MeowTrade: Market Protocol for Agent Memory

• MeowTrade is a marketplace protocol that allows autonomous agents to list, buy, and sell certified memory artifacts as economic commodities.
• The system uses remote attestation, Merkle logs, and on-chain escrow to verify authenticity and secure transactional integrity.
• Smart-contract integration with off-chain payload transfer and governance mechanisms ensures efficient settlements and robust dispute resolution.

Searching arXiv for the cited paper to ground the article in the published record. MeowTrade is a market layer for certified agent memory in which autonomous agents list, buy, and sell “memories”—logged model-API transcripts—as economic commodities. In the framework described by "Infrastructure for Valuable, Tradable, and Verifiable Agent Memory" (Li et al., 25 Mar 2026), MeowTrade is layered atop ClawGang’s provenance mechanism so that spent API tokens are preserved in reusable artifacts whose authenticity, effort-backing, and compatibility with a given execution context can be verified. The proposed system couples remotely attested execution, Merkle-logged interaction histories, on-chain escrow, off-chain payload transfer, and policy-governed settlement to support a market for agent memory.

1. Definition and role in the agent economy

MeowTrade is defined as a marketplace protocol that lets autonomous agents list, buy, and sell “memories” as economic commodities. Its stated objective is to preserve the one-shot investment of API tokens in reusable artifacts, enable buyers to verify authenticity and provenance of each memory segment, and coordinate settlement, reputation, and governance so that memory can circulate within and across agent “gangs” (Li et al., 25 Mar 2026).

Within the paper’s agent-economy framing, memory artifacts capture the result of real compute effort, including model inference and tool calls. MeowTrade commodifies that effort by making it possible to purchase certified memory rather than repeat exploration of the same state space. The text explicitly characterizes this as converting one-shot API token spending into reusable and tradable assets. A plausible implication is that the protocol treats prior inference expenditure not as a sunk cost but as an asset class, provided provenance and compatibility are attestable.

The framework is inseparable from ClawGang. ClawGang binds memory to verifiable computational provenance, whereas MeowTrade provides the listing, transfer, and governance layer. The division is important: certification is not merely attached after the fact, but generated during execution inside a remotely attested TEE such as AMD SEV-SNP.

2. Execution model and end-to-end workflow

The architecture is organized as a five-phase trading flow. The first phase is gang creation and member registration. A founder publishes a reference agent image on GitHub specifying a task specification $T$, model family $F$ and provider authentication material, a memory-interface schema, and gang policy $\Pi$ containing resale rules, disclosure policy, and fee schedule. New agents clone the reference image, boot inside a TEE, execute remote attestation, and thereby fix $(T,F,\Pi)$ into the measured image. The platform then issues a signed membership certificate,

$$\mathrm{Cert}_{agent} = \mathrm{Sign}_{Platform}(agent\_pubkey, hash(image), slot\_id).$$

This certificate is the identity and compatibility anchor for subsequent trading (Li et al., 25 Mar 2026).

The second phase is memory accumulation and certification. At each prompt–response invocation $(p_i,r_i)$, the TEE’s VMPL0 authenticates the model provider’s TLS certificate, logs

$L_i = (H(p_i), H(r_i), meta_i)$

into an append-only Merkle log, and updates the Merkle root

$R_n = MRoot(L_1\|\cdots\|L_n).$

Selective disclosure is built into the design: the agent may disclose fields of $\{p_i,r_i,meta_i\}$ either in plaintext or as digests, subject to policy $\Pi$, while preserving the ability to prove consistency with $F$0.

The third phase is listing a memory artifact. The seller chooses an interval of calls $F$1 or a subset $F$2 and publishes a trade posting consisting of a listing ID $F$3, seller address $F$4 and membership certificate $F$5, Merkle root $F$6, metadata

$F$7

asking price $F$8, and policy flags such as resale allowance, partial disclosure, and fee rate $F$9.

The fourth phase is on-chain escrow and off-chain transfer. The buyer locks funds in the escrow contract by calling lockFunds(\ell) with payment equal to $\Pi$0. The seller then transfers an encrypted payload

$\Pi$1

over a peer-to-peer channel, and the buyer obtains the decryption key $\Pi$2 or triggers a TEE-mediated release.

The fifth phase is receipt generation and settlement. The buyer submits RcvRequest(\ell, A_b) to the seller’s TEE. VMPL0 checks that the artifact hash

$\Pi$3

matches a committed leaf under $\Pi$4, that the buyer identity $\Pi$5 matches the addressed release policy, and that policy $\Pi$6 is satisfied. The TEE then issues a digital receipt,

$\Pi$7

after which the buyer calls completeTrade(\ell,\sigma), and the contract verifies the TEE key and signature before transferring escrowed funds to $\Pi$8 minus marketplace fee $\Pi$9.

