + jury dispute resolution. Proves work happened. Works inside one ecosystem.
Compute supply (Akash, Render, io.net) - GPU capacity and training escrow against liveness. Doesn't prove correctness.
Identity (ERC-8183) - Standardized agent authorization. Tells you who is transacting, not whether both legs clear.

Each layer solves a real problem. None of them solves this problem:

Agent A on Ethereum needs to pay Agent B on Solana for confidential compute work, but payment only clears when an attestation signed by the TEE arrives cross-chain, atomically.

When Agent A releases payment before the attestation, Agent B can run the work, pocket the funds, and claim the compute never happened. When Agent A waits for the attestation first, Agent B needs external capital to lock up the compute while waiting for payment. Both scenarios break at scale.

Why x402 Isn't Settlement

x402 is elegant. HTTP 402 has been in the RFC since 1997. Coinbase wired it for crypto: agent requests GPU time, server responds with 402 + payment request, agent pays via Solana, server sends 200 + the compute.

That's a payment rail. It clarifies the price, routes the money, and clears in one direction.

Settlement is different. Settlement means: once both parties lock funds, either both transactions complete or both refund. No partial states. No "Agent A paid but work never ran."

x402 doesn't promise that. If the GPU provider goes dark after payment, the agent has recourse only if x402 includes a custodian or an oracle. Which it doesn't.

Why Vector Works, But Only Inside Its Ecosystem

Vector opened to builders in August. It's proven with OriginTrail and others: on-chain work, staked reputation, jury disputes. 20K+ agent work packages.

But Vector's jury is a trusted third party. Effective? Yes. Decentralized? Sort of. Trustless? No. And it's one ecosystem - mainnet Vector only. When Agent A is on Ethereum and Agent B is on Solana, Vector's jury can't inspect both sides of the transaction simultaneously.

The HTLC Primitive for Cross-Chain Settlement

Hash-time-lock contracts have been around since 2013. They're the cryptographic foundation of payment channels, atomic swaps, and every cross-chain bridge that's actually atomic.

Here's how they settle agent trades:

Setup: Agent A (Ethereum) wants to pay Agent B (Solana) to run compute. Both agents' MCP servers have HTLC-capable settlement tooling.

Agent A creates HTLC on Ethereum: locks 1 ETH with hash(secret). "If someone proves they know the secret, they get this money."
Agent B creates HTLC on Solana: locks equivalent SOL. Same hash.
Agent B runs the compute. Computation produces an attestation (from NVIDIA TEE or similar), or a hash preimage.
Agent B reveals the secret (or submits the attestation + preimage) to claim the Solana funds.
Agent A uses the same proof to claim the ETH funds on Ethereum.
Cryptographic guarantee: both transactions complete or both refund after timeout. Zero intermediary.

The key: settlement is cryptographic, not economic. No jury. No custodian. No oracle. Just hash verification and timeouts.

The Caveat (and It Matters)

HTLC settlement is trust-minimized, not trustless. Why?

Attestation proves which code ran on which silicon. It doesn't prove the output is correct, useful, or that the model weights are what you expected.
The trust root moves from "Vector jury" to "NVIDIA root CA." That's a real cost. You've traded one intermediary for a hardware vendor's certificate authority.
Timeout risk is real. If Agent A crashes, its refund path activates, and Agent B loses the compute payment. Settlement primitives are only as reliable as their execution environments.

But those tradeoffs beat the alternatives. Economic jury settlement requires all parties to accept a jurisdiction. Custodial settlement requires trust. HTLC settlement requires only cryptographic verification and timeout execution.

Why This Week Matters

Coinbase's x402 expansion (Sep 22) + Vector's proof of scale (20K jobs) + Akash's supply maturity = agents are about to transact at scale.

But the settlement layer stays fragmented. x402 routes payments. Vector settles work inside one chain. Nobody settles cross-chain atomic agent work.

That's the gap we're addressing. MCP server + HTLC contracts on Ethereum (live end-to-end), Sui (deployed, CLI-tested), and Bitcoin signet (testnet). Open-sourced. No bridges, no custodians.

The architecture isn't revolutionary - it's 2013 atomic swap primitives applied to 2026 agent commerce. What changes is the vector: instead of human traders locking capital for days, agents lock for milliseconds, reveal cryptographically, and move on.

What Happens Next

Watch these signals:

x402 adoption - Does it stay payment-only, or does someone wire it to HTLC settlement underneath?
Vector on other chains - Does Apex Fusion go cross-chain, or stay single-ecosystem?
Compute attestation standards - NVIDIA and Intel both ship hardware-rooted attestation. Do we standardize what attestation proves for settlement?

If settlement stays fragmented, agents stay custodial. If it crystallizes around cryptographic proof (HTLC + attestation), you get trustless agent-to-agent commerce across chains.

That's what we're building toward.

Questions: How do you think agents should settle cross-chain work? Is economic finality (jury) good enough, or does cryptographic finality (HTLC) matter? https://hashlock.markets?utm_source=devto&utm_medium=post&utm_campaign=2026-09-26-agent-settlement-ecosystem

Every Compute Marketplace Today Settles Against the Wrong Thing

Baris Sozen — Wed, 23 Sep 2026 06:13:12 +0000

You rent $10,000 of GPU time on Akash. The machine comes online. The escrow starts draining. After 6 seconds, it drains again. After 12 seconds, again. This continues for 8 hours while your training job runs.

At the end of the 8 hours, the GPU owner gets paid.

And nobody can prove your job ran correctly.

