Security, Privacy, and Trust Boundaries

The concrete guarantees and non-guarantees of the public Market Worker, private Verification Core, x402 settlement, and audit data.

Architecture boundary

The public Market Worker validates protocol input, creates conservative quotes, enforces idempotency and replay controls, verifies and settles x402 payments, and writes transaction accounting to D1. A separate Verification Core Worker is reachable only through a Cloudflare Service Binding. Only that private worker holds the Ed25519 signing secret.

Input controls

• JSON request bodies are size bounded and schema validated.
• Decoded evidence is limited to 65,536 bytes and must be JSON.
• Assertion count and operations are allowlisted.
• No URLs are fetched, no dynamic code is evaluated, and no model is invoked.
• Quote, MCP, and purchase paths have separate rate-limit bindings.
• MCP hostnames are allowlisted for production.

Economic controls

A quote is issued only when a conservative variable-cost upper bound leaves the configured minimum contribution margin. Runtime controls include a kill switch, quote expiry, fresh fee-basis requirement, reconciliation backlog reporting, and scheduled maintenance. A successful delivery creates one auditable revenue event and bounded cost events.

Cryptographic verification

Public verification keys are served at https://agent-economy.kgninja.dev/.well-known/jwks.json. Key identifiers are embedded in signed evidence. Callers should verify the canonical envelope and treat unknown, expired, or policy-incompatible keys as untrusted.

Privacy posture

The service does not retain raw evidence in D1. It stores digests and transaction metadata needed for replay protection, settlement reconciliation, and accounting. Public statistics are aggregate and omit payer and evidence content.

Explicit non-guarantees

The service does not authenticate the origin of caller-supplied JSON, prove a real-world claim, validate legal compliance, guarantee continuous availability, custody user funds, or authorize payments on the caller's behalf. Payment approval remains the calling agent's policy decision.