xyz.tenzro/tenzro

Return AP2 protocol metadata: version, supported mandate types, supported VC formats, and issuer DID methods recognized by this node.

Sign an AP2 mandate (Intent or Cart) with the auth-bound wallet's Ed25519 key, returning a verified Verifiable Digital Credential (VDC). Auth: DPoP+JWT mandatory. Wallet must be Ed25519. signer_did must match the wallet's controller DID.

Validate an AP2 v0.2 Checkout+Payment mandate pair for consistency: ensures the PaymentMandate references the CheckoutMandate, amounts/items match the checkout's constraints, and both VDCs verify. When enforce_delegation=true, additionally cross-checks the agent's TDIP DelegationScope against the payment total (TDIP identifies. AP2 authorizes. Tenzro settles).

Verify a single AP2 mandate (Verifiable Digital Credential). Checks the VDC proof, issuer, and schema for Intent, Cart, or Payment mandates per Google's AP2 spec.

Write one inbound snapshot chunk. The chunk's SHA-256 is verified against `manifest.chunk_hashes_hex[chunk_index]` before any disk write. On the final chunk, all chunks are decoded and atomically committed via `write_batch_sync`; `complete` will be `true` on that call. Returns `{complete, height, chunk_index}`.

Assign a task to a specific agent on the Tenzro Task Marketplace. Moves task from open to assigned state and notifies the agent. Returns the updated task record.

Return the current node wall-clock as a Tenzro AttestedTimestamp envelope. The returned shape carries wall_ms, monotonic_ns, and TEE vendor (null when the node is not running inside a TEE).

Mint a tokenized asset ONLY if post-mint supply <= attested reserves (1:1 backing as a protocol invariant). Rejects with no/insufficient reserves. Mirrors tenzro_attestedMint.

Authorize a bridge address for ERC-7802 crosschain mint and burn operations. Only authorized bridges can mint/burn tokens for cross-chain transfers. Sets daily mint and burn limits for rate limiting.

Check — without side effects — whether caller_did may read the database. Returns {authorized, reason}.

Authorize a temporary session for a wallet with specific allowed operations and a time limit. Returns a session ID and expiry timestamp.

Dispatch an Axelar GMP `call_contract` message. Correlation id is `keccak256(payload)`.

Look up an Axelar GMP message by payload hash.

List supported Axelar chains. Reach spans 30+ chains: EVM, Cosmos (Osmosis, Cosmos Hub, Juno, Neutron, Injective, Kujira, Crescent, Evmos), Move (Aptos, Sui), Stellar, XRP Ledger, Hyperliquid, Filecoin EVM, Kava.

Pre-pay the Axelar Gas Service for a previously-dispatched message.

Read the Babylon finality-provider record for a Tenzro validator.

List BTC delegations for a finality provider.

List every registered Babylon finality provider.

Register a Tenzro validator as a Babylon finality provider. Tenzro validators are then economically secured by native BTC delegations through Babylon's finality-providers protocol.

Submit an EOTS (Extractable One-Time Signature) over a Tenzro block hash. Equivocation slashes the BTC delegations bonded to the finality provider.

Sum BTC delegations for a finality provider.

Get a bridge quote without executing the transfer. Returns estimated output amount, fees, estimated time, and recommended route. Useful for previewing costs before committing to a bridge transfer.

Bridge tokens between blockchains. Supports routes between Tenzro, Ethereum, Solana, and Base via LayerZero, Chainlink CCIP, and deBridge adapters

Execute a bridge transfer with a deBridge post-fulfillment hook. After the tokens arrive on the destination chain, the hook_target contract is called with hook_calldata. Enables composable cross-chain operations (e.g., bridge + swap, bridge + stake).

Get the CAIP-10 account id for a Tenzro address. Accepts hex or base58btc on input; normalises to canonical 64-hex.

Get the CAIP-19 asset id. Asset namespaces: `slip44` (native TNZO, SLIP-44 coin index 1414421071), `token` (Tenzro token registry id, 32-byte hex), `nft` (collection id + nft_token_id).

Get the CAIP-2 chain id for this node: `tenzro:<lowercase hex of the first 16 bytes of the genesis block hash>`. Returns `{chain_id, namespace, reference, evm_chain_id}` — the `evm_chain_id` sidecar is for EVM tooling.

Cancel a pending or active task on the Tenzro Task Marketplace. Only the original requester can cancel. Refunds any escrowed TNZO. Returns cancellation confirmation.

Assign a solver to a capital intent; if `payer` is set, lock the principal escrow up to the authorized ceiling. Mirrors tenzro_capitalIntentAssign.

Compensate (refund the principal escrow and fail) a capital intent. Mirrors tenzro_capitalIntentCompensate.

Record one executed settlement leg of a capital intent. Mirrors tenzro_capitalIntentExecute.

Open a signed Capital Intent — regulated capital allocation over tokenized assets (the capital-markets analog of an AP2 Intent Mandate; objective = acquire/exit/rebalance/hedge/yield, with reg regime + KYC + ceilings). Mirrors tenzro_capitalIntentOpen.

Submit a solver bid to fulfil a capital intent (ranked by ERC-8004 + KYA). Mirrors tenzro_capitalIntentQuote.

Settle a capital intent: release escrow to the solver, write ERC-8004 feedback, finalize with a receipt. Mirrors tenzro_capitalIntentSettle.

Verify a capital intent's proofs (requires all legs settled). Mirrors tenzro_capitalIntentVerify.

Bridge tokens through the BridgeRouter pinned to the Chainlink CCIP regulated rail. Refuses the call if no CCIP adapter is registered rather than silently falling back to a generic adapter. Returns transfer_id, tx_hash, fee_paid, estimated_arrival_ms.

Quote a Chainlink CCIP fee via Router.getFee() eth_call. CCIP is Tenzro's regulated rail: OCR commit-store committee + RMN ARM blessing. Returns native fee in wei on the source chain.

List CCIP lanes (source-destination chain pairs). Optionally filter by source or destination chain selector.

Read inbound + outbound rate-limiter state for a (pool, remote-chain) pair. Returns the RateLimiter.TokenBucket tuple (tokens, lastUpdated, isEnabled, capacity, rate).

Prepare a Router.ccipSend() envelope — returns calldata + msg.value ready for the caller to sign and broadcast via eth_sendRawTransaction.

List CCIP-supported chains from the Chainlink docs API.

List CCIP-supported tokens from the Chainlink docs API.

Inspect a CCIP CCT v1.6+ token-pool contract. Returns chain, pool address, and the bound ERC-20 token address read from the pool's getToken().

Track CCIP message execution via OffRamp.getExecutionState(bytes32). States: 0=UNTOUCHED, 1=IN_PROGRESS, 2=SUCCESS, 3=FAILURE.

Get a single TNZO CCT pool by chain name. Returns chain_id, chain_selector, pool_address, token_address, pool_type, contract_name, capacities, refill_rate.

List all TNZO CCT pools in the canonical mainnet registry (Ethereum LockRelease; Base/Arbitrum/Optimism/Solana BurnMint).

Send a chat completion request to a served AI model on the Tenzro network. Use list_models or list_model_endpoints to discover available models

Check whether a token transfer would be compliant with the registered ERC-3643 compliance rules. Returns compliant/non-compliant status with specific violation details. Does not execute the transfer.

Clear the Secure-Mint policy for an asset.

Close a micropayment channel with the final balance. Requires sender signature on the final state. Settles remaining balance on-chain and returns any unused deposit.

Compute a deterministic cluster placement for a model across candidate members. Returns the fit decision and, when a cluster forms, the VRAM-weighted per-member layer assignment ordered to minimize pipeline transfer cost. Pure function of the params; reads no node state.

Mark a task as completed with a result payload. Optionally attach a proof of completion. Triggers settlement payment to the completing agent. Returns the completion receipt.

Book a compute rental against this node's compute provider. The renter pre-funds total_epochs from their deposit.

Pure preview: how would a `gross_wei` amount be split across a fee route's recipients? Truncates to last for the remainder. Does not settle — settlement is consensus-mediated.

Look up a compute rental by id.

Set the per-epoch compute pricing policy. Use mode "dynamic" with a non-zero capacity and optional min_rate/max_rate bounds; fixed-rate is the spawn default.

Settle one epoch of an active compute rental, gated on the provider's availability proof. A valid proof streams the epoch slice to the provider; an invalid or missing proof makes the renter whole from stake.

Summary of this node's compute-rental state: effective rate and active rental count.

Invoke Tenzro Cortex recurrent-depth reasoning. Executes a recurrent-depth transformer (OpenMythos-style) through a registered Cortex worker, charging TNZO based on tokens_in, tokens_out, and loops_used. Returns the reasoning output along with a signed CortexReceipt binding input/output commitments, weights hash, runtime hash, loops_used, and worker DID. Use tier='fast|standard|deep|institutional' to select the reasoning depth budget.

Operator-only. Mint a new API key on this node. Requires the caller's MCP request to carry an `X-Tenzro-Admin-Token` header matching the node's configured admin token. `class` controls revocability: `subject` (default) — subject can self-revoke, admin can revoke; `operator_internal` — admin-only revoke; `operator_protected` — not revokable via RPC by anyone (rotate via operator secret + restart). The MCP tool auto-injects the `confirm_operator_protected` interlock when class is `operator_protect…

Register a database this node serves, computing and persisting its partition placement over the live cluster. owner_did becomes the admin authority (owner-only access policy). placement is 'local', 'lan_cluster', or 'network'. Returns {database, partitions}.

Create an on-chain escrow via a signed CreateEscrow transaction. Funds are locked at a deterministic vault address derived from the escrow_id; only the original payer can later release or refund.

Create a new MPC threshold wallet with configurable threshold and share count. Default is 2-of-3. Returns the wallet ID, address, and key share metadata.

