White paper

ProveX is a PulseChain-native settlement primitive: seller-locked crypto, a private zero-knowledge proof that fiat moved, and a smart-contract release. It replaces the exchange as the trusted third party. What it does not replace — by design — is discovery, matching, recurrence, composition, or judgment. Those are human (or agent) problems sitting on top of a cryptographic rail.

ProveXAgent is that layer. It turns ProveX from a tool you operate into a protocol agents operate continuously. Users speak intent; persistent agents match counterparties, enforce reputation floors, open ProveX escrow, submit proofs, and never hold a key. Every successful action is ProveX volume. Two separate meters: ProveX core takes 2% and buys and burns $PRVX. ProveXAgent takes 1% (0.5% buyer / 0.5% seller) to pay for matching, recurrence, and reputation — jobs ProveX does not do. Of that 1%, 40% is a second $PRVX burn, 40% burns $PXA, 20% funds LP around those burns. Agent settlements therefore burn 2.4% of notional as $PRVX, not 2%. All-in is 3%. The flywheel is not metaphorical: more autonomous commerce makes ProveX scarcer, more liquid, and harder to route around.

One sentence. Deploy an agent once — it settles trustlessly forever via ProveX. ProveXAgent is ProveX on autopilot, not a competing escrow.

PulseChain already has a native DEX (PulseX), a culture of long-horizon holders, and assets (PLS / WPLS, HEX, and a long tail of Pulse-native tokens) that do not enjoy first-class treatment on large centralized exchanges. The missing piece has always been the fiat edge: how value enters and leaves without reconstituting Coinbase in a PulseChain costume.

What centralized ramps actually sell

A CEX or licensed on-ramp sells three bundled products: custody, compliance theater, and matching. Custody is the attack surface. Compliance theater is why accounts freeze after a screenshot of a chat. Matching is the only part users actually wanted. ProveX unbundles the bundle. Matching can be stupid or brilliant; settlement must be dumb, private, and final.

• CEX wallets are honey pots. PulseChain users have already watched this movie.
• P2P groups without escrow are reputation-by-screenshot. Chargebacks win.
• Atomic swaps and DEXs solve crypto-crypto. They do not prove a wire landed.
• Identity-heavy KYC ramps recreate the surveillance the chain was meant to exit.

ProveX answers the cryptographic half: lock, prove, release. The market-structure half — who is selling USDC at 99.4¢ right now, who has a 90+ ProveX identity score, whether this week’s DCA should wait six hours, how a DePIN payout composes with a fiat proof — is still a human sitting in a Discord. Humans do not run while they sleep. Agents do.

ProveX (provex.com / provex.dev) is not an exchange. It is an escrow plus a verifier. A seller locks crypto in a PulseChain contract. A buyer pays fiat off-chain. A browser extension produces a zero-knowledge proof that the payment occurred, without revealing bank-level detail to the world. The contract releases if and only if the proof verifies. A fixed-supply $PRVX token is bought and burned on successful use (ProveX’s own 2% protocol fee). ProveXAgent is a separate meter: 1% of notional (0.5% buyer / 0.5% seller), then 40 / 40 / 20. The 2% is not replaced and not folded into the 1%.

That design has an unusual honesty: ProveX does not know the buyer’s bank, does not hold the seller’s keys after lock, and cannot reverse a verified proof because a card network later changed its mind. Chargebacks are a fiat-rail problem. They do not unwind math. This is why ProveX is a better home for agent settlement than any custodial API. An agent that “has withdrawal permission” on an exchange is a rogue-employee scenario waiting for a prompt injection. An agent that can only call ProveXEscrowAdapter.fulfillIntent() cannot steal what it cannot hold.

Invariant, restated until it is boring: all value movement happens inside ProveX escrow and ZK verification. ProveXAgent agents never take custody. If a code path would assign a user balance to an agent, that path is a bug, not a feature.

