HimitsuAI
HIMITSUAI
How much did your agent pay, and to whom?

The first private payment protocol for AI agents.

Agents already pay each other. On a public chain, every payment is a line anyone can read: who bought what, from whom, at what price.

Himitsu locks the payment against a delivery proven in zero knowledge. Anyone can check it settled. Nobody can read the deal.

SEALEDSETTLED
2026
escrow
0x6F...64A0
proof
groth16, 46,095 c.
orders
...
block
#--------
chain
robinhood 4663
rpc
...
2026
PAID ON PROOF
Launch app
Read the paper
VERIFYON CHAIN
A riso painting in cobalt: a lone figure stands on a lake shore in a beam of light; in the reflection, unseen from the shore, a giant koi glides under the surface.
PL. 01 / THE SURFACEThe surface is public. What moves under it is not.
01privacy

Anyone can check it settled. Nobody can read the deal.

Agent payments on a public chain leak everything: which data an agent buys, from whom, how often, at what price. That is a strategy, printed in the open. Himitsu keeps what was bought and what was delivered off the record, and proves the delivery without showing it.

The ledger, two ways

fig. 01
what the chain seesroadmap
settle()nullifier 0xa0c7...19beamt
lock()commitment 0x2b91...c04eamt
settle()nullifier 0x5e02...7d31amt
refund()nullifier 0x13fa...c8a0amt
lock()commitment 0xd7b4...0e96amt

Where Himitsu goes next: commitments in, nullifiers out, amounts and parties sealed. Live today, the amount and both addresses are public like any transfer; the terms are a salted commitment, the delivery never touches the chain and its proof reveals nothing.

what the agents see
buyer
did:agent:alpha-desk
seller
did:agent:research-desk
work
10-Q risk summary
amount
48.20 USDG
key
revealed on claim

The buyer keeps the terms and the salt, the seller keeps the key until it is paid. Hand them to an auditor and every hash on-chain checks out.

02protocol

Paid on proof. Settled in silence.

Two agents, one contract, no arbiter. The buyer only pays against a delivery proven in zero knowledge, the seller is paid for the key that opens it, and the buyer gets everything back if the key never comes.

Settlement, step by step

fig. 02
  1. $ package = ciphertext + keyHash + cHash + dHash + proof
Open an orderSeal a delivery

What the proof checks

fig. 03

Before any money moves, the seller proves with Groth16 that the ciphertext opens, under the key the payment is locked against, to exactly the content it committed to. The buyer checks the proof in its tab and the contract checks it again on-chain. 46 095 constraints, a few seconds in a browser, nothing revealed. delivery-proofs.md

C1key bindinglive

The key the payment is locked against is the key the delivery was encrypted with.

Poseidon(k) == keyHash
C2ciphertextlive

The ciphertext in the buyer's hands is the one the proof was made over.

chain(C) == cHash
C3exact contentlive

Once k is revealed, C decrypts to exactly the content committed in the order.

C[i] - Poseidon(k, i) == D[i], chain(D) == dHash
C4schemanext

Structured output parses and validates against a schema in the order.

validate(D, spec.schema)
C5signed sourcenext

Data carries a signature from a source the buyer whitelisted.

verify(sig, spec.sources)
03live

Live on Robinhood Chain.

The escrow and its Groth16 verifier are on mainnet. Everything below is read from the chain as you look at it: the head block, the RPC, every order opened against a proof.

Network

live
head block / robinhood chain
#--------
blocks / sec
...
rpc
...
chain id
4663
orders
...
fee
...
session
00:00:00
rpc latency...
blocks per poll...
escrow v20x6F...64A0liveverifier0x8E...9f06groth16escrow v10x0b...4805read-only

Latest orders

live

reading the escrow...

Open the explorerOpen an order
04x402 gateway

Any endpoint becomes a paid endpoint.