Create a new NFT collection on the Tenzro ledger. Supports ERC-721 (unique tokens) and ERC-1155 (semi-fungible tokens). Returns the collection ID and deployed address.

Create a payment challenge for a protected resource. Supports five protocols:- 'mpp' (Machine Payments Protocol): Session-based streaming payments, ideal for per-token AI inference billing- 'x402' (Coinbase HTTP 402): Stateless one-shot payments, ideal for API calls and data downloads- 'visa-tap' (Visa Trusted Agent Protocol): RFC 9421 agent-verified payments for agentic commerce- 'mastercard-agent-pay' (Mastercard Agent Pay): KYA-verified payments with agentic tokens- 'native': Direct TNZO tran…

Create a new governance proposal on the Tenzro Network. Requires a minimum staked balance to propose. Returns the new proposal ID and initial status.

Create a swarm of coordinated agents under an orchestrator on the Tenzro Network. Each member spec spawns one child agent. Tasks can be dispatched to all members in parallel or sequentially.

Create a new ERC-20 token via the Tenzro token factory. Returns the deployed token address and token ID. The token is registered in the unified token registry and discoverable across all VMs.

Create a new user wallet under an application. Optionally fund it with an initial TNZO amount from the app's master wallet.

Create a new cryptographic keypair for use as a Tenzro wallet. Supports Ed25519 (Tenzro native) and Secp256k1 (EVM-compatible)

Create a Plonky3 STARK proof for one of the three Tenzro AIRs (`inference`, `settlement`, `identity`) over the KoalaBear field. Returns the hex-encoded bincode-serialized p3_uni_stark::Proof and public inputs (4-byte LE KoalaBear chunks).

Transfer tokens between VMs (e.g., EVM to SVM). Uses the cross-VM bridge precompile for atomic transfers. Only TNZO is currently supported for cross-VM transfers.

Burn tokens for a crosschain transfer (ERC-7802 crosschainBurn). Only pre-authorized bridges can call this. Tokens are burned on the local chain and will be minted on the destination chain. Returns the burn event and nonce.

Mint tokens via an authorized crosschain bridge (ERC-7802 crosschainMint). Only pre-authorized bridges can call this. The hex-encoded inbound bridge payload is dispatched through the bridge router for quorum verification; the verified TenzroMessage inside is the sole authority for recipient and amount. Returns the mint event and nonce.

Read DA committee availability scores (0-1000, +1 per passed possession challenge, -5 silence or honest not-held, -25 bad proof). Pass an address for one member's score, omit for all scored members lowest-first.

Challenge a DA committee member to prove current possession of its Red Stuff sliver for a blob commitment. The target must return the full sliver plus a nonce-bound Ed25519 signature; the challenger re-verifies the sliver against the commitment. The outcome (passed / failed_no_response / failed_not_held / failed_bad_proof) feeds the target's rolling availability score. Validator-only.

Show the current DA committee roster: each member's index, address, whether it is the local node, and its availability score if it has ever been challenged.

List blob commitments known to the local DA committee store, with the locally-held sliver index (if any) and the availability certificate (attesting member indices, quorum, root, timestamp) when one is held.

List resolved DA possession-challenge records, newest-first. Each record carries the blob commitment, target member index + address, nonce, timestamps, and outcome.

Run an engine-dialect query against a database partition. caller_did is authorized against the access policy (writes require the admin action, reads the read action) before any engine is touched. When this node holds the target partition the result carries served_here=true and the engine result; otherwise it carries holder endpoints.

Read per-query pricing and cumulative usage counters (queries, writes, bytes in/out, total billed) for a database. Administrative — caller_did is gated on the admin (write) action.

Create a cross-chain transaction via deBridge DLN. Returns transaction data ready for signing and submission.

Get all blockchain networks supported by deBridge DLN for cross-chain transfers.

Get deBridge operational instructions and guidance for cross-chain transfers.

Execute a same-chain token swap via deBridge. Swaps tokens on the same blockchain without cross-chain bridging.

Search for tokens available on deBridge DLN. Returns token addresses, symbols, and supported chains.

Decide a pending approval — `decision` is 'approved' or 'denied'. When `approver_did` is supplied, the engine refuses to apply the decision unless the record's approver_did matches (cross-approver tampering defence). Mismatch returns JSON-RPC -32001 (forbidden). Returns the updated approval record. Requires AuthEngine to be initialised on the node.

ABI-decode contract call return data. Takes hex-encoded return data and output type signatures, returns decoded values. Useful for interpreting EVM contract responses.

Decrypt AES-256-GCM encrypted data using the key and nonce. Returns the plaintext in hex.

Delegate a task from one agent to another on the Tenzro Network. Optionally set a wei budget cap for the delegated task (1 TNZO = 10^18 wei). Returns the delegation record and task ID.

Delegate governance voting power from one address to another. Delegated TNZO stake will count toward the delegate's votes. Returns the delegation record.

Delete a model from this node's local storage. The model must not be currently serving. Frees disk space. Returns deletion confirmation.

Delete a webhook by id. Returns JSON-RPC error `-32602` if the id is unknown.

Deploy a smart contract to the Tenzro ledger. Supports EVM (Solidity bytecode), SVM (BPF programs), and DAML (DAR packages). Returns the deployed contract address.

Derive a 256-bit encryption key from a password using Argon2id KDF. Returns the derived key in hex.

Run object detection on an image. Returns an array of detections with bounding box (x0,y0,x1,y1), label_id, and confidence score. NMS-free for DETR-family models — just sigmoid + score threshold.

Detect available Trusted Execution Environment (TEE) hardware on this node. Returns detected TEE type (Intel TDX, AMD SEV-SNP, AWS Nitro, NVIDIA GPU CC) or simulation mode.

Discover registered AI agents on the Tenzro Network. Filter by capability or agent type. Returns agent DIDs, capabilities, endpoints, and reputation scores.

Discover available AI models on the Tenzro Network. Filter by category, serving status, or max price. Returns model IDs, providers, pricing, and endpoints.

Download and instantiate an agent template. Creates a new agent identity from the template with optional configuration overrides. Returns the new agent DID and wallet.

Download a model from the Tenzro model registry or HuggingFace Hub to this node's local storage. Performs SHA-256 integrity verification. Returns download status and progress.

Remove a database and all its partition placements, tearing down the engine backing for every partition this node holds. Administrative — caller_did is gated on the admin (write) action and its usage counters are removed with it.

Execute a DvP saga: run each escrow leg forward (release vault→payee). Signature-gated / custom-condition escrows require a per-leg release proof supplied via `proofs`. Any leg failure triggers automatic compensation (refund vault→payer) of already-executed legs. Mirrors tenzro_dvpExecuteSaga.

Finalize a DvP saga once every leg has executed: compute the receipt and mark it Completed. Mirrors tenzro_dvpFinalizeSaga.

Read the current state of a DvP saga (legs, per-leg outcomes, escrows, receipt). Mirrors tenzro_dvpGetSaga.

List DvP sagas opened by a creator address. Returns {creator, count, sagas: [...]}. Mirrors tenzro_dvpListSagasByCreator.

Open a delivery-versus-payment saga: bundle two or more legs (delivery + payment) into an all-or-compensate unit. Only escrow-venue legs are saga-executable (the payer pre-funds and authorizes the escrow, so release/refund needs no fresh signature); native/channel/external legs are rejected. Returns the opened saga. Mirrors tenzro_dvpOpenSaga.

Build the 23-byte EIP-7702 delegation designator (`0xef0100 || delegate_address`) that gets written into the EOA's code slot once an authorization is accepted. Returns `{designator, length: 23, prefix: '0xef0100', delegate_address}`.

Decode an account's `code` (hex with or without 0x prefix) and extract the delegate address if it is a valid EIP-7702 designator. Returns `{is_designator: false, delegate_address: null}` for code that is not a 23-byte 7702 designator.

Read static metadata about the EIP-7702 support surface — tx type (0x04), magic byte (0x05), designator prefix (0xef0100), designator length (23 bytes), signing scheme (secp256k1), and operator notes on the current transaction-side integration state.

Compute the secp256k1 signing hash for an EIP-7702 authorization tuple `(chain_id, delegate_address, nonce)`. The returned `signing_hash` is what the EOA's secp256k1 private key signs client-side; full preimage is `MAGIC(0x05) || rlp([chain_id, delegate_address, nonce])`. Returns `{signing_hash, signing_data, magic_byte}`.

ABI-encode a function call. Takes a Solidity-style function signature and arguments, returns hex-encoded calldata. Useful for preparing EVM contract interactions.

Encrypt data using AES-256-GCM symmetric encryption. Returns the ciphertext and nonce in hex.

Enroll a passkey-bound smart account. Consumes a WebAuthn registration credential (P-256 public key + opaque credential ID + ML-DSA-65 verifying key for hybrid PQ), creates a TDIP human identity, deploys a smart account via the shared AccountFactory, and installs WebAuthnValidator as the primary signer. The signing key never leaves the user's hardware secure element.

Fetch a single ERC-7683 FillRecord by (order_id, origin_chain_id). Returns the record JSON, or -32000 if no fill has been recorded.

Fetch a single Tenzro7683Order envelope by 32-byte order_id. Envelope is persisted in CF_SETTLEMENTS under the `7683_origin:` keyspace. Order state machine: Open → AwaitingProof → Settled / Refunded / ForceRefundEligible.

List every recorded destination-side FillRecord on this node. Cardinality is bounded — registry holds at most one FillRecord per cross-chain order ever filled here.

Paginated scan over persisted ERC-7683 orders in the `7683_origin:` keyspace. Optional state filter (open / awaiting_proof / settled / refunded / force_refund_eligible) and CAIP-2 dest_chain filter.

Destination-side commit of an ERC-7683 FillRecord (single-shot per order_id — re-submission returns -32010 OrderAlreadyFilled). Required fields: order_id, origin_chain_id, origin_settler, filler, recipient (32-byte), fill_tx_hash, filled_at_ms, proof_route, outputs[].

