Agentic reversibility: insure, reverse, and bet on agent commerce

In 2020, t3rn's whitepaper described one idea: execute, then commit or revert. Run each step of a cross-chain transaction against escrowed copies, defer every effect into a provable stamp, and settle with a single atomic decision that either releases everything or refunds everything. Up until the final commit, all of it is still reversible.

Six years later, that idea has a second life, and it's a bigger one. Autonomous agents now hire and pay each other on-chain — over a hundred million x402 payments, a live agent-commerce economy on Base. But none of their payment rails can do the one thing that makes commerce safe: hold money in suspense against work that is deferred and contestable, with real consequences for lying. That is exactly what reversible execution does. So we cut the mechanism to a kernel and shipped it as an SDK.

1The three attachments

Everything keys off one hash — the subject that identifies the thing being assured: a provider, a skill, a pool. Per subject, three one-call attachments:

Insure it. A refund pool and an underwriting book. Sellers bond a refund promise; anyone can back the book and earn the premium, taking claim risk. Backing a book is a bet that a provider's breach rate is below its premium rate — anyone can be the house.

Reverse it. Every call becomes an escrowed side effect: the buyer escrows the price, the executor bonds insurance, and a referee flips one bit — commit (pay the executor), revert (refund both sides), or slash (pay the wronged buyer the executor's bond). A timeout defaults to revert, so funds can never be stranded. With the shipped 10× bond, cheating is negative-expected-value for any referee catching more than one cheat in eleven.

Bet on it. A parimutuel market per provider per epoch: will this provider breach its SLA? The live price is the pool ratio, stakes adjust at face value until lock, and the same referee that settles the escrow resolves the market. The market price is a public breach-probability signal and the underwriter's hedge at once.

2The honest competitive map

We did the research before we wrote the code, and the finding is clear: no one ships post-settlement reversibility, bonded referees, and breach-betting as one layer. Every piece exists separately, and most are mature or maturing. So we compose rather than rebuild.

Escrow already exists — Virtuals' Agent Commerce Protocol has native escrow with auto-refund, ERC-8183 standardizes it, and third-party layers like x402r add pluggable-arbiter escrow on x402. What they lack is a bonded referee: ACP's evaluators don't stake, and ERC-8183 explicitly has no arbitration. A bonded, slashable referee that plugs into that evaluator slot is net-new and directly wanted.

Bonded referees already exist — UMA's optimistic oracle and reality.eth are exactly this, with configurable bonds and short liveness. They've just never been wired to an agent SLA. We wire them.

Betting infrastructure already exists — Gnosis conditional tokens let anyone mint a market with their own resolver, permissionlessly. Nobody has pointed it at provider breach. We do.

The differentiator isn't any one slice — it's the composition: reversibility with a price, on rails that already work.

3Case study — attested, but not settled

Phala Network is the sharpest illustration of the gap. Their 2026 stack attests confidential compute end to end: dstack confidential containers emitting hardware attestation quotes, GPU TEE inference with signed receipts, an ERC-8004 TEE agent that posts its attestation on-chain, and an on-chain DCAP verifier that turns a raw TEE quote into a verified measurement any contract can read.

That answers what code ran — provably. What it does not answer is what happens to the money if that code lied anyway. Nothing in the stack wires an attestation result into a settlement release or a refund decision. The ERC-8004 validation registry can record an attestation-backed score, and the standard even names "TEE oracles" as a validation method — but incentives and slashing are explicitly out of scope, and the settlement wiring simply isn't there.

That is precisely the seam the assurance layer fills. A TEE referee consumes a verified attestation as a settlement input: if the attested build produced the delivered output, commit; if it didn't, slash. Attestation proves the code; the enclave proves the consequence. Attested plus assured is the complete trust story neither half tells alone — and it's a bundle, not a competitor.

4Download it

The whole stack is dev-first and download-ready: ownerless contracts, the assured() x402 middleware that adds assurance to any skill with zero change to the buyer's client, the pricing math, and the settlement handler. Point it at the public reference deployment and try the full flow without deploying anything of your own.

npm install @t3rn/assurance ethers

The litepaper has the full lifecycle, the mathematics, and the live on-chain record. The assurance page has the live market. This is the ending t3rn's original idea deserved: not archived, but settling the economy that finally needs it.

The names changed. The guarantees didn't.