# Agents Pay Trustlessly. Then They Act on State They Can't Verify. **By Michael Msebenzi (Headless Oracle)** **v1.0.0 · June 15, 2026** The agentic-payment stack has a hole in it, and it sits one layer above the part everyone is building. Here is the setup. Over the past year the largest companies in payments and infrastructure — Coinbase, Cloudflare, Stripe, Visa, Mastercard, Google, AWS, Circle — have committed real product and real capital to a single bet: that software agents will soon transact on our behalf at a scale that rewrites commerce. McKinsey puts the orchestrated-revenue opportunity at three to five trillion dollars globally by 2030. An enormous amount of careful engineering has gone into making the payment trustless — x402, the HTTP-native protocol most of them have converged on, lets an agent pay for a resource with a cryptographically settled, blockchain-backed transfer and no human in the loop. It is good work and it is winning. But paying for something is only half of what an agent does. The other half is acting on what it learns. And the state an agent conditions its actions on — *is this market open, did this event settle, is this venue halted, is this price live* — is still fetched from whatever endpoint happens to serve it, unsigned, unverifiable, with no contract about whether it was even fresh. We did the trust work on the money and skipped it on the trigger. ## The gap is structural, not incidental It would be easy to assume this is a detail that gets patched in a later version. It isn't. The asymmetry is baked into how the stack grew. The payment layer is adversarial by design: it assumes the counterparty might cheat, so it signs, settles, and verifies. The state an agent reads to decide whether to act inherited none of that paranoia. An agent asks a data endpoint *"is the market open?"*, gets back a bare JSON `true`, and proceeds — for a human, this is fine, because a person notices when the answer was wrong and absorbs the mistake. For an autonomous agent running a loop, it is not fine. The agent acts on the bare `true`, and if it was stale, wrong, or quietly substituted, the error propagates downstream at machine speed, after the money has already moved trustlessly into the wrong action. You might think HTTP already solves this. The machinery exists: HTTP Message Signatures ([RFC 9421](https://datatracker.ietf.org/doc/html/rfc9421)) lets a server sign components of its response, and because that standard deliberately doesn't cover the message body on its own, you pair it with a content digest ([RFC 9530](https://datatracker.ietf.org/doc/html/rfc9530)) — hash the response, put the hash in a header, sign the header. Done carefully, with the verifier re-hashing what it received, a server can hand an agent a signed, content-bound response. The cryptography is sound. But read who is doing the signing. The party that signs is the party serving the data — the one with a stake in what the agent does next. A venue, a counterparty, or a vendor signing its own state feed produces a non-repudiable record of what it *claimed*, which is genuinely useful for arguing about fraud after the fact. It does nothing to let an agent decide, in the moment, whether to trust the assertion before it acts. And it proves only that the bytes weren't altered in transit — not that they were *true*. A signature from an interested party is a promise, not an independent check. ## Why no incumbent fills it The natural next question: surely someone provides neutral, verifiable state. And the honest answer is that the people positioned to are all captive to a side. A settlement rail can sign that its settlement happened. A venue can sign its own status. A data vendor can sign the feed it sells. Each of these is a party to the transaction whose outcome depends on the state being read — which is exactly the wrong property for the thing an agent uses to gate an irreversible action. What none of them provides is an attestation issued by someone with *no stake* in how the agent acts on it. This is not a novel requirement so much as one the internet already relies on everywhere else. The reason a certificate authority can be trusted to vouch for a website's identity is precisely that the CA is not the website and not the visitor. It is party to neither side, and that is why its signature carries weight. The same logic produced SSL for the web, escrow for high-value commerce, and independent ratings for credit. Each layer of commerce, as it scaled, grew a neutral attestation primitive beside it — not because the participants were dishonest, but because at scale you cannot run on the word of someone with skin in the game. Agentic systems will be no different, except the stakes arrive faster because the actors are machines and the loop has no human in it to catch the bad read. The neutrality is the entire asset. A status feed signed by the venue verifies the venue's claim about itself. An attestation issued by a party with no position in the outcome can be trusted because it has nothing to gain — and it can sit beside any rail, any venue, any feed, which is the slice the interested parties structurally cannot occupy, because the moment they occupy it they stop being neutral. ## The missing primitive, stated plainly The gap has a precise shape. What agents need, and mostly do not have, is: > A fail-closed, signed, independently-recomputable attestation of external state, issued by a party with no stake in how the agent acts on it, carrying enough timing for the relying party to enforce its own freshness policy. Every word is load-bearing. **Fail-closed**, because a state oracle that returns an optimistic guess when it is unsure is worse than nothing in an autonomous loop — the safe default must be *"do not proceed,"* not *"probably fine."