// LEDGER-SECURED · GRAPH-POWERED
The pantry
restocks itself.
An autonomous purchase agent that settles real x402 payments on Hedera testnet, gates its signing key behind a Ledger Key Ring, and reasons over its own on-chain history via a live subgraph — never mocked, never a raw dump.
01 · FLOW
Four moves, one settlement
Every completed purchase is a real Hedera testnet transaction, gated by hardware-rooted encryption and logged for a subgraph to reason over — see the repo for the full payment flow.
- 01
Decide
The agent reasons over its own on-chain purchase history via the subgraph — consumption intervals, not a fixed schedule — to identify what's due for restock.
- 02
Unlock
The Hedera operator key is decrypted via the Ledger Key Ring (wallet-cli ring decrypt) — encrypted at rest, gated by this Ledger's trustchain, never a raw key sitting in agent code.
- 03
Settle
The decrypted key signs a Hedera TransferTransaction, routed through the Blocky402 facilitator (x402 v2), and settled on Hedera testnet in HBAR.
- 04
Log & reason
PurchaseLog emits an event on Ethereum Sepolia; a subgraph indexes it live, and the agent queries it in natural language for the next restock decision.
02 · LIVE REASONING
Not asserted — computed, right now
This isn’t a mock-up of what restock reasoning would look like — it’s the actual output of src/reasoning/restock.ts against the live subgraph, re-computed on every page load.
03 · DESIGN
Device-backed, not device-blocking
The Ledger's job is scoped to one thing: nobody but this device's Key Ring can ever decrypt the Hedera operator key. That's a stronger guarantee than a live button-press per payment, and it's the one Agentry actually makes.
- No raw key in agent code. The Hedera operator key exists in plaintext only transiently, in-process, decrypted via
ring decrypt. - Live data, not a dump. Restock/price reasoning runs against a real subgraph on Ethereum Sepolia — mocked data disqualifies the Graph track.
- Scoped by design. The Ledger gate covers the Hedera key only; the PurchaseLog write signs with a plain env-var key, deliberately out of scope.
- Never v1. Blocky402 accepts x402 protocol v2 only — the fee-payer is fetched live from
/supported, never hardcoded.
04 · STACK
What it’s made of
- Hedera SDKSettlement chain — HBAR (asset id 0.0.0), ECDSA operator key, testnet.
- Blocky402x402 v2 facilitator — fee-payer fetched live from /supported, never hardcoded.
- Ledger Key Ring (wallet-cli ring)Encrypts the Hedera operator key at rest, gated by this Ledger's LKRP trustchain.
- PurchaseLog + The GraphA minimal emit-and-forget contract on Ethereum Sepolia, indexed by a live subgraph.
- TypeScript / Node.jsAgent loop, reasoning layer, and both check scripts and contract tooling.
05 · TRACKS
Three sponsors, one build
Full qualification checklists and evidence live in the README.
AI & Agentic Payments
Hedera
A live x402-gated payment, settled through the Blocky402 facilitator on Hedera testnet in HBAR — fee-payer fetched live from /supported, never hardcoded.
AI Agents x Ledger
Ledger
wallet-cli ring is the real key backend for the Hedera operator key — encrypted at rest, decrypted only by this device's trustchain. No Signer Kit, no live per-payment confirmation.
Best AI Use Case · Start Fresh
The Graph
Live, not mocked: PurchaseLog on Ethereum Sepolia, indexed by a real subgraph, reasoned over by an actual interval algorithm — see the numbers above.