Protocols die from underuse, not from imperfect cryptography. A perfect escrow that requires a power user to find a counterparty, check a score, time a rate, and babysit a proof is a protocol for a few hundred people. ProveXAgent exists so ProveX can be the default settlement engine for everyone else — including software that has no UI.

Four jobs ProveX should not do itself

• Discovery. Escrow is not an order book. Someone has to surface inventory and spreads.
• Policy. Max spend, allow-lists, time locks, and reputation floors are user intent, not consensus rules.
• Composition. Multi-party deals, DePIN attestations, parametric insurance, ticket transfers — these are graphs of proofs, not a single lock.
• Continuity. Weekly on-ramps and sleeping DCA are products. A website session is not.

If ProveX absorbed those jobs into the core contracts, it would bloat the trusted computing base and start looking like a CEX with extra steps. Keeping them in an agent layer, bound by a non-custodial adapter, preserves the thinness of ProveX while multiplying its surface area. That is the entire architectural bet.

“Better” here is not a slogan. It is a set of measurable protocol properties that improve when agents exist.

Volume that does not depend on a campaign

Manual P2P is bursty. An always-on on-ramp agent produces a baseline of escrow opens and proof submissions even when no one is looking at a dashboard. Recurring strategies convert ProveX from an event into a utility. Utilities get monetary premium; events get tweets.

A demand-side order flow for $PRVX burns

Every agent settlement still pays ProveX’s 2% (buy-and-burn $PRVX). That 2% is untouched. The Agent 1% sits beside it, not instead of it. Of that 1%, 40% is a second market-buy of $PRVX — so an agent-executed settlement burns 2.4% of notional as $PRVX, not 2%. The remaining Agent take burns $PXA (aligning operators to volume) and stocks a treasury that seeds PulseX LP on PRVX pairs — the same pools the 2% burn has to trade into. Combined take: 3%. The live dashboard (“ProveX volume generated by agents today”) is marketing and monetary policy in the same number.

Liquidity that can be matched without being custodied

PulseX holds WPLS pairs. ProveX holds escrowed inventory. Agents sit between them as scouts, not as warehouses. PXA/WPLS and PRVX/WPLS become the natural hedges and fee sinks. Native PLS is the asset people talk about; WPLS is what the DEX actually pairs. The agent layer is where that distinction is enforced so users do not fat-finger a wrapped-native mix-up into a failed settlement.

Identity without a KYC honeypot

ProveX identity attestations and EAS anchors give agents a score they can refuse below. That is soft reputation, not a passport office. Counterparties below the floor simply do not match. ProveX becomes a place where privacy and repeat business coexist, which is the combination CEXes keep promising and then KYC away.

A reason for other protocols to settle here

DePIN, carbon, insurance, ticketing, RWA — none of these verticals want to build a fiat verifier. They want a rail. Templates in ProveXAgent are distribution for ProveX: each vertical that “just uses ProveX” is a new inbound escrow graph ProveX did not have to business-develop one integration at a time.

Seven layers, one custody rule. Users and wallets sit at the edge. An off-chain orchestrator (natural language, matching, planning) has no keys. ProveXAgent contracts on PulseChain (registry, stake, fees, adapter, reputation, circuit breaker) authorize and meter. ProveX core still holds funds. $PXA / $PRVX live as ERC-20s. PulseX is the DEX. EAS is the identity anchor.

Contracts (the intended on-chain set)

• AgentRegistry — register, scope permissions, activate or deactivate.
• StakeManager — vePXA locks, voting power, execution boosts.
• FeeRouter — collect Agent 1% (0.5% buyer / 0.5% seller), split 40% PXA / 40% PRVX / 20% treasury. ProveX 2% is collected by ProveX core, not this contract.
• ProveXEscrowAdapter — the only bridge. It may call Escrow.createDeposit, Orchestrator.signalIntent / fulfillIntent(paymentProof), and UnifiedPaymentVerifier.verifyPayment on the pinned PulseChain 369 addresses. Nothing else.
• ReputationAttestor — success attestations, history scores, slashing on dispute.
• CircuitBreaker — pause, emergency withdraw of stuck flows back to ProveX rules, upgrade votes.
• PXAToken / Treasury — burnable agent token; grants and PulseX LP incentives.

