41. Toll

In plain words: Design rule 41: Payments

Designed 6 min read 7 glossary terms 10 connected pages
The short version written for the Snayu team

Defines Toll, an optional payments area with two parts: a ledger for quotes, budgets and accounting, and a separate gate that performs one verified, hard-to-reverse settlement. Models and responses can never authorize spending.

Why read it: Read this before adding paid APIs, budgets, credits or any money movement.
  1. 1No model, HTTP 402 response or routing choice can become spending authority.
  2. 2Budgets are reserved before spending to prevent double-spend; local credits come before payment rails.
  3. 3Each seller sets its own prices and currencies; there is no shared token or network-wide exchange.

Designed No payment package, ledger or settlement path exists.

Words on this page, decoded click one for its card

The original text Underlined words open their plain-English card.

Context

Remote labor and local compute can carry cost, while money movement is difficult to reverse. A response code, model, middleware hook, or DispatcherTraffic Controller choice must never become spending authority.

Decision

Toll is an optional economics Domain with two separated planes: a Counting House for quote handling and accounting, and an Irreversible Gate for one independently verified settlement effect. It is neither a mandatory wallet, global auto-payment interceptor, nor Agent authority.

Each selling operator owns its prices, accepted currencies, payment providers, and conversion and payout arrangements. The vendor or its chosen payment provider handles any offered conversion. Paid participation and remote casting require no shared currency, project-native asset, or network-wide token allocation. A vendor may choose supported conventional or optional crypto rails; that choice does not prescribe another vendor's prices, balances, or accepted assets.

Vendor choice does not establish a network-wide exchange or cross-vendor clearing service. The buyer still needs a supported, funded payment route under exact spending authority. A quote or local credit balance cannot authorize an implicit currency swap, substitute settlement assets, or make another issuer accept the balance. Toll retains quote, budget, settlement, delivery, refund, and reconciliation duties whichever payment route is selected.

A provider quote, invoice, or HTTP 402 can propose terms. It remains untrusted and cannot authorize signing, settlement, retry, identity, access, or an increased budget. x402, L402, Lightning invoices, Wallet Connect, Nostr Zaps, and future rails have distinct adapter contracts; their names are not interchangeable.

Remote casting and teaching a missing SpellStep are distinct purchased resources. They cannot share a quote or idempotency identity merely because one peer offers both. Payment satisfies neither peer authentication, task admission, teaching quarantine, publication, activation, nor authority.

Local credits first, rails later

The first practical topology is deliberately issuer-local. An operator may grant or sell MANA service credits, or charge an exact request through one conventional payment provider. MANA is an issuer-scoped entry in that issuer's durable Counting House ledger, not cryptocurrency, cash, a bearer asset, a global currency, a governance vote, or a claim on another issuer. An amount without its issuer is invalid. The initial profile is account-bound: unlike issuers' balances are not fungible, and no cash redemption, peer transfer, or cross-issuer conversion is implied. Changing any of those properties requires a separately admitted economic and legal contract, not a configuration toggle.

Tithe meters model-token usage, generated media, concurrency, queue weight, hardware time, and other resource consumption. The Counting House separately owns MANA balances, reservations, debits, credits, refunds, and reconciliation. Only an issuer-authorized accounting boundary—not an Agent, model, or ordinary tool—may issue, expire, or correct MANA. Every entry retains its authority and grant reason or exact external funding identity; corrections append compensating entries rather than rewriting history, while reservations prevent double-spend and negative available balance.

Only an independently verified settlement admitted under issuer policy may fund one exact local balance or settle one exact pay-as-you-go request. Funding atomically and idempotently binds the external-effect identity; a client claim, webhook alone, pending authorization, or ambiguous settlement cannot create reusable credit. A sale retains purchase asset, amount, rate, terms, expiry, and original funding identity. A required refund returns through its governed original route where possible; it is not a promise that MANA can freely cash out.

Toll can support different rails while retaining exact evidence. Every quote, authorization, and receipt names issuer, rail, asset, integer units, merchant, and the network or external-effect identity where applicable. Conventional processor and x402 adapters are sibling rails: x402 is neither a currency nor a requirement for a project-native asset. Translation must preserve provenance and cannot make unlike balances fungible.

The commitment before the signature

The Counting House may parse a versioned challenge, normalize integer monetary units, compare candidate costs, reserve a budget, and reconcile receipts. It holds no spend key. An authorization binds authenticated Principal and budget owner, merchant/service, method and canonical destination, request digest and purchased resource, asset/network, maximum amount including fees, expiry, redirect policy, and idempotency key.

