Triage x OWS

One CLI command. Reputation-gated spending policies for the agent economy.

npm · live demo · github

OWS gives the wallet. x402 handles payment. Triage decides how much the agent should be trusted with money.

Give agents wallets, not blank checks.

Triage × OWS builds on Triage, a previous trust-layer project that won 1st place at the AgentKit Hackathon by World, Coinbase, and XMTP. This version applies the same trust-first philosophy to OWS wallet governance and adaptive spending policies.

Every agent transaction is scored by identity, behavior, and compliance — then approved or denied automatically. One package. Five trust factors. Dynamic spending limits. Real-time dashboard. Reputation-aware spending governance, with stronger identity from World ID and Web Bot Auth.

Install

npm install triage-ows hono

Quick Start (Zero Code)

npx triage-ows init        # scaffold triage.config.json + .env.example
npx triage-ows dev         # start scoring server + dashboard
# Dashboard at http://localhost:4021
# Scoring server ready for OWS policy evaluation

Quick Start (Code)

const { startServer, setOWSWallet } = require('triage-ows')

setOWSWallet('agent-1', 'wallet-id', 'key-id')
startServer(4021)
// Done. Every signing request is now scored and governed.

Try It Now

Live deployment: https://triage-x-ows-production.up.railway.app/

Open the dashboard in your browser to see live trust scoring in action. Then try these commands:

# See all agents and their trust scores
curl -s https://triage-x-ows-production.up.railway.app/api/agents | python3 -m json.tool

# Fire a transaction — Sovereign agent sends $1
curl -s -X POST https://triage-x-ows-production.up.railway.app/api/policy/evaluate \
  -H "Content-Type: application/json" \
  -d '{"chain_id":"eip155:84532","wallet_id":"5dccd73e","api_key_id":"0d3531c9-83c4-401f-94d8-85f5dc9bdd6b","transaction":{"to":"0x1234","value":"400000000000000","raw_hex":"0x","data":"0x"},"spending":{"daily_total":"0","date":"2026-04-04"},"timestamp":"2026-04-04T12:00:00Z"}'

# Fire a big transaction — triggers DENY
curl -s -X POST https://triage-x-ows-production.up.railway.app/api/policy/evaluate \
  -H "Content-Type: application/json" \
  -d '{"chain_id":"eip155:84532","wallet_id":"test","api_key_id":"unknown-agent","transaction":{"to":"0x1234","value":"99000000000000000000","raw_hex":"0x","data":"0x"},"spending":{"daily_total":"0","date":"2026-04-04"},"timestamp":"2026-04-04T12:00:00Z"}'

# Override a denied transaction — boosts trust by +3
curl -s -X POST https://triage-x-ows-production.up.railway.app/api/override/unknown-agent

# Check x402 payment requirements
curl -s https://triage-x-ows-production.up.railway.app/api/x402/payment-requirements

# Get World ID verification context
curl -s -X POST https://triage-x-ows-production.up.railway.app/api/verify-context

# View aggregate stats
curl -s https://triage-x-ows-production.up.railway.app/api/stats

Every endpoint is real. No mocks. No stubs.

What Happens to Every Transaction

Agent wants to spend $50
  │
  ▼
OWS policy engine calls triage-policy executable
  │
  ▼
PolicyContext received (wallet, transaction, spending data)
  │
  ▼
Identity check — World ID? Web Bot Auth? OWS wallet? Fresh?
  │
  ▼
5-factor trust score computed (0-100)
  │
  ▼
Score maps to spending tier → daily + per-tx limits
  │
  ├─ APPROVE ──▶ Dashboard updated via WebSocket
  │
  └─ DENY ────▶ XMTP notification to human owner
               └─ Human replies "override" → approved + trust boost

The Six Spending Tiers

A temperature-of-trust gradient — deep blue (cold, untrusted) through cyan, green, and gold to white-gold (warm, sovereign). Trust is earned, not claimed.

All tiers are configurable via triage.config.json scoreBands.

Trust Score Formula

TrustScore = Identity(0-35) + OnChain(0-20) + Behavior(0-20) + Compliance(0-15) + Network(0-5) - Risk(0-30)

Range: 0-100 (clamped)

Identity (0-35) — Who is behind this wallet?