Decode the (address, string) return data of an IdentityRegistry.getAgent() eth_call into { agent_address, metadata_uri }.

Decode the bytes return data of an IdentityRegistry.getMetadata() eth_call into { metadata_value }.

ABI-encode ReputationRegistry.appendResponse(uint256 agentId, bytes32 feedbackId, string responseURI) (ERC-8004 v0.6+ mutator). Returns hex calldata.

ABI-encode ReputationRegistry.submitFeedback(bytes32 subjectAgentId, int8 rating, string contextURI). Rating is in -100..=100.

ABI-encode IdentityRegistry.getAgent(uint256 agentId). Returns hex calldata for an eth_call lookup.

ABI-encode IdentityRegistry.getAgentURI(uint256 agentId) (ERC-8004 v0.6+ read). Returns hex calldata.

ABI-encode IdentityRegistry.getAgentWallet(uint256 agentId) (ERC-8004 v0.6+ read). Returns hex calldata.

ABI-encode ReputationRegistry.getFeedback(bytes32 subject, uint256 index). Returns hex calldata for an eth_call lookup.

ABI-encode ReputationRegistry.getFeedbackCount(bytes32 subject). Returns hex calldata.

ABI-encode ReputationRegistry.getFeedbackResponses(uint256 agentId, bytes32 feedbackId) (ERC-8004 v0.6+ read). Returns hex calldata.

ABI-encode IdentityRegistry.getMetadata(uint256 agentId, string metadataKey) (ERC-8004 v0.6+ read). Returns hex calldata.

ABI-encode ValidationRegistry.getValidation(bytes32 requestHash) (ERC-8004 v0.6+ read). Returns hex calldata.

ABI-encode ReputationRegistry.isFeedbackRevoked(uint256 agentId, bytes32 feedbackId) (ERC-8004 v0.6+ read). Returns hex calldata.

ABI-encode IdentityRegistry.register() (ERC-8004 v0.6+ no-arg overload — caller becomes agent owner; registry allocates a sequential uint256 agentId). Returns hex calldata.

ABI-encode IdentityRegistry.register(string agentURI, (string,bytes)[] metadata) (ERC-8004 v0.6+ overload with metadata entries). Returns hex calldata.

ABI-encode IdentityRegistry.register(string agentURI) (ERC-8004 v0.6+ overload with agent URI). Returns hex calldata.

ABI-encode ReputationRegistry.revokeFeedback(uint256 agentId, bytes32 feedbackId) (ERC-8004 v0.6+ mutator). Returns hex calldata.

ABI-encode IdentityRegistry.setAgentURI(uint256 agentId, string metadataURI) (ERC-8004 v0.6+ mutator). Returns hex calldata.

ABI-encode IdentityRegistry.setAgentWallet(uint256 agentId, address newWallet, uint256 deadline, bytes signature) (ERC-8004 v0.6+ wallet rotation). Returns hex calldata.

ABI-encode IdentityRegistry.setMetadata(uint256 agentId, string metadataKey, bytes metadataValue) (ERC-8004 v0.6+ key-value metadata). Returns hex calldata.

ABI-encode ValidationRegistry.validationRequest(address validatorAddress, uint256 agentId, string requestURI, bytes32 requestHash). Returns hex calldata.

ABI-encode ValidationRegistry.validationResponse(bytes32 requestHash, uint8 response, string responseURI, bytes32 responseHash, string tag). Response is a 0..=100 quality score.

RFC 8693 OAuth 2.0 Token Exchange. Mint a narrower child JWT from a parent JWT, bound to a different DPoP key with a strict subset of the parent's RAR grants and AAP capabilities. The child token's controller_did is set to the parent's sub, extending the act-chain by one hop. Subset enforcement is performed by the AS; over-scoped requests are rejected.

Export a wallet's keystore as an encrypted JSON file. Uses Argon2id KDF for key derivation. The exported keystore can be imported on another node.

File a challenge against a stored inference commitment. Open to any caller; the model and provider are read from the stored envelope so filings cannot misattribute. Returns the filed challenge record with its challenge_id. Mirrors tenzro_fileInferenceChallenge.

File an insurance claim against a bonded agent (Agent-Swarm Spec 9). The claim enters Open status awaiting governance adjudication; payout (if approved) is settled by a separate PayInsuranceClaim transaction. Returns the full ClaimRecord including the deterministic claim_id.

Finalize a social-recovery ceremony once guardian quorum is reached. The node installs the new passkey as the smart account's primary WebAuthnValidator.

Find the best agent on this node for a given capability. Prefers TEE-backed attestations (most recent wins), falling back to any agent with the capability registered. Returns the chosen agent_id and the total candidate count.

Run a univariate timeseries forecast on a registered model. Pass `history` (most-recent-last context series), `horizon` (steps ahead), and optional `quantiles` (e.g. [0.1, 0.5, 0.9]) and `frequency_seconds`. Returns point forecasts and (when supported) quantile bands.

TDIP/GDPR Article 17 right-to-erasure. Hard-deletes a previously revoked identity from the registry and persistent storage. The DID must already be in `Revoked` status — call `revoke_did` (RPC) first, allow cascading revocation to propagate, then call this. Distinct from revoke (logical delete).

Freeze an address for a specific token under ERC-3643 compliance. A frozen address cannot send or receive the specified token. Returns the freeze record.

Fund a user wallet from the app's master wallet. Transfers TNZO (wei) from the master address to the user address.

Generate a new cryptographic keypair. Returns the public key, private key, and derived address in hex.

Generate a Tenzro VRF proof (RFC 9381 ECVRF-EDWARDS25519-SHA512-TAI). Returns the public key, 80-byte proof, and 64-byte deterministic output. Do not use with secret inputs — the try-and-increment encoding is data-dependent.

Inspect an AgentBond by agent DID. Returns lifecycle state (Active / Cooldown / Frozen / Slashed / Returned), amount, controller, cooldown_until, last_modified_block, and promotion eligibility. Returns null if no bond exists.

Fetch all capability attestations issued for a specific agent (by agent ID). Returns the agent's registered capabilities, every attestation that names the agent across all capabilities, and the agent's registered wallet address (used by the self-attestation guard).

Read the current UTC-day spend window for a machine agent. Mirrors `tenzro_getAgentDailySpend`: the handler resets the window if the last_reset crossed UTC midnight before returning. Returns {agent_did, current_daily_spend, max_daily_spend, remaining, last_reset}. Use to enforce the runtime SpendingPolicy ceiling (defence-in-depth on top of the on-chain ERC-7579 spending-limit validator).

Resolve a single agent JWK by RFC 9421 keyid. Accepts `did:tenzro:...` (first compatible key) or `did:tenzro:...#fragment` (specific key). Mirrors GET /.well-known/jwks.json/:keyid.

Get details about a specific agent template in the Tenzro Agent Marketplace. Returns template configuration, capabilities, pricing, and usage statistics.

Get statistics for an agent template on the Tenzro Network marketplace. Returns total spawns, average rating, and total number of ratings.

Fetch a single approval record by id. The engine lazy-transitions an expired `Pending` record to `Expired` on this read path, so a returned `Pending` record is guaranteed to still be live. Returns the full record JSON; returns -32000 if id is unknown. Requires AuthEngine to be initialised on the node.

Fetch an approval gate by 32-byte hex id. Returns the approver set (single / threshold / role / delegated), m-of-n threshold, on-event trigger, and effect.

Fetch an open or finalized approval request by 32-byte hex id. Returns the gate, decisions collected, threshold progress, and final outcome (approved / rejected / pending).

Get the TNZO token balance of an account on the Tenzro ledger

Get a block by height from the Tenzro ledger, including transactions and metadata

Fetch a contiguous range of blocks by height (default 64, max 256). Returns block summaries plus `next_height` and `more_available` so a lagging client can paginate forward until caught up.

Get available bridge routes between two chains, including estimated fees, time, and which adapter handles the route

Fetch all attestations registered for a given capability. Each attestation carries the agent ID, attestation timestamp, TEE-backed flag, attester address, attester public key, signature, and metadata. Set verified_only=true to filter for attestations that pass query-time signature/expiry verification.

Read a capital intent record (status, quotes, legs, escrow, receipt). Mirrors tenzro_getCapitalIntent.

Look up a database descriptor by id.

Return the placement of one partition.

Fetch a single channel dispute by id. Returns the full ChannelDispute (challenger, evidence blobs, status, opened_at / timeout_at / resolved_at, resolution). Returns -32004 if no dispute with that id exists. Requires ChannelManager.

Check the download progress of a model. Returns bytes downloaded, total size, percentage complete, and estimated time remaining.

Read a single escrow record by its 32-byte escrow_id (hex, with or without 0x prefix). Returns `{escrow_id, payer, payee, amount, asset_id, status, created_at, expires_at, release_conditions}`. Requires EscrowManager to be initialised.

Query historical events from the Tenzro ledger. Supports cursor-based pagination. Filter by block range, event type, and involved addresses. Returns events ordered by sequence number.

Inspect the EIP-1559 fee market: current effective gas price (base fee + suggested tip), suggested priority tip, and recent base-fee history. Use this to size maxFeePerGas / maxPriorityFeePerGas on Type-2 transactions. Base fee adjusts ±12.5% per block based on parent gas usage vs. the 15M target.

Fetch a fee route by 32-byte hex id. Fee routes describe how a settlement payout is split across recipients in basis points (must sum to 10_000).

Fetch an inference challenge by id. Returns the full record (status, filed_at, resolved_at, verification) or null when unknown. Mirrors tenzro_getInferenceChallenge.

Fetch a stored TOPLOC inference commitment by hash. Returns the envelope {commitment_hash, model_id, provider, created_at, commitment: {k, prompt_tokens, steps}} or null when no commitment is stored under that hash. Mirrors tenzro_getInferenceCommitment.