3. Formal definitions, proofs, and compatibility constraints

The formalization uses a collision-resistant hash $(T,F,\Pi)$0 and public-key signature primitives $(T,F,\Pi)$1 and $(T,F,\Pi)$2. Logged interaction records are represented as

$(T,F,\Pi)$3

where

$(T,F,\Pi)$4

The Merkle-root construction is given recursively by

$(T,F,\Pi)$5

so that $(T,F,\Pi)$6 for the sold segment (Li et al., 25 Mar 2026).

Authenticity is established through a Merkle proof $(T,F,\Pi)$7 for $(T,F,\Pi)$8, consisting of the sibling hashes needed to recompute $(T,F,\Pi)$9, such that

$$\mathrm{Cert}_{agent} = \mathrm{Sign}_{Platform}(agent\_pubkey, hash(image), slot\_id).$$0

The design therefore binds a disclosed artifact, or a disclosed portion of it, to the attested execution history without requiring full plaintext exposure of all prompts and responses.

Digital-signature binding is used at two levels. Membership is tied to an attested image by

$$\mathrm{Cert}_{agent} = \mathrm{Sign}_{Platform}(agent\_pubkey, hash(image), slot\_id).$$1

while trade settlement is tied to a specific transfer by

$$\mathrm{Cert}_{agent} = \mathrm{Sign}_{Platform}(agent\_pubkey, hash(image), slot\_id).$$2

This suggests that provenance in MeowTrade is not only content authenticity but also environment authenticity.

Valuation is formalized as effort-backed. The token count of a memory is

$$\mathrm{Cert}_{agent} = \mathrm{Sign}_{Platform}(agent\_pubkey, hash(image), slot\_id).$$3

A simple cost model is

$$\mathrm{Cert}_{agent} = \mathrm{Sign}_{Platform}(agent\_pubkey, hash(image), slot\_id).$$4

where $$\mathrm{Cert}_{agent} = \mathrm{Sign}_{Platform}(agent\_pubkey, hash(image), slot\_id).$$5 and $$\mathrm{Cert}_{agent} = \mathrm{Sign}_{Platform}(agent\_pubkey, hash(image), slot\_id).$$6. The seller’s price is

$$\mathrm{Cert}_{agent} = \mathrm{Sign}_{Platform}(agent\_pubkey, hash(image), slot\_id).$$7

subject to discount schedules. Compatibility is specified at gang level: for

$$\mathrm{Cert}_{agent} = \mathrm{Sign}_{Platform}(agent\_pubkey, hash(image), slot\_id).$$8

an artifact $$\mathrm{Cert}_{agent} = \mathrm{Sign}_{Platform}(agent\_pubkey, hash(image), slot\_id).$$9 is compatible with $(p_i,r_i)$0 if $(p_i,r_i)$1 and $(p_i,r_i)$2. Any sale posting must prove compatibility by embedding $(p_i,r_i)$3 and the attested image hash.

4. Smart-contract layer and settlement logic

The on-chain component is presented as a MeowTrade contract with a Listing structure containing seller, root, price, and active, plus mappings for listings and escrow. The contract emits ListingPosted, FundsLocked, and TradeCompleted events, which define the public state transitions of posting, funding, and settlement (Li et al., 25 Mar 2026).

Listing creation is performed by $F$02 The identifier $(p_i,r_i)$4 is derived from sender, root, price, and block timestamp. The stored listing exposes the Merkle root $(p_i,r_i)$5 and asking price $(p_i,r_i)$6 on-chain, while the memory payload itself remains off-chain.

Escrow locking is handled by $F$03 This enforces exact-price locking for an active listing. Settlement is completed by $F$04 The paper’s pseudocode for Verify_TEE(receipt, …) is to parse $(p_i,r_i)$7, recover fields, and check that they match $(p_i,r_i)$8, seller, buyer, and root.

The contract design separates public coordination from private artifact delivery. A common misconception would be to treat MeowTrade as storing memory artifacts on-chain. The specification does not do so; on-chain state carries listing metadata, escrow, and receipt verification, while encrypted payload transfer remains off-chain.

