Skip to main content
Status (2026-05-26): Implementation and Base Sepolia tiny-live evidence are merged into main. Public top-up route remains operator-gated and disabled by default (MG_AGENT_WALLET_TOPUP_ENABLED=false). This page describes the product boundary and operator model — not a license to enable the lane in production.

​
What this lane is

Agent Wallet Top-Up gives a user-owned coding or research agent (Claude Code, Cursor, Codex, autopilot CI, …) bounded USDC purchasing power without giving that agent access to the QTG treasury signer.
QTG only controls the funding step. After top-up finality, the Agent Wallet is a bounded hot wallet — Circle Gateway deposit and x402 payment are the agent or user session’s responsibility.

​
What this lane is not

  • Not an x402 HTTP proxy. QTG does not relay paid HTTP requests.
  • Not a Circle Agent Wallet session controller. QTG does not own the destination wallet’s session key.
  • Not a recovery or sweep feature. Once funds reach the Agent Wallet, QTG cannot guarantee or reverse the agent’s spending.
  • Not a treasury-key delegation. No credential available to the agent, Agent Wallet session, or x402 spend flow can move funds from the QTG treasury.

​
Security invariant

No credential available to the user agent, Circle Agent Wallet session, or x402 spend flow can move funds from the QTG treasury.
QTG enforces this by:
  • Keeping the treasury signer server-owned (default: AWS KMS in your account).
  • Resolving the source address / token / signer selector from a registered funding envelope — the agent never names them.
  • Enforcing destination allowlists at dispatch time.
  • Recording movement, ledger, and audit evidence for every top-up.
  • Bounding exposure with caps, cooldowns, and rolling windows — safety comes from small balances and manual review above policy, not from claims of reversibility.

​
Operator model

The intended operating path is:
1

Register a funding envelope

Operator seeds an active funding envelope for one approved Agent Wallet. The envelope names: destination wallet address, provider, chain, asset, source address, token address, treasury signer selector, caps, cooldown, purposes, and non-secret metadata (e.g. optional display email).
2

QTG validates policy

The compile path enforces same-authority / USDC envelope compatibility, cap and cooldown rules, and address allowlist membership.
3

QTG creates the movement graph

A normal movement graph is built for a USDC ERC-20 transfer from the treasury source to the Agent Wallet destination.
4

Dispatcher signs and observes

The dispatcher signs through the QTG treasury signer and observes finality. Ledger rows progress through reserved → submitted → completed (or release on failure).
5

Agent spends, outside QTG

The agent’s session uses the funded wallet for Circle Gateway deposit and x402 spend. QTG has no further role until the next top-up.

​
Current evidence

The lane reached Base Sepolia Stage 3 tiny live validation: The dashboard surfaces the metadata projection for approved Agent Wallet top-up envelopes, including optional display-only email metadata for operator convenience. That email is not an auth factor, signer input, recovery authority, or payment control.

​
Operator readiness ladder

Stage 1 / 2 / 3 are evidence gates — each one has a tool-owned validator and none of them is sufficient on its own to enable public/agent-facing top-up. Markdown packet templates alone are not evidence; only filled packets that pass qtg agent-wallet topup validate-packet --stage stage{1,2,3,3-post} count. Stage 3 hardening invariants the harness must keep enforcing: public top-up flag false, zero deployment-global active agent HMAC keys, KMS-only signer runtime with raw private-key env unset, live-time active-envelope template compatibility re-check, packet-approved signer/source/token equality, Stage 1 RPC balance timeout, terminal non-success movement immediate exit, JSON unexpected_error report, and no retry without reviewed recovery after ambiguous signed/broadcast evidence.

​
Production enablement gate

Public/agent-facing enablement must remain behind a feature flag and separate operator approval. Small testnet harness approval is not production/public-route approval. When this moves into broader user-facing docs, these claims stay intact:
  • QTG funds approved Agent Wallets; it does not proxy paid HTTP requests.
  • QTG never gives the agent treasury signing authority.
  • QTG cannot guarantee or reverse every spend after funds reach the Agent Wallet.
  • Optional Agent Wallet email metadata is display/operations metadata only.
  • Live readiness distinguishes no-live tests, Stage 1 environment evidence, Stage 3 tiny testnet proof, and production enablement — they are not interchangeable.