Source-linked AI summary

SoK: Decentralized Agent Economic Infrastructure

Rui Sun, Xihan Xiong, Qin Wang, Fei Gao, Zelin Li, Zehua Cheng, Jiahao Sun, Zhipeng Wang

arXiv:2610.01756v1cs.CRcs.AIcs.MA

TL;DR

Decentralized agent workflows can produce the wrong task outcome even when their component protocols operate correctly, and prior work lacks a task-level account of how guarantees compose across the full workflow. The paper maps lifecycle requirements and introduces guarantee closure, then finds failures where evidence or guarantees are not carried into downstream decisions. It concludes that recorded approval alone does not establish task conformance, and that economic guarantees depend on report, penalty, and evaluator-error assumptions.

  • Problem

    Existing work lacks a task-level view of how guarantees compose across the full workflow and which downstream decisions must preserve and use them.

    Source: §I · p. 1
  • Method

    The paper organizes 17 stage-indexed properties and introduces guarantee closure to test whether required guarantees are established and preserved across dependent decisions.

    Source: §I · p. 1
  • Results

    The analysis identifies local-to-end-to-end closure failures, including guarantees that are missing, dropped, or unavailable to acceptance paths, and shows that recorded approval alone does not establish task conformance.

    Source: §I · p. 2, §X · pp. 12–13
  • Takeaways & Limitations

    Secure agentic commerce requires guarantees to be established for the task and to constrain the downstream decisions that depend on them.

    Source: §X · p. 13

Abstract

from arXiv · show

Decentralized agent economies increasingly build a single task from protocols that were designed and secured separately. This creates a simple problem: a workflow can look correct at each step and still produce the wrong outcome. For example, a correct escrow may release payment on an authorized approval that provides little evidence that the delivered work actually satisfied the task. We systematize this problem across the full lifecycle of an agent task. Our study organizes security and economic requirements into 17 property families over six stages, with receipt soundness and completeness assessed separately. We examine 12 systems and standards, five reusable mechanism families, and four classical baselines. We introduce guarantee closure, a task-relative criterion for determining whether guarantees established at one stage remain available and constrain the later decisions that depend on them. We apply the criterion to controlled and native workflows, covering 840 matched executions and an exhaustive 11,648-case check over a finite objective-task domain. Our results expose recurring failures between verification and settlement, where conforming work can remain unaccepted or valid evidence can be ignored. Public records and model judgments further distinguish recorded approval from evidence of task conformance, while economic analysis identifies the report, penalty, and shared-error assumptions behind these guarantees. These findings show where end-to-end guarantees fail and what must be repaired to preserve them across the workflow.

I. INTRODUCTION

The paper argues that guarantees established at one stage can be missing, weakened, or ignored when later decisions depend on them, and introduces guarantee closure to assess those dependencies across a task lifecycle. It examines how these failures arise in workflows and what assumptions constrain the guarantees they support.

I. INTRODUCTION

  • The central gap is a task-level account of whether guarantees compose across a workflow and remain available to the downstream decisions that depend on them.Prior work covers service delivery, cross-stage consistency, negotiation, shared evaluator failures, and protocol-specific failure modes.Source: §I · p. 1
  • Guarantee closure tests whether task-required guarantees are established under stated assumptions and preserved for later dependent decisions.It distinguishes missing guarantees, valid evidence that is not used, and acceptance rules that cannot be reached in practice.Source: §I · p. 1
  • The paper maps 17 stage-indexed security and economic properties, including separate receipt soundness and completeness, across 12 systems and standards, five mechanism families, and four classical baselines.It also derives requirements for capability attestation, persuasion-robust interfaces, receipt-consuming settlement, and evaluator markets with explicit evidence, incentive, and error assumptions.Source: §I · pp. 1–2

A. Definitions

  • A mechanism implements a lifecycle function, a guarantee is a property it provides under stated assumptions, and a workflow combines mechanisms across stages.The study assesses claims from systems, specifications, and reusable mechanism families against their supporting documentation.Source: A. Definitions · p. 2

B. The Task Lifecycle

  • The lifecycle runs from provider discovery and task negotiation through execution, verification, settlement, and dispute resolution, with roles varying by workflow.The guarantees established at each stage must be preserved and used by later decisions that depend on them.Source: B. The Task Lifecycle · p. 2