Additive scoring with a hard cap at 35. Based on EigenTrust pre-trusted seeds (Kamvar, Schlosser & Garcia-Molina, 2003).

An OWS wallet with both Web Bot Auth and World ID: min(35, 20 + 4 + 11) = 35.

Source: src/scoring/identity.ts

OnChain (0-20) — What does the blockchain say?

Objective, verifiable data from Base Sepolia via viem. Cached for 10 minutes. Based on PeerTrust context factors (Xiong & Liu, 2004).

Source: src/scoring/onchain.ts

Behavior (0-20) — How does this agent use its wallet?

Multi-dimensional behavioral context (PeerTrust, Xiong & Liu, 2004).

Source: src/scoring/behavior.ts

Policy Compliance (0-15) — How well does this agent operate within governance?

The strongest OWS-native signal. Based on compliance monitoring as a trust dimension (TRiSM for Agentic AI, 2026; PolicyGuard, 2025).

Fewer human overrides = higher compliance. An agent that consistently stays within limits earns wider limits.

Source: src/scoring/compliance.ts

Network (0-5) — Who do you transact with?

Single-hop counterparty trust — the local trust value from Section 4.1 of the original EigenTrust paper (Kamvar et al., 2003).

Can be disabled via config: networkScore.enabled: false.

Source: src/scoring/network.ts

Risk Penalty (0-30, subtracted)

Attack-resilient trust management (EigenTrust++, Fan, Liu, Li & Su, 2012).

Frequency penalty and inactivity decay rate are configurable.

Source: src/scoring/risk.ts

Human Override Flow

1. Agent sends transaction
2. Policy evaluation → DENY (exceeds limit)
3. Server records pendingOverride with 5-minute TTL
4. XMTP notification sent to human owner:

   "⚠️ Transaction denied
    Agent: 0xABC...DEF
    Amount: $50.00 USDC → 0x742...0C
    Trust score: 42 (Building tier)
    Reason: Exceeds per-transaction limit ($25)

    Reply 'override' to approve this transaction."

5. Human replies "override" in XMTP DM
6. Message listener detects reply, POSTs to /api/override/:address
7. Transaction approved, trust score boosted by +3
8. TRUST_CHANGE event emitted to dashboard
9. Override expires after 5 minutes if not acted on

API Reference

POST /api/policy/evaluate

Core policy evaluation endpoint. Called by triage-policy for every transaction.

curl -X POST http://localhost:4021/api/policy/evaluate \
  -H "Content-Type: application/json" \
  -d '{
    "chain_id": "eip155:84532",
    "wallet_id": "5dccd73e-59a0-47e5-bf07-d2932eaa3288",
    "api_key_id": "0d3531c9-83c4-401f-94d8-85f5dc9bdd6b",
    "transaction": {
      "to": "0x742d35Cc6634C0532925a3b844Bc9e7595f2bD0C",
      "value": "1000000000000000",
      "raw_hex": "0x",
      "data": "0x"
    },
    "spending": {
      "daily_total": "0",
      "date": "2026-04-04"
    },
    "timestamp": "2026-04-04T12:00:00Z"
  }'

Response (200):

{
  "allow": true,
  "trustScore": 82,
  "tier": "Sovereign",
  "dailyLimit": 1000,
  "dailySpent": 150.50,
  "perTxLimit": 500
}

Denial reasons: Agent is frozen, Exceeds per-transaction limit ($X), Exceeds daily spending limit ($X)

Optional headers: x-policy-secret (shared secret auth), Signature-Input + Signature (RFC 9421 Web Bot Auth).

POST /api/override/:address

Human override for a denied transaction. Boosts trust score by +3. Override expires after 5 minutes.

curl -X POST http://localhost:4021/api/override/0xAgentAddress

200: Full AgentProfile JSON. 404: Agent not found or No pending override for this agent.

