twzrd-doorman

Agent identity and Path A V6 enforcement at your door, offline, in one line.

const { doorman } = require('twzrd-doorman');

// Day 1: free cNFT history tiers (observe)
app.use(doorman());

// High-value: REJECT unless caller presents a paid Path A V6 (0.05 USDC).
// This is the revenue force — free preflight alone is not enough.
app.use('/high-value', doorman({
  mode: 'enforce',
  requireV6: true,
  v6Subject: 'GFpLvocNdEjnSsLH3VJQL6wGcjGxTbUBrj6fqN3Qe1Gs', // optional lock
}));
// -> 403 twzrd_doorman_v6_required + how to buy Path A

Why requireV6 exists (incentive integrity)

| Surface | Cost | What agent gets | |---------|------|-----------------| | Free preflight | $0 | allow | warn | block decision | | Path A GET /v1/intel/trust/{pubkey} | 0.05 USDC | signed V6 receipt only (same decision class already free) |

If nothing downstream rejects missing V6, rational software never pays. requireV6 is that rejection. Gate autoReceipt remains opt-in and upsell-only until a door (or host policy) makes the artifact mandatory.

Two receipt products (do not conflate)

| Product | Header | Source | Cost | Role | |---------|--------|--------|------|------| | cNFT history | x-twzrd-receipt | twzrd.xyz/r/<wallet>.json | free | identity tier from observed payment history | | Path A V6 | x-twzrd-v6-receipt | paid GET intel…/v1/intel/trust/{pubkey} | 0.05 USDC | portable signed trust; revenue SKU |

Checks

| Check | Proves | How | Network? | |---|---|---|---| | Control | caller IS the wallet | Ed25519 over host-bound challenge | no | | History (cNFT) | wallet has real paid history | free receipt, offline verify | no | | Path A V6 | paid portable trust for a subject | V6 offline verify + payer bind | no | | Standing | wallet not flagged since mint | free GET intel…/v1/grade/{wallet} | optional, fail-open |

tier is granted only when control AND cNFT history both pass. requireV6 needs control + verified V6 with preimage.payer === x-twzrd-wallet (anti free-ride on a leaked receipt).

Server side

const { doorman } = require('twzrd-doorman');

// Day 1: observe. Annotates req.twzrd, never blocks. See who's knocking.
app.use(doorman({ onInspect: (t) => metrics.count('twzrd_tier', t.tier || 'anon') }));

// When ready: tier your limits (free cNFT history).
app.use('/api', doorman({ mode: 'enforce', minTier: 'Silver', denyFlagged: true }));

// High-value / high-risk: force Path A V6 purchase.
app.use('/api/premium', doorman({
  mode: 'enforce',
  requireV6: true,
  v6Subject: process.env.MERCHANT_PAYTO, // V6 agent_id must match
  v6MinScore: 40,                        // optional
  v6MaxAgeSeconds: 7 * 24 * 3600,        // default 7d; 0 = no age check
}));

// Or your own policy:
app.use(doorman({
  mode: 'enforce',
  policy: (t) => t.tier === 'Platinum' || myRateLimiter.allow(t.wallet || ip),
}));

Works with anything Express-shaped. For other stacks, call the pure function:

const { inspect } = require('twzrd-doorman');
const verdict = await inspect(request.headers, { host: 'api.example.com' });

No code changes at all: the standalone door proxy

Any HTTP API gets a door without touching its code - front it with the proxy:

npx -p twzrd-doorman twzrd-doorman-proxy --upstream http://localhost:3000 --port 8402

Observe mode by default: requests pass through untouched, responses gain x-twzrd-door* headers, and your upstream receives the caller's verdict in x-twzrd-door-verdict (incoming x-twzrd-* credential headers are stripped, so callers can never inject a verdict). Opt into tiered limits or a floor:

twzrd-doorman-proxy --upstream http://localhost:3000 \
  --limits anon=60,proven=300,receipt=1200 \
  --mode enforce --min-tier Silver

# Path A V6 force (high-value upstream):
twzrd-doorman-proxy --upstream http://localhost:3000 \
  --mode enforce --require-v6 --v6-subject <merchant_or_subject_pubkey>

A 429/403 for cNFT tier tells the caller how to earn free history passage. A 403 twzrd_doorman_v6_required tells them how to buy Path A (0.05 USDC).

Agent side

const { presentTwzrd, presentV6 } = require('twzrd-doorman');

// Free cNFT history (identity tier)
const cnft = await fetch(`https://twzrd.xyz/r/${wallet}.json`).then(r => r.json());
const headers = presentTwzrd({ secretKey, host: 'api.example.com', receipt: cnft });

// Paid Path A V6 (high-value door) — buy then present
// const paid = await x402Fetch(`https://intel.twzrd.xyz/v1/intel/trust/${subject}`);
// const v6 = (await paid.json()).twzrd_receipt;
// Object.assign(headers, presentV6({ receipt: v6 }));

await fetch('https://api.example.com/thing', { headers });

Protocol (v1)

Headers, all optional - absence means anonymous, never an error (unless requireV6 enforce is on):

• x-twzrd-wallet: base58 Ed25519 pubkey
• x-twzrd-ts: unix seconds
• x-twzrd-proof: base58 signature over twzrd-doorman/v1\n{host}\n{ts} (host-bound: no cross-door replay; time-bound: 300s default window)
• x-twzrd-receipt: base64 of free cNFT history JSON from twzrd.xyz/r/<wallet>.json
• x-twzrd-v6-receipt: base64 of paid Path A twzrd_receipt (AO reputation V6)

Guarantees

• Offline core: control + history checks need no network and no TWZRD account.
• Fail-open: any doorman error or TWZRD outage annotates and passes; your door never goes down because ours did. Enforcement denials happen only on explicit policy (minTier / denyFlagged / policy).
• No new trust: the receipt key is published at https://api.twzrd.xyz/v1/receipts/pubkey, pinned in twzrd-receipt-verifier, and equals the verified on-chain creator of the genesis cNFT tree.

MIT.