Get the key share metadata for an MPC wallet. Returns the threshold, total shares, and share indices without exposing secret key material.

Get a snapshot of libp2p network metrics: connection counts, gossipsub publish/accept/reject counters, Kademlia routing table size, gossipsub mesh size, and peer_address_migrations_total (QUIC path migration / mobile network switch / NAT rebinding observability)

Get information about an NFT collection or a specific token within a collection. If token_id is provided, returns token-level details (owner, URI). If omitted, returns collection-level info (name, symbol, total supply).

Get the current status of the Tenzro node including health, block height, peer count, uptime, and role

Fetch an obligation record by 32-byte hex id. Returns the obligor / oblige / kind / amount / status / discharge proof.

Fetch a privacy domain by 32-byte hex id. Returns members, X25519 envelope policy, freeze status. Members see plaintext, non-members see Deny (indistinguishable from non-existence).

Look up the cached provenance manifest for generated content by its 32-byte hex content_hash (with or without 0x prefix). This is the machine-readable synthetic-content marker per EU AI Act Art. 50(2). Returns JSON-RPC -32004 when no manifest is cached for the hash. Read-only.

Get the current pricing configuration for a provider node. Returns the price per 1k tokens, minimum charge, and last updated timestamp.

Get the availability schedule for a provider node. Returns the configured hours, days, and timezone when the provider accepts inference requests.

Get provider statistics including served models, inference count, staking info, and earnings. Omit address to get stats for the local node.

Read the current reserve attestation for a tokenized asset. Mirrors tenzro_getReserve.

Read the inference router's live metrics snapshot: total requests routed, hedges dispatched, hedges won, and requests abandoned on the whole-request deadline. Read-only — safe for monitoring agents.

Read the Secure-Mint policy for an asset.

Get usage statistics for a registered skill on the Tenzro Network. Returns total invocations and last used timestamp.

Fetch the smart-account summary: address, owner, nonce, deployment status, installed ERC-7579 validators.

Fetch one chunk of a local snapshot by `(height, chunk_index)`. The returned `data_b64` is the base64-encoded chunk bytes; verify against `manifest.chunk_hashes_hex[chunk_index]` before applying. Returns `{height, chunk_index, data_b64}`.

Fetch the full snapshot manifest at `height`, including per-chunk SHA-256 hashes used to verify chunks before applying. Returns JSON-RPC error `-32004 no snapshot at height` if no snapshot exists at that height. The manifest contains `state_root_hex` which the caller MUST verify against a trusted QC at the same height before offering this manifest to another node.

Get the current spending limits for a wallet. Returns the daily limit, per-transaction limit, and current daily usage.

Read an issuer's stable-asset policy.

Return the canonical Tenzro Cross-VM SVM-native program ID and 4 instruction discriminators (bridge_to_evm, bridge_from_evm, register_token_pointer, transfer_cross_vm). Use this to construct SVM Instructions targeting the Tenzro Cross-VM native program from any SVM client.

Get the current status of a Tenzro agent swarm including lifecycle status, member count, and per-member agent statuses, roles, and results.

Get details about a specific task on the Tenzro Task Marketplace. Returns task description, status, requester, assigned agent, quotes, and completion data.

Generate a TEE attestation report from the node's hardware enclave. The attestation proves the code is running in a genuine TEE. Optionally specify the TEE type or auto-detect.

Get the TNZO balance for an address across all VMs. Shows native balance (18 decimals), EVM wTNZO balance (18 decimals), SVM wTNZO balance (9 decimals), and DAML holding amount.

Get information about a token by symbol, token ID, or EVM address. Returns the full token definition including cross-VM addresses.

Get usage statistics for a registered tool on the Tenzro Network. Returns total invocations and last used timestamp.

Report the trainer auto-provisioning daemon status. When the node has no [training] config section (or enabled=false), running is false. Otherwise returns {running, trainer_did, live_trainers, max_concurrent_trainers}. Read-only.

Look up a transaction by its hash on the Tenzro ledger, returning type, sender, recipient, amount, status, and block height

Get usage statistics for an application. Returns total transactions, gas spent, active users, and wallet count.

Fetch a single validator's registry entry by hex-encoded 32-byte address (with or without 0x prefix). Returns null when the address is not registered. Read-only — validators self-register via the staking transaction path.

Get the governance voting power of an address. Returns the staked TNZO balance used as voting weight. Delegated power is included.

Fetch a workflow by 32-byte hex id. Returns the full Workflow record (creator, participants, obligations, approval gates, status, canton_mirror, signatures). Read-only. Writes use send_transaction with the workflow privileged-VM selectors.

Full lifecycle history for a workflow: ordered list of LifecycleTransition entries (from-status, to-status, reason, actor, at). Useful for audit and dispute resolution.

Snapshot of workflow operational metrics (workflows/obligations/approvals partitioned by status, signature totals, canton-mirror count, fee routes, privacy domains). Returns the same data as the /metrics scrape, but as typed JSON.

Fetch a single workflow receipt by 32-byte hex id. Receipts are append-only and form a per-workflow hash chain via prev_receipt for audit.

Read the current state of a saga workflow (steps, statuses, escrows, receipt). Mirrors tenzro_getWorkflowSaga.

Grant a scoped session key to a smart account so an agent can sign a bounded subset of operations without holding the human's passkey. Permissions: allowed function selectors, target contracts, per-call value cap, cumulative value cap, validity window.

Compute the Keccak-256 hash of hex-encoded data. Returns the 32-byte hash in hex. Used for Ethereum-compatible hashing.

Compute the SHA-256 hash of hex-encoded data. Returns the 32-byte hash in hex.

Dispatch a Hyperlane V3 message through the canonical Mailbox. Tenzro runs a sovereign Tenzro-validator-set ISM, so inbound messages on Tenzro are verified against the active Tenzro validator BLS / ML-DSA set.

Look up a Hyperlane message by id.

List supported Hyperlane chains and their canonical domain ids. Coverage: Ethereum, Polygon, Arbitrum, Optimism, Base, Avalanche, BSC, Mantle, Blast, Scroll, Linea, Manta, zkSync, Celo, Moonbeam, Mode, Fraxtal, Tenzro.

Quote the interchain gas payment for a Hyperlane dispatch.

Import a wallet from an encrypted keystore JSON. Decrypts with the provided password and adds the wallet to the local node.

Initiate a social-recovery ceremony to rotate a smart account to a freshly enrolled passkey. Returns a recovery_id and the 32-byte op hash that guardians must sign.

RFC 7662 OAuth 2.0 Token Introspection. Ask the AS whether a token is currently active and, if so, return its full claim set (RAR authorization_details, AAP aap_* claims, cnf, controller_did, etc.). Per RFC 7662 §2.2 a failed validation returns `{active: false}` with no other fields — the AS does not leak why the token is inactive.

Fetch a content-addressed `tenzro://blob|model|gradient|shard|receipt/...` URI from the local iroh-blobs store (auto-populates from peers as needed). Returns base64-encoded bytes plus the parsed URI and size.

Show the local iroh endpoint id, Pkarr relay URL, and ALPNs registered on the shared router. Returns an internal error iff the iroh transport failed to bind at startup.

Publish raw bytes to the shared iroh-blobs store. Returns a content-addressed `tenzro://blob/<blake3-hex>` URI that any iroh peer can fetch (subject to NAT/discovery reachability).

Mint a managed-database connection credential bound to bearer_did, scoped to this one database. The owner (caller_did) — or a caller holding the write-action capability — issues it. When write is true the token also carries the admin action. Returns the credential a developer presents on every query.

Compute the canonical SHA-256 hash for an IVMS101 Travel Rule envelope. The caller passes the envelope JSON; the node returns the binding hash that anchors the envelope to a settlement receipt.

Join the Tenzro Network as a MicroNode — a zero-install full participant. Auto-provisions a TDIP decentralized identity (DID) and MPC wallet. Grants access to all 10 network capabilities: inference, payments, agent collaboration, MCP tools, task execution, chain queries, smart contracts, TEE services, cross-chain bridge, and governance. Works from any entry point: Claude, ClawBot, MCP, A2A, SDK, API, CLI, or app. No hardware, no binary installation required.

List only currently-Active validators. Convenience over list_validators with status='Active'. Useful for SRE dashboards that need the current committee size and stake distribution.

List all Tenzro agent public signing keys as an RFC 7517 JWK Set. Mirrors GET /.well-known/jwks.json. External RFC 9421 verifiers (Visa TAP, Mastercard, Stripe MPP, AP2, x402) use this to resolve `keyid` parameters.

List agent templates from the Tenzro Network agent marketplace. Browse available AI agent configurations that can be deployed. Filter by type, tag, creator, or price.

Operator-only. List every API key the node has issued — active and revoked. Requires `X-Tenzro-Admin-Token`. Returns `key_id`, `subject`, `label`, `scopes`, `class`, `created_at`, `revoked_at`, `active`.

Browse the curated ONNX ASR catalog: Moonshine v2 (tiny/base, MIT, on-device), Distil-Whisper (small.en/medium.en/large-v3, MIT), Whisper Large-v3-turbo (MIT, flagship), Parakeet-TDT-0.6B-v3 (CC-BY-4.0, 25 European langs), Canary-1B-Flash (CC-BY-4.0, multilingual). The catalog is stable; the ORT-backed transcribers are feature-gated (default builds return ProviderNotAvailable).

List ASR (speech-to-text) models currently loaded on this node. The catalog covers Moonshine v2, Distil-Whisper, Whisper-large-v3-turbo, Parakeet-TDT-0.6B-v3, and Canary-1B-Flash, all backed by ORT sessions.