C. Threat Model

  • The threat model includes counterparty-controlled language that changes an honest agent’s report and dependent evaluator errors arising from shared models, sources, prompts, or tools.The analysis treats model-level compromise as part of the declared environment and considers shared failures that exceed fault budgets or violate error assumptions.Source: C. Threat Model · p. 2

III. STAGE-INDEXED SECURITY AND ECONOMIC REQUIREMENTS

The paper assigns security and economic requirements to lifecycle stages and task classes, distinguishing core requirements from those activated by task features. It emphasizes that verification and settlement guarantees must support both sound rejection and feasible acceptance, with payment tied to validated task-bound evidence.

III. STAGE-INDEXED SECURITY AND ECONOMIC REQUIREMENTS

  • Table I assigns requirements by task class, with conditional requirements activated by features such as capability claims, confidentiality, or usage-based payment.Objective versus subjective acceptance and single- versus cross-domain settlement define four task classes.Source: §III · pp. 2–3, Table I · p. 3

S1 Discovery.

  • Discovery separates identity assurance from capability evidence: Sybil resistance bounds influence from added identities, while capability soundness links advertised performance to a reference task distribution.Capability soundness concerns provider selection, whereas receipt soundness concerns an individual deliverable.Source: S1 Discovery · p. 3

S2 Negotiation.

  • Negotiation requirements cover truthful reporting, participation utility, budget balance, coalition gains, and resistance to fact-equivalent messages changing reports.Persuasion robustness protects report generation before commitment.Source: S2 Negotiation · p. 3

S4 Verification.

  • Verification requires both a bound on accepting nonconforming work and a feasible, timely, affordable acceptance path for conforming work.Receipt soundness and receipt completeness are separate requirements; subjective soundness also depends on evaluator selection, incentives, and error.Source: S4 Verification · pp. 3–4

S5 Settlement.

  • Settlement must condition payment on validated, task-bound acceptance; recording a verdict or replaying deterministic steps alone does not establish soundness.Conditional atomicity additionally matches finalized acceptance, progress under delivery and finality bounds, and consistent expiry or refund rules.Source: S5 Settlement · p. 4
  • A task-specific requirement set changes with its features: resource-based payment activates metering integrity, cross-domain payment activates conditional atomicity, and benchmark-based provider selection activates capability soundness.The resulting set governs both mechanism assessment and the closure test.Source: S2 Negotiation · p. 3, S1 Discovery · p. 3, S5 Settlement · p. 4

IV. MECHANISMS AND PROVIDED GUARANTEES

The section maps lifecycle guarantees across systems and reusable mechanisms, then shows that support for a property depends on what the task requires and on the mechanism’s assumptions. Identity, negotiation, and market mechanisms address distinct risks, but their guarantees remain conditional and often narrower than the task-level requirement.

IV. MECHANISMS AND PROVIDED GUARANTEES

  • The assessment covers 12 systems and standards, five reusable mechanism families, and four classical baselines, with support judged under stated assumptions and compatible interfaces.Full support meets the criterion under stated cryptographic and base-ledger primitives; restricted support may suffice only under additional trust, resource, or timing conditions.Source: §IV · p. 4
  • AP2, x402, and MPP authorize payment but do not establish work conformance, while ACP and ERC-8183 lack an established bounded alternative when an evaluator refuses.A ZK proof may establish soundness for a specified relation without providing the complete decision history needed for evidence verifiability.Source: §IV · p. 4

A. Identity, Attestation, and Reputation

  • Identity binding alone does not limit influence from additional identities; Kleros aggregates selection weight by stake, while Bittensor restricts support to its admitted validator set.Source: A. Identity, Attestation, and Reputation · p. 4
  • Capability evidence must bind evaluation to the serving configuration, including claimed performance, complete configuration, and validity interval, for full P2 support.The cited attestation and weight-commitment approaches support related bindings under their stated assumptions.Source: A. Identity, Attestation, and Reputation · p. 4
  • Reputation evidence may not bind feedback to completed work, and statistical reliability estimates may not bind to the serving configuration; rating correctness remains a separate obligation.ERC-8004 offers restricted support for feedback, FIRE relies on honest reporting, and TRAVOS estimates reliability under stationary behavior.Source: A. Identity, Attestation, and Reputation · p. 5