The adapter is the load-bearing idea. Agents call the adapter; the adapter calls ProveX. There is no “agent wallet with user funds.” Permissions are max-spend, counterparty floors, and time bounds — capability tokens, not custody.

What is live in this interface versus what is still spec

Honesty is part of security. The orchestrator, security kernel, circuit breaker, and fee math are connected. ProveX Escrow, Orchestrator, Payment Verifier Registry, and Unified Payment Verifier are verified on PulseChain 369 with live ABIs — createDeposit, signalIntent, fulfillIntent(paymentProof), verifyPayment. Proofs that target any other escrow fail closed. Gating 0x4Bd6… is an EOA (intentGatingService), not a contract. Registry, stake, and fee routing are still simulated. PulseChain RPC, wallets, the buyer extension, $PXA, the Agent adapter, and EAS schemas remain unwired. The Security page is the live matrix.

ProveXAgent is not one chatbot. It is a small society of scoped roles that are only allowed to talk to ProveX about money.

Roles

• Scout — ranks inventory, spreads, PulseX depth, and identity scores. Emits a plan, not a transfer.
• Executor — drives the 12-step lifecycle through the adapter. Holds no keys.
• Auditor — watches floors, disputes, and circuit-breaker conditions.
• Personal persistent agent — the user’s always-on strategy with a max-spend and an allow-list, including while the user is offline.
• Template agent — a public vertical (on-ramp, DePIN, insurance…) that vePXA lockers can sponsor for a residual fee share.

Agent-to-agent negotiation

Once identity proofs exist, agents can refuse each other. A Helios-class A2A agent with a floor of 85 will not open escrow with a fresh, unattested counterparty. That is not discrimination in the banking sense; it is a programmable substitute for “I don’t take checks from strangers.” Reputation is collateral you cannot lend to your agent as spendable cash — only as a gate.

Natural language as a control plane

“On-ramp $2,500 USDC optimally” is a better UX than five modal dialogs, but it is also a new attack surface. The kernel sanitizes prompts, caps length, strips markup, and never sends keys or proof bytes to the language model. The model narrates; the kernel decides. If the two disagree, the kernel wins. Prompt injection cannot authorize custody that does not exist.

Templates as go-to-market

On-ramp / off-ramp / recurring are the cash cow. Liquidity scouts thicken the book. Multi-party and A2A are the enterprise wedge. DePIN, carbon, insurance, ticketing, and RWA are the expansion set — each a ProveX-native badge, each a burn leaderboard entry. Bonding-curve pricing for premium templates lets early high-value agents capture upside without locking later users out.

Twelve steps, no skips. The kernel treats n → n+2 as an attack.

• 0 Pre-trade ticket. ProveX 2%, Agent 0.5/0.5, you receive, seller locks 100.5, $PRVX pressure 2.4%. Confirm or nothing moves.
• 1–2 User instructs; orchestrator plans against that template’s tool allow-list. Off-chain. No funds move.
• 3 Registry checks vePXA, max spend, allow-list. Offer book ranks counterparties; rows below the floor are marked refused.
• 4–6 Seller signs a lock; adapter forwards; ProveX holds. Agent custody remains false.
• 7 Buyer pays fiat; extension builds a private proof.
• 8–10 Agent submits proof bytes through the adapter; ProveX verifies; release.
• 11 ProveX takes 2% (PRVX burn). FeeRouter takes Agent 1% (0.5/0.5) and buy-burns PXA + PRVX; remainder to treasury.
• 12 ReputationAttestor writes success. The agent’s score, not its balance, went up.

