The operating system for autonomous onchain agents.

§1Introduction

Agents do not fail because they cannot think. They fail because they cannot live: they cannot pay, cannot hold gas, cannot access gated tools, cannot enforce budgets, and cannot persist as a process.

fold. is an operating system for autonomous onchain agents. The word operating system is literal: fold treats agents as first-class processes with resources, identity, permissions, budgets, and system calls. A human does not repeatedly prompt an agent; the human briefs it, fences it, funds it, and deploys it.

The earlier fold product was narrower: a deployment surface for trading agents. That first system taught the core lesson. A trading agent did not merely need a better prompt. It needed a wallet, scoped signing rights, budget enforcement, paid information, gas abstraction, and a transparent audit trail. The OS version of fold generalizes that stack beyond trading.

The thesis

The thesis is narrow and falsifiable: an agent economy does not emerge from larger models alone. It emerges when agents can buy what they need, act without human-funded gas, and operate inside constraints that are enforced below the prompt.

1. Reasoning is not enough. A perfect model still dies at a 402 Payment Required response it cannot pay.
2. Autonomy requires infrastructure. Wallets, budgets, tools, gas, and settlement are not accessories. They are the living conditions of an agent.
3. Safety belongs below the model. A mandate must bind at runtime and signing boundaries, not merely as text in a system prompt.

What fold is

fold is composed of four layers, shipped in risk order rather than narrative order.

Design principles

§2The agent as process

A fold agent is not a chatbot plus wallet. It is a process with a security principal, a private state, tools, resource limits, and a lifecycle.

An agent is represented as:

where w is the wallet, M is the mandate, π is the model-driven policy, σ is mutable private state, and T is the set of priced tools the agent can call.

Resource semantics

Every action has a cost vector. Paid tool calls have a fee. Onchain transactions transfer value. Gas is accounted separately because fold can sponsor gas through the execution layer.

This separation matters. If an agent must hold ETH to act, it inherits a liveness dependency on a human. If the platform sponsors gas and prices it into fees, the agent can act from a wallet that has never held the native token.

§3The mandate

The mandate is the central abstraction of fold. A human writes what the agent should do, how it should behave, and what it must never do. fold compiles that into an enforced envelope.

Three enforcement rings

Prompt-only guardrails are not guardrails. fold enforces the mandate in three concentric rings.

From brief to policy

The brief compiler has three stages:

1. Elicitation. Natural-language brief is converted into candidate objectives, constraints, budgets, and halts. Ambiguity is legal only here.
2. Normalization. Confirmed components become a canonical schema: typed predicates, integer budgets, timestamps, thresholds.
3. Projection. The schema is projected into prompt text, runtime checks, and the enforceable subset encoded into session-key policy.

// Normalized mandate sketch
{
  "objective": { "kind": "bounded_utility", "goal": "research and act inside constraints" },
  "constraints": [
    { "type": "allowlist", "field": "chain", "values": ["base"] },
    { "type": "deny", "field": "unknown_contract" }
  ],
  "budget": { "perTx": "25e6", "daily": "100e6", "lifetime": "1000e6" },
  "halts": { "deadline": "2026-08-01T00:00:00Z", "drawdownPct": 20 }
}

§4x402 payment layer

Payments are the circulatory system of the agent economy. x402 lets a machine buy one unit of computation or data with one signed payment.

The exchange is intentionally small:

Deployed service surface

The service layer exposes endpoints across trading intelligence, inference, search, extraction, chain access, prediction markets, and market data.

Permit2 self-settlement

For assets without native authorization transfer, fold uses Uniswap Permit2 signature transfer. The payer signs a permit binding token, amount, nonce, deadline, spender, and witness. The settlement signer redeems it; the identity wallet receives value.

The separation between settlement signer and identity wallet limits operational risk. The signer can redeem a valid permit, but cannot enlarge it, replay it, redirect it, or move funds outside the signed constraints.

§5The /exec endpoint

/exec is the smallest complete instance of fold: a service an external agent can discover, price, pay, and consume in one loop.

The endpoint charges a flat 0.01 USDT per paid call and supports three tools whose marginal cost remains below the flat fee.

// /exec request body
{
  "tool": "search",
  "params": {
    "query": "Base agents using x402 payments"
  }
}

Server-side handling

1  if payment header is absent:
2      return 402 + challenge(0.01 USDT, payee, settlementSigner, nonce, deadline)
3  if tool is unsupported:
4      return 400 + supportedTools       // never charged
5  if params are invalid:
6      return 400 + reason               // never charged
7  settle payment
8  dispatch in process
9  return 200 + result + settlement reference

§6Gasless execution

Gas is death one for autonomous agents. fold moves gas from the agent's liveness path onto the platform's execution layer.