B. Negotiation and Market Mechanisms

  • Payment authorization and signatures bind agreed terms but do not establish control over report generation; persuasive listings can alter reports before commitment.Classical LDS and VCG results offer stronger incentive guarantees only under specified economic assumptions, and the cited restricted P7 results do not extend to collusion among distinct participants without an additional coalition bound.Source: B. Negotiation and Market Mechanisms · p. 5
  • Bittensor bounds honest stake’s retained reward share under stated conditions, but does not establish truthful reporting as optimal or bound coalition utility; authorization controls alone do not bound coordinated deviation.P7 requires a coalition-utility bound, whereas P8 requires control of report generation before authorization.Source: B. Negotiation and Market Mechanisms · pp. 5–6

C. Verifiable Execution

Verifiable execution, settlement, dispute resolution, and governance each require task-bound evidence and compatible assumptions. Guarantee closure tests whether required guarantees are established and preserved through the decisions that depend on them, distinguishing missing guarantees from discarded evidence and unsupported bounds.

C. Verifiable Execution

  • A proof or attestation supports soundness only for its stated relation or measured configuration; proof cost, availability, and challenge windows also constrain whether conforming providers can obtain acceptance in time and within cost bounds.Settlement must validate the acceptance claim, its task binding, and supporting assumptions.Source: C. Verifiable Execution · p. 6
  • Execution proofs and configuration attestations do not establish task-bound resource consumption, leaving P11 unsupported for the assessed sources.Usage-based payment needs separate evidence binding measured consumption to the task and interval.Source: C. Verifiable Execution · p. 6
  • For subjective work, ACP and ERC-8183 depend on evaluator judgment for soundness, while ERC-8183 providers also depend on an evaluator response to obtain acceptance and payment before expiry.Source: C. Verifiable Execution · p. 6

D. Settlement and Cross-Domain Coordination

  • Escrow can execute correctly yet pay against a condition that does not establish task acceptance; cross-domain settlement must bind finalized acceptance of the same task and result to payment.P12 also requires coordinated expiry and refund conditions.Source: D. Settlement and Cross-Domain… · p. 6

E. Dispute Resolution and Governance

  • Dispute resolution needs attribution and evidence about the decision; reconstructing it requires integrity-protected inputs, procedure versions, and the evidence used to reach the outcome.Governance strength also depends on stake concentration, arbitration thresholds, appeal rules, and final authority.Source: E. Dispute Resolution and Governance · p. 6

V. END-TO-END GUARANTEE CLOSURE

  • Guarantee closure requires every task-active property to be established and preserved across dependent decisions, under task-specific thresholds, assumptions, evidence, validity intervals, and bounds.A dependent decision must consume the corresponding guarantee or revalidate equivalent evidence.Source: §V · p. 7
  • An absent source guarantee or recovery path is a hole, while a decision that ignores adequate existing evidence is a break; an unavailable sole evaluator creates a P9b hole.Closure assessment fixes task predicates, thresholds, histories, and dependencies before assessing mechanisms.Source: §V · p. 7

A. Closure on a Reference Task

The reference task establishes closure under explicit acceptance, cost, timing, and record assumptions. Evaluation finds recurring baseline gaps and shows that targeted repairs do not establish closure across all assessed properties.

A. Closure on a Reference Task

  • The reference sorting task prefunds 10 units, bounds provider cost at 10, and requires a verifier to accept by time 12 and payment to complete by time 16.The stated execution and delivery conditions support P5, P6, P9a, P9b, P13, P15, and P16.Source: A. Closure on a Reference Task · p. 7

B. Closure Evaluation.

  • Matched tasks, predicates, and schedules compare policies across eight configurations, 15 conditions, and seven policies, yielding 840 executions.Subjective simulations vary verdicts against fixed conformance labels; native tests run x402 and ERC-8183 implementations on local EVMs.Source: B. Closure Evaluation · pp. 7–8