GET /api/agents

Top 20 agents sorted by trust score. Filters out auto-created counterparty entries.

curl http://localhost:4021/api/agents

GET /api/agents/:address

Single agent profile with full trust breakdown.

curl http://localhost:4021/api/agents/0d3531c9-83c4-401f-94d8-85f5dc9bdd6b

GET /api/stats

Aggregate statistics (active agents only).

curl http://localhost:4021/api/stats

{
  "totalAgents": 5,
  "totalDecisions": 142,
  "totalApproved": 128,
  "totalDenied": 14
}

POST /api/verify-context

World ID sign request. Returns signing parameters for client-side verification. Returns 501 if WORLD_ID_RP_ID and WORLD_ID_SIGNING_KEY are not set.

curl -X POST http://localhost:4021/api/verify-context

POST /api/verify-human

World ID proof verification. Verifies proof server-side via World API, stores nullifier hash.

curl -X POST http://localhost:4021/api/verify-human \
  -H "Content-Type: application/json" \
  -d '{"address": "0xAgentAddress"}'

POST /api/x402/verify

Verify an x402 payment signature via the facilitator.

curl -X POST http://localhost:4021/api/x402/verify \
  -H "Content-Type: application/json" \
  -d '{
    "paymentHeader": "...",
    "payTo": "0xRecipient",
    "maxAmountRequired": "1000000"
  }'

GET /api/x402/payment-requirements

Returns payment info for HTTP 402 responses. Requires PAY_TO_ADDRESS env var.

curl http://localhost:4021/api/x402/payment-requirements

POST /api/agents/:address/pubkey

Register an agent's Ed25519 public key for Web Bot Auth (RFC 9421).

curl -X POST http://localhost:4021/api/agents/0xAgent/pubkey \
  -H "Content-Type: application/json" \
  -d '{"publicKey": "base64EncodedEd25519PublicKey"}'

WebSocket: /ws

Real-time event stream. Connect to ws://localhost:4021/ws.

// Event types:
{ type: 'POLICY_DECISION', agent, amount, trustScore, tier, decision: 'APPROVE'|'DENY'|'OVERRIDE', reason, dailyLimit, dailySpent, timestamp }
{ type: 'TRUST_CHANGE', agent, oldScore, newScore, oldTier, newTier, reason, timestamp }
{ type: 'BUDGET_WARNING', agent, spent, limit, percentage, timestamp }

CLI Reference

triage-ows — Reputation-gated spending policies for OWS agent wallets

Usage:
  triage-ows init            Scaffold triage.config.json + .env.example
  triage-ows dev             Start scoring server + dashboard (dev mode)
  triage-ows register        Register Triage policy with OWS
  triage-ows attach          Attach an OWS agent to Triage governance
  triage-ows seed            Populate demo agents for testing
  triage-ows status          Show server status + agent summary
  triage-ows help            Show this help

Options:
  --port <number>            Server port (default: 4021)
  --config <path>            Config file path (default: ./triage.config.json)

triage-ows init

Creates triage.config.json and .env.example in the current directory. Skips if files already exist.

triage-ows dev

Starts the scoring server and dashboard. Reads config from triage.config.json.

triage-ows dev --port 8080 --config ./custom.config.json

triage-ows register

Registers the Triage policy with OWS. Copies policy-template.json to ~/.ows/policies/triage-trust.json and runs ows policy create.

triage-ows attach

Creates an OWS API key attached to a wallet with the Triage policy.

triage-ows attach --wallet sovereign-agent --key sovereign-key

triage-ows seed

Seeds 5 demo agents at different trust levels (Sovereign ~85, Trusted ~65, Building ~45, Cautious ~25, Restricted ~10) and starts the server.

triage-ows status

Shows server status and agent summary table.

triage-ows status --port 4021

Configuration

triage.config.json

Create with triage-ows init or manually:

{
  "warningThreshold": 0.8,
  "scoreBands": [
    { "name": "Sovereign",  "min": 80, "dailyLimit": 1000, "perTxLimit": 500 },
    { "name": "Trusted",    "min": 60, "dailyLimit": 200,  "perTxLimit": 100 },
    { "name": "Building",   "min": 40, "dailyLimit": 50,   "perTxLimit": 25 },
    { "name": "Cautious",   "min": 20, "dailyLimit": 10,   "perTxLimit": 5 },
    { "name": "Restricted", "min": 1,  "dailyLimit": 2,    "perTxLimit": 1 },
    { "name": "Frozen",     "min": 0,  "dailyLimit": 0,    "perTxLimit": 0 }
  ],
  "scoring": {
    "overrideBoost": 3,
    "maxFrequencyPenalty": 10,
    "inactivityDecayRate": 0.5
  },
  "xmtp": { "enabled": true },
  "worldId": { "enabled": true },
  "webBotAuth": { "enabled": true },
  "networkScore": { "enabled": true },
  "port": 4021,
  "dashboardEnabled": true
}