Agent transactions can be submitted as ERC-4337 user operations. The smart account validates the signature and the session-key policy; the paymaster sponsors gas subject to its own policy. The agent does not need the native token.

The strategic value of gaslessness is not merely cost reduction. It removes the human operation of funding a wallet with native gas before an agent can act.

§7Economics of autonomous agents

An autonomous agent must survive three deaths before it can earn: gas, data, and tools. Each failure is infrastructural, not intellectual.

If each subsystem is 70% available, conversion is only about 34%. An OS raises each factor architecturally: sponsorship for gas, x402 for paid data, and unified tools for execution.

Value of information

Agents should buy information when it changes decisions enough to exceed its cost.

In the symmetric case, the minimum decision stake is:

Agent unit economics

The platform's job is to make everything except judgment cheap enough that judgment is what gets tested. If infrastructure drag dominates the equation, the agent economy never starts.

Marketplace dynamics

Flat pricing is not an aesthetic choice. A buyer agent comparing services must parse the price before it evaluates quality. A single flat number reduces evaluation cost and increases discoverability. This is why /exec uses one price even though its tools have different marginal costs.

§8The fold kernel

The kernel is a computer you walk into: a browser desktop where humans and agents share the same tools through different surfaces.

Application surface

The GUI and the API are views of one system. Every capability a human can click, an agent can call, subject to the same mandate and payment rules.

§9tref deployment

tref is the path from a plain-language brief to a running, funded, mandate-fenced agent.

// tref deployment pipeline
1. elicit and confirm brief β into (O, C, B, H)
2. deploy ERC-4337 smart account w
3. issue session key k with policy projection of (C, B, H)
4. register (w, k, hash(M)) onchain
5. transfer funding F from principal wallet to agent wallet
6. start runtime process π with (w, k, M)
7. begin append-only decision-record stream

Threat model

§10Transparency

Autonomy without legibility is a liability. fold agents emit decision records so humans can read the machine’s work.

{
  "n": 421,
  "ts": "2026-07-08T18:42:10Z",
  "action": { "kind": "call", "endpoint": "/search" },
  "rationale": "Need current market context before deciding.",
  "confidence": 0.74,
  "informationSpend": [
    { "endpoint": "/search", "cost": "0.007e6", "settlement": "0x..." }
  ],
  "cumulativeSpend": "12.41e6",
  "refs": ["ipfs://..."]
}

Confidence is treated carefully. Until enough outcomes exist for calibration, confidence is stated confidence, not measured probability. The intended loop bins decisions, measures calibration error, and applies a monotone recalibration map before using confidence as an R2 gate.

§11Wire formats

The request lifecycle is small enough to model explicitly. Smallness is a property: fewer states mean fewer hidden edge cases.

§12Reference schemas

Mandate schema

{
  "version": "1.0",
  "objective": {
    "name": "bounded autonomous execution",
    "utility": "maximize task completion under constraints"
  },
  "constraints": [
    { "type": "target_allowlist", "targets": ["0xRouter..."] },
    { "type": "chain_allowlist", "chains": ["base"] }
  ],
  "budget": {
    "perTransaction": "25000000",
    "perDay": "100000000",
    "lifetime": "1000000000",
    "asset": "USDC"
  },
  "halts": {
    "deadline": "2026-08-01T00:00:00Z",
    "killSwitch": "enabled"
  }
}

402 challenge schema

{
  "scheme": "exact",
  "asset": "USDT",
  "amount": "10000",
  "payTo": "0xPayee...",
  "network": "base",
  "nonce": "0x...",
  "expiry": "2026-07-08T18:45:00Z"
}

§13Buyer-agent quickstart

A buyer agent does not create an account. It makes a request, receives a price, signs, retries, and receives the result.

// 1. Attempt request without payment.
const body = {
  tool: "prediction",
  params: { query: "Will ETH ETF inflows exceed expectations this week?", limit: 5 }
};

const r1 = await fetch("https://x402.fold.computer/exec", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify(body)
});

// 2. If 402, parse challenge and sign the exact authorization.
const challenge = await r1.json();

// 3. Retry with X-PAYMENT.
const r2 = await fetch("https://x402.fold.computer/exec", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-PAYMENT": signedPayment
  },
  body: JSON.stringify(body)
});

const result = await r2.json();

§14Verification and security checklist

§15Roadmap

Phases ship in order, and each phase must leave a working system behind.

§16Glossary