C. Closure Findings

  • Baseline outcomes include P9a breaks when valid acceptance evidence does not control settlement, P9b holes when evaluators may remain silent, and cross-domain P12 holes when adapters check funds rather than task acceptance.Every configuration also has a P16 evidence-schema hole; subjective configurations additionally leave P2, P7, and P9a unestablished.Source: C. Closure Findings · p. 8, Table IV · p. 8
  • Across 68 property assessments, 16 were preserved, 40 remained unestablished, and 12 had holes; all 11,648 finite-input cases retained each fixed configuration’s outcome pattern.The twelve holes comprise eight P13 holes and four subjective P9b holes.Source: C. Closure Findings · p. 8
  • C and A prevent the same nine unbound payments per objective cross-domain configuration, but V misses five of eleven conforming objective cases and E alone does not establish closure.V makes acceptance recoverable after silence or contestable rejection; E makes intact decision records replayable, while altered records need a recovery path.Source: C. Closure Findings · p. 8
  • Recovery must cover every unusable receipt, including an approval, while provider retries and total retry cost must fit the task budget for P9b.For delivery delay d, the schedule requires r + d ≤12 and r + d + 1 ≤16; admitting d = 10 requires recovery by r = 2.Source: C. Closure Findings · p. 8

D. Native Workflow Evaluation

Native workflow tests show that correct verification, task binding, and access to acceptance are distinct requirements. Deployment evidence also shows that recorded approvals and usable evaluator decisions do not by themselves establish task conformance.

D. Native Workflow Evaluation

  • In x402 tests, settlement races left completed service requests unpaid, while upfront payment prevented unpaid effects but could leave payment without successful service delivery.A payer-signed request commitment prevented substitution between equally priced resources.Source: D. Native Workflow Evaluation · p. 8
  • Before expiry, address-controlled evaluation paid all 12 nonconforming submissions and eight of 16 conforming ones; objective validation prevented all 12 invalid payments, and provider invocation enabled payment for all 16 conforming submissions.These results hold under the tested balances, local transaction inclusion, and pre-expiry scheduling.Source: Table V · p. 8, D. Native Workflow Evaluation · p. 9
  • After normalization, address-controlled approval paid all 64 altered-input cases and all 64 replaced-digest cases, while callable objective verification rejected both groups and paid 64 conforming outputs during operator silence.The same answers were reused across two interfaces, four conditions, and two acceptance policies.Source: D. Native Workflow Evaluation · p. 9

VI. DEPLOYMENT EVIDENCE AND EVALUATOR DECISIONS

  • Of 219 parsed public feedback documents, none supplied a searched task/job identifier; commitments verified retrieved content, not its claims, and local registries accepted seven records with missing or inconsistent external links.An application-level check accepted only the consistent linkage case.Source: §VI · p. 9
  • The helpfulness cutoff of three is an operational reference for a balanced five-stratum sample; a contractual P9a assessment additionally needs a task acceptance predicate and adjudication of reference uncertainty.Source: §VI · p. 9
  • Across 3,840 settlements, normalization shifted 91 expiry refunds into 67 payments and 24 explicit refunds; the added payments included 27 reference-eligible and 40 below-reference answers.Figure 2(d) shows these settlement changes.Source: Figure 2 · p. 10, §VI · pp. 10–11
  • Adding Ministral changed below-reference approvals from 17 to 13 under unanimity but from 17 to 34 under strict majority, while unanimity also increased eligible withholdings and unavailable decisions.The primary unanimity pair retained 17 of Qwen’s 19 below-reference approvals; the other two lacked a usable Gemma vote.Source: §VI · p. 10
  • ERC-8183 can record the same deliverable reference and approval for conforming or nonconforming content, so transcript fields alone cannot distinguish those outcomes.A content-addressed proof checked against a declared predicate rules out that construction for that predicate.Source: §VI · p. 11

VII. ECONOMIC GUARANTEE ANALYSIS

Economic guarantees depend on how reports are formed, whether evaluator misconduct is deterred, and how evaluator errors are related. Under explicit assumptions, the analysis derives bounds while identifying limits that collateral alone cannot overcome.

