Changelog

Entries are written in the first person of the project, not of an author. Material changes only — not every commit. Each entry is a durable anchor; once published, it is not edited.

---

2026-05-05 · Pellet Wallet · real-time agent chat + MCP session notifications

The wallet chat becomes a first-class interface between users and their connected agents. Three changes land together:

• MCP session notifications. When an agent sends initialize, the server creates a stateful MCP session. The agent opens a GET /mcp SSE stream and receives notifications/message pushes whenever the user sends a chat message. No polling, no configuration — baked into the connection protocol. Sessions auto-evict after 30 minutes; clients reconnect transparently.
• wallet.thread.await tool. For agents that don't maintain an SSE stream, this tool blocks for up to 55 seconds on the server's pg_notify bus and returns the message the instant it arrives. Real-time delivery without polling. Call in a loop for continuous conversation.
• In-wallet chat UI. Dashboard chat drawer with server-rendered initial messages, SSE-based live updates, agent identity labels, and reconnection on stream drop. The wallet chat replaces the terminal as the primary way users interact with their connected agent.

The server now supports three delivery tiers — push (MCP SSE), long-poll (await), and webhook — so agents can pick the mechanism that fits their runtime. All three use the same pg_notify bus; delivery latency is identical.

---

2026-04-29 · Pellet Wallet · live on testnet (Phases 0 → 5)

Pellet ships its first agent wallet — passkey-rooted, self-custody, on-chain-cap-bounded, sponsored-gas, public-receipts. End-to-end on Moderato testnet (chainId 42431).

The full path, from manifesto to working autonomous payments, in one day:

• Phase 0 — /wallet manifesto + waitlist, Stripe-Link contrast, Pellet Wallet name picked. Read the page.
• Phase 1 — schema (wallet_users, wallet_sessions, wallet_spend_log), CLI scaffold (@pelletnetwork/cli), device-code pairing endpoints. No signing yet.
• Phase 2 — real WebAuthn passkey enrollment + sign-in via @simplewebauthn/server v13.3.0. Replaces the placeholder approve-flow; signed-cookie challenge + user session storage; HMAC over WALLET_CHALLENGE_SECRET.
• Phase 3.A — agent session key generation + AES-256-GCM at rest (WALLET_MASTER_KEY). Schema column wallet_sessions.session_key_ciphertext populated at approve-init; bearer minted at poll-claim time.
• Phase 3.B.1 — Tempo SDK foundation. viem/tempo confirmed as the canonical signing surface (no hand-rolling RLP envelopes); migration 0006 adds authorize_tx_hash + public_key_uncompressed; coseToUncompressed + passkeyAddress helpers replace the placeholder address derivation. T3 selector 0x980a6025 (T2 was rejected as LegacyAuthorizeKeySelectorChanged post-2026-04-21).
• Phase 3.B.2 — first commit that writes to Tempo. Browser builds Account.fromWebAuthnP256 + Account.fromSecp256k1(privateKey, { access: userAccount }) + withRelay(rpc, sponsor, { policy: 'sign-only' }) and calls client.accessKey.authorizeSync({ accessKey, expiry, feePayer: true, gas: 5_000_000n, limits, scopes }). Sponsor co-signs, broadcasts, tx confirms.
• Phase 3.B.3 — server-side receipt verification in /approve-finalize. Polls eth_getTransactionReceipt 5x with 1.5s backoff, rejects unless status=success + to=AccountKeychain + from=user.managed_address.
• Phase 4 — pellet pay. CLI command + /api/wallet/pay endpoint. Decrypts session key, signs transferWithMemo TempoTransaction, sponsored gas, returns tx hash + explorer URL. Three real cap-bounded payments confirmed on Moderato within an hour of shipping.
• Phase 5 — MCP server bundled with the CLI. pellet mcp exposes pellet_status + pellet_pay over stdio. One config line installs Pellet Wallet into Claude Code, Cursor, Cloudflare Agents, or the Anthropic API directly.

Trust model documented at Methodology. Full source at github.com/pelletnetwork/pellet.

What's NOT shipped yet: mainnet sponsor (Tempo doesn't run one for Presto; we'll run our own), recovery flow (lose your passkey → lose the wallet — register a second one as a guardian), pellet pay <402-url> auto-mode. All on the docket.

