The agreement and policy layer for programmable money.

Overview

COVENANT coordinates exact USDC payment intents across a deterministic authorization policy, an immutable CovenantVault on Arc Testnet, and isolated execution workers. The browser and proposing agent never receive payment authority.

Quickstart

Use the server-side TypeScript SDK with a project API key. Credentials belong in trusted backend code, never in browser bundles.

import { Covenant } from "@enrare/covenant-sdk";

const covenant = new Covenant({
  ["api" + "Key"]: process.env.COVENANT_API_KEY!,
  baseUrl: process.env.COVENANT_API_URL,
});
const result = await covenant.covenants.get("covenant-id");

Authentication

Send the project API key from a trusted server using the SDK or REST API. API authentication grants project access; it never grants signer, wallet, or arbitrary transaction authority.

Create

Create a Covenant with exact project, vault, token, recipient, budget, count, policy, and validity terms. The API rejects unsupported or ambiguous configuration.

Retrieve

Retrieve a Covenant by its exact project and covenant identity to inspect immutable terms and current lifecycle state.

Authorize

Submit signed vendor and agent evidence. COVENANT evaluates eleven canonical rules and issues short-lived DecisionReceipt and AuthorizationReceipt evidence only for an exact approved intent.

Execute

Execution is a separate, submission-only boundary. The executor reconstructs fixed CovenantVault calldata and cannot change signed payment fields.

Observe

Circle provider status and Arc receipt/state observations are read independently and reconciled without authorizing another payment.

Audit

Audit timelines provide deterministic, non-authoritative evidence with stable identities, causal links, and explicit claim boundaries.

Errors

Malformed schemas, expired evidence, signer mismatches, replayed nonces, unsupported chains, and ambiguous provider outcomes fail closed with sanitized errors.

Security

The core invariant is simple: no component capable of generating payment requests possesses authority to execute payments. Trust anchors bind each worker to one exact vault and specification.

ERC-1271

Agent PaymentIntent signatures support both EOAs and ERC-1271 smart accounts. Contract signatures are accepted only when the configured signer contract returns the ERC-1271 magic value on Arc Testnet.

Architecture

Agent proposes; Authority evaluates; an isolated signer authorizes; the executor submits through Circle; CovenantVault enforces limits and replay state on Arc; evidence and audit remain read-only.