Deus - Chain Access, Auth, Wallet, Registries, and Manifests

Caller Authentication

Source: deus/internal/auth/auth.go

Caller is the authenticated agent identity passed through request context via auth.Middleware.

Header behavior

Header	Behavior
`Authorization`	Required bearer token in normal mode
`X-Caller-DID`	Optional DID hint (dev mode fallback when bearer absent)
`X-Caller-Wallet`	Optional wallet address

In dev mode, a missing bearer can still produce a Caller if X-Caller-DID is present.

Chain Client

Source: deus/internal/chain/client.go

Client wraps ethclient.Client for Paxeer chain 125. New can reject a connection if the remote chain ID does not match. Ping issues a lightweight BlockNumber call.

On-Chain ServiceRegistry

Source: deus/contracts/src/ServiceRegistry.sol, deus/internal/chain/bindings/service_registry.go

The ServiceRegistry contract stores service records, ownership, payout addresses, manifest/pricing hashes, and status on Paxeer chain 125.

Service struct

Property	Type	Meaning
`id`	`uint256`	Numeric service identifier
`owner`	`address`	Current owner
`payout`	`address`	Payout address
`manifestHash`	`bytes32`	Manifest content hash
`pricingHash`	`bytes32`	Pricing content hash
`status`	`uint8`	0=draft, 1=active, 2=paused, 3=delisted
`hosted`	`bool`	Whether hosted
`confidential`	`bool`	Whether confidential
`registeredAt`	`uint64`	Registration timestamp
`updatedAt`	`uint64`	Last update timestamp

Contract methods

Method	Access	Description
`register`	Anyone	Create active service, emits `ServiceRegistered`
`update`	Owner	Update manifest/pricing hashes
`setStatus`	Owner/Governor	Change status (0-3)
`setPayout`	Owner	Update payout address
`transferOwner`	Owner	Transfer ownership
`getService`	Anyone	Read full service record

Chain Registry facade

Source: deus/internal/chain/registry.go

Registry is the Go facade that signs and submits register transactions, waits for receipts, and extracts the ServiceRegistered event to get the on-chain service ID.

Wallet HTTP Client

Source: deus/internal/wallet/client.go

HTTPClient forwards the caller bearer token to the Paxeer embedded wallet API:

Method	Description
`Send`	Direct native PAX transfer via `/v1/agent/send`
`AuthorizeSpend`	Pre-flight wallet configuration check
`OpenStream`	Open PaymentStreams session
`StreamSettle`	Settle a stream
`StreamClose`	Close a stream

HTTP 403 responses are mapped to PolicyDenied with the cap_wei preserved.

Registry Orchestration

Source: deus/internal/registry/registry.go

Service orchestrates listing lifecycle:

Method	Description
`Create`	Validate manifest, insert draft in store, return id + slug + manifest hash
`Publish`	Sign + submit on-chain `register`, mirror chain state to store, push to discovery indexer

Manifest Schema

Source: deus/pkg/manifest/manifest.go

Manifest struct

Field	Type	Description
`schema_version`	`string`	Manifest version
`slug`	`string`	URL-safe identifier
`kind`	`string`	`"agent"` or `"data"`
`display_name`	`string`	Human-readable name
`summary`	`string`	Short description
`description`	`string`	Full description
`tags`	`[]string`	Discovery tags
`owner`	`string`	Owner address
`payout_address`	`string`	Payout address
`payee_did`	`string`	LayerX earnings identity (LXP rail)
`mode`	`string`	`"proxy"` or `"hosted"`
`settlement_mode`	`string`	`"exact"` (default) or `"hold"`
`hold_ttl_s`	`int64`	Hold lifetime seconds
`confidential`	`bool`	TEE-backed execution
`operations`	`[]Operation`	Callable operations
`pricing`	`[]Pricing`	Per-operation pricing
`endpoint`	`*Endpoint`	Proxy routing hints
`sla`	`*SLA`	Uptime/latency targets

Pricing

Pricing supports dual denomination: wei (price_wei) for legacy plans and USDX (unit_price_usdx) for LayerX settlement. USDX-only listings are enforced when the LXP rail flag is on.

Operation

Field	Type
`name`	`string`
`method`	`string` (HTTP method)
`input_schema`	`map[string]any`
`output_schema`	`map[string]any`
`timeout_ms`	`int`
`max_response_bytes`	`int`