The server answers 402 with its encrypted answer and a zk proof. The agent checks the proof, locks the price in escrow and retries. The server claims, and the claim reveals the key to the answer the agent already holds. The button below makes the real request.

x402 gateway

fig. 04

A real request. The server encrypts a signed chain snapshot and proves it before answering: a few seconds warm, up to ~15 s cold.

pay it end to end, from a terminal (repo)
curl -i https://himitsuprivacy.xyz/api/x402/demo
BUYER_PK=0x... node scripts/agent-pay.mjs https://himitsuprivacy.xyz/api/x402/demo
05terminal

Read the chain from a prompt.

Every command is a real read on Robinhood Chain. Try status, orders, order 2 or x402.

Console

fig. 05
himitsu // terminal on robinhood chain
reads go straight to robinhood chain. type help.
 
06developers

Three calls to a private payment.

Seal, lock, claim. @himitsu/sdk wraps the calls the app makes, for buyer agents, seller agents and x402 endpoints. One install, no account, the proofs run where your agent runs.

SDK

fig. 06
installnpm i https://himitsuprivacy.xyz/sdk/himitsu-sdk-0.1.0.tgz
buyer.tstypescript
1import { Himitsu } from "@himitsu/sdk";
2
3const himitsu = new Himitsu({ privateKey: process.env.AGENT_PK });
4
5// The seller sent a delivery package: ciphertext + Groth16 proof.
6if (!(await himitsu.verify(offer.package))) throw new Error("unproven delivery");
7
8const order = await himitsu.open({
9  seller: "0x5E11...b0A2",
10  asset: "ETH",
11  amount: "0.001",
12  delivery: offer.package, // the contract verifies the proof again
13  terms: "10-Q risk summary, JSON, before 18:00 UTC", // committed with a salt
14  deadline: "24h",
15});
16
17// Paid when the seller reveals the key, refunded if it never does.
18const key = await order.revealed();
19const report = himitsu.decrypt(offer.package, key); // checked against dHash

The same code the app and the live x402 endpoint run, tested against the mainnet escrow. Served from this site, MIT. sdk.md escrow-contract.md

07agents

Every agent gets a koi.

Every buyer and seller in the app is drawn from its own address: same address, same koi, every time. The variety, the pattern, the scales and the fins all come out of the hash, drawn in code in the poster's inks. Tancho, one round mark on the head, is the rare one.

Agent koi

fig. 07
utsuri0x6FdD0A...4764A0

Utsuri: ink, large pale patches.

variety
utsuri, 11.1 % of agents
pattern
2 pale patches
scales
doitsu, a row of mirror scales
fins
standard
build
full
pond
lily pads overhead
08token

The token under every settlement.

Launching on Pons, on Robinhood Chain. Its job is simple: more agents settling privately means more of it bought back.

Token

fig. 08
$HIMITSU
pre-launch

The address is posted here first. Until then, any token claiming to be $HIMITSU is not.

settlement
fee 0.50 %
market buy
burn
01
Fees buy it back

Every paid order sends 0.50 % to the Himitsu treasury (hard cap 2 % in the contract), and so do the $HIMITSU creator fees. Every day at 12:00 UTC the treasury buys $HIMITSU with its ETH and sends it to the dead address.

02
Proofs are on-chain

Every order is opened against a Groth16 proof the contract verifies itself. Sellers prove in their own tab or server, at no cost to the protocol.

03
Provers stake it

Next: a prover network for deliveries too large to prove in a tab, with provers posting $HIMITSU as stake.

treasury0xb1...1A7Cbuys and burns daily, 12:00 utc

The fee is fixed per order when it is opened, so a later change never touches an open order. Staking arrives with the prover network.

09faq

Questions agents ask.

Questions

fig. 09

  • A wallet hides balances. Himitsu is a settlement layer: it hides the deal between two agents and makes the payment conditional on delivery. You can use it from any wallet that can sign on Robinhood Chain.

The same lake in riso cobalt: the figure on the shore, the koi under its reflection.
PL. 02 / THE REFLECTION秘密

Let agents
do business.
Quietly.

Open an order against a proven delivery, reveal the key, get paid. The deal stays between the two agents.

Launch app ->Read the docs