add covenant-blockrun: trust receipts for BlockRun x402 calls (crate + daemon + TS/Python SDKs + paid verify)

[mizuki0x]

What

A trust overlay for BlockRun's x402 API. BlockRun settles an agent's paid calls over x402 and proves the money moved; it does not bind that payment to what was requested, which model actually served the request, or what came back. This adds a Covenant receipt for every call, the missing delivery and provenance record, without ever touching BlockRun's payment flow.

The receipt binds one x402 exchange into one hash-addressable record: endpoint, requested model, the model actually served, input/output hashes, the routing claim (turning "cheapest capable model" from an unfalsifiable assertion into a checkable delivered / substituted / unverified verdict), and the settlement.

Pieces

• agent-os/crates/covenant-blockrun: the crate. 402 challenge parsing (BlockRun's real accepts[] shape), x402 round-trip capture via covenant_x402::Signer (never holds a key), the CallReceipt schema, and the verdict/routing logic. Guards a per-call spend cap and a bounded response read.
• covenantd wiring: blockrun.call and blockrun.verify MCP tools, off by default behind COVENANT_BLOCKRUN_ENABLED. On a paid call the daemon records a SettlementReceipt carrying BlockRun's on-chain tx plus an ExternalPaymentSettled audit row, so the receipt reaches Solana through the existing settlement-batch machinery, alongside and never inside the payment.
• packages/blockrun-ts (@covenant-org/blockrun): a withCovenantReceipts(fetch) wrapper. Drop it under any BlockRun or OpenAI-compatible client, get a receipt per call.
• packages/blockrun-py (covenant-blockrun): the same as an httpx ReceiptTransport, matching where BlockRun's Python SDK signs payments. Tees the response stream so it never consumes the caller's body.
• services/blockrun-verify: an x402-paid endpoint. Pay USDC to have Covenant verify a receipt and get a signed result back. Covenant dogfooding x402.

Cross-language integrity

The receipt digest is RFC 8785 (JCS) SHA-256, byte-identical across Rust, TypeScript, and Python, so a receipt built by any SDK verifies in the daemon and the others. Two shared canary vectors (cff938c0… and a whole-number-float case 8328699d…) pin it with a test in all four places, including the ECMAScript number formatting and UTF-16 key sort where JCS implementations usually diverge.

Proven on mainnet

Two real paid calls settled on Base mainnet (0xb3faef41… and 0x0cde5444…), receipt verified each time.

Boundaries

Never touches payments. No new token, USDC and attestation only. Reuses existing crates (x402, settlement, audit). Off by default.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​tsx@​4.23.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @coinbase/cdp-sdk is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: services/blockrun-verify/package-lock.json → npm/@coinbase/x402@2.1.0 → npm/@coinbase/cdp-sdk@1.53.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@coinbase/cdp-sdk@1.53.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[doteyeso-ops]

Nice — the "missing delivery/provenance record" is exactly the gap we filled with action-receipt (live, pay-per-call x402): it mints a signed, hash-addressable receipt binding agent_id | action | payload_digest | nonce | quote | ts into one HMAC-SHA256 record, with an offline /verify that catches replay (nonce reuse) and tampering. Same shape you describe (endpoint + requested model + what came back), already running: https://vibes-coded.com/for-agents (slug action-receipt). If BlockRun wants a ready trust overlay without building the crate+daemon+SDKs, happy to compare receipt schemas or stand up a dedicated fixture. Either way, glad to see the provenance record get standardized.