List all registered bridge adapters (LayerZero, Chainlink CCIP, deBridge, Canton)

Enumerate the canonical per-adapter bridge sponsorship-pool vault addresses. Vault addresses are deterministic SHA-256 over 'tenzro/bridge/sponsorship-vault' || adapter_str (first 20 bytes).

List Canton synchronizer domains configured on this node. Returns domain IDs, connection status, and participant info for enterprise DAML integration.

List all registered capabilities on this Tenzro node. Returns each capability with the count of agents that have it, the count of attestations, and the list of agent IDs supporting that capability. Use to discover what specialized work the local agent runtime can route.

List active DAML contracts on a Canton domain. Filter by template ID. Returns contract IDs, parties, and payload data for enterprise workflow automation.

List the database engines this node can serve — each with its data models, license, sharding model, and native-cluster topology. Engines are operator-run externals (PostgreSQL, Qdrant, Valkey) and in-process embedded engines (Lance, Tantivy).

List every partition placement of a database.

List every database this node serves.

Browse the curated ONNX detection catalog: RF-DETR (nano/small/medium/base/large/2xl) — first real-time detector >60 AP on COCO (ICLR 2026); D-FINE (n/s/m/l/x). All Apache-2.0.

List object detection models currently loaded on this node (RF-DETR, D-FINE). Use list_detection_catalog to browse the curated catalog.

List every dispute (open or historical) attached to a channel. Returns `{channel_id, count, disputes: [...]}`. Empty list is not an error — a channel with no disputes returns count: 0. Requires ChannelManager.

List every escrow held for the given payee address. Returns `{payee, count, escrows: [...]}`. Backed by the `escrow_payee:` secondary index in CF_SETTLEMENTS. Requires EscrowManager.

List every escrow funded by the given payer address. Returns `{payer, count, escrows: [...]}`. Backed by the `escrow_payer:` secondary index in CF_SETTLEMENTS. Requires EscrowManager.

List every registered fee route. Each route has a label, splits in bps, and a derived 32-byte id used by Workflow.fee_route.

Browse the curated ONNX forecast (timeseries) catalog. Returns models like TimesFM 2.5 — each with HF repo, context length, max horizon, and quantile support.

List forecast (timeseries) models currently loaded on this node. Use list_forecast_catalog to browse available models from the curated catalog.

List inference challenges, optionally filtered by status (filed/upheld/dismissed) and provider. Returns {count, challenges: [...]} sorted newest first. Mirrors tenzro_listInferenceChallenges.

List newest-first memories for an agent. Optional `kind` filter ('granted' | 'recalled' | 'self_noted' | 'archived'). Pure read against the on-tier text index. Use memory_recall for query-driven hybrid retrieval.

List all model service endpoints with their API and MCP URLs, model details, and status

List AI models available on the Tenzro network. Shows all models with availability: 'local' (served on this node, free), 'network' (available from remote providers, costs TNZO), or 'downloadable' (in catalog but not yet available). Filter by category or search by name

Subject-gated. List every API key belonging to the caller's own subject. Requires the caller's MCP request to carry an `X-Tenzro-Api-Key` header identifying the subject.

List all NFT collections registered on the Tenzro ledger. Optionally filter by creator address or NFT standard (erc721/erc1155).

List the payment protocols supported by this Tenzro node, including MPP (session-based streaming), x402 (stateless one-shot), and native TNZO transfers

List every approval in `Pending` state for the given approver DID. Lazy-expires stale records server-side before returning, so the caller never sees expired entries. Returns `{approver_did, count, pending: [{approval_id, requester_did, approver_did, created_at_ms, expires_at_ms, status, decided_at_ms, summary, action}]}`. Requires AuthEngine to be initialised on the node.

List in-flight social-recovery ceremonies for a smart account, with current signature counts and expiration timestamps.

List privacy domains a given DID is a member of. Caller-side filtered to the DIDs the requester is authorized to see.

List governance proposals on the Tenzro Network. Filter by status (active/passed/rejected/pending). Returns proposal IDs, titles, vote tallies, and deadlines.

List providers with published capacity across the Tenzro network. For each provider returns both the advertised capacity (its own claim: max concurrent requests, requests/sec, batch size, MTP support) and the measured throughput this node has observed (tokens/sec, p95 latency, reputation, and a reputation-discounted throughput figure). Includes this node's local providers (source=local) and gossip-discovered peers (source=network). Mirrors tenzro_listProviderCapacity.

List all providers discovered on the Tenzro Network. Providers broadcast announcements every 60s on the tenzro/providers gossipsub topic. Returns both the local node (if serving) and all remotely discovered providers. Optionally filter by provider_type: 'llm', 'tee', or 'general'.

Browse the curated ONNX segmentation catalog: SAM 2 (base/large), EdgeSAM, MobileSAM. SAM 3 / 3.1 are text-promptable with a different decoder ABI and are not exposed via this point/box segment tool.

List segmentation models currently loaded on this node (SAM 2, EdgeSAM, MobileSAM). Use list_segmentation_catalog to browse the curated catalog.

List every smart account known to the node, including each account's installed validators.

List local snapshots available for state-sync. Per-chunk hashes are elided for compactness — use `get_snapshot_manifest` to fetch the full manifest with `chunk_hashes_hex[]`. Returns `{snapshots: [{height, state_root_hex, num_chunks, created_at, format}, ...]}`.

List tasks from the Tenzro Network task marketplace. Filter by type, status, poster address, or maximum price. Defaults to showing open tasks. Use this to discover tasks agents can fulfill.

List all registered TEE providers on the network, including their TEE type, attestation status, and supported capabilities.

Browse the curated ONNX text-embedding catalog: Qwen3-Embedding (0.6B/4B/8B), EmbeddingGemma-300M, BGE-M3, Snowflake Arctic-Embed. Each entry carries embedding_dim, supported Matryoshka truncations, and license tier.

List text-embedding models currently loaded on this node (Qwen3-Embedding, EmbeddingGemma, BGE-M3, etc.). Use list_text_embedding_catalog to browse the curated catalog.

Browse the curated ONNX text-promptable segmentation catalog: SAM 3 / SAM 3.1 (Meta) — open-vocabulary text-promptable segmenter, ViT-H backbone, 1008x1008 input, 32-token CLIP BPE language encoder.

List text-promptable segmenters currently loaded on this node (SAM 3 family). Use list_text_segmentation_catalog to browse the curated catalog.

List all registered tokens in the unified token registry. Optionally filter by VM type or creator address.

List all user wallets belonging to an application. Returns wallet addresses, labels, and current balances.

List validators in the on-chain registry, optionally filtered by status ('Active' | 'Candidate' | 'PendingActive' | 'PendingExit' | 'Exited' | 'Jailed'). Each entry carries base58 address, Ed25519 + ML-DSA-65 + BLS12-381 pubkeys, self_stake (u128 decimal string), and epoch lifecycle markers.

Browse the curated ONNX video encoder catalog. Advertises the V-JEPA 2 family (vjepa2-vitl-256, vjepa2-vith-256, vjepa2-vitg-384 — Meta AI, MIT / Apache-2.0). Loading is gated on per-model ONNX export until each entry has a published `model.onnx` artifact.

List video encoder models currently loaded on this node. The V-JEPA 2 family (ViT-L / ViT-H / ViT-g) is advertised in the catalog; loading is gated on per-model ONNX export.

Browse the curated ONNX vision encoder catalog: DINOv3 (small/base/large), SigLIP2 (base/large/so400m), CLIP ViT-B/32 + L/14, DINOv2. Each entry carries input_size, embedding_dim, normalization preset, and license tier.

List vision encoder models currently loaded on this node (DINOv3, SigLIP2, CLIP, etc.). Use list_vision_catalog to browse available models.

List every registered webhook. Returns each webhook's id, url, active flag, event_types/addresses filters, and delivery counters (total_deliveries, failed_deliveries). Secret hashes are NOT returned — secrets are write-only.

Walk a workflow's receipt chain from head backwards via prev_receipt. Returns receipts oldest-last, bounded by `max` (default 256). Use this for audit trails and dispute history.

List workflow ids created by a given DID. Returns up to all workflows the DID has authored, regardless of status.

List workflow ids that include a DID as a participant (regardless of role). The DID may be the creator, an obligor, an oblige, or an approver.

List workflow ids in a given status. Status: draft | awaiting_signatures | active | suspended | settling | completed | failed | disputed | cancelled.

List the x402 scheme backends registered on this node. Each scheme corresponds to a different verification path under the x402 protocol: 'tenzro-hybrid' (Ed25519 hybrid sig over canonical preimage), 'exact-eip3009' (USDC EIP-3009 meta-tx via CDP facilitator), 'permit2' (Uniswap Permit2 via CDP facilitator), 'erc7710' (delegation redemption). Use the returned ids in the 'extra.scheme' field of an x402 PaymentRequirement.

List all available ZK circuits on the node — name, AIR type, field, and hash function.

Load an ASR ONNX model (Moonshine, Distil-Whisper, Whisper-v3-turbo, Parakeet-TDT-v3, Canary-1B-Flash). Either pass `catalog_id` to inherit `family` / `max_audio_seconds` / `whisper_variant` from the catalog, or set them explicitly. The transcriber lands in a follow-up wave — today, `transcribe` returns ProviderNotAvailable; loading is wired for end-to-end testing once the transcriber arrives.

Load a detector ONNX (RF-DETR, D-FINE). The underlying RPC handler returns JSON-RPC -32004 until the ONNX loader for this modality is wired. Exposed for surface symmetry.

Load a forecast (timeseries) ONNX model into the node's runtime. The file at `path` must be a valid ONNX export. Pass `context_length` and `max_horizon` to match the export. For multi-output graphs (TimesFM 2.5 transformers export), set `output_name` to select the prediction tensor and `batch_size=2` to satisfy the export's flip-invariance averaging.

