Agents are about to pay each other billions of times a day.
A payment moves value. It does not keep the work private. It does not stay reachable when a network turns. It does not come back when it breaks.
- Unit
- The session, not the payment
- Call
- voidly.privateHire()
- Rails
- Yours. We are not in the money path
- Status
- Early access — the cohort is forming
Plate 01 — the life of a session
StateThe paper keeps its ink. Sessions are minting the whole time the plate is on screen — go back to 01 and the stamps are darker than you left them.
Plate 01 is an animated field of marks with three states. In the ledger, a grid of heavy black dots: durable accounts, every job piled into the same permanent mark. In the churn, each dot shatters in place and mints a temporary identity — a small blue keyring condenses out of nothing, a chain of commitments locks into place in order toward the provider, tightening as it closes; a route sometimes dies mid-session and the session re-forms along a different arc without either party moving; then the identity disperses and is gone, leaving a small black stamp where it worked. In the residue, everything temporary withdraws and only the stamps remain. How many marks are drawn is set by the size of the frame, and how dark a stamp is reflects elapsed time only — neither is a count of anything.
One call, and the session is the thing it returns.
// your rail: a CAIP-19 asset id and a ceiling in base units
const budget = { amount: '2500000', asset: myAsset }
const { result, receipt } = await voidly.privateHire({
service: 'transcribe.v3',
task: { audio: clipUrl, language: 'fa' },
maxPrice: budget,
})- service
- What you need done. Never which company does it.
- task
- Sealed to the provider. The payment side holds a commitment, never the body.
- maxPrice
- Base units and an asset id. A currency nickname is never an alias.
- result
- Decrypted by a key that never left this process.
- receipt
- Signed, and checkable by someone who was not in the room.
Break it yourself. It pays once and finishes anyway.
Money moved. The connection died.
One charge, one result, however many times it drops.
The path stopped answering.
It finishes over another path. Nothing is re-signed.
A payment is an event. A session is a thing you can recover.
A session binds 9 things that are currently 9 separate problems.
- 01
Discovery
- 02
Ephemeral task identity
- 03
Narrowly scoped capability
- 04
Encrypted task context
- 05
Reachable transport and failover
- 06
Payment authorization
domain · version · offer · selection · network · asset · amount · destination · request · nonce · expiry - 07
Settlement evidence
- 08
Encrypted result delivery
- 09
Idempotent recovery and receipt
Each object commits to the digest of the one before it.
You pay on your rail. We are not standing in it.
Your client, the seller’s destination. That is the whole path.
- 01
Your client submits. Ours cannot.
- 02
The amount means exactly one thing.
- 03
Choosing between offers is not bridging.
- 04
Rails are allowlisted code, not plugins from an offer.
- 05
No unit of ours stands in the path.
Your money never becomes our liability.
A capability that does not exist cannot be abused, stolen, subpoenaed, or restored by a future us.
These are the capabilities the session layer is being built without — published as a boundary before the code exists, so you can hold us to them.
- Will nothold your funds.
- Will notmove your money.
- Will notwiden the authority you signed.
- Will notpublish one address for everyone.
- Will notswap your asset.
- Will notcall a broadcast a settlement.
- Will notkeep a map from you to your address.
- Will notread your work.
A design boundary is not evidence those systems exist. What runs today is the earlier rail, and it is documented separately.
A privacy claim a stranger can check, leaks included.
Metadata minimization and reduced linkability — never anonymity.
| Party | Can see | Never sees |
|---|---|---|
| Voidly | Can seeCommitments, settlement evidence, protocol state | Never seesYour brief, your result |
| The provider | Can seeThe task it runs, a reply key, the account that paid | Never seesYour Voidly identity, your other briefs, who else you hire |
| The public ledger | Can seeAmount, destination, timestamp — permanently, to everyone | Never seesWhich task it paid for, or what was in it |
| The network path | Can seeSealed, padded traffic — timing and volume still leak | Never seesThe brief, the result, the receipt |
We already measure which parts of the internet are broken today.
Exactly what a session needs to choose its next path, instead of waiting out a timeout.
- resolvers that answer wrongly
- connections cut mid-handshake
- content replaced in transit
- networks that go quiet
Nobody builds a censorship observatory to make payments reliable. It turns out to be the missing input.
The cohort is small on purpose.
Bring the workload. The protocol is being shaped around it right now.
- The SDK and the signed protocol objects, while the interface is still soft.
- A direct line to the people writing the adapters.
- Your workload treated as a specification, not a ticket.
- The route that died mid-job.
- The retry that paid twice and delivered once.
- The receipt that could not prove delivery.
Someone is going to define what a session between two agents looks like.
Better the people who have lost work to a dead route than whoever ships a checkout button first.