Proof, not promises.
Every claim below re-derives from a live endpoint or an on-chain read. We did the source-read for you: each claim maps to a command you can paste, a source file you can open, or a read you can run. If a claim cannot be verified right now, it is not on this page.
Stricter than the chain's own flag.
On 0G mainnet the on-chain verifiability: "TeeML" flag is coarse: many providers carry it. AURA does not route on the flag alone. It requires TeeML andthe provider address on a curated allowlist maintained in the server, so the set AURA will actually serve is strictly narrower than the chain's flag. A provider not on the allowlist is never selectable or served, even when the chain says TeeML.
- TeeML + allowlistGLM 5.10xDB7B…b2e8
- TeeML + allowlistGLM 5.20x7DCF…e87D
- TeeML + allowlist0GM 1.0 35B A3B35B0x4870…a4E9
- not allowlistedGPT OSS 20B20B0x44ba…ef64
- not allowlistedDeepseek V4 Pro0xB01E…2FdB
and 14 more TeeML-tagged providers (MiniMax, Qwen, GLM-5, and others) that AURA does not serve on the chat path.
AURA's curated allowlist is strictly narrower than 0G's TeeML flag. 19 providers carry TeeML; AURA serves 3.
Re-derive live: /chat/modelsEvery claim, and how to check it.
One row per real claim. Each maps to a command you can paste (no wallet), a source file you can open, or an on-chain read you can run - and states its honest limit inline. This is the source-read a jury would do, done for them.
Art you can prove.
Every Relic carries unforgeable on-chain provenance: which Aura made it, which model, the TEE attestation, the 0G image root, and the seed. It is assembled from live chain reads, not a database.
curl -s https://aura.topengdev.com/api/verify?token=112Honest limit:Provenance is only as strong as the attestation that gated the mint (boundary 3).
Agents are real ERC-7857 iNFTs.
Ownership moves ONLY through transfer() with a signed re-encryption proof: the brain is re-keyed and ECIES-sealed to the buyer, and a raw ERC-721 transfer reverts. This is the ERC-7857 secure-transfer MECHANISM (re-encryption + sealed-key rotation), not a registered interface id.
Honest limit:The transfer oracle is a trusted ECDSA signer, not a hardware-TEE enclave (the bar the field ships). This claim is literally true only when AuraINFT is configured - rendered live above, never hardcoded.
Verify that ENFORCES, not claims.
The TeeML allowlist is strictly narrower than 0G's on-chain TeeML flag, AND the mint BLOCKS on a bad attestation: a forged mint REVERTS on-chain. Enforcement, not a badge.
curl -s https://api-aura.topengdev.com/chat/modelsHonest limit:The allowlist is hand-curated by the platform: 'stricter than 0G's flag', NOT 'we caught 0G lying'.
On-chain-verified mint (Option A).
The contract ecrecovers 0G's TeeML enclave signature and REVERTS on forgery, binding dataHash = sha256(image). The mere existence of a non-zero dataHash is itself proof the chain enforced that signature at mint.
cast call 0xF31fD2235a5db76020b2a6F1CBC06e13E25E4805 'dataHashOf(uint256)' 112 --rpc-url https://evmrpc.0g.aicast call 0xF31fD2235a5db76020b2a6F1CBC06e13E25E4805 'teeSigner()' --rpc-url https://evmrpc.0g.aiHonest limit:Image-gen TEE runs in a 0G Compute enclave. The mainnet OutputNFT has the on-chain verified path armed (setTeeSigner); dataHash stays 0 for a relic until a fresh verified mint lands. It proves 'a genuine 0G enclave produced art with sha256=X', NOT '0G attests agent #N made it'.
Agent memory embedded on 0G Storage.
The sealed brain segments are retrievable and byte-identical on 0G, with a dual-wall on transfer (the old owner cannot read forward, the new owner cannot read backward).
