Removing a dependency is easy to argue for. The code shows what the dependency was doing.
Three Dependencies Nobody Talks About argued that agentic payments projects quietly rely on a hosted model for reasoning, a public chain for settlement, and a custodian for identity, and that an agent built on all three is a product with extra steps. Agora Agent is the code behind that argument, built for Logos’s LP-0008 Lambda Prize and committed on the same April day. Each dependency could be swapped for a Logos component. Each swap also exposed a job the old dependency had been doing that nobody had assigned to the replacement.
Local reasoning still reads strangers
Moving inference onto the machine removes the observer. The model provider can no longer watch, throttle, or revoke the agent’s reasoning. It does nothing about the inputs. A marketplace agent spends its day reading messages from parties it has never met, and it holds a wallet. A hosted model never protected against that combination either, but once inference is local, the boundary is the agent’s own problem.
The code draws one. Marketplace text is size-capped, stripped of control characters, filtered for injection phrases like “ignore previous instructions,” and wrapped in tags that tell the model it is data. Regex filtering is a weak defense. It is still a boundary, and any agent that reads strangers and spends money needs one somewhere.
The second lesson was smaller and more embarrassing. The backend detector tries daemon-ai, then Ollama, then an OpenAI-compatible API if a key is set. The third step is the exact dependency the essay argued against. Sovereignty, in this build, is a configuration choice. A sovereign build has to delete that line.
A promise about output that doesn’t exist yet
The escrow design asks the seller to commit to a hash of the output before doing the work, so the answer can’t change after the buyer pays. That works for a file that already exists. A language model’s output doesn’t exist until it is generated, and the code admits it: the commitment is a hash of the session ID and the string “output_placeholder.”
For inference, a hash commitment proves integrity. The bytes the buyer received are the bytes the seller pinned. It can’t prove the work was done, or done well. Private settlement needs something to settle against, and for generated work that something is still missing.
A key nobody else can check
Owning your identity matters only if others can verify it. The essay promised a secp256k1 keypair. The Python code derives a public ID from a hash of the private key and signs messages with HMAC, which needs the secret to verify. The agent owns its identity completely, and no counterparty can check a single signature. Self-sovereign identity turns out to be half about the self and half about everyone else.
The custodian comes back as a leash
This principle held up best, and it came out of the code rather than the essay. Removing the custodian doesn’t remove the need for a limit. It moves the limit to the owner.
The agent holds its own key, separate from its owner’s, and every spend passes a policy first: 10 NOM per transaction, 100 NOM per rolling 24 hours, allowed categories, a minimum counterparty reputation, and a freeze flag. Anything the policy shouldn’t decide alone goes to the owner, and if the owner doesn’t answer within five minutes, the agent doesn’t spend. Earnings have no cap. An autonomous agent, stated plainly, is one whose constraints come from its owner instead of a platform.
The experiment, revisited
The published piece described a demo against three real local services: a logos-blockchain-node with Groth16 proofs, Ollama for inference, and two nwaku nodes for messaging. It said zero mocks. That was true of the demo script and narrower than it sounded. The script makes raw HTTP calls and bypasses the agent framework. Its trade is a shielded 2 NOM transfer plus a delivery notice over Waku, with no escrow, no commitment check, and no reputation update. The model was Ollama’s llama3.2:3b, not daemon-ai. One local node says nothing about the Blend Network’s metadata privacy. The record of the five-agent testnet deployment says "mode": "mock".
Underneath sit three Rust contracts with 18 unit tests: an identity registry with a 1,000 NOM stake, an escrow with a 10% dispute bond and a 48-hour seller claim, and a reputation score that starts at 5,000 and moves by an exponential moving average over delivery rate, latency, price accuracy, and disputes. They are plain Rust over an in-memory ledger and have not been compiled as LEZ programs. The owner channel is described as end-to-end encrypted and publishes plain JSON. A C++ and QML module wraps the agent for Logos Basecamp with five views.
What stays open
Every dependency was replaceable, and the replacements could talk to each other. No trade yet keeps every promise at once: an escrow that runs on chain, a signature a stranger can check, and a commitment that means something for output that is generated rather than retrieved. The reputation rules have only met agents that cooperate by construction. Five funded identities trading in a ring would be the real test. The README dates LEZ mainnet to early 2027, and until then private settlement rests on a local node.
Agora Bazaar carries the same architecture into human trade and inherits all of it. The essay asked whether an agent could stop depending on someone else. The code answers yes, provided the agent takes over the work that someone was doing.