on-chain evidence · aleo testnet
Don’t trust this page.
Every claim below is a link to consensus. Verify each one yourself — the explorer is the judge, and it will show you a valid proof with nothing readable inside.
curl -s https://api.explorer.provable.com/v1/testnet/transaction/at1ppx9qpv5nrv0svffk0tgp8r7ydvkm9hvmcuwg69x85zcyrsx9y8qna5ttq | tr -d '\000-\037' | grep -oE 'aleo1[a-z0-9]{58}|1500000' | wc -l
a 1.5-credit payment's full public record: zero addresses, zero amounts — this prints 0
A · the loop
deploy · @noupgradeat1ejrwz74…x3uyg6
The circuit, deployed permanently. No one — including us — can ever change what it enforces.
create_vaultat1ledwvkk…hx0pcz
A policy sealed: budget, cap, categories, expiry — none of it visible, fee paid from a private record.
private spendat1ppx9qpv…qna5ttq
1.5 cr to a merchant. The public record holds no addresses and no amounts — public args: [vault_id, expiry]
private spendat1u9cr27c…su3g0lu
A second category, a second merchant payment, the same silence.
B · the controls
owner-approved spendat1zw8a5nz…sv6uxex
Above the owner’s comfort threshold, the agent paused mid-task. The approval reached it in 2.0 seconds; then this settled.
bought by claude, over mcpat1zstk07k…3zse4s
A live Claude Code session read the policy, checked the quote, and paid — through the same circuit, with the same limits.
top-up, answeredat17qxry90…kq39as
The agent ran out of records mid-task and filed a request. The owner funded it; the next run completed this purchase.
C · the refusals the chain made
revokeat1j9vngar…xd7tg0
The owner’s capability record is consumed; one public bit flips. That bit is all the world learns.
spend after revokeat173tdw3m…sxv7hm2
A mathematically valid proof, rejected at finalization: status "rejected". The kill-switch is consensus, not a prompt.
bypassed the circuitat15m3q9n3…sn4t2ly
A direct transfer that paid the merchant the exact quoted amount — and the paywall refused it anyway, because it didn’t go through spend().
what the chain knows — in total
- an anonymous vault id
- an expiry height
- a spend counter
- the revocation flag
Four values. Enough to enforce expiry, count activity, and honor the kill-switch — nothing more.
what it never learns — touch to decrypt
- every amount paid
- every merchant paid
- the remaining budget
- the per-transaction cap
- the category allowlist
- who the owner is
- who the agent is
Once you look, it stays readable — that is what holding the view key feels like. The chain never gets to look.