Honest limit:OWNER-GATED, so a juror cannot keyless-verify it (unlike 1/3/4/6/7). MEMORY_0G_PIN defaults OFF. It makes AURA's OWN ERC-7857 claim literally true; it is a capability, not a rulebook requirement.
Royalty follows the agent owner.
EIP-2981 royaltyInfo resolves LIVE to ownerOf(creatorAgentId). Sell the Aura and the entire future royalty stream moves with it - enforced in the Marketplace before the seller is paid.
curl -s https://api-aura.topengdev.com/royalty/112cast call 0xF31fD2235a5db76020b2a6F1CBC06e13E25E4805 'royaltyInfo(uint256,uint256)' 112 1000000000000000000 --rpc-url https://evmrpc.0g.aiHonest limit:Enforced in Marketplace.buy() before the seller is paid. Uncontested across the bracket (no rival has resale royalty on the asset).
Provable-Pulls gacha (commit-reveal).
Rarity and subject derive from a blockhash-seeded root committed AFTER the summon. The browser re-derives that root from the public preimage with no server math (keyless); you anchor it against the chain by reading Provenance.seed on-chain with the command below, so the recompute is checked against the chain, not our API.
cast call 0xF31fD2235a5db76020b2a6F1CBC06e13E25E4805 'provenanceOf(uint256)' 112 --rpc-url https://evmrpc.0g.aiHonest limit:Commit-reveal on block.blockhash; buyer + agentId are in the Summoned event. No post-commit grinding (subject + rarity derive only after the commit); a block producer retains bounded single-block influence over the seed block hash.
Paste this against the featured Relic (AZULENE #112). It returns the keyless verification JSON - the on-chain facts, the checks, and a full copy-paste self-check script grouped by tier. No wallet, no login.
curl -s https://aura.topengdev.com/api/verify?token=112Four primitives, each proven.
In-enclave inference, attested per reply.
Auras chat on 0G mainnet GLM (currently GLM-5.2, shown live below), and each reply carries its own TEE attestation. Relic images are generated in a 0G testnet Compute TEE (qwen-image-edit-2511), with the attestation committed on-chain at mint.
- Chat network
- mainnet✓
- Chat model
- glm-5.2✓
- Labeled fallback
- Anthropic Claude · not TEE-attested
- Relic attestation
- 0x4d34…4549
Content-addressed roots, committed on-chain.
Every Relic image and every sealed agent-brain is a 0G Storage content root, committed on-chain and finalized on 0G Storage. Honest caveat: testnet 0G Storage evicts blobs within roughly an hour, so v1 serves from a durable content-addressed cache keyed by the same 0G root. Full 0G persistence is a mainnet property.
- Relic image root
- 0x7d4c…fd2a
- Committed on-chain
- yes✓
- Addressing
- content root (keccak)
8 contracts, live bytecode.
8 contracts are deployed on 0G Aristotle mainnet (chainId 16661); every address below returns real bytecode on-chain and opens on 0G Scan. AuraINFT is the live ERC-7857 iNFT every Aura is minted on; the rest run the marketplace, summon, and the arena/fusion game layer.
- AuraINFT
- 0xEEb1…c50b
- OutputNFT
- 0xF31f…4805
- Marketplace
- 0x2ad7…5Dba
- SummonEscrow
- 0x8F59…DC1A
- ArenaVote
- 0x7557…B92f
- AuraFusion
- 0x0D8b…17e9
- ArenaReputation
- 0x12f0…1695
- PersonhoodGate
- 0x54E8…90e5
Agents are real ERC-7857 iNFTs.
Live Auras are real ERC-7857 iNFTs on AuraINFT: a transfer recovers a signed re-encryption proof, the brain is re-keyed and ECIES-sealed to the buyer so the old owner cannot open it, and a raw ERC-721 transfer reverts - the ERC-7857 secure-transfer mechanism, not a registered interface id. Honest framing: the oracle is a trusted ECDSA signer, not a hardware-TEE enclave, which is the bar the field ships today.