A. Report Formation and Incentives

  • The report model bounds deviations from truthful values by δ, while treating the bound and reachable shifts as assumptions; truthful auction-game reporting remains dominant.Generative extractable value measures the increase in maximal expected gross value over an honest, fact-only baseline; the common-shift example gives total GEV ≥δ, but does not alone bound the marginal message increment.Source: A. Report Formation and Incentives · p. 11
  • A second-price auction without reserves, report caps, or withdrawal has welfare loss at most 2δ; a reachable common upward shift of δ leaves allocation unchanged and raises revenue by δ.The construction can violate ex-post individual rationality when the price increase exceeds the winner’s value advantage.Source: A. Report Formation and Incentives · p. 11
  • A sufficient P8 condition derives reports from a private value fixed independently of the message and canonical attested context shared by fact-equivalent messages.The condition prevents message-induced shifts but requires a validated mapping to the same context; truthful policy choice remains a separate incentive claim.Source: A. Report Formation and Incentives · p. 11

B. Evaluator Incentives and Shared Errors

  • For purchased-seat attacks, expected cost is at least tqb times the probability of wrongful release; b > g/(tq) deters direct attacks with gain g under the stated assumptions.The bound assumes separately committed job bonds and enforced net loss with probability q, among other restrictions; positive q may be hard to substantiate for subjective tasks, and participation and budget conditions must also hold.Source: B. Evaluator Incentives and Shared… · p. 11
  • With equal marginal evaluator error e and pairwise correlation ρ, the stated majority-error bound is an upper bound, while a constructed committee has error at least ρe for every n.The bound counts ties as errors and assumes the declared task/attack distribution; for P9a, e and ρ must hold conditional on nonconforming work.Source: B. Evaluator Incentives and Shared… · pp. 11–12
  • Collateral alone cannot certify a pure-channel attack cost above Cerr; mixed attacks require a joint model, and economic guarantees must state report, misconduct-evidence, and error-distribution assumptions.The pure-channel cost is bounded using the minimum of direct purchased-seat and induced-error attack costs.Source: B. Evaluator Incentives and Shared… · p. 12

VIII. A GAP-DERIVED RESEARCH AGENDA

The research agenda translates guarantee-closure failures into missing guarantees and enabling interfaces. It emphasizes that evidence, assumptions, and downstream checks must remain linked across task stages.

VIII. A GAP-DERIVED RESEARCH AGENDA

  • The agenda derives missing guarantees and enabling interfaces from identified closure failures.It focuses on capability attestation, persuasion-robust interfaces, receipt-consuming settlement, and evaluator markets with explicit evidence, incentive, and error assumptions.Source: §VIII · p. 12

A. Holes and Missing Guarantees

  • Capability evidence should bind serving identity and full agent configuration to performance on a declared task class; market interfaces should exclude irrelevant persuasive content while retaining decision-relevant information.Capability attestation still faces gaps in statistical confidence, tools and memory beyond model weights, and validity under changing workloads; persuasion bounds should be assessed for the deployed model and interface.Source: A. Holes and Missing Guarantees · p. 12
  • Cross-domain conditional atomicity must preserve the specified acceptance predicate, authentication, finality, expiry, and refunds; measured-program coupling alone does not establish subjective task conformance.Receipt-consuming settlement can repair the payment-first break for objective single-domain tasks when adequate verification is available, by checking task-bound evidence.Source: A. Holes and Missing Guarantees · p. 12, B. Interfaces and Enabling Mechanisms · p. 12

B. Interfaces and Enabling Mechanisms

  • A common machine-checkable evidence object should bind task, deliverable digest, procedure, receipt, and evaluator decision; evaluator markets need capture-cost, enforceable-penalty, and shared-error assumptions.Job-specific misconduct evidence is needed before a penalty probability supports an incentive bound; acceptance paths also matter, since penalizing approval but not rejection may favor conservative refusal.Source: B. Interfaces and Enabling Mechanisms · p. 12

IX. RELATED WORK

  • Guarantee closure adds a task-relative test of whether required guarantees and their evidence bindings, assumptions, validity conditions, and consumer checks persist to dependent decisions.Related work examines lifecycle consistency, payment security, evaluator failures, and task/payment linkage; this analysis relates them to task-specific obligations, evidence consumption, and repair locations.Source: §IX · p. 12

X. CONCLUSION

  • The conclusion is that correct protocol execution can still pay for nonconforming work or leave conforming work unpaid, while recorded approval alone does not establish conformance.Economic guarantees depend on report formation, enforceable penalties, and evaluator error dependence; secure agentic commerce requires guarantees to constrain dependent downstream decisions.Source: §X · pp. 12–13

APPENDIX A FORMAL PROPERTY DEFINITIONS

The appendix formalizes properties by specifying what each guarantee establishes, the evidence it requires, and the assumptions and bounds under which it holds. It distinguishes sound evidence from a viable route to acceptance and payment.

