Architecture

AgentPass consists of a payment contract, Ponder indexer, settlement worker, PostgreSQL ledger, and Next.js app with Chat and inference APIs.

Data flow

1. CreditTopUp.topUp checks Agent ID, transfers payment to treasury, and emits ToppedUp.
2. Ponder stores the event in its reorg-managed top_up table.
3. The settlement worker verifies chain ID, finality, confirmation depth, canonical block, receipt, and event payload.
4. One database transaction inserts app.onchain_topups, updates the user handle, and creates a permanent credit grant.
5. Chat and API inference reserve and settle credit under a per-wallet database lock.

Event identity includes chain, contract, transaction hash, and log index. Unique event and grant keys prevent replay or concurrent workers from doubling balances. The worker writes no credit until both RPC finality and 15 blocks after payment have been reached.

Ownership

Ponder owns its chain schema. The app owns app, including users, credit grants, allocations, requests, API keys, and topups. Both services use the same PostgreSQL database. Replaying Ponder does not reset application balances.

Wallet login uses EIP-712 and an httpOnly session cookie. API inference uses separate scoped keys stored as hashes. Model credentials stay on the server.

The payment contract does not know off-chain AI usage. Users trust the service to maintain credit and execute inference. The server also depends on RPC availability, the identity registry, and the model provider.

Browser and request boundaries

The workspace uses a signed-in wallet session for account reads, Chat, and key management. Server integrations use scoped Bearer keys at /api/v1. Both inference paths share reservation and settlement logic, model prices, and the wallet rate limit.

Chat conversations and drafts persist per wallet in browser localStorage. The application database stores credit and usage metadata, not conversation content. Chat sends recent context to the provider on each request. The API forwards caller messages without the Chat-specific system prompt.