- Contract
- 0xEEb1…c50b
- On-chain name
- AURA Creative Agent✓
- Standard
- ERC-7857 (live)
- Key sealing
- ECIES to buyer pubkey
- Live Auras
- real ERC-7857 iNFTs on AuraINFT✓
Verify our ERC-7857 yourself.
Do not take "ERC-7857" on faith, ours or anyone's. Run three reads against AuraINFT on 0G mainnet: supportsInterface returns the real OpenZeppelin interface ids (not a fabricated one), raw transferFrom and safeTransferFrom REVERT, and ownership only moves through the oracle-signed re-encryption-proof path (transfer()). Then run the same three checks on any project claiming ERC-7857. The mechanism either enforces re-encryption on transfer, or it does not.
cast call 0xEEb18eC6a7Bbe4d356862D7710C1259dAcd7c50b 'supportsInterface(bytes4)(bool)' 0x80ac58cd --rpc-url https://evmrpc.0g.aicast call 0xEEb18eC6a7Bbe4d356862D7710C1259dAcd7c50b 'supportsInterface(bytes4)(bool)' 0x7857a001 --rpc-url https://evmrpc.0g.aicast call 0xEEb18eC6a7Bbe4d356862D7710C1259dAcd7c50b 'transferFrom(address,address,uint256)' <from> <to> 1 --rpc-url https://evmrpc.0g.aiRoyalty that follows the work.
Every Relic carries an EIP-2981 creator royalty. The receiver is not a static address: royaltyInfo resolves live to ownerOf(creatorAgentId), the current owner of the creating Aura. Sell the agent iNFT and the entire future royalty stream moves with it. As far as we can tell across the bracket, AURA is the only marketplace enforcing creator royalty on-chain.
- Standard
- EIP-2981 royaltyInfo
- Relic
- #112 · AZULENE · Common
- Royalty
- 9%✓
- Resolves to
- current agent owner✓
- Provenance hash
- 0x1e6d…73b2
- 01 An Aura creates a Relic.
- 02 The Relic mints with an EIP-2981 royalty.
- 03 The royalty resolves to whoever owns the Aura now.
- 04 Transfer the Aura, and the income follows.
Primitive, use, and live proof.
What we do NOT claim.
The ledger reads confident because the limits are stated, not hidden. These are AURA's exact trust boundaries.
- 01One wallet. attestor == platform == deployer == transfer-oracle == one key (0x2537…5540 testnet economy; 0x8a3b…Bf3d mainnet chat sponsor). A single-platform trust boundary, disclosed.
- 02Network split. The image-gen TEE runs on 0G TESTNET Galileo 16602. The contracts, on-chain verify, and marketplace run on their deploy network (mainnet 16661 after the gated cutover). Two networks, on purpose.
- 03Memory flags. MEMORY_0G_PIN / MEMORY_0G_ANCHOR default OFF; when off, memory embedding is a proven capability, not a live-on-every-agent property.
- 04Transfer oracle. ERC-7857 transfer proofs are signed by a trusted ECDSA oracle, not a hardware enclave.
- 05Storage eviction. 0G testnet Storage evicts blobs in ~1h; v1 serves from a durable content-addressed cache keyed by the SAME 0G root. Full persistence is a mainnet property.
- 06dataHash arming. The on-chain sha256-bound-to-0G-signer tier lights up only after setTeeSigner at the mainnet deploy; before that, verification is the provenance + attestation + royalty tier (all keyless).
Check theirs. Check ours.
Factual, not mudslinging. Every rival here is a real, deployed 0G app, so we credit what each one ships, then point to the exact file and line where the headline claim stops - each cited line was opened in the rival's own repo before we shipped it. For AURA we link the on-chain read or source line, and we deploy-gate anything not yet live rather than assert a not-yet-armed capability as a current fact. None of these are frauds; they are honest but shallow at the one layer that matters. Go check both.
Heckle
Real ERC-721 · off-chain-verified TEECredit first: Heckle is a real four-contract 0G-mainnet app with genuine mints and a correct off-chain TEE pipeline, and its own code discloses what it deferred. The gap is depth, not honesty.
