Pin
One public GitHub repository, full commit, and explicit Agent Skill directory. No branches, tags, private sources, or uploads.
public evidence index · x402 live on Base mainnet
Evidence
before execution.
VouchSpec gives agents a signed record of what was checked for one exact Agent Skill version—before an install decision or connection.
Static evidence ≠ universal safety certification
capability-receipt.dsse.jsonCURRENT
artifactgithub.com/example/agent-skills
commit9f20a1…c773d4
pathskills/pdf-extract
DIGEST_PINNED
STATIC_INSPECTION_COMPLETED
INDEPENDENT_STATIC_SCAN
limitations / artifact content not executed; publisher identity not established
sha256: 01a8…44fcEd25519 ✓
25
exact skill versions
12
repository owners
DSSE
signed envelopes
Ed25519
public verification
No wallet required for this part
See the live machine contract right now.
terminal
curl https://vouchspec.plyrium.com/api/vouchspec/v1/discoveryReturns the exact price, network, request schema, and every machine-readable endpoint below — no account, no key, no payment.
The trust boundary
A receipt is a chain of claims, not a badge.
Each label names the evidence that actually exists. Failures remain visible and signed. “Verified” is never used as a shortcut for “safe.”
Constrain
The exact tree is size-bounded. Static inspection runs in a read-only, no-egress worker. Artifact scripts are not executed.
Sign
The receipt binds source coordinates, content digest, checks, limits, timestamp, and evidence labels into an Ed25519-signed DSSE envelope.
Verify
Your agent verifies exact bytes, the published key, and lifecycle status before using the evidence in an install policy.
API beta
Quote first.
Pay only for a fresh run.
An agent submits one immutable public source request and pays exactly $0.25 in USDC on Base mainnet through a single x402 negotiation. There is no human checkout path.
- Opaque bearer key stored only as a keyed digest
- Every quote, order, and payment bound to one tenant
- Order-specific delivery capability can rotate or revoke
- Durable x402 claims prevent replay and concurrent settlement
agent / x402 Base mainnet
No account page. No card form. No checkout session.
The buyer is an authenticated agent. The purchase is one HTTP 402 negotiation and an onchain USDC settlement.
- 01DiscoverPOST one immutable public source request to /api/vouchspec/v1/validate with no payment header. It returns the canonical x402 PAYMENT-REQUIRED challenge for exactly $0.25 in USDC.
- 02PayRetry the identical request with PAYMENT-SIGNATURE. Settlement is a single onchain USDC transfer on Base mainnet through the Coinbase facilitator.
- 03RetrieveThe response returns a one-time tenant key, delivery token, and order/result endpoints. Poll the result endpoint until the signed DSSE receipt is ready, then cache or share it and check its live status.
HTTP exchange
POST /api/vouchspec/v1/validate
Content-Type: application/json
{ "source": { "host": "github.com", ... }, "max_price": {...} }
HTTP/1.1 402 Payment Required
PAYMENT-REQUIRED: {base64_payment_requirements}
POST /api/vouchspec/v1/validate
Content-Type: application/json
PAYMENT-SIGNATURE: {agent_signed_payment}
{ "source": { "host": "github.com", ... }, "max_price": {...} }
HTTP/1.1 202 Accepted
PAYMENT-RESPONSE: {settlement_proof}Base mainnet is live: every settlement here is real USDC. A separate, free Base Sepolia sandbox exists at vouchspec-sandbox.plyrium.com for agents that want to prove the end-to-end mechanics before spending real funds.
Free path
Cache the receipt. Share it. Verify it yourself.
The public catalog, content-addressed receipts, lifecycle status, GitHub Action, verifier, schemas, keys, and methodology are open. Payment buys a fresh constrained run—not exclusive access to its evidence.