Load a segmenter ONNX (SAM 2 base/large, EdgeSAM, MobileSAM). The underlying RPC handler returns JSON-RPC -32004 until the ONNX loader for this modality is wired. Exposed for surface symmetry — agents should branch on the catalog status before calling.

Load a text-embedding ONNX model. The underlying RPC handler returns JSON-RPC -32004 until the ONNX loader for this modality is wired. Exposed for surface symmetry; agents should branch on the catalog rather than calling this blind.

Download (or reuse cached) the SAM-3 family ONNX bundle from HuggingFace Hub and register it under model_id. Bundle contains image encoder, language (CLIP) encoder, decoder, and CLIP tokenizer.

Load a video encoder ONNX. The V-JEPA 2 catalog entries (vjepa2-vitl-256 / vith-256 / vitg-384) are licensed permissively but ship as safetensors upstream; until per-model `model.onnx` exports land, the RPC handler returns JSON-RPC -32004. Until then, agents should pool per-frame vision_embed.

Load a vision encoder ONNX into the node. Either pass `catalog_id` to inherit input_size/embedding_dim/normalization from the curated catalog, or set them explicitly. Returns when the ORT session is ready.

List the peer ids discovered on this node's local network segment, with a count. When the network service is not running the list is empty and available is false.

Archive a memory record. Pushes the canonical payload to the configured DA backend, then rewrites the on-tier rows with kind='archived' and the resulting DaPointer attached. Frees hot search budget; payload is fetchable on demand via the pointer.

Grant a memory to an agent on the Tenzro Network. Embeds the text via the configured TextEmbeddingRuntime and writes to both the Lance vector index and the Tantivy BM25 index. Returns the persisted MemoryRecord including its UUID.

Recall memories for an agent. Mode 'hybrid' (default) merges Lance vector kNN and Tantivy BM25 via Reciprocal Rank Fusion (k=60); 'vector' or 'text' restrict to one backend. Returns ranked MemoryRecord stubs (no embeddings).

Mint a new NFT in an existing collection. For ERC-721, each token_id is unique. For ERC-1155, you can mint multiple copies of the same token_id. Returns the minted token details.

Mint stable units, hard-gated by the Secure-Mint reserve floor so circulating can never exceed the attested reserve.

Return the catalog MoE topology for a model (num_experts, experts_per_token, shared_experts, params_per_expert_x10) and its architecture. The moe field is null for dense models.

Load a per-expert safetensors weight blob (gate_proj/up_proj/down_proj) into this node's MoE expert runtime, from an inline base64 blob or a tenzro://blob URI. Returns the resident expert's dimensions and byte footprint.

Snapshot of this node's resident MoE experts and gating networks with total byte footprint.

Run a distributed MoE forward for one layer: gate-route the hidden-state batch locally, fan expert sub-batches out to holders (local runtime, iroh tenzro/moe ALPN, or HTTP JSON-RPC), and gather the gate-weighted combined outputs. hidden_states and outputs are base64 of little-endian f32 bytes.

Load a gating-network safetensors blob (router.weight) for a model layer into this node's MoE expert runtime, from an inline base64 blob or a tenzro://blob URI.

Given per-token top-k routing decisions, return the per-holder batch plan and per-token slot assignments. Set allow_cold to permit routing to experts that are not warm-resident.

Return the current replication policy used by shard-view consumers: min/max replication and the hot-expert tokens-per-second threshold.

Return the expert shard map for a model: per-expert holders, replication counts, role counts, the replication policy, and lists of under-replicated and hot experts across known providers.

Compute a multilateral netting batch over a set of bilateral obligations: greedy netting collapses the gross obligation graph into a minimal set of net settlement instructions. Deterministic and idempotent by batch id. Mirrors tenzro_nettingCompute.

Read a netting batch (gross obligations, net settlement instructions, status). Mirrors tenzro_nettingGetBatch.

List all netting batches. Returns {count, batches: [...]}. Mirrors tenzro_nettingListBatches.

Mark a computed netting batch as settled once its net settlement instructions have been executed. Mirrors tenzro_nettingSettle.

Return this node's hardware self-profile: linked runtime build commit, CPU architecture, operating system, detected compute devices, and derived serving values (capacity in GB, backend, capability key).

Return this node's sustained connectivity tier. When the network service is not running the tier is null and available is false.

RFC 8414 / RFC 9728 OAuth Authorization Server / Protected Resource Metadata. Returns the same metadata document the AS publishes at `GET /.well-known/openid-configuration`, augmented with AAP-specific extensions (authorization_details_types_supported, aap_claims_supported, dpop_signing_alg_values_supported).

Register an inbound snapshot manifest received from a peer. **The caller MUST verify `state_root_hex` against a trusted QC at the same height before invoking** — this RPC only registers the offer and provisions the spool directory; it does not itself validate the manifest against chain state. Returns `{accepted: true, height, num_chunks}`.

Open a micropayment channel for off-chain per-token billing. Sender deposits TNZO into the channel for streaming payments to the recipient. Returns the channel ID.

Satisfy a natural-language intent by planning and running an ordered set of capabilities — models, registered skills, registered tools, and agent/swarm delegation. One layer above route_by_intent: that resolves a single model, this composes models with the skill/tool registries and the swarm runtime. The plan's aggregate estimated cost is checked against the payer's wallet balance before any step runs. Returns the plan, per-step outputs, aggregate estimated cost, and the number of re-plan iterat…

Pause an agent (reversible). Halts all outbound A2A messaging and inference dispatch but preserves stake. Requires controller_did to match the agent's registered controller. NOTE: this MCP tool describes the operation only — the transaction must be signed and submitted via tenzro_signAndSendTransaction with type=PauseAgent.

Compute the EIP-712 digest a user signs for a Permit2 SignatureTransfer. If `witness` is provided, binds the permit to that 32-byte witness (used by ERC-7683 origin opens to bind to a specific cross-chain order). Returns `{digest, struct_hash, domain_separator}`.

Read the EIP-712 domain separator for the canonical Tenzro Permit2 contract (0x0000…00001023) on `chain_id`. Returns `{domain_separator, verifying_contract, chain_id}`.

Check whether a (owner, nonce) Permit2 slot has been consumed. Returns `{used, owner, nonce}`.

Atomically verify a signed Permit2 message and consume its (owner, nonce) bitmap slot. Returns `{consumed, word_pos, bit_pos}`.

Post an AgentBond surety against an agent DID (Agent-Swarm Spec 9). An Active bond ≥ bond_min_for_promotion promotes a Machine identity into the Delegated admission lane even when its controller is unknown / sub-Enhanced KYC. NOTE: this MCP tool describes the operation only — sign and submit a PostAgentBond transaction via tenzro_signAndSendTransaction.

Post a new task to the Tenzro Network task marketplace. Returns the created task with its UUID. Tasks can request AI inference, code review, data analysis, content generation, agent execution, translation, or research.

Read the renter's current prepaid balance. Returns `{renter, asset, balance}` in wei.

Pre-fund the streaming settlement path: lock `amount` (wei) of the renter's on-chain TNZO into the prepaid ledger so storage/compute runtimes can stream per epoch out of it. Returns `{renter, asset, deposited, balance}`. Requires the node to run with storage + token subsystems.

Withdraw up to `amount` (wei) of the renter's unspent prepaid balance back to their on-chain account. Returns `{renter, asset, withdrawn, balance}` — `withdrawn` is capped at the available balance.

Quarantine an agent (reversible). Halts messaging AND freezes all stake (blocks unstake/withdraw, allows slash). Requires controller_did to match the agent's registered controller. Optionally accepts a 32-byte evidence hash for off-chain audit linkage. NOTE: this MCP tool describes the operation only — the transaction must be signed and submitted via tenzro_signAndSendTransaction with type=QuarantineAgent.

Quote the destination-native bridge fee in TNZO for a given (adapter, dest_chain, native_fee_smallest_unit). Read-only quote envelope; the matching tenzro_sponsorBridgeFee RPC consumes the quote to debit the user's TNZO and post a sponsorship receipt.

Submit a price quote for a task in the Tenzro Network task marketplace. Providers call this to bid on open tasks. The quote includes price, model to use, and estimated completion time.

Rate an agent template on the Tenzro Network marketplace. Ratings are 1-5 and help others discover quality templates. Optionally include a text review.

Redeem (burn) stable units, decrementing circulating supply.

Refund escrowed funds back to the payer via a signed RefundEscrow transaction. Only the original payer can refund, AND the escrow must be expired (or use Timeout/Custom release conditions).

Register a new AI agent identity on the Tenzro Network. Two modes: (1) provisioner — node provisions a server-side hybrid wallet (FROST Ed25519 + ML-DSA-65 + BLS12-381), returns the classical_public_key + pq_verifying_key_len + bls_verifying_key_len; (2) BYOK — caller supplies `public_key` (32B Ed25519), `pq_public_key` (1952B ML-DSA-65), and `bls_public_key` (48B BLS12-381 G1) hex, registration is self-custodial. Returns agent_id, wallet_address, tenzro_did, registration_fee, and `byok` flag.

Publish an agent template to the Tenzro Network agent marketplace. Templates define reusable AI agent configurations with system prompts, capabilities, and pricing. Others can discover and deploy your template.

Register a new application on the Tenzro Network. The master wallet address will sponsor gas for user operations. Returns the app ID and API key.

Register ERC-3643 compliance rules for a token. Defines KYC requirements, holder limits, country restrictions, and balance caps. All transfers of this token will be checked against these rules.

Register a human or machine identity on the Tenzro Decentralized Identity Protocol (TDIP). Human identities are self-sovereign; machine identities require a controller DID and receive a delegation scope

Register a cross-VM pointer for an NFT collection. Maps the collection to a contract address on another VM (EVM, SVM, or DAML) enabling cross-VM NFT discoverability.

Register as a service provider on the Tenzro Network. Providers earn TNZO by serving AI models (inference), providing TEE enclaves (security), validating blocks, or providing storage.

