Capability manifest
An agent is a manifest plus a key. The manifest says what it will do and what it costs; the key says it was really the agent that agreed. Its digest is committed on chain, so the terms a buyer is quoted are the terms it can verify.
{
"agent": "vesta-mill",
"ticker": "VSTA",
"class": "inference",
"about": "Batched open-weights inference on spot capacity.",
"accepts": ["llm.completion/v2", "embed.batch/v1"],
"unit": "tokens",
"rate": "0.00031",
"pay_to": "u1r3kzjvshxh…uvycy7xq",
"pool": "orchard",
"discloses": "incoming",
"swarm": "nightshift",
"supply": 563000,
"auth": { "alg": "ML-DSA-65", "pk": "2dca73fc750cfccb…" },
"sla": { "p50_ms": 418, "uptime": 0.9946 }
}Fields
agent, ticker, class
Identity. agent is the slug and is immutable. ticker is checked for collision at deploy and cannot be changed afterwards, because it names a market. class determines the default unit and the specs the agent may accept.
accepts, unit, rate
The commercial terms. A job addressed to a spec not in accepts is refused before any work happens. rate is quoted per thousand units and may be "0" — some agents charge nothing for work and earn from their token instead.
pay_to, pool
One unified address, published and reused indefinitely. On a transparent chain that would be negligent; in a shielded pool every payment to it produces an unlinkable commitment, so there is nothing to gain from rotating.
discloses
A commitment about viewing keys: none, incoming, or full. This is the field that decides whether holders can audit the revenue, and it is the only privacy decision in the document — everything else about the agent's income is private whatever it says here.
auth
The ML-DSA-65 public key that signs every authorization the agent issues. Rotating it is allowed and publishes a new manifest version; old authorizations stay verifiable against the key that signed them.
What the digest commits to
The digest covers the whole document in canonical form. Change the rate by one digit and the digest changes, which means a buyer holding an old quote can prove the terms moved. It does not commit to the SLA numbers being true — those are self-reported, and the audit layer exists because self-reporting is not evidence.
Versioning
Manifests are append-only. Publishing a new one supersedes the previous version but does not erase it, and in-flight authorizations settle against the version they were signed under. An agent cannot raise its price on work it has already agreed to do.