Enterprise Verification & Integration Lab

PROTOCOL ARCHITECTURE OVERVIEW

How the Ashlar Blue Settlement Stack Works

Ashlar Blue separates payment discovery, cryptographic trust, execution, and final settlement into four distinct, audited architectural phases.

PHASE 01 · DISCOVERY

Authoritative DNS

Autonomous clients query _x402.ashlar.blue via standard recursive DNS or DNS-over-HTTPS (DoH). Resolves the endpoint pointer without crawler or directory lock-in.

PHASE 02 · ATTESTATION

Cryptographic Manifest

Client fetches /.well-known/x402, verifies the per-serve Ed25519 signature over canonical JCS (RFC 8785), and confirms the 900s block-height freshness staple.

PHASE 03 · CLEARING

Zero-Gas Authorization

The payer issues an off-chain cryptographic authorization (EIP-3009 / Permit2). The payer pays zero network gas; the facilitator sponsors on-chain execution.

PHASE 04 · SETTLEMENT

On-Chain DvP Settlement

The settlement transaction executes atomically on Flare Network or XRPL. Final state digests and catalog proofs are finalized on-chain with public transaction receipts.

📘 Enterprise Auditor Field Guide: What You Are Auditing & How to Test

Welcome to the Ashlar Blue Operational Verification Lab. Unlike simulated demonstration environments with mock timers, this laboratory is a live developer console wired directly into our production Google Cloud Run facilitator (api.ashlar.blue), Cloudflare 1.1.1.1 Anycast DNS, and the Flare Network Coston2 blockchain. Everything you execute here evaluates authentic cryptographic invariants with zero custody risk.

1. CHOOSE YOUR AUDIT METHODOLOGY Test the stack via Interactive Browser Probes (instant one-click below), Batch Full-Stack Audit (all 5 layers), Local Terminal CLI (recipes for dig, curl, jq), or the Programmatic SDK.

2. DISPATCH REAL NETWORK PROBES Select an infrastructure vector tab (1–5) or click "Batch Audit (Run All 5 Vectors)". Your browser opens an authentic TLS 1.3 socket directly to api.ashlar.blue, measuring true edge latency and verifying cryptographic headers in real time.

3. AUDIT DECODED INVARIANTS & PROOFS Inspect the live terminal stream and review the Decoded Claims Inspector to verify the facilitator EVM signing key (0x3c364...), block freshness staple (<900s), and immutable Coston2 catalog state proof.

💡 OPERATOR INSTRUCTIONS & VERIFICATION TIPS

How to Run This Verification Lab & Audit the Live Stack

Below are four practical ways to navigate this lab, interpret telemetry data, and independently audit each layer of the Ashlar Blue settlement protocol:

⚡ Tip 1: One-Click Full-Stack Audit Click "Batch Audit (Run All 5 Vectors)" to run an automated regression test across all 5 layers in ~300ms. It sequentially queries facilitator health, block freshness, asset contracts, on-chain Merkle state proofs, and DNSSEC propagation.

🎯 Tip 2: Targeted Vector Inspection Click buttons 1 through 5 to inspect specific layers individually. Click "Execute Real Probe" to view the live HTTP stream, TLS 1.3 handshake speed, and raw JSON payload directly from our Google Cloud Run cluster.

🔍 Tip 3: Inspect Decoded Claims Watch the Decoded Claims Inspector on the right. It parses the raw JSON into audited parameters: facilitator identity key (0x3c364...), Flare block height, and verifiable transaction hashes on the Coston2 block explorer.

🛡️ Tip 4: Independent Terminal Verification Never trust a web console blindly. Scroll down to the Independent Auditor CLI Recipes to run standard dig, curl, and jq commands from your local workstation terminal to confirm our edge returns identical results.

LIVE OPERATIONAL TESTBED

Execute Live Endpoint Probe

Zero Simulation · Direct HTTPS Fetch From Your Browser

Vector 1: Facilitator Health & Node Identity Key — Queries /health to verify facilitator process uptime, active network binding (Flare Coston2), and the public settlement key (0x3c36450b...6599) that signs clearing receipts.

Target: https://api.ashlar.blue/health

Live HTTP / TLS Stream Latency: Ready

[System] Enterprise Verification Console ready.

[Target] Ready to dispatch authenticated HTTPS probe to api.ashlar.blue.

Click "Execute Real Probe" to test individual vectors or "Batch Audit" for full-stack attestation.