Config is loaded from (in order):

1. Path passed to loadConfig(path)
2. TRIAGE_CONFIG_PATH environment variable
3. ./triage.config.json in the current working directory
4. Built-in defaults (if no file found)

Environment Variables

Library Exports

import {
  // Server
  app,                        // Hono app instance (add custom routes)
  startServer,                // Start scoring server + dashboard + WebSocket
  BASE_SEPOLIA,               // Chain ID constant: 'eip155:84532'
  USDC_BASE_SEPOLIA,          // USDC contract address on Base Sepolia

  // Scoring
  computeTrustScore,          // Compute all 5 factors → TrustBreakdown
  getSpendingLimits,          // Score → { tier, dailyLimit, perTxLimit }
  identityScore,              // Identity factor (0-35)
  onChainScore,               // On-chain factor (0-20)
  refreshOnChainData,         // Refresh on-chain balance cache for an address
  behaviorScore,              // Behavior factor (0-20)
  complianceScore,            // Compliance factor (0-15)
  networkScore,               // Network factor (0-5)
  riskPenalty,                // Risk penalty (0-30)

  // Store
  getOrCreateAgent,           // Get or create agent profile
  getAgent,                   // Get agent (returns undefined if not found)
  getAllAgents,                // All agent profiles
  getTopAgents,               // Top N agents by trust score
  recordApproval,             // Record approved transaction
  recordDenial,               // Record denied transaction
  recordOverride,             // Record human override (+trust boost)
  addVerifiedHuman,           // Mark agent as World ID verified
  isVerifiedHuman,            // Check World ID status
  setOWSWallet,               // Mark agent as OWS wallet
  setWebBotAuthVerified,      // Mark agent as Web Bot Auth verified

  // Web Bot Auth (RFC 9421)
  verifyWebBotAuth,           // Full signature verification
  registerAgentPublicKey,     // Register Ed25519 public key
  parseSignatureInput,        // Parse Signature-Input header

  // Events
  emitEvent,                  // Broadcast event to WebSocket clients
  startWebSocketServer,       // Start standalone WebSocket server
  attachWebSocketToServer,    // Attach WebSocket to existing HTTP server

  // Config
  loadConfig,                 // Load triage.config.json
  getConfig,                  // Get current config

  // Types & Constants
  getTierForScore,            // Score → SpendingTier
  SPENDING_TIERS,             // Current tier definitions
  updateSpendingTiers,        // Replace tier definitions at runtime
} from 'triage-ows'

import type {
  PolicyContext,              // OWS policy input
  PolicyResult,               // OWS policy output
  TrustBreakdown,             // Per-factor score breakdown
  SpendingTier,               // Tier definition
  AgentProfile,               // Complete agent state
  TriageConfig,               // Configuration interface
  PolicyDecisionEvent,        // WebSocket: transaction decision
  TrustChangeEvent,           // WebSocket: trust score change
  BudgetWarningEvent,         // WebSocket: budget warning
  TriageEvent,                // Union of all event types
} from 'triage-ows'

XMTP uses native bindings — import lazily:

const xmtp = await import('triage-ows/dist/xmtp')
await xmtp.initXMTP()

Technologies Used

What's Real

Security

• Policy Secret — Optional shared secret (POLICY_SECRET env) authenticates the policy evaluation endpoint. Both the executable and server must share the same secret. The triage-policy executable automatically includes it in requests.
• World ID — Nullifier hashes are verified server-side via the World API. The client never self-reports verification status.
• Override Timeout — Pending overrides expire after 5 minutes. Stale overrides cannot be replayed.
• Input Validation — Policy evaluation validates JSON structure, handles malformed BigInt values gracefully (falls back to 0).
• XMTP Graceful Fallback — XMTP is lazy-loaded. If native bindings are unavailable, the server starts normally with notifications disabled.
• Web Bot Auth — Ed25519 signature verification follows RFC 9421. Public keys must be pre-registered via the API.

Production Deployment Recommendations

For production, secure the scoring server endpoint:

1. Localhost binding — Bind server to 127.0.0.1 only. OWS policy executable runs on the same machine, so only localhost access is needed.