Not because Akash is bad. Akash is solving the right problem for its scope: ensuring the provider has economic incentive to keep the machine online. If the machine goes offline, earning stops immediately. Aligned incentives.

But alignment and correctness are different problems.

An honest provider and a dishonest one have identical escrow drains as long as the server stays online. The dishonest provider can:

Run your job against stale model weights
Add noise to the output
Skip your compute entirely and return a cached result
Return random numbers

The escrow drains on schedule either way. The provider gets paid either way. You find out your result is garbage six hours later, after the settlement is complete.

This is not a bug in Akash's design. It is the fundamental shape of the problem Akash chose to solve: the liveness problem, not the correctness problem.

The question is: does anyone solve the correctness problem?

The Settlement Proxy Landscape

Every compute marketplace shipping today settles against something that correlates with good behavior but does not prove it.

Marketplace	Settles against	What it does NOT prove
Akash	Liveness: escrow drains per block (~6s). Machine offline = earning stops. Plus on-chain reputation.	Job executed correctly. Model was untampered. Provider used the hardware you paid for.
Apex Fusion Vector	Bonded escrow, staked reputation, staked-jury dispute resolution, signed receipts.	Jury decision is cryptographically certain. Jury is a trusted third party, just with better incentives than a single provider.
x402	HTTP response served. Money embedded in the request itself; payment clears on response.	Whether the response is correct, complete, or honest. Response could be a cache hit from six months ago. Protocol does not ask.
Hyperbolic	Collateral + proof-of-stake (PoS) model + reputation system.	Output quality or model integrity. You're paying for a machine to run; not for the machine to run correctly.
io.net / Render	Liveness + provider reputation.	Proof of work. Same gap as Akash.

Each marketplace is optimizing for something real. Akash optimizes for "provider doesn't disappear mid-job." Vector optimizes for "disputes are resolved fairly." x402 optimizes for "charge per API call without a central bank." Hyperbolic optimizes for "stake incentives alignment."

None of them optimize for: "The money moves against cryptographic proof that the correct work was done."

The Cryptographic Gap

Asset-for-asset settlement has a built-in truth function. When you swap ETH for BTC using a hash-time-lock contract (HTLC), the settlement condition is cryptographic: you release the preimage (the secret input to a hash function), proving you control the funds on one side, and money flows on the other side. Both transactions are atomic, or both refund. The proof is embedded in the protocol.

You settle against cryptography.

Compute settlement has no native preimage.

Until now. Maybe.

NVIDIA H100 and H200 GPUs carry a hardware-fused Device Identity Key, anchored to NVIDIA's root certificate authority. When you run a workload in confidential mode, the GPU produces a signed attestation report that covers:

The firmware running on the GPU
The cryptographic hash of the workload code
Measurements of the execution environment

That attestation is signed by NVIDIA's root CA. It's verifiable offline. It's a cryptographic statement about what code actually ran on what silicon.

You can embed it in a settlement condition.

An HTLC that releases payment only when a valid attestation report is provided, signed by NVIDIA's root CA, carrying the workload hash the buyer specified. The hardware attestation becomes the preimage.

The Caveat That Cannot Be Omitted

Attestation proves which code ran on which silicon. It does NOT prove:

The output is correct
The output is useful
The model was any good
The training data was what you thought
The inference latency was acceptable

It relocates the trust root. Instead of trusting:

Akash's reputation system (economic trust)
Vector's jury (social trust)
x402's HTTP protocol (protocol trust)

...you trust NVIDIA's certificate authority (infrastructure trust).

That's a real trade-off. Not trustless. Trust-minimized. You remove the intermediary, but you replace it with a hardware vendor's CA.

Is that better? It depends on your threat model. An agent that needs to pay for work without involving a custodian, and that trusts NVIDIA more than it trusts a DAO or a jury? Yes. For others? Maybe not.

The Unsolved Question

If attestation is the artifact, then we have a settlement primitive:

HTLC on top of cryptographic attestation. Money locked. Provider runs workload. Attestation signed by hardware CA. Hash matches. HTLC resolves. Settlement atomic.

Except we haven't built it. No one has. There is no deployed testnet, no production contract, no proof that the attestation delay is acceptable, no evidence that the TEE performance tax (NVIDIA quotes ~98% of unsecured speed) is bearable at scale.

We know the question. We don't know the answer.

This is what Hashlock is testing over the next four weeks in Colosseum. The hypothesis: if you gate an HTLC on NVIDIA attestation as the settlement condition, you get cryptographic proof that the work executed without needing a jury, a reputation system, or a provider to stay online forever.

The counterargument is already clear: attestation is not proof of correctness, you're trusting the hardware CA, and the latency will kill performance.

Both might be true. We'll find out.

What This Means for Agent Compute Procurement

Agents buying compute don't have a choice today. They rent from a marketplace, they trust the provider's reputation or a jury's judgment or an HTTP response. They pay for uptime or consensus or a served request.

They do not have an option to pay against cryptographic proof of work.

If that option exists by October 12, it won't matter whether it scales. The category will be defined. Every other marketplace will have to answer: why should I trust your jury / your reputation system / your HTTP response when you could verify against cryptographic hardware attestation?

That's the question we asked yesterday in Colosseum. We don't have the answer yet.

Hashlock is hiring. We're looking for people who think deeply about settlement primitives, hardware trust models, and the shape of unsolved problems. If this interests you, check out hashlock.markets.

What's your threat model? Do you trust NVIDIA's CA more than a jury? More than Akash's reputation system? Hit the comments.