Skip to content

Payment Proof (π)

Every AXL packet carries a payment proof in its preamble. This is not an authorization token or an API key - it is part of the grammar. Payment is a first-class linguistic construct.

Format

π:AXL_ID:SIGNATURE:GAS
Field Description Example
AXL_ID The sender's AXL identity (short hash or registered name) axl_7f3a
SIGNATURE ED25519 signature over the packet body ed25519_sig_abc
GAS Gas amount paid for this packet (decimal) 0.001

Full Example

π:axl_7f3a:ed25519_sig_abc123def456:0.001

This reads: "Agent axl_7f3a signed this packet with their ED25519 key and paid 0.001 gas units."

Why Payment Is Grammar

In traditional systems, payment is handled by a separate layer - an API gateway, a billing service, a rate limiter. The message itself knows nothing about its cost.

AXL inverts this. The payment proof is embedded in every packet because:

  1. Agents need economic skin in the game. A packet that costs nothing to send costs nothing to spam. The π proof makes every message economically accountable.
  2. Routing depends on payment. Relay nodes can verify payment before forwarding, without needing to understand the packet body.
  3. Provenance is cryptographic. The signature binds the sender's identity to the packet content. Replay attacks require forging a signature.

Cryptographic Details

ED25519 Signatures

AXL uses ED25519 for all packet signatures. The signing payload is the entire packet body - everything from the selector (S:DOMAIN.TIER) through the last field, excluding flags.

signing_payload = "S:OPS.CRITICAL|target:db-primary|status:!DOWN|metric:latency|value:%312.5|threshold:#100|action:failover"
signature = ed25519_sign(private_key, signing_payload)

Monotonic Nonce

Each agent maintains a monotonically increasing nonce tied to their AXL_ID. The nonce is embedded in the signature computation (not visible in the packet) to prevent replay:

nonce = last_nonce + 1
signing_payload = f"{nonce}:{body}"
signature = ed25519_sign(private_key, signing_payload)

A relay node that sees a signature with a nonce less than or equal to the last-seen nonce for that AXL_ID rejects the packet.

Gas Economics

Gas is the unit cost of sending a packet. It serves three functions:

1. Proportional Fees

Heavier packets (more fields, higher tiers, more compute required by the receiver) cost more gas. The fee schedule is determined by the network, not by AXL itself.

Tier Typical Gas Range
CRITICAL 0.005 – 0.05
HIGH 0.002 – 0.01
MEDIUM 0.001 – 0.005
LOW 0.0005 – 0.002
INFO 0.0001 – 0.001

2. Spam Prevention

Every packet has a nonzero cost. Even at fractions of a cent, this makes volumetric spam economically infeasible at scale.

3. Floor for Broke Agents

Agents with depleted balances are not silenced - they can still send packets at a floor gas rate. The floor is high enough to prevent abuse but low enough that a critical alert from a broke agent still gets through. This prevents economic denial-of-service, where an adversary drains an agent's balance to silence it.

# A broke agent can still send critical alerts
π:axl_7f3a:ed25519_sig_xyz:0.0001

Verification Flow

  1. Extract π:AXL_ID:SIGNATURE:GAS from the packet preamble.
  2. Look up the public key for AXL_ID from the registry (see REG domain).
  3. Reconstruct the signing payload from the packet body.
  4. Verify the ED25519 signature against the public key.
  5. Check that the nonce is strictly greater than the last-seen nonce for this AXL_ID.
  6. Verify that the agent's balance covers the declared gas amount.
  7. If all checks pass, deduct gas and forward the packet.