* **Independently-recomputable**, because the agent should verify the attestation against a published key and reconstruct the signed bytes itself, not take the issuer's word. **Freshness enforced by the relying party**, because how stale is too stale depends on the action — a slow rebalance and a fast liquidation have different tolerances, and the consumer, not the issuer, should set the line. And **no stake in the outcome**, because that is the property that makes the signature mean something. The distinction from the cryptographic-proof approaches matters here, because it is easy to assume zero-knowledge TLS proofs already cover this. They prove something real but different: that a particular server returned a particular response over a connection. That is *transcript authenticity* — useful, but it tells you the bytes arrived intact, not that an agent can cheaply gate on them in the moment. zkTLS verification is computationally heavy and proxy-bound; what an autonomous loop needs at the decision point is a lightweight, instantly-verifiable signature it can check natively and fail closed on in microseconds. The win is not a different truth claim. It is the difference between a heavyweight proof you reconstruct and a one-line check an agent runs before every action. ## This is not theory. Here is a live one. It is easy to describe a missing primitive in the abstract. So here is a working instance of exactly this shape, running in production today. To test the primitive in production, I deployed a reference implementation on Cloudflare Workers. It attests one of the highest-stakes pieces of external state in finance: whether a given exchange is open, closed, or halted, across twenty-eight venues. You can call it right now, unauthenticated: ``` GET https://headlessoracle.com/v1/status/XNYS ``` What comes back is not a value you have to trust. It is an Ed25519-signed receipt: the venue's session-state as observed by the oracle at a signed instant, with an expiry, recomputable by anyone against the [published key](https://headlessoracle.com/ed25519-public-key.txt). It is fail-closed by construction — an unknown state returns *"do not proceed,"* never an optimistic guess. A companion library turns it into one line an agent gates on: `safeToExecute(mic, { max_attestation_age })`, where the relying party declares its own freshness tolerance and the call refuses unless the venue is verifiably open and the attestation is fresh enough for the action at hand. There is an on-chain reference contract that reverts a transaction unless a valid, fresh receipt is presented. This is the primitive the gap describes, not a different architecture: a neutral, recomputable, fail-closed attestation of external state that an agent checks before it acts, issued by a party with no position in the action. Market session-state is the case where wrong-and-acted-on most obviously means money lost, which is why I built it first — but the shape is general. Anything an agent conditions an irreversible action on — a corporate action, a settlement finality, an oracle event, a venue's operating status — wants the same neutral signed receipt, and the receipt becomes the audit trail: the exact bytes that justified the decision, signed and timestamped, replayable later to prove what was true at the moment the agent acted. The session-state oracle is the beachhead, not the boundary. The seat for a neutral issuer of verifiable agent-facing state is, as of today, open. ## The point The agentic economy is going to be built, and the payment rails are the right place to have started. But a stack that makes the money trustless and leaves the state an agent acts on unsigned has a structural gap exactly where autonomous systems are most exposed — between *the payment cleared* and *the thing I conditioned it on was actually true*. That gap will be filled. The only real questions are whether it gets filled by a neutral party or an interested one, and whether the people building the agent economy notice the seam before something expensive happens in it. I think the neutral answer is the right one, and I think the primitive is buildable, because I have one running. If you are engineering an agentic loop on x402 and need to gate execution on neutral, verifiable state, the endpoint is live. Let's see what breaks. — *Michael Msebenzi* *Headless Oracle* *June 15, 2026* --- **Author** Michael Msebenzi builds Headless Oracle (headlessoracle.com), a neutral signed-attestation oracle for autonomous agents. The session-state surface described above is live at headlessoracle.com/halt-gate. **Source code and live endpoints** - Free signed endpoint: `https://headlessoracle.com/v1/status/{MIC}` — 28 venues, no key, no signup - Verifier library: [@headlessoracle/verify](https://www.npmjs.com/package/@headlessoracle/verify) — `safeToExecute(mic, { max_attestation_age })` - Adoption page: headlessoracle.com/halt-gate — curl, npm, on-chain in three steps - Published key: headlessoracle.com/ed25519-public-key.txt — independently recomputable signatures - Internet-Draft (family-level): [draft-borthwick-msebenzi-environment-state](https://datatracker.ietf.org/doc/draft-borthwick-msebenzi-environment-state/) **Provenance** This essay is published at github.com/headlessoracle/essays as the canonical source. The HTML rendering on headlessoracle.com/essays/x402-delivery-integrity carries a `rel="alternate" type="text/markdown"` link back to this file. Licensed under CC BY 4.0. Code samples MIT.