The execution-road policy considers quotes only among roads that satisfy capability, privacy, policy, and resource feasibility. Toll owns judgment of the economic terms and reservation of their exposure; Dispatcher binds an already eligible capability. Policy rejects the quote, applies one matching bounded low-risk standing authority, or parks the RunJob Record for live MagusYou, the Operator consent over the exact terms. Novel or significant spend requires HitL. Consent means this exact maximum, never whatever a later challenge asks.

Accounting reserves worst-case exposure before signing. The isolated Irreversible Gate revalidates the pinned authorization and live reservation, enforces per-effect and rolling caps, atomically consumes the reservation, signs once, submits once, and records a stable external-effect identity. Unknown version, scheme, network, destination, amount, fee bound, changed quote, or expired authority fails closed. No model or ordinary tool receives a wallet or general signing surface.

Two settlement rites

Local MANA consumes no wallet signature or external proof-bearing replay:

eligible request → quote → authorize and reserve local balance
→ execute → debit on the declared delivery condition / release / refund → reconcile

An external rail separately crosses the Irreversible Gate:

destination-pinned request → quote → validate and reserve → reject / standing authority / live consent
→ revalidate → sign and submit once → one proof-bearing replay → reconcile settlement and delivery

After independently authorized settlement, the original connector may make at most one proof-bearing replay to the same pinned destination. That replay cannot initiate another payment. Payment and delivery remain non-atomic: a settled charge may produce no useful result, and a successful response does not establish content truth. Refund, credit, dispute, expiry, paid-but-undelivered, and ambiguous outcomes stay durable and visible. Unknown settlement requires investigation and reconciliation, never a second signature.

Budgets, effects, and restore

Tithe records currency-neutral model-token usage, generated media, concurrency, queue weight, and hardware time against a stable Principal or service grant even with every payment adapter disabled. A paid quota grant cannot mint or widen aan SigilID Badge, expose memory or tools, bypass consent, or displace protected local work. Currency-free Legion work still needs quotas, reservation, attribution, and evidence.

Quote, reservation, authorization, submission, settlement, delivery, refund, expiry, and ambiguity form a durable idempotent receipt chain. Keys, signatures, bearer proofs, preimages, invoices, and wallet credentials never enter prompts, ordinary projected configuration, logs, traces, or artifacts. Oculus can observe redacted transitions and reconciliation lag; a trace is not the financial ledger. Restore cannot rewind money: spending stays closed until external rail state reconciles.

Extensions may add bounded quote parsers, rails, signers, and paid PortalCloud Model connectors, but not arbitrary global middleware, unrestricted keys, rival ledger truth, or a bypass of host authorization. Every external adapter pins one exact provider or protocol profile and conformance corpus. The first delivered adapter need not be x402.

Deferred shared and sovereign settlement

x402, stablecoin settlement, cross-provider clearing, a native token, a validator network, and a sovereign L1 remain future candidates, not accepted dependencies or delivery promises. A native chain is not admitted merely by calling it another rail adapter. It requires later amendments to this and every affected CovenantDesign Rule (ADR) after independent operators demonstrate a need that issuer-local credits and existing payment rails cannot satisfy, together with explicit consensus, custody, issuance, validator, upgrade, economic-security, privacy, recovery, abuse, and legal gates.

No MANA balance, contribution, usage receipt, test token, or participation creates any right to a future token allocation, conversion, airdrop, cash redemption, or governance claim. Economic balance, token ownership, and validator status cannot grant canonical-source selection or Evolution promotion authority; Packaging and Evolution retain those separately governed human-seat decisions.

Delivery and consequences

This CovenantDesign Rule (ADR) is Designed, not payment capability. No Toll package, quote/budget ledger, reservation, authorization, signer, settlement path, safe 402 response, reconciliation, or budget enforcement ships. State of Work owns that public boundary; Toll owns operated doctrine.

Delivery proceeds through these steps:

  1. Establish immutable financial identities and integer money types.
  2. Verify quote, budget, reservation, and receipt accounting without money movement, then prove manually granted MANA through idempotent reservation, debit, release, and refund.
  3. Build and verify the isolated, capped Irreversible Gate.
  4. Admit one allowlisted conventional payment adapter in its provider's sandbox, with evidence for crash, replay, refund, chargeback, and ambiguous settlement.
  5. Only then admit production pay-as-you-go, seller routes, x402, or other optional rails.

Toll makes economic consequence attributable, bounded, interruptible, and reconcilable, while requiring durable accounting, key custody, explicit parked/ambiguous caller states, and later marketplace, refund, dispute, legal, and abuse domains.