An AI agent can write code. It cannot get paid for it without a human approving the payment.
MergeGate settles that payment on a test the seller cannot touch. A buyer agent pins the acceptance criteria and funds USDC escrow before any work begins; a deterministic evaluator decides; escrow releases or refunds. No model is consulted at any point in the payment path.
All of it runs on Circle. Escrow is a Circle Agent Wallet under a spending policy the operator cannot widen, settlement executes as a circle wallet transfer on Base mainnet with Circle's relayers paying the gas, and the verifier is an x402 service that Circle's own CLI pays after verifying the ERC-1271 signature of a Circle Agent Wallet.
This submission's code was correct. It was refused anyway.
It fixed the bug and would have passed the buyer's tests. It also edited a file the contract protected, so the pinned commands never ran (0 executed) and escrow returned to the buyer. That is the difference between a control layer and CI wired to a transfer.
The same task, submitted without touching the protected file, released 0.25 USDC to the provider agent automatically. No human approved it.
Proposes
Drafts contract terms from a plain request, screens the diff for malicious code, explains failures, and plans a retry. It cannot change a verdict, move escrow, or enter a receipt.
Decides
Runs the buyer's pinned tests in a sealed Cloud Run job the provider cannot influence. The grader bundle is injected after the provider's diff, overwriting anything left there.
Settles
The buyer's pre-signed mandate is executed, not re-decided. Escrow is a Circle Agent Wallet under a policy the operator cannot widen, settlement is a circle wallet transfer, and Circle's relayers submit those legs so MergeGate pays no gas on them.
Circle is the substrate, not the rail. Remove it and there is no escrow to fund, no gas model, no agent-payable verifier and no settlement. The verifier is itself an x402 service that Circle's own CLI pays, verifying the ERC-1271 signature of a Circle Agent Wallet before the fee settles.
Intelligence informs; rules decide. That boundary is enforced by tests rather than by convention — the settlement is byte-identical for hostile model output, and a diff that successfully steers the screening still refunds correctly.
Grading happens inside a sealed Cloud Run job on a VPC with no Cloud NAT. The posture below was measured from inside that job, on the pinned image, and is written into the signed receipt.
Not a flat deny, and the reason is worth stating: a completely sealed job cannot mount the volume its inputs arrive on. One destination is allowed — Google's restricted API VIP — and the posture names it rather than rounding it off. DNS also still resolves. Both are disclosed here, in the constant, and on the receipt. See the probe →
- — Verified contract acceptance is not code quality. A PASS means the submission satisfied the buyer's pinned tests. It does not mean the code is good, secure, or mergeable.
- — Buyer griefing is unsolved. A provider can verify the tests cannot change, not that they are passable, because the contract publishes the grader hash rather than the bundle. Scope is trusted buyers and approved providers.
- — MergeGate holds escrow authority. This is programmable escrow with policy-bound settlement. It is not non-custodial and it is not trustless.
- — x402 carries the verifier fee, not the reward. The task reward is a plain USDC transfer through Circle agent wallets.
- — Gemini has been wrong here, publicly. It flagged our own honest submission for knowing the grader — over a comment that lives in the buyer's base tree and which the provider deleted — and scored that same wrong finding 40, then 10, then 25 out of 100 across three runs on equivalent input. That is the argument for keeping it out of the payment path.
In the browser
10 receipts, each re-verified on load rather than trusting a stored flag.
On your machine
mergegate verify receipt.json
Exit 0 verified, 1 failed, 2 could not check. Offline, no MergeGate access.
From your agent
MCP server, read-only by design. There is deliberately no funding tool.