UntchChangelog
What has actually shipped. Every date comes from a commit or an on-chain transaction, and every entry states whether the capability is live or still in beta. Where there is evidence you can check without trusting us, the link goes to the chain.
Untch has completed an externally funded Consumer Intent in production. The user funding wallet and Untch provider-settlement treasury are separate, while policy, payment, delivery verification and accounting remain bound to one intent. Providers are currently settled from Untch's pre-funded operational treasury. The externally funded intent flow is implemented and undergoing final production proof.
Receipts currently include durable Untch records and X Layer testnet anchors. Mainnet receipt anchoring is pending writer activation through the contract's three-day timelock.
- BETA
Externally funded Consumer Intent in production
A wallet that is not any Untch treasury funded a Consumer Intent with real USDT0 on X Layer. Untch then paid StableDomains in USDC on Base from its own settlement float, verified the result through public RDAP, and reconciled both rails to zero under one intent.
Why it matters: Until now Untch was both funder and settler, so the only novel leg exercised was the outbound merchant payment. This proves the two parties are genuinely separate while policy, payment, delivery verification and accounting stay bound to a single intent. Providers are still settled from Untch's pre-funded operational treasury.
external funding transaction on X Layer ↗ - LIVE
Mandatory ownership authentication
Reading a tenant's consumer intents now requires a SIWE signature over a server-issued, single-use, expiring nonce, verified against the policy's on-chain owner. The legacy path of passing a policy id as a query parameter is refused outright.
Why it matters: A policy id is public on-chain data. Deriving a tenant from it was namespacing, not authorisation: anyone who read one off the explorer could see that tenant's amounts, provider and decisions. Fourteen attacks were run against live production with real signatures, and all fourteen were refused, including a cryptographically valid signature from a wallet that does not own the policy.
catalog reports auth.required ↗ - LIVE
Public receipts
Every completed consumer action has a receipt anyone can open with no account, showing what was paid, to whom, on which chain, what was delivered and what Untch independently verified.
Why it matters: A receipt only the buyer can read is not a receipt. The public view is built by naming the fields that may be published rather than by removing fields from the private one, so a field added later cannot silently become public. The request payload, correlation id and approval channel are all withheld.
open a real receipt → - BETA
Production worker executed a governed purchase end to end
The deployed worker picked an approved intent off the queue, paid StableDomains 0.050000 USDC on Base, verified the result, booked the ledger and wrote a receipt, with no local driver involved.
Why it matters: The first settlement was driven by a script on a laptop. This one proves the deployed system does it by itself, which is the only version that matters.
Base settlement transaction ↗ - LIVE
Independent delivery verification via RDAP
Domain results are checked against public RDAP, the registry itself, rather than against the merchant's own response.
Why it matters: A merchant confirming its own delivery is not verification. The receipt reports the merchant's claim and Untch's independent check as two separate fields and never merges them.
- BETA
First real provider settlement
Untch paid a real merchant on the merchant's own rail, USDC on Base, from a capped, single-use EIP-3009 authorisation, for an action a deterministic policy had approved.
Why it matters: Everything before this was a decision about money. This was money.
Base settlement transaction ↗ - BETA
Consumer Pack
An agent proposes a real-world action. Untch decides whether it is authorised, funds it for the exact approved amount, pays the merchant on the merchant's rail, verifies delivery and produces one receipt spanning both payments.
Why it matters: The purchase value is separate from the call fee, an ambiguous outcome goes to a human rather than a retry, and what the merchant says is never presented as what Untch proved. Untch has completed an externally funded Consumer Intent in production. The user funding wallet and Untch provider-settlement treasury are separate, while policy, payment, delivery verification and accounting remain bound to one intent. Providers are currently settled from Untch's pre-funded operational treasury.
live capability matrix ↗ - LIVE
OKX.AI listing — ASP #6086
Untch listed as an Agent Service Provider on OKX.AI, with ERC-8004 agent #6047 and seven priced x402 services.
Why it matters: Agents can discover and pay for the authority layer without a bespoke integration.
ERC-8004 registration card ↗ - LIVE
Mainnet contracts on X Layer
PolicyRegistry, SpendIntentRegistry, UntchReceipts and VaultFactory deployed to X Layer mainnet with separated role keys.
Why it matters: None of them holds funds. There is no payable, receive or fallback, so the registry layer cannot become a honeypot.
UntchReceipts on OKLink ↗ - LIVE
Trust Bureau
Receipt-backed vendor and buyer scores with a lower-confidence bound, so a vendor with two good receipts does not outrank one with two hundred.
Why it matters: Reputation built from receipts you can check, rather than from self-reported stars.
- LIVE
Escalation across four channels
Human approval over Telegram, Discord, Slack and the operator dashboard, with dual-channel enforcement and a single authority boundary.
Why it matters: When policy says a human must decide, the human must be reachable where they already are, and no channel may become a way around the boundary.
- BETA
Receipts anchored on chain
Durable Postgres receipts, batched and anchored to the UntchReceipts contract with retry, reorg re-verification and honest degradation.
Why it matters: The ledger is authoritative. Anchoring is publication. When anchoring fails the receipt says so rather than implying an anchor that does not exist. Receipts currently include durable Untch records and X Layer testnet anchors. Mainnet receipt anchoring is pending writer activation through the contract's three-day timelock.
- LIVE
Deterministic policy engine
Fourteen rules over a bounded SpendIntent, evaluated in a fixed order: budget, per-call cap, category, recipient, agent, duplicate, cooldown, rate limit and expiry.
Why it matters: No LLM call appears anywhere on the money decision path. The engine is a pure function of the intent, the policy and the ledger window, so the same inputs always produce the same decision and the decision can be re-derived by anyone.
- LIVE
Exact approvals and mutation rejection
An approval binds to a hash of the canonical quote, not to a description of it.
Why it matters: Change the amount, recipient, item or deadline and the hash changes, so the approval stops applying and execution refuses. There is no path where a human approves $5 and $500 leaves.
What is deliberately not here
Domain registration, shopping, gift ordering, travel booking, notification sending, Solana settlement and Tempo settlement are implemented and gated, and every one of them refuses with a named reason. They are not listed above because they have not shipped. The live capability matrix at /consumer/catalog reports each provider’s real maturity, so any claim here can be checked against the machine rather than against this page. The full production-proof page lives at docs.untch.xyz/consumer-pack-proof.