Trialoom

Track: Build with buy. Trialoom is a product that pays for a service it does not own — inference, bought per test over x402 on Celo mainnet, from its own wallet, with the builder never seeing a paywall.

Who it is for. A solo founder or two-person team shipping a web app with no QA. When they change something, the check is manual: open the preview, click the signup, click the invite, click checkout, and hope nothing else broke. It costs them 20–40 minutes per release, and they skip it when they are busy — which is exactly when they break something.

What Trialoom does. They authorise a preview URL they own and ask for a test. Trialoom drives a real Chromium in an isolated gVisor sandbox whose only route out is a proxy that denies every origin outside the run's allowlist, and returns three things: what it observed step by step, the findings, and a recorded replay that opens at the first failure.

What we buy on buy. One service, used for real: cencori.v1.chat.completions, the Cencori inference endpoint published in buy's catalogue, model maximo-atlas-1.3, reached at https://gateway.usebuy.ai/cencori/v1/chat/completions and paid to 0x20faAca5F980E29639A0FCC6dcA6988E18ed333B. When a test finds something, Trialoom buys an explanation of the failure and a debugging step. It is not a wrapper around a model we already pay for: Trialoom owns no model, no browser farm and no inference capacity, and the same path is how it would rent isolated browsers and disposable machines as demand outgrows one host.

Where buy is integrated, by file. src/server/buy-report.ts pins the service and does discovery against the live catalogue at https://gateway.usebuy.ai/v1/catalog — before paying it checks the capability is present and available, that the URL and method match what we pinned, that our model is in the endpoint's own schema enum, and that the 402's payTo is the payee we expect. src/server/buy-x402.ts is the x402 client: it reads the 402, rebuilds the EIP-712 domain from a pinned asset table and compares it against the token's own DOMAIN_SEPARATOR before signing, then signs an EIP-3009 transferWithAuthorization. src/server/sponsored.ts holds the budget — a ceiling reserved atomically, a per-report cap of 25,000 base units, and reconciliation against finalised chain state. src/server/free-test-reports.ts builds the report input and binds the purchase to its hash. workers/main.ts and workers/free-tests.ts are the deployed worker that actually fires it.

Two details that took real work. Because USD₮ and USA₮ expose no version() on chain, a token cannot be asked what its EIP-712 domain version is — so the domain is rebuilt from a pinned table and verified against the token's own separator, and a quote claiming a different domain is refused. And the authorisation nonce is keccak256(intentKey), so a retry signs the same nonce and the token itself rejects a second use: a double payment is impossible at the token, not merely in our bookkeeping.

The verified paid call. 0.01 USD₮ — 10,000 base units of Tether USD, 0x48065fbBE25f71C9282ddf5e1cD6D6A887483D5e — settled on Celo mainnet in transaction 0x339fe5f4bf8c0885c4070cd9700cdca935125ce2f90a952da473c977782943ef, block 82,243,718, payer 0xf8Ff4F7C83404e04506785b7DFDf838CA75C22ae, payee 0x20faAca5F980E29639A0FCC6dcA6988E18ed333B, re-read from the chain and finalised. Because USD₮ implements EIP-3009 the payer signs off chain and buy's facilitator submits the transfer and pays the gas, so the on-chain sender is the facilitator and no transaction of ours carries calldata to tag; the attribution tag stays wired into the Remesso settlement client, which is the path where we do send our own transactions.

The privacy boundary that makes the paid call safe. At most twelve closed observations per report leave the product — HTTP status, count agreement, navigation outcome, denied-request count, infrastructure blockage, recorded boolean checks. No URL, no page text, no raw trace, no account identity, no credentials, no source. The canonical input is hashed and the report is bound to it, so an explanation can always be traced to the exact evidence it was bought for and never to the customer's data.

State, stated plainly. Trialoom runs on its own dedicated host at https://trialoom.xyz: public wallet signup, an isolated gVisor runner, private object storage, nightly backups with a rehearsed restore. The purchase decision runs in production — a check requested from the live site on 9 November completed with all four checks passing and the worker recorded skipped: all_checks_passed, declining to spend because a passing test has nothing to explain. ERC-8004 identity 10031 is registered from the agent wallet and resolves on chain. There are no independent users yet and one paid call has settled, both from our own wallet; where an input does not exist, the record says so rather than reporting a number.