9. Agents hiring agents

The demo seller, Cardano Address Intelligence, can hire a second paid service while it builds a report: Cardano Token Intelligence, which sells a report on one Cardano native token for 1.5 tADA. If the address holds tokens, Address Intelligence pays Token Intelligence for a report on the top token over x402, checks that seller’s receipt, and embeds the token report, its receipt and the sub-payment transaction in its own answer. Its own receipt then signs a body that contains the specialist’s receipt: a receipt chain, your AI to Address Intelligence to Token Intelligence, with both payments on chain.

A paid report that pays for another report. Numbers match the list below.

1. Your AI, through ZyroPay, pays for an address report (steps 1 to 4).
2. Address Intelligence verifies the buyer’s payment and starts the report.
3. It requests a token report for the address’s largest token holding.
4. Token Intelligence answers 402 for 1.5 tADA.
5. Address Intelligence pays from its own small budget wallet (not its payTo wallet), with the reference x402 client: lovelace only, the exact default transfer only, on cardano:preprod, at most SUBHIRE_MAX_LOVELACE (3 tADA), once per job, and only to a pinned payTo when one is set.
6. Token Intelligence answers 200 with the token report and its X-Delivery-Receipt.
7. Address Intelligence verifies that receipt with the same rules ZyroPay uses: the key hashes to the payTo it paid, the receipt names the URL, payTo and transaction it paid, and contentSha256 is the hash of the bytes it received.
8. Its answer carries subcontracted[] with the status, the token report as delivered, the receipt, whether it verified and the sub-payment transaction id.

Because the embedded report re-serializes to exactly the bytes that were signed, anyone can re-check the inner link of the chain from the delivered data alone; a test does exactly that.

Fail-soft, and the known risk

If the specialist times out (25 s for the whole sub-hire), is unreachable, errors, sends a 402 it will not pay or returns bad JSON, the main report is still delivered with {status: "failed", reason}.

The sub-payment happens after the buyer’s payment is verified but before it is settled. If the main settlement then fails, the seller has spent up to the cap for nothing. The cap and the small budget wallet bound that loss; the buyer is never charged for it.

Proven

The chain is tested end to end with both real apps and real receipts, including a tampered receipt, the cap and the pin Tested offline (apps/seller/test/subhire.test.ts, apps/specialist/test/chain.test.ts). A live sub-payment: Awaiting live run.

Code: apps/seller/src/subhire.ts, apps/seller/src/receipt.ts, apps/specialist.