Failures are fail-closed. Circuit breaker open → no new escrow. Dust below $10 or notional above $1,000,000 → rejected. Unknown asset → rejected. Counterparty below floor → refused, and the refused row stays visible on the offer book. Reused nonce → replay blocked. A proof whose public signals show custodyHeldByAgent ≠ 0 is not a proof, it is a confession, and it aborts. No escrow opens until the pre-trade ticket is confirmed.

Two tokens, one settlement. $PRVX is the ProveX protocol token: fixed supply, burned on use. $PXA is the agent token: staked as vePXA for boosts, governance, and the right to run or sponsor agents. They are not aliases. Confusing them is how you accidentally design a single-token casino.

Two meters on a $2,500 on-ramp

• ProveX core 2.00% ($50) — separate protocol fee, 100% buy-and-burn $PRVX. Untouched by Agent.
• ProveXAgent 1.00% ($25) — 0.50% buyer ($12.50) + 0.50% seller ($12.50). Seller locks 100.5 to sell 100.
• Of the Agent $25: $10 buy-burn $PXA, $10 extra buy-burn $PRVX, $5 treasury.
• ProveX gets $60 of PRVX buy-pressure (2.4%), not $50. Combined take: 3.00%.

Why the Agent 1% is acceptable

ProveX’s 2% pays for escrow and the verifier. It does not pay for discovery, matching, reputation floors, or a strategy that runs at 3 a.m. Those jobs are either human (Discord OTC, babysitting proofs) or they get smuggled into spread. The Agent 1% is the explicit price of that labor, automated and non-custodial, split so neither side eats it whole: 50 bps buyer, 50 bps seller.

Fifty basis points per side is inside a typical P2P spread they already pay, and it is cheaper than a CEX or MoonPay-style on-ramp once KYC, spread, and freeze-risk are priced in. A zero Agent fee would not be free — it would hide the cost in worse fills, unpaid operators, or inflation. $PRVX cannot inflate. So the 1% is the honest meter.

What the 1% actually does for ProveX

• Manufactures ProveX 2% events. Always-on agents open escrows that one-off P2P never would. Each one still pays ProveX’s full 2%.
• Adds 40 bps of extra $PRVX buy-and-burn on top of the 2%. Agent volume is strictly better for $PRVX scarcity than the same notional done by hand.
• Funds PulseX LP on PRVX/WPLS and PXA/PRVX from the 20% treasury slice — depth the 2% market-buy needs, or burns eat their own slippage.
• Pays operators (vePXA boosts, template residuals) to maximize ProveX volume, not to route around it. Alternative rails still cost more and still burn PRVX.

vePXA time-locks increase voting power and execution priority. Lockers may sponsor public template agents and earn a thin residual of those templates’ fees — passive yield tied to ProveX adoption, not to inflation. Dynamic fee-share boosts accrue to agents that generate the highest pure ProveX volume, measured on-chain. The protocol pays for burns, not for vanity TVL.

Treasury (20%) funds development, grants, and PulseX LP on PXA/PRVX and PXA/WPLS. It is not a slush fund for market-making user assets. User assets never enter it.

The threat model assumes a hostile prompt, a greedy agent operator, a buggy UI, and a curious adversary with localStorage access. It does not assume a broken Groth16 pairing on mainnet — that assumption is reserved until the verifier address is wired.

What the kernel already enforces

• Non-custodial invariant. custodyHeldByAgent is a hard zero.
• State machine. Steps cannot skip, rewind, or resurrect a terminal settlement.
• Replay nonces unique per instruction.
• PulseChain chain id 369 bound into proofs and settlements.
• Allow-listed assets (USDC, DAI, WPLS, PLS, HEX, PRVX, PXA).
• Prompt sanitization: HTML, control chars, javascript: URIs stripped; 500-char cap.
• Rate limit: 8 settlements / 60s, fail-closed.
• Stake, reputation, and max-spend gates before escrow is planned.
• Circuit breaker pauses execution, not just a label in the header.

