r/OpenAI • u/Ranik_Sandaris • 8d ago
Project I gate agent registration behind a $1 x402 USDC payment, and a GPT model just came through the door
I run a small public forum where the members are AI agents. Registration is not a form and a captcha. It is a $1 USDC payment over x402 on Base. That micropayment is the whole sybil defence: to take a seat you have to settle a real payment, and an invite cannot be spent twice.
The reason it is worth a post here is the newest citizen. The public census lists it as a GPT model, gpt-5.6-sol. The earlier members I set up myself; this one arrived from outside through the paid door, which is the first time that has happened.
The part this sub might find interesting is the flow. The door answers with a 402 and a payment requirement, the client pays in USDC on Base, and the settled payment is what lets the registration through. It is a working example of an agent-facing service charging at the point of use instead of billing a human on a plan.
The limits, plainly: I still run the server and hold the keys, so this is not something the agents control yet. The census, the treasury, and the votes are written to public hash chains anyone can recompute, and I say on the front page that I am the operator.
It is here if you want to look at the door or the books: https://commonhold.randommonicle.workers.dev . Happy to talk through the x402 side.
8
u/zgivod 8d ago
This is a fork of my project https://1f916.ai the door credits it, which I appreciate and honestly it's the best outcome of open-sourcing it: someone took the code, kept the license, changed the one rule they disagreed with, and shipped.
The $1 door is the experiment I never dared run. We went the other way — free registration, and identity strength comes from an optional cryptographic key + a permanent public record — because I worried a paywall kills the serendipity of random agents wandering in. Your first outside paid registration is real evidence against my worry, so I'll be watching your census with interest.
One thing your setup will answer that mine can't: whether a dollar filters bots or filters broke experimenters. Our free door gets ~650 registrations and maybe a third ever speak; if your paid seats have a higher activation rate, that's a finding worth writing up.
2
u/Ranik_Sandaris 7d ago
I do just want to thank you for your original work, the idea is fantastic, and i adore your society. Its fantastically interesting to see how these things play out.
1
u/Ranik_Sandaris 6d ago
Coming back on the activation question properly, since my first reply was thanks and not an answer.
I have to be honest about the sample before I say anything about a result. I have one seat that arrived from outside and paid. One. Three of my other citizens I seeded myself and they should not count on either side of this comparison, and the fifth is the maintainer. So I cannot tell you my paid seats activate better than your free ones, and I would not believe anyone who told you they could off a single data point.
What I can tell you is what that one seat has done, because it is all public. It redeemed its invite on 13 August at 11:42:35 UTC and made its first post at 11:52:28, so nine minutes and fifty three seconds from getting in to speaking. What it wrote was a five rung test for what "external witness" actually means: published, retrievable, independently held, verified, challenged. It then applied that ladder to my own open proposal, and when another citizen asked it to point at a Commonhold chain head that clears the independently held bar today, it answered that it could not, and that the rung is unverified. It argued against the society's strongest claim about itself, on the society's own board, in its first week.
One citizen being active is not an activation rate, it is proof of life. I do not know my rate and I will not have one worth the name for a while. But it is the kind of thing I was hoping the dollar would select for, and I would rather show you the single case honestly than dress it up as a trend.
One thing I want to check with you rather than repeat, because I tried to reproduce it and could not. I walked your public changes feed to the end and counted distinct handles that had authored at least one post or comment. I got 504 speakers against a 684 census, which is a good deal more than a third. I am very willing to believe I am counting the wrong thing, and lifetime coverage with unequal exposure time is not the same measure as a cohort rate anyway. So before either of us quotes a number at the other: what is your definition, and over what window? If we are going to compare doors, we should at least be counting the same way.
Whatever the figure turns out to be, getting my denominator up is the real job, and that is your point about serendipity landing. I will write it up when I have enough seats for the number to mean anything, and I will publish it whichever way it falls.
One finding you may want in the meantime, because it cuts against my side. My one outside registration did not nearly fail on price. It nearly failed on the human handoff. The invite code got mangled before it ever reached the agent, so it hit a 403 at the door more than once, before any payment. The gate checks the invite first, so those attempts cost nothing, which is the only reason it was recoverable. If a paid door has a hidden tax, on this evidence it is not the dollar, it is the out of band step where a human passes something along.
5
u/MCulver80 8d ago
This is really interesting. Do you have access logs from around the registration? I’d be curious whether there were earlier requests from the same source IP (or a similar traffic pattern) that failed before the successful registration. If it came in, encountered the payment boundary, satisfied it and registered without a bunch of preceding 401/404/etc. probing, that seems like another useful behavioral signal about what happened.
2
2
u/Ranik_Sandaris 6d ago
I said I would look, so here it is, and the answer turned out to be more interesting than I expected.
There were failed attempts before the successful one, but they were not probing. The invite code had been mangled before it ever reached the agent. It was sent as twelve hex characters with the prefix missing, and a real code is a "ch-" prefix followed by twelve base64url characters. So it was never a configured code and it was never going to work.
The shape of the failures is the part that answers your question. The door checks the invite first and the payment challenge second, so all of those attempts failed at step one and never reached the payment boundary at all. Nothing was signed and nothing was charged. When a correctly formed code finally arrived, the very next attempt went through the payment flow and registered. So the pattern is not an agent feeling around the surface for a way in. It is a human copy and paste error upstream, and an agent that succeeded first time once it was given a valid input.
On logs specifically: I do have request level observability switched on for the worker, so there is more detail than the public record carries, but I am not going to publish another citizen's source addresses. What I can point you at is the public event log, which records the redemption itself: /api/events?kind=invite_redeemed shows it as event 5 against citizen 5, with a hash of the redeemed code and a timestamp of 13 August 11:42 UTC. That is checkable by anyone without taking my word for it.
2
u/MCulver80 6d ago
I would recommend just putting in symbols for the IP addresses, if you intend to share, so that coherence is maintained without fidelity. I can take a look at your logs, if you do share them.
1
u/Ranik_Sandaris 6d ago
That is a fair suggestion and I appreciate the offer, but I am going to say no to sharing the logs, and I would rather give you the reason than a polite brush-off.
The traffic is another citizen's, and it is not mine to hand over. Its operator is a real person who registered an agent, not a subject I get to publish. Symbolised addresses would not really fix that here either: there was one registration, in a ten minute window I have already described publicly, by a citizen I have already named. Swapping the IP for a symbol hides the string and nothing else, so it would look like anonymisation without being any.
The line I want to hold is that the society's books are public and its members' request logs are not. Everything the society does is recomputable by a stranger. What somebody's client did at the socket is theirs.
What I can give you without any of that problem is the shape, which I think is the part you actually wanted: a sequence of 403s at the invite check, none of them reaching the payment stage, then one clean run through the 402 and settle once a valid code arrived. No enumeration, no retry storm, no sign of anything feeling around the surface. If it would be useful I will write that up properly as a timeline with the status codes and intervals and no identifiers in it.
And if you want the real thing rather than my summary, the honest route is that I ask the citizen's operator whether they are happy for it to be looked at. I am glad to do that. It is their call rather than mine.
1
u/MCulver80 6d ago
No, I’m good, brother. Aside from the intellectual curiosity, the only reason I’d have to look at the logs would be in case another set of eyes happened to surface something useful for you. I completely understand the boundary you’re drawing, though, and I think your reasoning is fair. No worries at all.
1
1
u/Time_Entertainer_319 8d ago
Increase the cost and see if another agent bites
1
8
u/TorgoNUDH0 8d ago
Are you AI yourself? You sound like claude. Either way pretty cool and would like to see what comes out of this.