cqx-trustqueued
Holds the pathway budget and releases payment against a graded receipt.
enstrust.clinicalquantum.eth
intentsbudget-release
human-backedtrue
World ID · Selfie Check · AgentBook
Who authorised the spend
The money rail proves a payment happened. ENS proves which agent received it. Neither answers the question an auditor asks first: on whose authority was public money committed to this assessment? An autonomous process spending a budget on nobody's behalf is not an acceptable audit line for NHS-shaped work.
So a budget release carries a human. World ID reduces that human to one nullifier hash — stable for one person on this action, so a second release by the same person is visibly the same person, and a bot farm cannot mint a fresh approver per run. The hash goes into the receipt, through the SHA-256 digest and the post-quantum seal, and is anchored on Arc alongside everything else.
Three layers, three questions
| Layer | Question it answers | Proof |
|---|---|---|
| Arc · Circle | Did money actually move? | A USDC transaction on Arcscan |
| ENS · ENSIP-25 | Which agent was paid, and is it permitted to do this? | Resolver records under clinicalquantum.eth on Sepolia |
| World ID | Which unique human authorised the spend? | A Selfie Check credential, reduced to a nullifier hash |
The gate runs between the ENS identity check and the classical floor, so an unauthorised release is stopped before a penny of the budget is committed. An unauthorised run still executes and publishes at full size — it simply settles nothing. Run one on the board and watch the human step.
The credential
simulated — sandbox pendingA low-friction, low-assurance human credential used as an authorisation and abuse-prevention signal for releasing a pathway budget. Selfie Check is deliberately a low-assurance signal: it is evidence that a live person is behind the request, not evidence of identity, authority, professional registration or clinical competence. Nothing here is a clinical, diagnostic or outcome claim.
app idapp_b54b380043842fef8b8c88c8e3bcdc5d
actionbudget-release
credentialSelfie Check
flowWorld ID v4 · RP-signed request context · server-side verify proxy
verify endpointdeveloper.world.org/api/v4/verify/{rp_id}
What is never collected
- No image, selfie, video or biometric template reaches this app — the credential is produced and held inside World App.
- No name, email, phone number or wallet address is stored against an authorisation.
- No cross-action linkage: the nullifier is scoped to this action, so it cannot be matched against a nullifier from any other app.
- No clinical, diagnostic or competence claim attaches to a verified human — it authorises a spend, nothing more.
The agents in AgentBook
registration pendingEach agent carries three bindings: a name under clinicalquantum.eth, an Arc actor address it is paid at, and an AgentBook entry declaring it is human-backed. An agent missing from AgentBook is shown as missing rather than quietly passing.
Sandbox entitlement requested on 12 September 2026 and not yet approved. Registration runs through scripts/agentbook-register.mjs the moment it lands; the entries below are the exact payloads that will be submitted.
cqx-baselinequeued
Runs the powered classical floor, the cohort-fitness sweep and the dequantization gate.
ensbaseline.clinicalquantum.eth
intentsclassical-floor
human-backedtrue
cqx-nexusqueued
Submits circuits to Quantinuum Nexus and returns a graded receipt or assessed-blocked.
ensnexus.clinicalquantum.eth
intentsquantum-submit
human-backedtrue
cqx-registryqueued
Anchors the sealed receipt hash on Arc Testnet before any payment clears.
ensregistry.clinicalquantum.eth
intentsanchor
human-backedtrue
Identity on Sepolia, authorisation through World, settlement on Arc Testnet. These are separate networks: the bindings are attested pointers between them, not a bridge and not message passing. World ID and ENS are both classically signed; only the receipt digest carries a post-quantum seal.