APPENDIX A FORMAL PROPERTY DEFINITIONS

  • Property definitions fix each guarantee’s evidence, assumptions, and bounds; λ is the security parameter and negl(λ) denotes a negligible function.PPT means probabilistic polynomial time.Source: Appendix A · p. 16

A. S1 Discovery

  • P2 binds an advertised capability to statistical performance of a serving configuration over a fixed validity interval and reference distribution.Soundness bounds the probability of accepting performance below θ−η by β plus a negligible term, assuming the serving configuration and reference law remain stable; requests must also be tied to the measured configuration.Source: A. S1 Discovery · p. 16

B. S2 Negotiation

  • P7 bounds coalition gain only for the declared coalition size, utility model, and admissible strategy class; it does not by itself cover induced-error attacks.P8 requires reports or decisions to be invariant across messages with the same task-relevant facts, though baseline strategic shading may remain.Source: B. S2 Negotiation · p. 16

C. S4 Verification

  • P9a requires accepted evidence to support task conformance, with cryptographic, statistical, or economic claims specifying their strategy, trust, and evidence assumptions.P9b separately requires a permitted honest-provider strategy to obtain task-bound acceptance within time and cost bounds against every admitted adversary.Source: C. S4 Verification · p. 16

D. S5 Settlement

  • P12 keeps cross-domain payment conditional on finalized acceptance of the same task, while excluding duplicate release and conflicting terminal outcomes.P13 requires the selected workflow to reach its specified completion outcome within the horizon under declared delivery, finality, and service assumptions; acceptance acquisition, receipt delivery, and payment are measured separately.Source: D. S5 Settlement · p. 16
  • The appendix identifies Table VI as covering verification conditions for P9a and P9b, and distinguishes partial-result payment from a terminal client refund.P9a concerns receipt soundness and P9b receipt completeness: acceptance must match the task predicate, and an honest provider must obtain it within stated time and cost bounds.Source: Table VI · p. 17, D. S5 Settlement · p. 17

E. Aggregation of Closure Bounds

  • Closure combines bad-event probability bounds with a union bound, permitting dependent events when each bound is justified; time and economic guarantees are checked in their own units.Adaptive calls require bounds conditional on admissible preceding histories.Source: E. Aggregation of Closure Bounds · p. 17

APPENDIX B CORPUS CONSTRUCTION AND SCORING

The appendix sets corpus and scoring rules, reviews mechanisms and related analyses, then specifies a controlled evaluation of guarantee closure. Its reference task and schedule make acceptance, evidence delivery, and payment distinct obligations.

A. Corpus and Scoring Rules

  • Corpus ratings retain their assessment unit, evidence source, and assumptions; the study purposively selects version-specific public designs available by 31 August 2026 and excludes wallet-only rails and closed platforms without an exposed lifecycle stage.The property set was derived from distinct security or economic losses across six lifecycle stages and draws on DeFi, MEV, multi-agent systems, and agent-security sources.Source: Appendix B · p. 17, A. Corpus and Scoring Rules · p. 17
  • P9a ratings ask whether approval or payment evidence establishes conformance, while P9b ratings require an identified provider acceptance route and its controller, time, and resource conditions.A submission interface alone gives no availability guarantee if an exclusive evaluator can withhold a decision; payment authorization is not an acceptance service.Source: A. Corpus and Scoring Rules · p. 17

B. Evidence Basis for the Mechanism Matrix

  • Cross-domain settlement mechanisms have distinct trust and timing assumptions, and P12 requires payment conditions to bind finalized acceptance of the same task and result.The mechanism review also distinguishes authenticated identity and feedback provenance from substantive correctness, which remains a separate P9a question requiring task evidence.Source: B. Evidence Basis for the Mechanism… · p. 17

C. Literature Crosswalk

  • Classical mechanism results are restricted: false-name-proof auctions and faithful implementation offer narrow P7 support for one economic participant, while computational trust bounds controlled aliases only under stated assumptions.The appendix also distinguishes explicit substantive analysis from limited or absent coverage, and warns that its coverage table is not a security ranking.Source: B. Evidence Basis for the Mechanism… · p. 17, C. Literature Crosswalk · pp. 17–18

