Everything the house knows, written down.

01Core concepts

Memory is the product. The house keeps a file on every wallet that pays it — trust score, visit count, repeats, failures, hiring record — and reads that file before deciding anything. Strangers pay full price; regulars earn discounts; cheaters are refused before any work happens. Turn the memory off and a smart business becomes a dumb vending machine. That collapse, demonstrated live, is the entire point.

Payments are x402 on Base. x402 is a web-native way to charge for API calls: the server answers an unpaid request with a machine-readable quote (HTTP 402), your wallet signs a fixed-amount permission slip (no gas, nothing broadcast by you), you retry with the proof, and a facilitator moves USDC on Base (chain eip155:8453, ~$0.01–$0.05 a call). Quotes live 10 minutes.

The wire always settles full price. The payment technology cannot settle a discount, so loyalty works as cashback: you pay list price onchain, the house sends part back as a second, publicly visible transaction. A refusal cancels the payment before money moves — refused means uncharged, always.

Repeats are free. Ask the exact same question twice and the second answer costs net $0, served from memory. Trust doesn't grow on repeats — otherwise status could be farmed for free.

02The seven functions

Only functions 1 and 2 move your trust. Functions 3–7 build provider records, verdict feeds, bond books, and credit balances instead.

03The trust system

04Anatomy of a transaction

1. Quote. You call the endpoint with no payment. It answers 402 with a signed envelope: exact amount (atomic USDC), the house wallet, asset, network, and a 10-minute window.

2. Sign. Your wallet signs an EIP-3009 authorization for exactly the quoted amount via eth_signTypedData_v4 on Base (chain 8453). Nothing is broadcast; no gas is spent.

3. Retry with proof. The same request goes again carrying a PAYMENT-SIGNATURE header: the signed authorization plus the exact quote it answers.

4. Verify + settle. The facilitator checks the signature and your balance, then moves full list price to the house wallet. Any failure here returns an error and nothing moves.

5. Serve. The handler runs — pricing, refusals, dedup, scars, jobs. Any 4xx cancels the settlement: refused means uncharged.

6. Cashback + journal. Earned discounts return as a second onchain transaction; every step lands in the journal with its receipt hash.

# 1. ask for a quote (always free to ask)
curl -sS -X POST 'https://YOUR-HOST/bond/quote' \
  -H 'Content-Type: application/json' \
  -d '{"provider":"0x436f324eff0b32a405c5b9102e1a6ef85451cec1"}'
# → 402 + payment-required header (amount, payTo, asset, window)
# 2-3. sign in your wallet, retry with PAYMENT-SIGNATURE
# 4-6. facilitator settles base → house serves → cashback if earned

05Memory on vs off, per function

Around the functions: trust frozen (everyone ×1.00), no cashback, no refusals, failures never compile to policy, crashes can't resume, audits start from zero, journals and stats go blank — and return on re-enable. Unknown wallets read identically in both modes (404 either way); the deletion proof lives in known state collapsing.

06History & records

Caller rows — one per wallet: trust, band, visits, serves, repeats, paid totals, prepay balance, failures, first/last seen. Thin writes are normalized at write time (a screened-but-never-served wallet reads as a neutral new file, never a crash).

Journal — every settlement (with receipt hash), serve (+3s), free repeat, refusal, screen, failure, hire ruling, and funding edge, timestamped. Full wallet addresses stay in the cold journal for receipt reconciliation; every public surface masks them.

Scars → policy — three identical failures compile into a standing rule (e.g. switch upstream, refuse-until, prepay-required) that future requests cite; rules sunset after 24 hours.

Watch feed — published screens with evidence; jobs — crash-proof work orders settling exactly once; provider book — jobs, quality, punctuality, defaults, claims, escrow.

After a purge, subjective state never returns — but a fresh boot re-learns the chain-proven baseline (who verifiably paid, how often) from Base receipts. Faces return; conversations don't.

07The memory gate

08API reference

Operator routes (/house/compile, /house/audit/run, /house/calibrate/run, /house/bonds/claim, /scout/delegate) require the x-house-capability token. Every response carries X-House-Memory stating the memory mode it was decided under.

09Reproducing everything

1. The gate: python deletion_test.py flips memory off and asserts the collapse (exit 0 = holds).

2. The money beats: scripts/demo_beats.py all replays recall, bad-actor refusal, scar compilation, and kill-resume through the real engine on a throwaway database.

3. The suite: pytest tests/ -q — 60 tests, one per real contract.

4. The ladder: serve one fresh wallet twice — first serve 50 → 53, identical repeat $0 net with trust frozen, nine more distinct serves to VIP.

5. Live, for cents: ~$0.50 USDC on Base, the workbench: ask ($0.01), repeat (free), dossier ($0.02), screen, report, hire, bond — then disable memory and watch the same question cost full price with no history.

10Glossary