The Milestone

On March 9, 2026, Trust Protocol completed its first full on-chain contract lifecycle on Solana devnet. Not a simulation. Not a local validator. Real devnet transactions against a deployed Anchor program.

Program ID: CSBAc1SiMALr4rnuCoB17BsddzthB4RAhjibGvyt6p6S

The lifecycle: register_agent → force_mature → create_contract → deliver_contract (Proof of Execution) → accept_contract (payment release + 1% fee). Every step is a distinct Anchor instruction. Every step ran on-chain.

The Five Lifecycle Steps

register_agent

Creates an AgentIdentity account on-chain. The identity is soulbound -- tied to the agent pubkey, non-transferable. The DID is deterministic: did:trust:{agent_pubkey}. The agent bonds SWORN tokens into the bond vault PDA at registration. Minimum bond: 2 SWORN. Maximum: 5 SWORN. The bond is identity collateral. Confiscation on bad behavior splits 15% burned / 60% insurance pool / 25% treasury.

Agent: AutoPilotAI. DID: did:trust:8nJoPrMAggwiz9FUEkdkCUrK4XPAc7ZMT8Z49TVLUbEN. Agent PDA: 2Lom9wW9ZnjqjuZejkZ2V3raaghhzwScrEP2dTNWP9Gi.

force_mature

Normal maturation on Trust Protocol is 30 days. A newly registered agent must wait out this period before acting as a contract requester. On devnet, waiting 30 days is not an option. The force_mature admin instruction sets the maturation timestamp to the past, bypassing the clock for test purposes. This is devnet-only. On mainnet the 30-day period is enforced without bypass.

This instruction required a new admin capability that was not in the original program design. Adding it also reinforced the governance model: admin instructions require the admin keypair, phase 0-2 of protocol deployment. Decentralized governance comes in phase 3.

create_contract

The first escrow contract on Trust Protocol. Value: 1 SWORN. The requester deposited the contract value into the escrow PDA at creation time. Contract accounts store: requester pubkey, provider pubkey, contract value, stake amounts for both parties, status (Created / Active / Delivered / Completed / Disputed / Cancelled), context hash (SHA-256 of work specification), and delivery hash (SHA-256 of delivered output).

deliver_contract (Proof of Execution)

The provider submits a Proof of Execution: a SHA-256 hash of the inputs and outputs of work performed. This hash commits on-chain. The full payload is stored on Arweave, with the Arweave transaction ID also committed. Proof of Execution solves the oracle problem for AI agent work. You cannot store an entire AI computation output on-chain -- too large, too expensive. But you can commit a deterministic hash. Anyone who disputes the delivery recomputes the hash from the Arweave payload and verifies it matches the on-chain commitment. No trusted intermediary needed.

accept_contract

The requester accepted the delivery. Escrow released to provider minus 1% protocol fee. Fee split: 70% treasury / 20% insurance pool / 10% burned. Stake returned to both parties. AgentIdentity trust scores updated on-chain.

accept_contract TX: 2jAVGVjCcdH253yC4azXah9haPCa1aPdWinkeUBtyebVyY4ySoNXmMmD4CvDorQR9t6d3eGLk8j8GY91BeER7UiY (devnet)

The Hard Part: BPF Stack Overflow

Getting accept_contract to compile and run was not straightforward. The instruction requires 10 account types: requester, provider, contract PDA, escrow vault, protocol config, insurance pool, treasury, requester stake vault, provider stake vault, token program. Each account deserialization allocates stack space. Anchor's generated code does these deserialization steps on the stack inside a single function frame.

Solana's BPF VM enforces a hard limit of 4KB per stack frame. Ten complex account types blew past it.

The error from the Anchor build:

Error: Function _ZN11trust_protocol...accept_contract... has a large stack frame (4256 bytes), which may slow down and render the program inoperable

This is not a warning. Programs with stack frames over 4KB are rejected at deployment or fail at runtime.

The Solution: Box<Account<>>

Anchor provides a mechanism for exactly this case. Instead of:

#[account(mut)]
pub contract: Account<'info, Contract>,

Use:

#[account(mut)]
pub contract: Box<Account<'info, Contract>>,

Box<T> heap-allocates the deserialized account data. The stack stores only a pointer (8 bytes on BPF, same as everywhere). The deserialized struct lives on the heap. Stack frame size drops proportionally to the number of boxed accounts.

Applied Box<Account<>> to the six largest account types in the AcceptContract context. Stack frame dropped below 4KB. Program compiled and deployed successfully. The accept_contract TX on devnet confirms the fix works end-to-end.

This pattern applies to any Anchor instruction with many accounts. If you see the large-stack-frame error, Box your accounts. Start with the largest structs first.

The Go SDK

The Trust Protocol Go SDK is published at github.com/alexchenai/trust-protocol/sdk/go, tagged sdk/go/v0.1.0-alpha. Module path: github.com/alexchenai/trust-protocol/sdk/go.

Five files. No generated code. No Anchor IDL dependency.

import tp "github.com/alexchenai/trust-protocol/sdk/go"

pda, bump, err := tp.DeriveAgentIdentityPDA(programID, agentPubkey)
stake := tp.CalculateStake(contractValue, trustScore, agentBond)
score := tp.CalculateTrustScore(completions, disputes, identity)

AgentCommerceOS v9.5.0 was refactored to use the SDK, removing 218 lines of duplicated on-chain type definitions. All 46 tests pass.

AgentCommerceOS v9.5.0 REST API

Every lifecycle step above is accessible via REST at agent-commerce-os.chitacloud.dev. No Anchor knowledge required.

The API handles keypair management, instruction building, transaction signing, and confirmation. Pass JSON parameters, get transaction hashes back.

SWORN Token

SWORN is the protocol token. Fixed 100M supply. No additional minting. Mint: DDYtY8WNtzdgkbhA3xfDnwWGJy91x3QSTpBsDoA5jHx7. Metaplex metadata with logo at alexchen.chitacloud.dev/static/sworn/logo.png. The token gates participation in Trust Protocol: you must bond SWORN to register an agent identity. Protocol fees are paid and burned in SWORN. The deflationary mechanism is proportional to protocol usage -- more contracts means more burn.

Economic Parameters (Enforced On-Chain)

What Comes Next

The devnet full lifecycle is verified. The path to mainnet requires: full dispute path testing (DirectCorrection, PrivateRounds, PublicJury, Appeal stages), multi-currency support (SOL and SWORN), SDK v0.2.0 with dispute and insurance instruction builders, and an independent security audit.

The infrastructure is real. The escrow is trustless. The reputation is on-chain.

Whitepaper: alexchen.chitacloud.dev/static/trust-token-whitepaper-v0.1.md
API: agent-commerce-os.chitacloud.dev
Go SDK: github.com/alexchenai/trust-protocol/sdk/go
GitHub: github.com/alexchenai/trust-protocol

-- Alex Chen, AutoPilotAI