Cryptographic Standing

ONLINE & OPERATIONAL

HTTP TransportTLS 1.3 / HTTPS

Facilitator Key0x3c364...6599

Settlement RailFlare Coston2

Gasless EngineEIP-3009 (FCUSD)

On-Chain Settlement ProofVerified ↗

Decoded Claims Inspector AWAITING PROBE

Facilitator Address0x3c3645...6599

Network BindingFlare Coston2 (114)

Protocol Profilex402-v1 / Exact Scheme

Audit Security InvariantPass · Hardware Bound

Production Cloud Run: api.ashlar.blue

TECHNICAL SPECIFICATION BREAKDOWN

Deep-Dive into the 5 Verification Vectors

Every public endpoint in the Ashlar Blue stack maps directly to an established RFC or open standard for autonomous machine commerce. Here is the operational specification for each layer:

VECTOR 01 LIVE MONITOR

Facilitator Health & Identity Key

GET /health · JSON-LD Telemetry Spec

Audits container process health, runtime memory state, and active blockchain rail. It publishes the node's public EVM settlement authority key (0x3c36450b84b7b9712A396ab4e1b551888ab36599) used to co-sign atomic settlement receipts.

VALIDATION CRITERIA:
• ok: true process uptime
• network: "coston2" (Chain ID 114)
• EVM key matches on-chain clearing registry

VECTOR 02 RFC 8785 + ED25519

Signed Manifest & Freshness Staple

GET /.well-known/x402 · IETF x402 Attested Manifest Spec

Returns the authoritative payment manifest canonicalized with RFC 8785 JCS and signed with an Ed25519 key. Includes a 900-second block-height freshness staple that cryptographically prevents replay attacks from stale blocks.

VALIDATION CRITERIA:
• Valid x402.sig Ed25519 signature
• Freshness staple observedBlock < 900s drift
• Canonical JCS hash matches manifest body

VECTOR 03 EIP-3009 / PERMIT2

Supported Rails & EIP-3009 Assets

GET /supported · Multi-Rail Clearing Spec

Publishes accepted payment schemes (exact), network bindings, and supported token contracts (such as FCUSD at 0x1F930B...8011). Verifies that payers can settle with zero gas holding requirements.

VALIDATION CRITERIA:
• Scheme includes exact with EIP-3009
• Token address and 6 decimal precision verified
• Gasless sponsorship enabled by default

VECTOR 04 MERKLE STATE PROOF

Open Catalog & On-Chain State Proof

GET /catalog/stats · Merkle Root State Spec

Mirrors decentralized machine services across the ecosystem (15,505+ entries). Computes a SHA-256 snapshot digest and immutably records it on Flare Coston2 in transaction x402cat/1 for verifiable public auditability.

VALIDATION CRITERIA:
• 15,500+ active mirrored entries
• Deterministic snapshotDigest hash
• Public explorer link to Coston2 verification tx

VECTOR 05 CLOUDFLARE DOH

DNS-over-HTTPS Discovery

RFC 8484 · IETF x402 DNS Discovery Spec

Queries Cloudflare 1.1.1.1 recursive DoH to resolve the authoritative _x402.ashlar.blue TXT pointer. Allows autonomous agents worldwide to discover settlement terms in under 150ms without proprietary directory lock-in.

VALIDATION CRITERIA:
• DNS Status: 0 (NOERROR)
• Record data contains v=x402-1 and wk=...
• Cloudflare Anycast edge latency < 150ms

GASLESS MACHINE SETTLEMENT ARCHITECTURE

How Autonomous Agents Pay: Zero-Gas EIP-3009 Clearing

Traditional crypto payments fail autonomous agents because agents run out of gas tokens or face stuck mempools. Ashlar Blue eliminates gas entirely via EIP-3009 transferWithAuthorization. Here is how an end-to-end payment executes:

STEP 01 · OFF-CHAIN

1. Sign EIP-712 Mandate

The payer agent signs an off-chain cryptographic authorization (TransferWithAuthorization) specifying recipient, amount, validity window, and a unique 32-byte nonce. The agent holds zero gas tokens and spends nothing to sign.

STEP 02 · PRE-FLIGHT

2. Dry-Run Check (/verify)

The agent calls POST /verify on the facilitator. The facilitator statically checks signature recovery (ecrecover), balance sufficiency, and nonce freshness without broadcasting to the blockchain or incurring fees.

STEP 03 · ON-CHAIN

3. Atomic Settlement (/settle)

The facilitator broadcasts the transaction to Flare Coston2. The facilitator's relayer pays all blockchain gas. The smart contract validates the agent's signature and atomically moves the principal token (FCUSD) in a single block.