2. Shared secret — Set POLICY_SECRET env var. The OWS executable passes it via header, server rejects requests without it.

   export POLICY_SECRET=your-secret-here
   # triage-policy.js automatically includes it in requests

3. Request origin verification — In production, validate that requests originate from the OWS subprocess via policy_config.secret field in PolicyContext.

For hackathon/demo deployments, these are optional — the security boundary is OWS itself (it controls the private keys and signing).

Architecture

OWS Policy Engine
    │
    │ spawns subprocess for every transaction
    ▼
┌──────────────────────────┐
│  triage-policy (thin)     │  ← Receives PolicyContext on stdin
│  bin/triage-policy.js     │  ← HTTP POST to scoring server
│  4-second timeout         │  ← Returns PolicyResult on stdout
└──────────────────────────┘
    │
    ▼
┌──────────────────────────┐
│  Scoring Server (Hono)    │  ← Holds agent state (in-memory Map)
│  src/server.ts            │  ← Computes 5-factor trust score
│  Port 4021                │  ← Broadcasts events via WebSocket
│                           │  ← XMTP notifications on denials
└──────────────────────────┘
    │
    ├──▶ Dashboard (React)     Real-time trust visualization
    ├──▶ WebSocket /ws         POLICY_DECISION, TRUST_CHANGE, BUDGET_WARNING
    └──▶ XMTP                 Human override flow

Package Structure

triage-ows/
├── bin/
│   ├── triage-ows.js           # CLI: init, dev, register, attach, seed, status
│   └── triage-policy.js        # OWS policy executable (stdin → HTTP → stdout)
├── src/
│   ├── index.ts                # All library exports
│   ├── server.ts               # Hono server with all API routes
│   ├── store.ts                # Agent profiles + history (in-memory Map)
│   ├── config.ts               # Configuration loader
│   ├── emitter.ts              # WebSocket event broadcasting
│   ├── xmtp.ts                 # XMTP notification bot + override listener
│   ├── webbotauth.ts           # RFC 9421 Ed25519 signature verification
│   ├── types.ts                # TypeScript interfaces + spending tiers
│   └── scoring/
│       ├── index.ts            # Orchestrator: computes all 5 factors
│       ├── identity.ts         # Identity scoring (0-35)
│       ├── onchain.ts          # On-chain profile via Base Sepolia RPC
│       ├── behavior.ts         # Behavioral analysis (0-20)
│       ├── compliance.ts       # Policy compliance scoring (0-15)
│       ├── network.ts          # Single-hop counterparty trust (0-5)
│       ├── risk.ts             # Risk penalty calculation (0-30)
│       └── limits.ts           # Score → spending tier mapping
├── dashboard-dist/             # Pre-built React monitoring UI
├── policy-template.json        # OWS policy file template
└── triage.config.example.json  # Example configuration

Academic References

Core Trust Literature

Emerging Research (Compliance & Agent Governance)

The policy compliance scoring dimension draws on emerging work in AI agent governance, including Gartner's TRiSM (Trust, Risk, and Security Management) framework applied to agentic AI, and the growing body of research on policy-compliant agent guardrails and compliance-by-design architectures (2025-2026). These are active research areas where standards are still forming.

What's Next

v2 — Deeper Intelligence

• Full Network Score (0-15) — Eigenvector propagation across transaction graph. Recursive trust computation with collusion resistance via EigenTrust++ mechanisms
• Persistent storage — PostgreSQL backend for agent profiles and trust scores
• Multi-chain scoring — Query wallet history across all OWS-supported chains
• Audit logs — OWS append-only audit log integration for forensic analysis

v3 — Ecosystem

• Mainnet deployment — Base mainnet with real USDC
• Trust portability — Agent reputation follows across OWS wallets and deployments
• Policy marketplace — Share and compose policies

Future Integrations

• AgentKit — Coinbase AgentKit agent verification as an identity signal. AgentKit-created agents would receive an identity boost similar to Web Bot Auth, recognizing that the agent was created through a governed framework.
• ERC-8004 — External reputation feed integration for standardized agent identity tokens.

Demo

• Live demo: Railway deployment
• npm: npmjs.com/package/triage-ows
• GitHub: github.com/ioannisCC/triage-x-ows

Built for

OWS Hackathon — April 2026 Track 02: Agent Spend Governance & Identity

License

Apache-2.0

Give agents wallets, not blank checks.