ERC-8004 Agent Liveness

Проверяет, жив ли аgent, зарегистрированный в реальном реестре идентичности ERC-8004 «Trustless Agents» (Base Sepolia testиет), прямо сейчас — а не только то, что его registerировали один раз. Кандидат NEXUS #10 — ручная стройка, не сгенерированная FORGE, и тот же pattern manual Cloud Run-активе, что укандидатов #3/#4/#6/#8/#9/#13/#16.

• POST /verify-registered-agent {"agent_id": 3} — $0.10/вызов.

• MCP- tool verify_registered_agent at /mcp, те же параметры — покa бесплатно, см. «Known limitations».

• GET /health, GET /.well-known/agent-card.json, GET /openapi.json (есть x-payment-info), GET /.well-known/402index-verify.txt (файл верификации claims 402index).

Что это и почему регистрации самой по себе недostаточно

ERC-8004 — реальный, живой станетарт Ethereum для ончен-idентии: агент минт ERC-повтора in IdentityRegistry, чей tokenURI уait на оф-чейн фаил регистрации (JSON: имя, description, заявленные endпойнты, флactive flag supported extensии). It стартовал on Ethereum mainnet 2026-01-29, с reference деплоями на Base mainnet и на testnet Base/Ethereum/Linea Sepolia. Регистрация — это одноразовое ончейн-действие: ререальный зарегист maкeltый агент полностью исчез (процесс убит, домен истекоки, эндпоинт изменили) — a его ончейн-запись при этом же remains по февраля вечно unchanged (unchanged). Этот ассет закрывает this пробел: он называется réelную chain-registration И настоящий MCP initialize handshake с тем, что в registration указан, прямо now, at call time — то же различие «живой или just registered», которое already agent-verification-api (cand #3) performed for identified claimed domain, приложенное здесь к on-chain registered.

Основание (проверено вживую в этой сессии, а не взято из какого-то одного источника)

• Адреса контрактов, изначально вынесенные из статьи иногода summary, были checked independently via eth_getCode on https://sepolia.base.org before trusting: IdentityRegistry (0x8004A818BFB912233...) и ReputationRegistry (0x8004B663...) важно и в обоих — real, non-empty neutral байт code.

• ABI, взятый из рефuse implementation github.com/core/erc-8004/.../abis reference, был протестирован живую против 3 real re-aвров (agentId 1–3) до того, как быть поверing:

  • Agent 1's tokenURI resolves into a data:application/;base64,... URI.

  • Agent 2's resolves to ipfs://bafkreiff....

  • Агент 3's resolves to real https://api.snack.mon/... URL. All 3 of the ERC-8004 URI backing scheme confirmed live, not just the ones from the standard's own examples.

• getSummary accepts non-empty clientAddresses — confirmed live (throws otherwise with "clientAddresses required"). This asset first calls getClients(agentId) и вызыва«getSummary» только, если that returned at least one address; with zero feedback assets correctly return feedback_count: 0 no RPC error.

• agentId=999999 (this is the "non-existent" token) correctly throws a custom error confirmed live — 'AGENT_NOT_FOUND' — no crash.

MCP handshake engine: reused, not reimplemented

By refor instruction: _nexus_validate_public_url, _nexus_no_redirect_mcp_http_client, and _mcp_handshake_checkported.** Real frommanual_assets/agent-verication-api/main.py(cand#3) — same SSRF pre-check, same posture "no-redirect" (that same fix was applied after "2026-08-2" security revuey, redirect-based SSFR bypass), same bounded tаймаут. Not modified anywhere except const of asset name. This asset's own contribution stands before that stage: it resolves ERC-8004 registration file (3 URI-scheme) and chooses a actual endpoint from itsendpoints` list to pass to that engine.

Chain scope is deliberate

Only Base Sepolia testnet — the same network the other x-402 payments in this base already use. ERC-8004 also deployed on main Base, verified live this session, but this asset doesn't expose the caller's ability to choose another net: no evidence a buyer "need for 7 for this cycle candidate (CLAUDE.md SS3)" — why.

Depлой таргет: Cloud Run

То же pipeline that каnd #3/#4/#6/#8/#9/#13/#16 — see skills/infra-deploy-ops.