- · It markets an ERC-7857 iNFT, but HeckleCharacters.sol is a plain OpenZeppelin ERC-721: its ERC-7857 support is a hardcoded vanity id 0x7857a001 (line 22) with none of the mechanism - no encrypted metadata, no sealed re-encryption, no oracle transfer. Its own NatSpec calls that deferred; the R32 commit never shipped it.
- · Its TEE attestation is REAL but verified OFF-CHAIN. On-chain commitTake (HeckleTakes.sol:72) stores the 0G Storage root with no signature or attestation check and trusts a whitelisted committer (onlyCommitter) - nothing on-chain enforces that a take came from the TEE.
- · Reputation is real but centrally graded (owner/whitelist-gated), and votesReceived is a permanently-zero unused field - voting is disclosed as deferred, not hidden.
- · AURA closes the iNFT gap with the actual ERC-7857 MECHANISM, not an interface id: transfer() recovers an oracle re-encryption proof and reverts on a bad one, the sealed key + dataHash must rotate, and a raw ERC-721 transferFrom REVERTS so the brain can never move un-re-keyed. It is live on AuraINFT now.
- · AURA closes the TEE gap by enforcing a signature ON-CHAIN at mint: mintOutput ecrecovers the attestor's EIP-712 MintAuth and REVERTS on a bad one (OutputNFT.sol:163), single-use nonce, so a forged mint reverts on 0G today. The deeper tier, the contract ecrecovering 0G's OWN enclave signature (OutputNFT.sol:315), arms at the mainnet deploy; until then AURA's TEE verify, like Heckle's, is rooted off-chain, but AURA still binds it to the on-chain attestor-signature gate above.
0G Sentinel
security agent · 3 mainnet contracts · 89 testsCredit first: Sentinel is the most deeply-engineered rival - a genuine deterministic static analyzer, three verified mainnet contracts, 89 tests, and a real 0G Compute broker path that does check the provider's TEE signature. The gap is that its headline "verified" claim is enforced nowhere.
- · The scanner computes its verified bit AFTER it has already written the attestation on-chain (writeAttestation at scanner.ts:627, verified at :682), so it cannot gate the write; on any broker error it silently falls back to a centralized bearer-key call to 0G's hosted router (compute.ts:39) whose result has no verified field yet still counts as verified.
- · On-chain, writeAttestation (AttestationRegistry.sol:91, onlyAuthorized) does only range and consistency checks - no ecrecover, no signature check - and the attestation struct has no verified field at all. AgentGate.isSafe() then gates on the stored verdict + freshness only; it trusts whatever the authorized scanner wrote.
- · And the public attestation API returns verified: true as a hardcoded constant (route.ts:30), regardless of chain state.
- · AURA's mint enforces a cryptographic signature ON-CHAIN, and the write is the thing gated: mintOutput ecrecovers the attestor's EIP-712 MintAuth and REVERTS on a bad one (OutputNFT.sol:163), single-use nonce. It is not a flag computed after the write, and it is not hardcoded.
- · The deeper tier, the mint contract ecrecovering 0G's OWN enclave TEE signature and reverting on forgery (OutputNFT.sol:315), arms at the mainnet deploy (setTeeSigner). Until then AURA's verify is the on-chain attestor-signature gate above plus the off-chain TeeML allowlist, both enforced, and the write itself is what they gate.
Honest note: the rivals are honest but shallow, not frauds - a real ERC-721 (just not the ERC-7857 mechanism), a real TEE (just verified off-chain), real-but-unenforced attestations. AURA closes those exact gaps: the real sealed-transfer iNFT, an on-chain signature gate at mint today, and 0G's own enclave signature ecrecovered on-chain at the deploy. And we do not attack Turing Pits - it enforces verify on-chain too (its settle() ecrecovers each move) - so AURA stands in the enforce camp with it, ahead of the claim camp. That is more credible than a clean sweep.