APPENDIX C CONTROLLED EVALUATION OF GUARANTEE CLOSURE

  • The controlled evaluation separates whether acceptance is established, whether payment consumes it, and whether a conforming provider can still obtain it.The objective reference pays 10 units for sorting a committed array and assumes authenticated delivery and settlement within the time-16 deadline; required dependencies include P9a, P9b, and P13.Source: Appendix C · p. 18

A. Reference-Task Obligations

  • Reference-task obligations add P2 for subjective configurations and P12 for cross-domain configurations; objective conformance checks preserve array length and element multiplicities as well as order.Subjective tasks assign fixed conformance labels separately from evaluator verdicts, isolating how inaccurate verdicts affect settlement.Source: A. Reference-Task Obligations · p. 18, B. Tasks and Schedule · p. 18

B. Tasks and Schedule

  • In logical steps, escrow receives 10 units at time 0, provider submits at time 1, and evaluator returns a verdict or remains silent at time 2; objective approval requires fixed-verifier success.A complete source receipt reaches settlement at 2 + d, and payment is attempted at 3 + d. Delay d includes transport and scheduling, defaults to zero, and is bounded by 10; payment is due by time 16.Source: B. Tasks and Schedule · pp. 18–19

C. Perturbations and Repair Policies

The repair policies address distinct receipt, acceptance, and replay dependencies, but substantial closure gaps remain. Sensitivity, finite-input, and registry checks identify limits on what those results establish.

C. Perturbations and Repair Policies

  • C validates the complete receipt at payment, A validates it before task-bound authorization, V recovers after selected verdict failures, and E retains decision inputs for replay.V does not invoke on every failed acceptance check, so some unusable receipts still leave conforming work unpaid.Source: C. Perturbations and Repair Policies · pp. 19–20

D. Measurements and Eligible Cases

  • Failure counts require both an observed event and eligibility under the relevant premises; missing finality and permanent partition are excluded from admitted progress cases.The five receipt conditions retain the provider’s conforming original submission while varying task, output, predicate, authentication, or validity.Source: D. Measurements and Eligible Cases · p. 20

E. Repair Outcomes and Remaining Evidence

  • Objective fallback reduces receipt misses from 7/11 to 5/11; combined repair misses deadlines in 5/11 objective and 7/11 subjective cases, while E replays 12/13 admitted conditions.The altered evidence bundle is detected and rejected, but a guaranteed authenticated recovery path remains unestablished.Source: E. Repair Outcomes and Remaining… · p. 20

F. Sensitivity of Closure

  • Removing verifier soundness leaves P9a unestablished, while removing finality or the delivery bound leaves P12 unestablished; baseline verification-first cases also miss seven deadlines.Objective repaired configurations still lack P9b until an acceptance strategy is justified over admitted histories with compatible response and resource bounds.Source: F. Sensitivity of Closure · p. 20

G. Delivery Boundaries, Finite Inputs, and Stress Conditions

  • Across 11,648 finite-input executions, outcomes remain unchanged across sorting inputs, and combined repair pays conforming outputs while refusing nonconforming ones.Permanent partition prevents destination delivery and payment despite timely source acceptance; missing finality prevents timely source acceptance, and both conditions eventually refund.Source: G. Delivery Boundaries, Finite Inputs,… · p. 20

A. Registry Acceptance and Application-Level Task Binding

  • The unmodified ERC-8004 registries accept all eight tested task-payment linkage submissions, including seven that alter or omit at least one required link.The 36 test cases cover identity authorization, reputation, validation, and task-payment linkage.Source: A. Registry Acceptance and… · p. 20

B. x402 Payment Order and Service Delivery

The native evaluations examine payment ordering, escrow acceptance and deadlines, agent submissions, public feedback records, and evaluator decisions. Their findings distinguish payment linkage and recorded approval from evidence of task conformance.

