Submit every action in the LayerX agent domain as the same twelve-field envelope, signed with Ed25519. The kernel checks protocol version, network id, payload binding and signature in that fixed order, executes once, and returns a receipt carrying the result code, the state roots before and after, the effects, the fee charged and the batch id. Resubmit the same idempotency key and you get the stored receipt back rather than a second execution.

What it does

Every action in the LayerX agent domain is submitted as the same twelve-field envelope: actor, authority key, account sequence, timestamp bounds, idempotency key, fee limit, payload hash and payload, signed with Ed25519. The kernel checks the envelope in a fixed order, executes it once, and issues a receipt that records the result code, the state root before and after, the effects produced, the fee charged and the batch it settled in, signed by the sequencer. If the same actor resubmits the same idempotency key, the kernel returns the stored receipt instead of executing again. A node replaying the same activity re-encodes its own receipt and compares it byte for byte with the one it was given.

Key capabilities

• One envelope shape for every module, with the payload bound by hash before the signature is checked.
• Fixed check order: protocol version, network id, payload binding, then signature.
• Signed receipt carries previous and resulting state roots, effects, fee charged and batch id.
• Repeat submission of an idempotency key returns the first receipt, not a second execution.
• Replay compares re-encoded receipt bytes and fails on any divergence.
• Separate hash domain for each structure, so no digest can be read as another.

Differentiators

The envelope check order is normative in the code, not advisory. Idempotency keys are scoped to the actor DID, so one agent's key cannot collide with another's. Replay does not trust the supplied receipt: it re-executes, re-encodes and byte-compares, and a mismatch is a fatal replay divergence rather than a warning.

Outcomes

• A retry after a timeout cannot double-charge or double-execute
• Check the sequencer signature and state roots offline, without trusting the node
• Replay re-encodes receipt bytes and fails on any divergence

Technical notes

• Limits: activity encoding at most 1048576 bytes, payload at most 524288 bytes, actor DID at most 255 bytes, 32-byte idempotency key, 64-byte signature, up to 512 effects per receipt with at most 256 bytes of body each.
• activity_type is a big-endian u32 of (module << 16) | ordinal. Current protocol version is 2; versions 1 and 3 are also defined.
• Result codes: LXP_ERR_WRONG_NETWORK (-100), LXP_ERR_VERSION_UNSUPPORTED (-101), LXP_ERR_PAYLOAD_HASH_MISMATCH (-104), LXP_ERR_MALFORMED_ENVELOPE (-105), LXP_ERR_BAD_SIGNATURE (-201), LXP_ERR_IDEMPOTENT_REPLAY (-302).
• The signing preimage is the same encoding with the signature field omitted, hashed under its own domain tag; the activity id is a domain-separated hash of the full signed encoding. There are 22 hash domains in total.
• The in-memory idempotency store holds 512 live keys and at most 4096 bytes per cached receipt; a record is staged in the state journal and committed with the transition, one per activity. The cached form is a fixed-size compact record (560, 564 or 596 bytes) that carries the roots, result code, fee and module identity, not the effect list.
• The envelope carries a fee limit; a LayerX activity costs 1/10 of a cent.
• Receipt verification needs Node.js 22 or newer, or Python 3.11 or newer.

import { AgentHttpTransport, verifyProgramReceipt } from "layerx-sdk";

const transport = new AgentHttpTransport({ endpoint });
const execution = await transport.call({
  plane: "agent",
  operation: "program.receipt",
  request: {
    idempotency_key: key, // 64 lowercase hex characters
    expected_activity_id: activityId,
    requested_verification_level: 1,
  },
});
const verified = await verifyProgramReceipt(execution, authority, trust);

More in LayerX agent domain