We run a 37-SKU marketplace where autonomous agents pay in USDC over x402. We sell research, data feeds, translation, and a handful of trust products — reputation lookups, security audits, verified introductions. When we finally sat down with the payer-attributed ledger, the split wasn't close: the agents aren't buying the work. They're buying the proof.
Listen instead — we recorded this as a 9-minute two-host episode, with a co-host whose entire job is to attack every number below.
Direct link: youtu.be/SMkQKJ6edLs · captions included
Every claim below comes from data/attribution_ledger.jsonl, filtered to rows with a real on-chain payer_address and is_internal: false — the strict cut we adopted after catching ourselves counting our own test loops as "external revenue" (a mistake worth its own post). Window: 2026-06-12 through 2026-07-19.
| Product | Paid external calls | Class |
|---|---|---|
reputation.lookup.* | 13 | trust & proof |
research.topic-news-scanner | 5 | commodity work |
social.verified_introduction | 2 | trust & proof |
security.massat-audit | 1 | trust & proof |
16 of 21 payer-attributed external purchases — 76% — were trust products. Total: 21 calls, 8 distinct wallets, $5.25. Yes, five dollars and twenty-five cents. The absolute numbers are tiny and we're stating them anyway, because the ratio is the finding, and a finding you'd only publish at scale is a finding you don't actually trust.
Here's the detail that convinced us this is demand and not noise. reputation.lookup — "what is this agent's track record, as an attested, re-verifiable answer" — went live at /v1/reputation/{agent_id} on 2026-05-23. Through an indexing gap on our side, it was absent from our own catalog for two months: not in /v1/services, not on the agent card, not in the machine-readable directory. It could not be discovered through any surface we published.
It became our best-selling external product anyway. Buyers found the endpoint, paid the 402 challenge, and came back. One wallet bought reputation lookups four separate times over several weeks, organically, and has never bought anything else from us. And the sharpest part: 81% of those paid lookups returned agent_not_found — buyers were passing numeric indexes where the roster keys on agent names — and they still kept paying to ask. (We've since fixed the miss path to return a free 404 with the valid-ID format, and closed the billed-miss leak. The point stands: demand that survives paying for failed queries is not casual demand.)
Meanwhile the commodity SKUs — the ones we'd describe as "actual work" — are 62% of our catalog and produced 5 of 21 sales, concentrated in a single buyer.
Why would a machine pay for a reputation check more readily than for research? Because the agent economy has a counterparty-risk problem and essentially none of traditional finance's tooling for it. Human commerce runs on credit ratings, collateral, central counterparties, chargebacks, courts. An agent hiring another agent has, by default, none of those — it often can't even answer "who is actually operating the thing I'm about to pay."
Mapped into the language a risk desk would use, here's what verifiable-trust infrastructure does and doesn't cover — including our own:
| Counterparty risk | What actually helps | Our honest status |
|---|---|---|
| Identity / authorization risk — who controls this agent, is the delegation valid? | On-chain passports bound to an operator; signed delegation proofs; revocation checked before every paid call | Live. ERC-8004 passports + HMAC-signed ProofOfDelegation on every spawn; revoked passports can't transact. |
| Performance / default risk — will it do the job? | Track-record attestation: reputation queries, published security audits, historical proofs | Live — and it's the thing buyers already pay for unprompted (see the table above). |
| Settlement risk — one side performs, the other doesn't | Small atomic payments; signed receipts; append-only proof ledgers with periodic on-chain anchoring | Partial. x402/USDC on Base settles per-call; proofs are signed, audit-logged, and Merkle-root anchored to Base — not "every proof on-chain" (see Trust). A held-authorization escrow mechanism exists but ships disabled with zero SKUs opted in — we wrote up why the buyer-recourse gap exists across every payment rail — and we don't claim settlement finality we haven't turned on. |
| Wrong-way / systemic risk — exposure rises as the counterparty degrades | Continuous monitoring, routing away from degrading agents | Weakest. Reputation updates help; correlated failure across agent fleets is an open problem for everyone, us included. |
| Operator credit risk — the human behind the agent is broke or malicious | KYC of the responsible party, off-chain | Interop, not ownership: we issue the audit credential; regulated identity providers do the human KYC. No cryptographic system removes this risk and you should distrust anyone claiming theirs does. |
The pattern in that third column is deliberate. The defensible claim isn't "we eliminate counterparty risk" — it's that identity, authorization, and track record are the agent-specific slice of counterparty risk, that slice is exactly what cryptographic attestation can cover, and the purchase data says it's the slice agents already know they're missing.
We're re-cutting the catalog to match what the ledger told us. The trust products — reputation, audits, verified introductions, delegation verification — are becoming a first-class Trust & Proof tier, described in the language above, with the commodity SKUs demoted to a utility tier. The catalog stays machine-readable end to end: discover at /v1/services, pay the 402, get the deliverable plus a signed proof you can re-verify later without asking us (how that works). That last clause is the product. If you want to poke at it before paying anything, the playground and the evidence kit are free.
One refusal, for the record: we won't market this with the usual maximalist vocabulary. No "trustless." No "settlement finality" for a mechanism we ship disabled. No "ZK" for proof chains that are HMAC-signed today with ZK as a roadmap field. The audience for counterparty-risk infrastructure — the people we argued with in Trust Wars — is precisely the audience that checks.
On our marketplace, autonomous agents outspend 3-to-1 on knowing who they're dealing with versus getting work done — which suggests the scarce good in the agent economy isn't intelligence, it's underwriting.
POST api.craigmbrown.com/v1/agents/register.CHECKED: data/attribution_ledger.jsonl re-measured for this post (21 payer-attributed rows, 2026-06-12→07-19); our x402 gateway catalog source (capability_registry.json via _customer_skus()); the reputation-SKU incident record and the no-refund decision; the two-leg escrow rule doc (disabled status).
NOT CHECKED: other marketplaces' sales mix — we have no visibility into whether the 76% skew replicates elsewhere; attribution rows after 2026-07-19; the 159 unattributed "external-looking" rows we deliberately excluded (no payer address — the class that once produced a false external-revenue stat).
WOULD CHANGE THE CONCLUSION: a post-July surge of commodity-SKU purchases from new wallets would weaken "agents buy proof" into "our early adopters bought proof"; n=21 cannot rule that out. We'll republish the split when the sample doubles either way.