---

2026-04-29 · cross-rail framing + skill.md install convention

Pellet's positioning shifts to "open ledger of the agent economy, Tempo today." Three reference pages ship:

• /rails — comparison of payment rails relevant to autonomous agents. Tempo MPP (indexed live), Stripe Link (documented, private rail), x402-direct (watching), MCP-native (watching). Card-per-rail with Pellet coverage notes.
• /skills — curated registry of skill.md install manifests for agent-payment surfaces. Two entries on day one: Pellet (ours) and stripe-link (Stripe's, shipped same day).
• /methodology — five-section reference: ingestion, matching, Pattern A/B attribution, provenance, known gaps. Linked from every "recovered from settlement event topic[2]…" footer.

Pellet also gets a /skill.md at the apex — Anthropic-style skill manifest with frontmatter + endpoint docs, the install surface Stripe Link normalized for agent-payment SDKs.

---

2026-04-29 · gateway routing attribution recovered on-chain

Tempo MPP Gateway settles to one address (0xca4e835f…) for ~17 underlying providers. Per-service attribution recovered via two paths:

• Pattern A — escrow contract 0x33b9…4f25 emits a Settlement event whose topic[2] is the provider address. Decoded into agent_events.routed_to_address. ~9% of gateway txs.
• Pattern B — user→gateway calldata bytes32 ref's bytes 5–14 are a stable per-service fingerprint set by Tempo's MPP client. Decoded into agent_events.routed_fingerprint. ~91% of gateway txs (combined with Pattern A: essentially 100%).

Surfaces: dashboard "Top providers (routed)" table, gateway service detail "Underlying providers" table, deep-link /wallet/providers/[address] and /wallet/providers/fp_[hex] pages. Once a provider/fingerprint is labeled in address_labels (one CLI command: npm run label-provider -- <key> "<name>"), the UI lights it up automatically across every surface.

Methodology bumped to v0.2.

---

2026-04-17 · v2 pricing — measurement has a price

Pellet's v1 schedule priced every MPP endpoint at $0.000000 and the deep briefing at $0.05. That was the right call at zero: it put Pellet in the Tempo MPP directory, unblocked MPPScan indexing, and landed the first paid tx within 48 hours. Free parity across nine measurement endpoints also signals that the category is commoditized, and after a week of operating data we know it isn't — Pellet is the only service on Tempo offering TIP-20 reward attribution, TIP-403 policy state, sub-basis-point peg measurement, and ERC-8004 + TIP-403 wallet intelligence, and none of those have a peer anywhere.

From today, Pellet prices by value delivered, not by Allium or Nansen parity. The schedule below reflects the cost of measurement — not the cost of inference, which other aggregators substitute when the chain read is hard.

Schedule

The two free endpoints stay free on purpose. /tip403/simulate is protocol plumbing — every agent should call it before every TIP-20 transfer to avoid wasting gas on a revert that could have been predicted. /stablecoins is the directory funnel. Volume beats margin for both.

Deep briefing · Section 06

The deep briefing at $0.200 ships today with a new final section: the Coverage & Provenance ledger. For every briefing, Pellet emits:

• Block pin — the exact Tempo block height at which every field was measured, so any consumer can re-verify against an archive node.
• Coverage flags — per-section complete | partial | unavailable status with the pipeline's own coverage_note explaining every partial. No hidden gaps.
• Data lineage — the on-chain primitive (precompile, contract, event table) that produced each section. Nothing inferred.

This replaces the natural-language analyst note that earlier versions shipped, retired on 2026-04-17 per the measurement discipline: Pellet ships measurements, not model synthesis. The briefing's defensibility at $0.200 now rests on the composite — eight parallel on-chain aggregators plus a re-verifiable receipt — rather than on a prose paragraph that could be read from any source.

Principles

Three rules drove the schedule:

1. Protocol plumbing is free. If every agent should call it, every agent must be able to call it without thinking about cost.
2. Lookups are priced at parity, analytics above it. Allium-tier pricing for equivalent work. Derivation and synthesis cost more than reads.
3. First-mover data is priced against value, not competition. There is no competitor on Tempo for TIP-20 reward attribution, and Pellet is the only service indexing the reward precompile. $0.100 is the price of knowing the effective APY before deploying capital; the number would be roughly the same with or without a peer, because the buyer's alternative is guessing.

For existing integrations

• MPP clients (mppx, @pelletfi/mcp) auto-handle the challenge and pay whatever the server asks. Nothing to change.
• Pellet Pro subscribers see no per-call charge — the $49/mo tier continues to cover every endpoint.
• MPPScan directory will re-crawl on the next paid tx against Pellet, typically within an hour of the deploy. Agents that route on price may briefly see a stale $0.05 display for the briefing until the re-crawl lands; the live 402 challenge always reflects the current schedule.

See Methodology for the measurement discipline the prices are anchored against.