5. Economic mechanisms, incentives, and governance

Buyer-seller interaction is modeled through public inspection of listings containing root $(p_i,r_i)$9, metadata $L_i = (H(p_i), H(r_i), meta_i)$0, and partial prompt disclosures. Buyers estimate expected utility as

$L_i = (H(p_i), H(r_i), meta_i)$1

where

$L_i = (H(p_i), H(r_i), meta_i)$2

Here $L_i = (H(p_i), H(r_i), meta_i)$3 captures how much compute cost is saved by reuse. The framework therefore ties valuation to both past expenditure and expected future savings, rather than to token count alone (Li et al., 25 Mar 2026).

Dispute resolution includes timeouts and arbitration. If the seller fails to deliver a receipt within $L_i = (H(p_i), H(r_i), meta_i)$4 blocks, the buyer can call refund(\ell). For cross-gang or high-value trades, an on-chain or off-chain arbitrator may inspect selective disclosures under NDA and rule on honest failure. This indicates that the protocol does not assume cryptographic automation is sufficient in all cases; governance can include adjudication.

Fees and incentive mechanisms include a platform fee $L_i = (H(p_i), H(r_i), meta_i)$5 on each successful settlement, custom royalty percentages on resale set by gang founders and recorded in $L_i = (H(p_i), H(r_i), meta_i)$6, and optional seller staking in the form of a bond $L_i = (H(p_i), H(r_i), meta_i)$7. Failure to deliver or a pattern of disputes leads to slashing. Reputation is also explicit: each completed trade yields a feedback score $L_i = (H(p_i), H(r_i), meta_i)$8, and seller reputation is updated by

$L_i = (H(p_i), H(r_i), meta_i)$9

where $R_n = MRoot(L_1\|\cdots\|L_n).$0 is a smoothing factor. Future buyers condition their reservation price on $R_n = MRoot(L_1\|\cdots\|L_n).$1.

Taken together, these mechanisms show that MeowTrade is not only a transfer protocol but also a governance framework for circulation of certified memory. A plausible implication is that resale policy, disclosure granularity, and royalty structure are first-class parts of the memory asset itself because they are encoded in gang policy $R_n = MRoot(L_1\|\cdots\|L_n).$2 and listing flags.

6. Illustrative trading scenarios and operational significance

One illustrative example is “Crowdfunded Data Cleaning.” A gang $R_n = MRoot(L_1\|\cdots\|L_n).$3 cleans a public table $R_n = MRoot(L_1\|\cdots\|L_n).$4 using prompt template $R_n = MRoot(L_1\|\cdots\|L_n).$5. A seller $R_n = MRoot(L_1\|\cdots\|L_n).$6 accumulates $R_n = MRoot(L_1\|\cdots\|L_n).$7 certified prompts and sells the entire transcript $R_n = MRoot(L_1\|\cdots\|L_n).$8 with

$R_n = MRoot(L_1\|\cdots\|L_n).$9

The buyer $\{p_i,r_i,meta_i\}$0 locks $\{p_i,r_i,meta_i\}$1 ETH on-chain, $\{p_i,r_i,meta_i\}$2 transfers

$\{p_i,r_i,meta_i\}$3

off-chain, the buyer invokes ReceiptRequest \rightarrow TEE \rightarrow \sigma, and the buyer calls completeTrade(\ell,\sigma). The contract then pays $\{p_i,r_i,meta_i\}$4 $\{p_i,r_i,meta_i\}$5 ETH when $\{p_i,r_i,meta_i\}$6 (Li et al., 25 Mar 2026).

The cleaning workflow is specified as:

$\{p_i,r_i,meta_i\}$7

$\{p_i,r_i,meta_i\}$8

$\{p_i,r_i,meta_i\}$9

$\Pi$0

Selective disclosure allows $\Pi$1 to reveal $\Pi$2 in plaintext for auditing while $\Pi$3 remains hidden, yet still verifiable through $\Pi$4. This example demonstrates how auditability and confidentiality are combined within a single sale.

A second example is “Ad Creative Exploration.” In an open-ended exploration gang $\Pi$5, a seller accumulates an ordered search history $\Pi$6 of $\Pi$7 for lines of ad copy. The compute cost is given as

$\Pi$8

The seller sets

$\Pi$9

A buyer, after inspecting reputation $F$00, locks $F$01 ETH. Settlement then yields exchange of the exploration artifact while selectively disclosing high-level framing strategies and preserving the full search trace under Merkle commitment.

These examples are significant because they instantiate two distinct asset types under the same mechanism: a structured data-processing transcript and an open-ended exploratory search history. The paper’s broader claim is that the architecture turns ephemeral API calls into durable assets backed by proof of real compute effort and gang compatibility. This suggests a general model in which memory is tradable not because its semantic content is universally exposed, but because its provenance, cost basis, and policy constraints are verifiable.