The passport (Pass)

Under the hood

A name is an ENS subname under musepass.eth, minted as an ERC-721 on Robinhood Chain (chainId 4663) and resolved on Ethereum mainnet through a CCIP-Read resolver:

wallet or agent asks ENS   →   mainnet resolver   →   CCIP-Read   →   gateway   →   names live here
        name → address         0x9eA7A889…            (ERC-3668)      gw.musename.xyz    Robinhood Chain 4663
                                                                                    registry 0x4b959e1fb5567caa7fe21d0d2a7f870af705b792
                                                                                    registrar 0xb1e8a90e5a9b1c8e69242bc70d928789d89c02b7

The split is deliberate. The name has to be readable by every wallet, so it lives in ENS on mainnet. Minting has to be cheap, so the registry lives on an L2. The resolver is a deployed copy of ensdomains/durin; we did not write a name system, we run one. The gateway host gw.musename.xyz is the project's earlier MuseName domain, baked into the resolver's constructor arguments — an on-chain address cannot be renamed, so the old host stays.

The card

An ERC-8004 document: what the agent is, what it runs on, how to reach it. Not a token. Two rules shape it. Private by default: only the name and the address are public, and fields open one switch at a time. The owner signs, the platform pays: what goes on chain is the fields the owner marked public, the visibility map, and a hash of the whole card — private fields are never in the bytes that are signed or stored.

Stamps and the record

The design: acceptance criteria are registered before the work starts; the result and the evidence are anchored together, so nothing can be quietly edited after the fact. A stamp is data on the name, not a token. A transfer resets the stamps — reputation cannot be bought with the name. What exists on chain today is the anchoring pipeline: merkle roots of real batches.

The vault

A wallet that belongs to the name rather than to whoever runs the agent this week. Money an agent is trusted with sits with its identity: a payment address on the card that follows the name, not the vendor. Design constraints: the vault must not give the platform a spending key, and anything that touches money waits for an external audit.

The bond

Escrow and a margin the other side can check before a deal: payment is released when the work passes the criteria both sides registered, with the same evidence rules as stamps. The bond is what makes a track record commercially meaningful instead of decorative — and it is the last piece for exactly that reason.

Ownership and transfer

The name is an ERC-721 that lives in its own right. Owning it is owning the name: it moves with the wallet, it can be sold or given away, and the registry has no burn function and no admin transfer. On a transfer the passport resets — the card stays (it is the name's record) but the reputation does not follow the previous owner. The exact reset belongs to the record contract, which is not deployed; until it is, say “a transfer is planned to reset the stamps”, not “resets”.

Genesis and invitations

The first 1,000 names that publish a card get a genesis number, counted from the registrar's events — a display trait of the one name, not a second token, served by the API. Short names (three and four characters) are invitation-only for now: a whitelist plus a signature, not a transferable token.