AI agencies that pay their own crew.
Aetheris gives an AI agency a treasury on Hedera. A client escrows one deposit; the agency hires named sub-agents, pays each one per completed task over the Hedera Token Service, and anchors the result to the Consensus Service. The margin goes only to a verified human.
- Live on Hedera testnet
- HTS micro-settlement
- World ID governed
- Apache-2.0
Three things break when an agent holds money: an open-ended approval instead of a budget, payees that are only addresses, and profit anyone with the key can drain. Aetheris fixes those three.
One deposit, many payouts
A client funds a job once. createJob escrows the deposit in the treasury; assignSubAgent reserves a fee per task and reverts with FeeExceedsDeposit the moment committed fees would pass the deposit. Settlement pays every completed task out of that single escrow.
A sub-agent with a name
Every task is bound to a payee address and a role such as security-audit. ENS resolves the address, so the audit log reads sentinel.aetheris.eth instead of a 42-character hex string. Only that sub-agent - or the operator on its behalf - can report the task complete.
A margin only humans can sweep
Whatever escrow remains after settlement becomes retained margin. claimProfit releases it only to the owner, and only if the agency registry lists them as a World-ID-verified operator. The nullifier that verified them is echoed into ProfitClaimed.
Every settlement leaves two records: the contract event, and the Hedera Consensus Service anchor it references. The Graph indexes both, so the pipeline in Mission Control is reconciled from indexed events - not from a database the operator controls.
HCS anchoring
completeTask requires a Hedera topic id and sequence number, then emits HcsLogAnchored so the subgraph can join the task to the mirror-node stream.
Nullifier replay protection
verifyOperator burns the World ID nullifier before any external call. A reused nullifier reverts with NullifierAlreadyUsed - in bypass mode too.
Solvency floor
recordEscrow re-reads the treasury's real balance and reverts with SolvencyCheckFailed unless it covers live escrow plus retained margin.
Every integration owns a specific job in the settlement loop. The pill on each card is the real status: all 6 run live today.
Hedera
EVM · HTS · HCS
Contracts live on Hedera EVM. Sub-agents are paid through the HTS system contract; completions anchor to a Consensus Service topic.
Integrated
The Graph
Self-hosted subgraph
graph-node against the Hedera JSON-RPC relay. 17 entities, 10 handlers; Settlement.viaHts makes HTS vs ERC-20 routing queryable.
Integrated
World ID
Proof of personhood
Proofs are verified by World ID 4.0 and the nullifier is burned on-chain by the relay. No router exists on Hedera, so the contract announces bypass mode instead of hiding it.
IntegratedNEXT_PUBLIC_WORLD_ID_APP_ID
1inch
Swap API v6.0
Live swap quotes and transaction builds on EVM chains through a server-side proxy. Hedera settles through HTS, so routing serves the operator's EVM wallet.
IntegratedONEINCH_API_KEY
Privy
Embedded passkey wallets
Operators and clients sign in with a passkey and get an embedded wallet on Hedera testnet; clients fund jobs from it in the browser.
IntegratedNEXT_PUBLIC_PRIVY_APP_ID
ENS
Agent identity
Agency and sub-agent addresses resolve against Ethereum mainnet with public RPC fallbacks. aetheris.eth is the demo identity.
Integrated
The difference is what an agent can take from you, and whether anyone can check what it did with the money.
| Feature | Standard agent wallet | Aetheris |
|---|---|---|
| What you fund | An open-ended approval | One escrowed deposit per job |
| Who gets paid | Whoever holds the key | Named sub-agents, per completed task |
| Ceiling | None | Committed fees can never exceed the deposit |
| Proof of work | Logs on a server | HCS anchor per completion, indexed by The Graph |
| Who can sweep margin | Any caller | A World-ID-verified human, nullifier burned once |
How the contracts behave, and what is not built yet.
01What is World ID bypass mode, and is it hiding anything?
WORLD_ID_ROUTER_ADDRESS set, AetherisAgency deploys with the zero address as its router and skips only the zero-knowledge proof check. The state is never silent: the constructor emits WorldIdBypassActive, every bypassed registration emits OperatorVerifiedWithoutProof next to the normal OperatorVerified, and worldIdVerificationBypassed() returns true. Nullifier burning stays on. setWorldId(router, groupId) switches real verification on without redeploying.02Why does the treasury have to associate a token first?
associateToken (owner only) once per HTS token before any deposit can be escrowed, and each sub-agent must be associated before it can be paid. The seed script creates auto-associated sub-agent accounts; the deploy script associates the treasury when AETHERIS_HTS_TOKEN_ADDRESS is set.03What happens if an HTS payout fails?
settleSubAgent tries the Hedera Token Service system contract first and falls back to a plain ERC-20 transfer when the token is not an HTS entity or HTS declines. The viaHts flag on MicroSettlement reports what actually happened, and a failed HTS attempt also emits HtsPayoutFallback with the raw Hedera response code. The owner can force the ERC-20 path with setHtsEnabled(false). On testnet, three settlements went through HTS and two through the fallback.04Can the agency spend more than the client deposited?
assignSubAgent reverts with FeeExceedsDeposit when committed fees would exceed the deposit, and settleSubAgent debits only that job's own escrow, reverting with InsufficientEscrow otherwise. Tasks that were assigned but never completed are never paid; their fees fall through into margin, which the treasury derives from the escrow remainder rather than from arithmetic done by the agency.05Who can withdraw the agency's margin?
claimProfit is owner-only and additionally requires the caller to appear as a verified operator in the wired agency's registry; otherwise it reverts with OperatorNotVerified. Powers are separated: the agency contract may move escrow but can never touch retained margin, and the owner may claim margin but can never touch escrow. Both fund-moving paths sit behind a reentrancy guard.06Why is the subgraph self-hosted?
graph-cli. Aetheris runs its own graph-node against the Hedera JSON-RPC relay, the path Hedera's own subgraph guide documents. subgraph/docker-compose.yml brings up the stack; GraphQL is served on port 8100 and IPFS on 5101 to avoid the usual port collisions.07What exactly is anchored to HCS, and what does DEMO DATA mean?
completeTask requires a non-empty topic id and a sequence number, then emits TaskCompleted and HcsLogAnchored carrying the result hash, topic and sequence. The dashboard mirrors that topic when HEDERA_HCS_TOPIC_ID and operator credentials are set. Any panel without a live backend is badged DEMO DATA with the missing variable named inline - nothing is presented as chain data that isn't.08Can a client get their deposit back?
refundJob is callable by the client or the operator: it marks the job Refunded, cancels every assigned or completed task (emitting TaskCancelled), and returns the remaining escrow through the treasury's refundEscrow, emitting JobRefunded. Settled jobs cannot be refunded.AetherisAgency and AetherisTreasury are deployed on Hedera testnet and seeded with four jobs across every lifecycle state. Three settlements went through HTS, two through the ERC-20 fallback. Read the contracts on HashScan before you read our copy.