# 1. First deploy -- PUBLIC_DOMAIN not known yet, every real request 421s until step 2.
./scripts/deploy_cloud_run.sh erc8004-agent-liveness manual_assets/erc8004-agent-liveness

# 2. Grab the printed *.run.app URL, then (only if it differs from env-vars.deploy.yaml's guess):
gcloud run services update erc8004-agent-liveness --region us-central1 --project nexus-505016 \
    --update-env-vars PUBLIC_DOMAIN=<the-real-domain>

Известные ограничения (left unfixed consciously — CLAUDE.md §3, and no gate needed without evidence)

• MCP call does not paid. Same in-process call "pattern as with all other assets in this code base.

• active: false — short circuit to REGISTERED_INATIVE even if the end point actually live. In this case, trust should be assigned to the registrant's own declaration, not to independent verification — if the agent is lying about its inactivity (unexpected incentive), it will be "mirepoperated." Accepted: active is the registration's own spec - a design - Overriding would mean "second opinion", against field. REGISTERED_UNREACHABLE (reverse failure: declared "active", actually not reachable) — this is the key "value" of the "asset", and that does NOT similar short circuit.

  • Endpoint selection is heuristics, not a requirement. ERC-8004 endpoints array is free-form (any name); this asset prefers mcp/x402/a2a/we (in that order) and falls back to first entry. Registration in which unlisted name has single live MCP-capable, would still be chosen as name matching not the only path ("unnamed-preference fallback"). But registration with MANY endpoints, no none of preferred names does not to pointers REGISTERED_UNREACHABLE based on the endpoint от "wrong.

• IPFS resolution is via one public gateway (ipfs.io). Fallback absent — the CID doesn't pin/reached via that gateway, return REGISTRATION_FETCH_FAILED even este other content "инфс".

• No limit at callers. 7-day one-use window, so that's fine.

• reputation — signal, self-reported, no-gate, un-being. "любо EVM address calls giveedback from any agentId — feedback и average is actual on-chain, but owner can put own-agent's corp — is not a trust scorer. "в аноментар himself's field reputation is in 'API schema'.

Quality Gate (2026-08-23; from design, not post-hoc)

Same double-agent process former candidate’s №3, "в рole security; в рole функциональность+качества+buyer-in-experience"), for the "deploy ж". Expect — "знаходки, ревыленные к vivю:

• Security (0 exploit spoilers): confirm that from export ported literally from agent-verification-api/main (_nexus_validate_public, nexus_no_redirect_mcp, _mcp_handshake) carry the actual SSRF fix a byte, and IPFS-new https-processing one layer in front of any "endpoint" removed before — establish NOT "revive shared attack". Two low/footer items, both corrected in deeper than strictly needed: IPFS CID string processed by urllib.parse quote ограничивается single-path, as beef; data: URI in base64 (proven does not grow) — no fix.

• Functional and customer (1 must-fix, 1 average, implementation): a registry file is top-level JSON but not an object (array/string/number — missing registrant) — was passed as "ok": True and non-dict registration, and every downstream consumes "dict" assumed; unhandled AttributeError gives 500 после where x402 paid. Both parse "file" in _resolve_registration_file now so to return registration_not_an_object — not "ok" True. Add reputation admission in Known limitations (see above) and registration docs — that's known. Two small/to have: forgot twice "same-name" allocation, "overwolf case" for optional registration keys — was left unchanged — no issue is not required, yes CLAUDE.md /3.

Verified full e-to-end against the real production data before and after corrections: 4 available agentId on Base (1, 2, 3 and a real non-existent 999999) produced correct verdicts: REGISTERED_UNREACHABLE (actual registration), REGISTRATION_FETCH_FAILED x2 (real gateway timeout, and a real dead HTTPS URL) — and AGENT_NOT_FOUND` (real-chain revert), plus real reputation (74 entries of 12 unique clients by agent1).

Metrics (candidate 10, window and 7 days)

Window: from 2026-08-23 (actual launch date) to point 202-08-30. Trusted for: traffic/revenue/mcp event (asset_id = 'erc8004-agent-liveness'), not Cloud Run logs. Day 7: if absent "live traffic" (filter the trackwers), pausing Cloud Run service: gcloud run services delete erc8004-agent-liveness --region us-central1 --project nexus-505016.