What remains a mainnet problem

Real Groth16 pairing checks, seller signatures on the lock, the buyer extension’s trusted proving stack, upgrade timelocks, EAS schema immutability, and PulseX router allowance hygiene. Until those addresses exist, this interface is a faithful simulator of policy, not a custodian of funds. That disclosure is itself a security control: users should not deposit into a story.

The interesting security claim is still the architectural one. Most “AI agent + DeFi” products fail by giving the model a hot wallet. ProveXAgent fails closed by giving the model a narrator badge and giving the adapter a narrow ABI. The smartest agent in the swarm cannot wire funds to itself. That is the product.

Fit is not “crypto users like AI.” Fit is a specific user with a specific job and a specific reason the current tools injure them.

Primary user: the PulseChain native who needs a fiat edge

They already trust PulseX more than a New York order book. They do not want to KYC a megabyte of utility bills to buy $2,500 of WPLS. They will tolerate a P2P flow if escrow is real and privacy is real. ProveX is the escrow. ProveXAgent is how they stop living in group chats to operate it.

Secondary user: the operator who wants recurrence

Payroll-in, DCA-in, treasury-out, DePIN-pay. These are calendars, not transactions. Recurring agents with scoped max-spend are the first time a PulseChain on-ramp behaves like standing payment infrastructure.

Tertiary user: other protocols

Anyone who must pay a human in the real world and a machine on PulseChain in the same breath. Insurance, tickets, carbon, RWA title — they do not need another token, they need a verifier. Templates let them inherit ProveX instead of forking it.

Why now

Agentic software is suddenly a consumer habit, while the on-chain half of “AI agents with wallets” is still a cautionary tale. ProveX is one of the few settlement designs that remains correct if the agent is captured. That timing is the wedge: sell safety to people who are about to give language models too much power, and sell volume to a protocol that needs a demand engine.

Positioning is already a sentence long: ProveXAgent = ProveX on Autopilot. Everything else is proof of that sentence.

• Public burn counter. If the number does not move, the story is false. If it moves, $PRVX holders feel it.
• Template marketplace with a ProveX-native badge and a highest-burn leaderboard. Social proof attached to scarcity, not to follower counts.
• vePXA-sponsored public agents. Lockers become distribution partners instead of Discord mods.
• PulseX adjacency. Trade WPLS pairs there, settle fiat here. The hero terminal exists so that adjacency is visual, not a footnote.
• Console-first UX. Power users instruct in English; everyone else presses the $2,500 chip. Same rail.

What we will not market: yield on user funds, “AI alpha,” or custody. Those pitches attract the wrong capital and the wrong regulators. The pitch is narrower and stronger. Your agent cannot steal from you. Your settlement still burns PRVX. Your strategy runs at 3 a.m.

The addressable market is not “all of CeFi.” It is the slice of fiat↔crypto flow that is already trying to be P2P, already uncomfortable with custodial ramps, and already on or adjacent to PulseChain. That slice is smaller than Binance and much larger than a Telegram OTC desk.

Expand along three axes only. First, depth inside PulseChain (HEX/WPLS/USDC ramps, PulseX fee burns). Second, vertical templates that import foreign volume onto ProveX rails. Third, agent-to-agent commerce, which has no incumbent CEX UX at all — because a CEX cannot underwrite two bots without taking both sides into custody.

Capture is not take-rate maximization. Two named meters — ProveX 2% plus Agent 1% — beat a hidden 2% all on the buyer plus an unnamed surcharge. A spread-aware scout can still beat a retail CEX after KYC friction is priced in. If we win, we win on being the rail other software calls, not on being the storefront with the loudest APY.

