💳 Splitrail

Autonomous Multi-Merchant Agentic Commerce & Compliant Split-Escrow Engine on Monad

Cleanverse Build: Trusted Assets Hackathon - Track 02: Compliant DeFi & Agent Skill Framework Author: (mrnetwork)

When an AI buyer agent checks out a multi-merchant cart (hosting $50 + API credits $40 + asset license $60), Splitrail settles it atomically in one Monad transaction - screening every wallet through Cleanverse CVI/CCP first. If one merchant's credential is revoked mid-transaction, Splitrail doesn't abort the cart: it pays the compliant merchants, quarantines the failing item's funds in an escrow vault, and instantly refunds the buyer agent with an audit-ready CCP Travel Rule receipt. Selective Risk Quarantine, fail-closed by default.

📖 Full blueprint: SPLITRAIL_PROJECT_SPEC.md · Cleanverse integration conventions: CLAUDE_CLEANVERSE.md

Architecture

Buyer Agent ──executeCart([items], cviProof)──▶ SplitrailRouter
                                                    │  per-item CVI + CCP check (CVIComplianceHook)
                     ┌──────────────────────────────┼──────────────────────────────┐
                     ▼ pass                         ▼ pass                         ▼ FAIL (revoked)
              Merchant 1  ✅                 Merchant 2  ✅                SplitrailEscrowVault 🛡
              $50 released                   $40 released                  $60 quarantined
                                                                           └─▶ instant refund → buyer
                     └──────────────── one atomic tx ── CCP AuditReceipt event ────┘

Contract	Role
SplitrailRouter.sol	Multi-item cart checkout, per-merchant compliance screening, atomic split-settlement, spend mandates (Agent Skill Framework), onchain CCP audit receipts
SplitrailEscrowVault.sol	Selective Risk Quarantine: records failed items, instantly refunds the buyer agent (or holds for review), full audit surface
CVIComplianceHook.sol	Cleanverse CVI credential registry + CCP Travel Rule pre-transaction checks, fail-closed
MockCVAUSDC.sol	CVA clean-USDC settlement token stand-in (6 decimals, faucet)

Quickstart

# 1. Contracts - build & test (18 tests incl. fuzzed refund invariant)
forge build
forge test -vv

# 2. Deploy to Monad testnet
npm install
cp .env.example .env          # add PRIVATE_KEY (funded with testnet MON)
npm run deploy:monad

# 3. Run the live demos
npm run demo:cart             # all merchants Verified → full 3-way split settlement
npm run demo:quarantine       # Merchant 3 revoked → Selective Risk Quarantine + instant refund
npm run toggle:compliance -- 3 verified   # flip Merchant 3's CVI status any time

# 4. Dashboard
cd dashboard && npm install && npm run dev   # http://localhost:3000

Each demo run exports an audit-ready receipt to receipts/cart-<id>.json and prints Monad explorer links.

Dashboard

Dark glassmorphic Next.js dashboard (dashboard/) with:

• Agent Cart Simulator - the 3-merchant demo cart with live CVI status per merchant
• Compliance State Toggle - flip Merchant 3 between Verified ✅ and Revoked ❌
• Live Split-Settlement Visualizer - animated atomic fund routing with per-item tx status
• Onchain Audit Receipt Exporter - Cleanverse CCP Travel Rule receipt, downloadable as JSON

Runs in simulation mode out of the box; set the NEXT_PUBLIC_MONAD_* addresses printed by deploy:monad in dashboard/.env.local to point it at the live Monad testnet deployment.

Live Deployment - Monad Testnet

Chain ID 10143 · RPC https://testnet-rpc.monad.xyz · Explorer https://testnet.monadexplorer.com

Settlement runs in a real Cleanverse CVA A-Token - SRUSD4097 "Splitrail Clean USD", issued by Cleanverse via POST /atoken/launch with their compliance hooks enforcing A-Pass checks on every transfer. Splitrail's router and vault contracts each hold their own A-Pass, so they can custody and route CVA.

Contract	Address
SplitrailRouter	0x833f93CaFE549004e3DdE508e5F4EFd65DA86583
SplitrailEscrowVault	0x8eAe6C8e3801664d0f4E86285305349c39E92FdE
CVIComplianceHook	0x52c003045dc09946d3f5c334f715688e69974189
SRUSD4097 (real Cleanverse CVA)	0x738ae23180cBe03d761A3938eC48F1Cd786512f0

Verified onchain runs (real CVA):

• Full 3-way settlement ($150 SRUSD): 0x9829…5a47a7
• Selective Risk Quarantine ($90 settled, $60 quarantined + instantly refunded after a real Cleanverse A-Pass freeze): 0x3dcf…6dd73c
• Compliance negative case: CVA transfer to a non-A-Passed contract reverts (0xa6725971 pool check) - contracts must hold A-Passes, which router and vault do

Earlier mock-token runs (first deployment iteration): settlement 0xfd9d…fbc68, quarantine 0x7f46…17c7c.

Cleanverse Integration (Cooperate API v5.6, live sandbox)

Splitrail integrates the real Cleanverse sandbox (uatapi.cleanverse.com/api/cooperate), not a simulation:

1. CVA / A-Token - the settlement token is a real Cleanverse-issued CVA (SRUSD4097), launched on Monad via the AES-encrypted POST /atoken/launch and confirmed ISSUED through query_apply_status. Cleanverse's own transfer hooks enforce A-Pass checks on every send/receive; the Splitrail router and vault hold A-Passes so they can custody CVA mid-settlement.
2. CVI / A-Pass - every participant (buyer, 3 merchants, router contract, vault contract) holds a real A-Pass on Monad generated via the encrypted generate_apass endpoint. The A-Pass currentKycHash is anchored onchain as the wallet's credential hash in CVIComplianceHook, so the credential a cart declares is Cleanverse's KYC hash.
3. Revocation round trip - the demo freezes an A-Pass via update_status (status 2), the oracle sync (scripts/cleanverse.ts sync) reads the verdict via query_apass and pushes revokeCredential to Monad, and the next cart selectively quarantines that merchant. Unfreeze reverses it.
4. Auth model per docs - api-id header on every call; the api-key never leaves the server (it is the AES-256-CBC key, zero IV, used to encrypt sensitive request bodies).

npm run cleanverse -- query m3        # A-Pass record for merchant 3 (tier, status, KYC hash)
npm run cleanverse -- freeze m3       # freeze A-Pass on Cleanverse (encrypted update_status)
npm run cleanverse -- sync m3         # push the Cleanverse verdict into the onchain hook
npm run demo:quarantine               # freeze → sync → atomic cart with quarantine + refund

Fail-Closed Guarantees (tested)

1. Unverified/revoked/suspended buyer → whole cart reverts, zero funds move
2. Unverified/revoked merchant → only that item quarantined + instantly refunded; the rest settles
3. Unknown wallet = Unverified = blocked (absence of credential is never a pass)
4. Credential hash mismatch (rotated credential) → quarantined
5. Travel Rule threshold breach without CCP clearance → quarantined
6. Spend mandate ceiling exceeded → cart reverts before any transfer
7. Vault refuses quarantine cases whose funds didn't actually arrive