One bit settles
the agent economy.

By 2026, autonomous agents discover each other, negotiate work, and pay each other on-chain. The payment rails they settled on split cleanly in two: atomic pay-per-call (x402 — instant, final, no dispute surface at all) and escrowed jobs (agent-commerce escrow — funds held, an evaluator decides release).

Neither can hold money in suspense against work that is deferred and contestable, with real consequences for lying. The atomic rail has no custody window by design. The escrow rail has no bonds and no slashing — and its evaluator defaults to the buyer judging its own purchase, a weakness the security literature now names as the central trust hole of agentic commerce.

The proposed fix in that literature — bonded referees with slashing — is precisely the mechanism this protocol shipped in its 2020 whitepaper. This addendum describes its port to the agent economy.

A side effect (SFX) is any deferred, contestable job — an API call, an intel report, a cross-chain fill, a month of hosted compute. Every SFX walks the same state machine inside a small per-chain contract, the SfxEnclave: OPEN (the buyer escrows the reward and names a referee) → FILLED (the executor bonds in and stamps a hash of the deliverable) → COMMITTED or REVERTED.

The referee flips one bit. Commit pays reward plus bond to the executor. Revert refunds both sides. Slash hands the dishonest executor's bond to the buyer — in the live deployment the bond is 10× the reward, so lying costs ten times the job. And if the referee never shows, anyone may unwind the SFX after its deadline: timeout defaults to revert, so funds can never be stranded, by construction.

The caller-facing interface is five functions: open, fill, finalize(Commit | Revert | Slash), timeoutRevert, and the state read. The whole three-phase economy — escrow custody, bond management, slash accounting, conservation of funds — sits behind them.

This is not a new design; it is the Circuit, cut to its kernel. The escrow accounts of the original paper are the SfxEnclave contracts. The Execution Stamp is the fill stamp — the executor's provable deliverable commitment. The insurance bonds of the execution agents are the executor bonds. The fisherman's slash is the Slash outcome. The Composable Execution Schedule is the XtxCoordinator.

That coordinator carries the composability guarantee verbatim: a cross-chain transaction is a set of SFX steps, each escrowed in some enclave with the coordinator named as referee. All steps commit together or unwind together. As the original paper put it — up upon the final Commit phase, all of the steps are still reversible.

The names changed; the guarantees didn't. This time the sentence is a deployment note, not a slogan.

The enclave takes its referee as a parameter per SFX — it enforces outcomes, it never decides them. That one seam carries four trust models on the same escrow: an off-chain evaluator agent signing a 65-byte verdict anyone can relay (the evaluator needs no gas, no wallet connection, no chain awareness); a delivery grade from an autonomous pipeline; a finality proof checked by a light client; or the coordinator itself, attesting a whole cross-chain schedule.

The first of these is the commercial edge: bonded evaluation. An agent-commerce job that today is judged by its own buyer can instead name a t3rn-bonded evaluator — a referee with slashable skin in the game. It is the exact fix the literature calls for, sold as a service.

Seven invariant tests pin the mechanism: conservation on every path, commit-requires-filled, forged-verdict rejection, atomic multi-enclave commit, and full unwind on expiry. The same cycles were then executed as real transactions on the deployment chain — a full commit cycle and a full slash cycle, funds conserved to the last unit.

The rollout is deliberately boring: identical small enclaves, one per chain. Devnet first, then testnet beside the existing agent-commerce contract suite, then mainnet after audit. Cross-chain logic never enters the enclave; it stays at the referee seam, where it belongs.

Three revenue surfaces, in the order they arrive. First, a protocol fee on commit — basis points on the reward at finalize, an order of magnitude under the ~20% take of incumbent agent-escrow release paths. Second, bonded evaluation as a service — verdicts priced per job, backed by slashable bonds, listed on the agent-skill marketplaces where buyers already are. Third, bond underwriting — staking evolves from emissions to insurance: stakers underwrite executor and evaluator bonds, earn a share of settlement fees, and carry the slash risk.

The fee model of the original paper held for six years: executors collect fees from requesters, the protocol takes a small ecosystem cut, capital providers earn yield from what they secure. The substrate changed twice. The model didn't.