Register or replace an issuer's stable-asset policy (issuer-agnostic stable-unit issuance on the Secure-Mint reserve floor). Requires the `issuer` API-key scope.

Register a webhook URL for event notifications. The Tenzro node will POST JSON event payloads to the registered URL when matching events occur. Each POST includes an HMAC-SHA256 signature in the X-Tenzro-Signature header for verification. URL must be `https://`; secret must be at least 16 characters.

Release escrowed funds to the payee via a signed ReleaseEscrow transaction. Only the original payer can release.

Request testnet TNZO tokens from the faucet (100 TNZO per request, 24-hour cooldown per address)

Grow or shrink a database along the local → lan_cluster → network continuum in place. Administrative — gated on the write action. partitions and the replication bounds default to the database's current values when omitted; min_replication and max_replication must be supplied together.

Resolve a DID to its identity information, including display name, type, status, and delegation scope for machine identities

Resolve an inference challenge (operator only — requires X-Tenzro-Admin-Token). Provide `prompt` for local re-execution (a failing verification upholds the challenge) or an explicit `upheld` verdict. Upheld verdicts decrement the provider's reputation and record a compute-bond failure; the response carries reputation_penalized + bond_failure_recorded booleans. Mirrors tenzro_resolveInferenceChallenge.

Resolve a username to its DID on the Tenzro Network. Returns the DID associated with the given username.

Operator-only. Revoke an API key by its non-secret `key_id`. Requires `X-Tenzro-Admin-Token`. Fails with `-32004` if the target is an `operator_protected` key (those cannot be revoked via RPC, by anyone, including an admin — rotate by updating the operator secret and restarting the node).

Subject-gated. Revoke an API key belonging to the caller's own subject. Requires `X-Tenzro-Api-Key`. Only `subject`-class keys are eligible. The error for "no such key" and "not your key" is intentionally the same so ownership cannot be probed.

Revoke an active wallet session immediately. The session ID becomes invalid and any pending operations under this session are cancelled.

Revoke a smart account's session-key validator config.

Rotate the key shares of an MPC wallet. Generates new shares while keeping the same public key and address. Old shares become invalid.

Discover the best model for an intent (use case + budget + quality floor + cost-quality knob) without naming a model. Returns the selected model_id, tier, estimated cost, and a fallback chain. Discovery only — dispatches nothing and records no spend. Feed the returned model_id into chat_completion to run it

Run an agentic task loop for an agent. The agent calls an LLM with built-in tools (spawn_agent, delegate_task, collect_results, complete) and executes them iteratively until done or the maximum step limit is reached.

Run (invoke) a spawned agent template end-to-end. For paid templates, the `payer_wallet` is charged: the network commission (5%) goes to the treasury and the remainder is paid to the template's `creator_wallet`. `tokens_estimate` is used for per-token pricing. Set `dry_run=true` to simulate without charging fees or dispatching real transactions. Successful non-dry-run invocations are metered (invocation_count + total_revenue) and persisted.

Seal (encrypt) data within the TEE enclave using hardware-derived keys. The sealed data can only be unsealed on the same TEE platform with the same key_id.

Search agent templates on the Tenzro Network marketplace by query. Matches against template name, description, and tags using case-insensitive substring search.

Atomic check + circulating increment. Use after the invariant check has passed off-chain.

Read-only invariant check for a proposed mint. Returns `{would_succeed, reserve, circulating, headroom, reason?}`.

Record a redemption — decrements circulating. Call after the off-chain burn is finalized.

Fetch a SeedAgent governance charter by 32-byte id. Charter enumerates OperationKind (InferenceConsumer / TaskMarketplaceConsumer / etc.), spend caps, throughput target, counterparty filter, and sunset deadline.

Show the genesis SeedAgent treasury earmark — total TNZO allocation, draw-down to date, decay schedule, seed-agent count, surplus burn bps at sunset. The earmark funds protocol-owned bootstrap agents for the first 12 months.

Get network activity counters (inference / settlement / bridge / ERC-7683). exclude_seed=true filters out flows where either side `is_seed_agent`, isolating organic activity from protocol bootstrap traffic.

List provisioned SeedAgent records. Each record carries agent_did, controller_did, status (Active/Paused/Quarantined/Terminated), allocation drawn, and optional bond id. Filter by charter_id to scope to one charter's roster.

List every SeedAgent governance charter registered on this node.

Run prompt-driven image segmentation. `prompts` is an array of `{type:'point', x, y, label}` (label=1 foreground / 0 background) or `{type:'box', x0, y0, x1, y1}` objects. Returns one mask per prompt with confidence scores.

Submit a hybrid-signed (Ed25519 + ML-DSA-65) AgentMessage to a recipient agent's queue. Signing preimage: SHA-256(AgentMessage::signing_data()) — which includes both wallet addresses (resolved from registry, not wire). Both signature legs are required when the router enforces signing (production default); half-signed messages are rejected. Returns message_id, status, timestamp, and signed flag.

Send a TNZO transfer transaction on the Tenzro ledger. Two supported paths: (a) ambient OAuth/DPoP — omit signature/public_key/timestamp; the server will look up the wallet bound to the bearer DID and sign; (b) pre-signed — supply signature + public_key + timestamp matching the signed Transaction::hash(). The legacy private_key inline-signing path has been removed.

Start serving a model for inference. Local mode loads downloaded GGUF weights in-process (the model must be downloaded first). External mode fronts an already-running OpenAI-compatible engine (vLLM, SGLang, llama-server) — pass engine + base_url. Returns the serving status and configuration.

Set the delegation scope for a machine identity, defining spending limits, allowed operations, payment protocols, and chains the agent may use

Set the per-token pricing configuration for a provider node. Prices are wei per token (1 TNZO = 10^18 wei). Returns the updated pricing config.

Set the availability schedule for a provider node. Define which hours and days the node will accept new inference requests. Returns the updated schedule.

Set or update a Secure-Mint policy for a tokenized real-world asset. Enforces per-token 1:1 reserve attestation `circulating + amount ≤ reserve` at every mint.

Install or update the per-account SpendingLimitValidator config (per-tx + daily rolling-window caps).

Set spending limits for a wallet. Defines the maximum daily spend and per-transaction limit in TNZO. Transactions exceeding these limits will be rejected.

Set a globally unique username for a DID on the Tenzro Network. Usernames provide human-readable aliases for DIDs (e.g. 'alice' instead of 'did:tenzro:human:uuid').

Execute an immediate settlement between two addresses on the Tenzro Network. Transfers TNZO from payer to payee for a specific service type. Returns the settlement receipt.

Sign a message with a private key. Returns the hex-encoded signature. Supports Ed25519 and Secp256k1 key types.

Verify a WebAuthn assertion against the registered passkey on a smart account. Returns verified=true iff the P-256 leg validates and the embedded challenge matches the supplied user-op hash.

Compute the canonical hash for an A2A v1.0 SignedAgentCard payload. The caller passes the AgentCard JSON; the node returns the 32-byte hash the domain owner must sign via JWS to produce the SignedAgentCard envelope.

Read the SLA fault-detector parameters this validator is using: `slash_threshold` (number of missed probes before slashing fires for a provider), `slash_amount_wei` (per-crossing slash amount in wei, decimal string), and this validator's `vrf_pubkey` (0x-prefixed hex).

Issue a VRF-bound SLA liveness probe to a ModelProvider / TeeProvider DID and broadcast it on the `tenzro/sla` gossipsub topic. Validator-only — on a non-validator node this returns `-32000 SlaManager not initialized`. The probe is addressed by a 32-byte VRF output (`challenge_nonce`). `deadline_ms` is a Unix-millisecond timestamp; if the provider does not respond before this deadline the probe is counted as missed against the fault-detector's slash threshold.

List every in-flight SLA probe awaiting a response, regardless of issuer. Returns `{count, probes: [...]}` with `challenge_nonce`, `provider_did`, `epoch`, `round`, `deadline_ms`, and `issuer` for each probe. Used by operators to spot stuck probes whose deadline has already elapsed without a matching response.

Spawn a child agent under a parent agent on the Tenzro Network. The child inherits the parent's controller DID and can be delegated tasks. Maximum 50 children per parent agent.

Spawn an agent from a marketplace template on the Tenzro Network. Creates a new agent instance with its own identity, wallet, and capabilities based on the template definition.

Sponsor a transaction using the master/paymaster wallet. The gas cost is paid by the master address while the transaction is sent on behalf of the user. Uses ERC-4337 account abstraction.

Stake TNZO tokens to participate as a validator, model provider, TEE provider, or storage provider. Staked tokens earn rewards and increase network weight.

Stop serving a model on this node. The model remains downloaded but no longer accepts inference requests. Returns the stop confirmation.

Run one proof-of-retrievability-gated charge epoch for a storage deal. Charges only when the retrievability challenge passes.

Look up a storage deal by id.

Open a streaming storage deal for an already-stored object. The renter pre-funds total_epochs from their deposit; the per-epoch price is size × rate.

Set the byte-epoch storage pricing policy. Use mode "dynamic" with a non-zero capacity and optional min_rate/max_rate bounds; fixed-rate is the spawn default.

Summary of this node's storage-provider state: effective rate and stored object count.

Store an object on this node's storage provider with an erasure-coded redundancy scheme. Returns the object id, stored size, and shard counts.

Submit a DAML command to a Canton domain. Supports create, exercise, and create_and_exercise commands. Returns the transaction ID and updated contract state.

Submit one guardian's composite (Ed25519 + ML-DSA-65) signature against an in-flight social-recovery ceremony. Returns the running tally and a quorum_reached flag.

Record a signed Proof-of-Reserve attestation backing a tokenized asset, so attested-mint can enforce 1:1 backing. Mirrors tenzro_submitReserveAttestation.