B. x402 Payment Order and Service Delivery

  • The x402 evaluation compares default payment, upfront payment, and upfront payment with a payer-signed request commitment from identical chain and application states.Eleven conditions test payment and service behaviors; transfer, application effect, and response delivery are observed separately.Source: B. x402 Payment Order and Service… · pp. 20–21, Table IX · p. 21

C. ERC-8183 Acceptance Correctness and Availability

  • ERC-8183 tests compare address-controlled, operator-only objective, and provider-callable objective evaluation using committed document hashes recomputed on the EVM.The tested escrow holds 106 base units of a local token, with zero platform and evaluator fees.Source: C. ERC-8183 Acceptance Correctness and… · p. 21

D. ERC-8183 Deadlines and Verification Cost

  • None of the twelve late cases per evaluator extension receives payment, and objective invocation costs 247,870 to 1,702,640 gas under Prague EVM rules.A bounded-cost P9b contract must also compare total provider expenditure with the task budget and justify inclusion before expiry.Source: D. ERC-8183 Deadlines and Verification… · p. 21

E. Agent Execution, Task Binding, and Settlement

  • The agent experiment runs eight document-hashing tasks per model, then replays captured answers while varying task evidence or the acceptance path.Seven models are listed, with 64 agent attempts; normalization requires one structured 64-digit hexadecimal digest submission.Source: E. Agent Execution, Task Binding, and… · p. 21

A. ERC-8004 Feedback Integrity and Task Binding

  • Among 219 parsed ERC-8004 feedback documents, all five checked task-identifier locations are empty, and both payment-linked documents lack output commitments.Of 223 referenced entries, 219 were parsed; 198 retrieved contents match commitments, including 41 after declared gzip decompression.Source: A. ERC-8004 Feedback Integrity and… · p. 21

B. Evaluator Agreement and Decision Availability

  • All 96 repeated local evaluator pairs agree, while hosted-model agreement ranges from 7/12 to 12/12.Strict and normalized interfaces parse the same 1,680 first responses; primary comparisons use those original responses.Source: B. Evaluator Agreement and Decision… · p. 22

C. Committee Composition and Voting Rules

The analysis examines evaluator committees and adversarial influence over reports, including the economic value of expanded control over transaction, message, and context channels. It also gives conditions for bounding report distortion and restoring content-independent bidding.

C. Committee Composition and Voting Rules

  • Normalized strict-majority committees have median below-reference approval counts of 44–45 out of 72, while seven-member committees range from 42 to 50.The 624 configurations reuse the same 120 requests and local models, so the distributions measure sensitivity to committee membership within that collection.Source: C. Committee Composition and Voting… · p. 22

A. Persuadable Report Model

  • The persuadable-report model bounds message-induced report changes by δ while holding task-relevant facts fixed and measuring changes against a reference report.For general policies, strategic reporting already present in the reference report is distinguished from the message-induced change.Source: A. Persuadable Report Model · p. 22

B. Generative Extractable Value

  • GEV compares expected gross value across nested strategy classes that add transaction ordering, message control, and counterparty context control to an honest-participation baseline.The transaction-ordering increment corresponds to additional value obtained through ordering, as studied in MEV,.Source: B. Generative Extractable Value · pp. 22–23

C. Incentive Compatibility Under Persuadable Bidders

  • With bounded report shifts, second-price-auction welfare loss can approach 2δ, while a common shift lets a seller-affiliated adversary extract δ without changing allocation.Content-minimized, committed bidding removes message-induced changes while allowing baseline strategic shading; truthful bidding remains weakly optimal under the stated private-value model,.Source: C. Incentive Compatibility Under… · p. 23

D. Collusion Cost of Bonded Evaluator Committees

The analysis derives corruption-cost conditions for bonded evaluator committees and shows that correlated errors impose a floor on majority soundness. The resulting guarantees depend on penalty enforcement and the specified error-dependence model.

D. Collusion Cost of Bonded Evaluator Committees

  • For a bonded random committee, b > g/(tq) makes positive-success bribed or adversary-owned-seat attacks unprofitable under the stated penalty assumptions.A single unbonded evaluator’s corruption cost need not scale with escrow value p; for new identities its modeled exposure r can approach zero.Source: D. Collusion Cost of Bonded Evaluator… · p. 24

E. The Correlation Floor on Committee Soundness

  • With marginal error e and pairwise correlation ρ, majority-error probability can remain at least ρe for every committee size, so size alone cannot certify a lower bound.The correlation-aware upper bound approaches a nonzero limit when ρ > 0; increasing bonds alone cannot bound pure-channel attack cost above the induced-error channel’s cost, and mixed attacks require a joint model.Source: E. The Correlation Floor on Committee… · p. 24
Loading 2610.01756v1…