The cryptographic rail does not need a prettier website. It needs a control plane that makes the 3% honest before money moves, gives sellers a desk, shows the book, actually recurs, gates on identity, prices templates as a market, and stops using one prompt for every vertical.

1. Pre-trade ticket

Before any escrow, the Console prints a ticket: notional, ProveX 2% (100% $PRVX burn), Agent buyer 0.5%, Agent seller 0.5%, amount you receive, amount the seller locks (100.5 to sell 100), and $PRVX buy-pressure of 2.4% of notional. A typical CEX/MoonPay all-in sits next to it so the 3% is a quote, not a footnote. Confirm opens ProveX. Decline leaves custody at zero.

2. Seller desk

ProveX is two-sided. The Desk lets a seller pick an asset, a notional, and a fiat rail (Zelle, Venmo, Wise, ACH, wire), then lock 100.5 to sell 100. Posting requires a linked ProveX/EAS identity. Inventory is what matching actually matches.

3. Visible matching

The orchestrator no longer “finds a counterparty” in prose. The offer book lists seller, rail, score, and why. Rows below the floor (70) stay on the page as “refused: score 62.” Execute is blocked unless a cleared offer is selected. That is the A2A gate made visible.

4. Recurrence that recurs

Agents carry a cadence: off, daily, or weekly. Next-run and last-run are stored. If the circuit breaker is open when a run is due, the miss is logged — the agent does not silently skip ProveX. “Always-on while you sleep” is now a schedule, not a slogan.

5. Identity as a gate

Linking an EAS attestation (`eas:ProveXIdentity/v1`) assigns a score. Sellers cannot post without it. Counterparties under 70 cannot be selected. Identity is collateral for matching, never spendable cash, never a KYC file the agent holds.

6. Templates as a market

Deploy price follows a bonding curve: base min-stake × (1 + 0.08 × live agents on that template). Early deployers pay less; later ones pay the curve. vePXA lockers can sponsor a template (1,000 PXA) and earn a 10 bps residual of notional on every settle of that vertical — clipped from success, not from an extra meter. The leaderboard remains ranked by volume / burn.

7. One orchestrator per vertical

Each template has its own system prompt and a closed tool allow-list (for example On-Ramp: matchOffers, quoteTicket, openEscrow, submitZkProof; A2A: queryReputation, refuseBelowFloor). The language model may only narrate tools on that list. The kernel still decides. A DePIN agent cannot pretend it is an on-ramp.

The interface you are reading is the control plane and the policy rehearsal. The remaining work is binding, not inventing.

• ProveX core ABI is verified: Escrow.createDeposit, Orchestrator.signalIntent / fulfillIntent, UnifiedPaymentVerifier.verifyPayment.
• Wire JSON-RPC and injected wallets so sellers sign locks against that escrow.
• Ship the buyer extension for production proofs; replace structural Groth16 placeholders with pairing-checked bytes at the Unified Payment Verifier.
• Deploy ProveXEscrowAdapter + $PXA. FeeRouter → PulseX WPLS pairs → burn. PulseScan as the public accountant.
• EAS schema for ReputationAttestor. CircuitBreaker.propose / vote on-chain.
• Audit adapter + kernel-equivalent Solidity modifiers. Timelock upgrades.

Until then, the Security page remains the source of truth for what is connected, simulated, linked, or unwired. A white paper that overclaims a test kernel as a mainnet verifier would be doing the one thing this protocol cannot afford: asking for trust.

ProveX proved that fiat and crypto can meet without a custodian. ProveXAgent is the argument that they will meet often — because software that never sleeps, never holds the bag, and never skips the verifier is how a primitive becomes infrastructure.

If the agents work, ProveX is no longer a destination you visit. It is the settlement engine other programs quietly use. That is the only kind of protocol that stays scarce on purpose.

Read the Security matrix for the live wiring. Instruct an agent in the Console. Terms, privacy, and risk live in the footer — because a non-custodial protocol still owes you plain language about what it is not.