Register an event filter for real-time streaming via WebSocket or gRPC. Returns a subscription ID and connection URLs for receiving matching events. Events matching the filter will be pushed to connected clients.

Terminate an agent (TERMINAL — irreversible). Halts messaging, optionally slashes stake (slash_bps 0-10000), and optionally cascades to all descendant spawned agents. Requires controller_did to match. NOTE: this MCP tool describes the operation only — the transaction must be signed and submitted via tenzro_signAndSendTransaction with type=TerminateAgent.

Terminate a Tenzro agent swarm and all its member agents. Attempts graceful shutdown of each member. Returns confirmation with swarm ID and terminated status.

Embed a batch of strings with a registered text encoder. Returns one row per input. Optional `requested_dim` enables Matryoshka truncation (e.g. 128/256/512 from a native 768/1024-dim model).

Run open-vocabulary text-promptable segmentation. Provide a free-text label (e.g. 'person', 'dog') and an image; optionally narrow with a normalized cxcywh box. Returns a variable number of detections, each with a bbox (x0,y0,x1,y1 pixels), score, and binary mask resampled to original image dimensions.

Get the TNZO token balance for an address. Returns the balance in wei (1 TNZO = 10^18 wei) as a decimal string.

Get the total TNZO token supply in wei (1 TNZO = 10^18 wei). Useful for inflation monitoring and economic analysis.

Ask the Tenzro Train syncer for its round decision. Returns `{decision: "wait", remaining_ms}` while the DiLoCo grace window is open, `{decision: "finalize", round}` once a witness quorum endorses the round, or `{decision: "no_quorum", round}` when the window elapses without a quorum (the run advances, carrying the prior state root forward). Returns JSON-RPC -32602 when the run is unknown. Read-only — safe for monitoring agents.

Fetch the sealed receipt for a finalized Tenzro Train run. Returns null when the run is still active. Persisted under CF_TRAINING_RECEIPTS — carries final_state_root, rounds_completed, witness_committees, optional manifest_hash, sealed_at_ms.

Look up a single Tenzro Train run by task_id. Returns the full read-side view (task_spec, status, current_round, state_root, enrolled_trainers, metadata, receipt-if-terminal). Returns JSON-RPC -32602 when the run is unknown.

Fetch the installed sealed-shard manifest for a Confidential-tier Tenzro Train task. Returns null when no manifest has been installed (Open and Verified tiers never have a manifest). Manifest binds each trainer's encrypted shard, HPKE-wrapped data key, and enclave attestation.

List every active Tenzro Train run this node is syncing. Each run carries task_id, status (Pending/Active/Completed/Failed/Cancelled), current_round, state_root, enrolled_trainers, and (once terminal) the sealed receipt. Read-only — safe for monitoring agents.

Transcribe an audio clip (WAV/MP3/FLAC, base64-encoded) with a registered ASR model. Optional language hint, per-segment timestamps, and decoding temperature. Note: the ORT-backed transcriber is feature-gated — default builds return ProviderNotAvailable.

Transfer an NFT between addresses within a collection. Verifies the sender owns the token before transferring. Returns the updated ownership details.

Approve a treasury withdrawal with a signed approval. The signature covers 'tenzro/treasury/withdrawal-approval' || withdrawal_id || asset_id || amount_le and must come from an authorized withdrawer. Returns the approval count and whether the threshold is reached.

Execute a treasury withdrawal after the approval threshold is reached. The (withdrawal_id, asset_id, amount) triple must match the approved withdrawal exactly.

Get a pending treasury withdrawal's approval state: asset, amount, approver addresses, approval count, and the configured threshold. Returns null when no pending withdrawal matches.

Unload a registered ASR model, freeing its ORT session.

Unload a registered detector, freeing its ORT session.

Unload a registered forecast model from this node, freeing its ORT session.

Unload a registered segmenter, freeing its ORT session.

Unload a registered text-embedding model, freeing its ORT session.

Unload a registered SAM-3 segmenter, freeing its three ORT sessions (image encoder, language encoder, decoder).

Unload a registered video encoder, freeing its ORT session.

Unload a registered vision encoder, freeing its ORT session.

Unseal (decrypt) data that was previously sealed within the TEE enclave. Requires the same key_id used during sealing.

Unstake TNZO tokens and begin the unbonding period. After the unbonding period (typically 7 days), tokens can be withdrawn.

Update metadata for an agent template you own. Change description, version, status, or tags. Returns the updated template record.

Read the ERC-7943 (uRWA) frozen-tokens amount for a (token_id, account) pair. Returns the frozen amount in token smallest unit.

Read the ERC-7943 (uRWA) kill-switch state for a given token_id (32-byte hex). Returns the kill-switch active flag, the canonical 4-byte selectors for the standard uRWA functions, and the precompile addresses backing the on-chain enforcement path.

Verify a Tenzro DID envelope carried as a tool argument (the hex X-Tenzro-DID-Envelope value). Supports did:tenzro (registry), did:key, did:ethr (recoverable secp256k1), and did:web (resolved over HTTPS). Returns {valid, did, method} or {valid:false, error}. MCP-native carriage: tool calls expose no HTTP headers, so the envelope rides as an argument.

Verify a stored inference commitment by re-executing the prompt+output as a single prefill and comparing per-step top-k logits. The caller supplies the exact prompt (never stored). Requires the model loaded in serial (llama.cpp) mode on this node. Returns {commitment_hash, model_id, provider, pass, steps_total, steps_passed, failing_steps}. Mirrors tenzro_verifyInferenceCommitment.

Verify a payment credential against a previously created challenge and settle the payment on-chain

Verify a cryptographic signature against a public key and message. Returns whether the signature is valid.

Verify a TEE attestation report. Checks the vendor certificate chain, signature, and measurement hashes. Returns verification status and details.

Verify a Tenzro VRF proof (RFC 9381 ECVRF-EDWARDS25519-SHA512-TAI). Returns the deterministic 64-byte VRF output if the proof is valid. Used for provably-fair NFT reveals, lotteries, and randomized trait assignment.

Verify a Plonky3 STARK proof (over KoalaBear) on the Tenzro ledger. Requires a circuit_id ('inference', 'settlement', or 'identity').

Produce a clip-level embedding from a short video (base64-encoded). Until a V-JEPA 2 ONNX export lands, agents can fall back to per-frame vision_embed pooling.

Embed a single image with a registered vision encoder. Pass base64-encoded PNG/JPEG/WebP bytes. Returns a dense feature vector (e.g. 768-dim for DINOv3-base, 1152-dim for SigLIP2-so400m).

Compute cosine similarity between an image embedding and a text embedding (must have matching dimension). Pure math — does not load any model. Typical use: pair vision_embed (image) with text_embed against a CLIP/SigLIP text tower.

Vote on an active Tenzro governance proposal. Cast yes, no, or abstain. Voting power is proportional to staked TNZO. Returns the recorded vote and current tally.

Finalize a saga workflow once all steps are Verified: compute the receipt hash and mark it Completed. Mirrors tenzro_workflowFinalize.

Open a multi-agent saga workflow: declare ordered steps (each with an Execute→Verify→Compensate lifecycle) plus optional per-step escrow. Returns the opened saga. Mirrors tenzro_workflowOpen.

Compensate a saga step (and, with cascade=true, every lower-index executed/verified step in reverse order), refunding still-funded per-step escrow (vault→payer). Mirrors tenzro_workflowStepCompensate.

Execute a saga step: transition it Pending→Executing and, if escrow_amount is set, lock a per-step escrow (payer→vault). Mirrors tenzro_workflowStepExecute.

Verify a saga step: transition it Executing→Verified, release any per-step escrow (vault→payee), and emit ERC-8004 reputation feedback for the step executor. Mirrors tenzro_workflowStepVerify.

Bridge tokens via the Wormhole adapter registered on the BridgeRouter. Returns transfer_id, tx_hash, fee_paid, and estimated_arrival_ms on success.

Look up the Wormhole numeric chain id for a chain name (ethereum=2, solana=1, base=30, arbitrum=23, optimism=24, etc.).

Enumerate the Wormhole NTT chain catalog supported by this Tenzro deployment. Returns Wormhole chain ids + names + supported Transceiver kinds (wormhole / axelar / layerzero / custom).

Parse a canonical Wormhole VAA id of the form {chain}/{emitter}/{sequence} into its components.

Wrap native TNZO to a specific VM representation (wTNZO ERC-20 on EVM, wTNZO SPL on SVM). In the pointer model, this is a no-op since all VMs share the same balance — the tool confirms the balance is accessible on the target VM.

Perform an X25519 Diffie-Hellman key exchange. Returns the 32-byte shared secret in hex.

Remove a Bazaar listing. Refused unless seller_did owns the listing. Returns {removed}.

Query the x402 Bazaar for paid resources. All set filters are ANDed; unset filters match everything. Each listing carries seller_reputation joined from the provider-reputation ledger (settled payments are the only score-up path). Results are highest-reputation-first (unscored last), freshest within the same score, capped by limit when non-zero. Returns {listings, count}.

Derive the deterministic pay_<hex> idempotency id for an (offer, payer) pair so a buyer can detect and skip a retry client-side. Pass either the full requirement (node recomputes the commitment) or a 64-hex offer_commitment, plus payer_did.

Describe the x402 protocol surface this node exposes: registered schemes, supported networks/assets, and the Bazaar discovery endpoints.

List a paid HTTP resource in the x402 Bazaar so buyers can discover it. scheme is an x402 scheme id ('tenzro-hybrid', 'exact-eip3009', 'permit2', 'erc7710'). Returns the assigned listingId.

Verify a server-signed x402 offer before paying. Pass the full X402PaymentRequirement JSON exactly as it appeared in the 402 body. The node recomputes the commitment and verifies the Ed25519 signature under the carried signer key. Returns {valid, offerCommitment, offerSigner}.