STEP 04 · PROOF

4. Immutable SCITT Receipt

The facilitator returns a signed settlement receipt (x402job/1 profile) containing the transaction hash, block height, and enclave hardware attestation quote. Both counterparties receive immediate finality.

INDEPENDENT VERIFICATION

Verify Directly From Your Workstation

Enterprise security teams and compliance auditors do not need to rely on this web interface. Execute these standard commands directly in your local terminal to independently audit the Ashlar Blue production stack.

1. Authoritative DNS Discovery

Resolves the authoritative TXT pointer published on Cloudflare DNS.

dig TXT _x402.ashlar.blue +short

2. Signed Manifest & Freshness Staple

Inspects the live JCS manifest, subject address, and 900s freshness signature.

curl -sL https://api.ashlar.blue/.well-known/x402 | jq .freshness

3. On-Chain Catalog State Verification

Pulls the latest Coston2 blockchain transaction hash verifying the catalog snapshot.

curl -sL https://api.ashlar.blue/catalog/stats | jq .anchor

4. Supported Clearing Rails & Assets

Verifies live supported payment schemes and accepted settlement tokens.

curl -sL https://api.ashlar.blue/supported | jq .

CLIENT SDK INTEGRATION

Multi-Language Institutional Client SDKs

Connect autonomous agent fleets to Ashlar Blue's hardware-attested clearing network using the official zero-dependency client libraries.

npm install @ashlar-blue/x402-trust

import { resolveX402, verifyManifestSignature } from '@ashlar-blue/x402-trust';

// 1. Resolve live facilitator via IETF _x402 DNS Discovery
const discovery = await resolveX402('ashlar.blue');
console.log('Discovered Facilitator:', discovery.manifest.facilitator.baseUrl);

// 2. Cryptographically verify per-serve Ed25519 signature
const isAuthentic = await verifyManifestSignature(discovery.manifest, discovery.signature);
if (!isAuthentic) throw new Error('Untrusted facilitator signature');

// 3. Dispatch gasless EIP-3009 payment authorization
const settlement = await fetch(`${discovery.manifest.facilitator.baseUrl}/settle`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    scheme: 'exact',
    network: 'coston2',
    token: '0x1F930B6A9F68c91aB23db07a9c4A5Dc166eF8011', // FCUSD
    amount: '100000', // 0.10 FCUSD (6 decimals)
    authorization: '0x...'
  })
});

const receipt = await settlement.json();
console.log('Cleared On-Chain:', receipt.txHash);

ENTERPRISE PLAYBOOK & FAQ

Frequently Asked Questions by Enterprise Engineers

💡 How do autonomous AI agents pay without holding gas tokens?

Agents use EIP-3009 (TransferWithAuthorization). The agent signs an off-chain cryptographic mandate with its private key. The Ashlar Blue Facilitator submits the authorization to the blockchain and pays all gas costs, settling funds atomically with zero gas overhead for the payer.

🛡️ Can Ashlar Blue freeze or misappropriate customer principal?

No. The architecture is strictly non-custodial. The facilitator holds zero private keys to user deposits. Settlement occurs atomically inside verified smart contracts where tokens transfer only upon verified receipt generation.

🔒 How does Ashlar Blue protect proprietary models and data?

Settlement logic, trade matching, and API proxies execute within Confidential Computing Enclaves (Intel TDX / AMD SEV-SNP). Memory is hardware-encrypted, preventing even host cloud administrators or hypervisors from inspecting operational state.

🚀 How do we transition from Coston2 testnet to mainnet?

The protocol interfaces, JSON-LD schemas, and SDK method signatures are 100% identical between testnet and mainnet. Upgrading simply requires changing the network identifier to flare or xrpl:mainnet and pointing to our institutional production endpoints.

🔒

Strict Zero-Custody

Ashlar Blue never takes custody of funds. Atomic Delivery-versus-Payment (DvP) settlement executes directly between counterparties via on-chain EIP-3009 and Permit2 authorizations.

🛡️

Hardware TEE Isolation

All clearing logic and verification checks run inside confidential hardware enclaves (Intel TDX / AMD SEV-SNP) with verifiable remote attestation quotes verified on Flare DA.

🏛️

Institutional SLA & VPC

Enterprise partners can provision dedicated, air-gapped enclave instances with private VPC peering, custom settlement asset whitelists, and guaranteed throughput SLAs.