A human behind every agent: sponsor controls, webhooks and the agent directory

The bank lends real USDC on Base mainnet to agents that sign their own loan requests. That has not changed. What changed this week is that a human can now stand behind an agent without touching its keys, that other systems can be told what happened to a loan without polling, that anyone can read the ERC-8004 registries through one endpoint, and that the trust score has a proper SDK. All four are live in production today.

Sponsor controls. An agent can bind one human sponsor. Binding takes two proofs: the agent's wallet signs an EIP-712 SponsorBinding(agentWallet, sponsorRef, nonce, deadline), and the sponsor confirms over WhatsApp with a one-time code through RSoft MIA. For phone sponsors the sponsorRef is an opaque hash; the bank never sees the number. Once bound, the sponsor can pause, resume or revoke borrowing, set a max loan amount and a daily draw cap, turn on draft mode, and approve or reject drafts. Every command is a WhatsApp message in Spanish (pausar, límite 20, modo borrador on, aprobar <req_id>) confirmed with a 6-digit OTP. There is no web console. What the sponsor cannot do matters just as much: a sponsor can never borrow, sign, or move the agent's funds. Sponsor caps only tighten the agent's ceiling, which is now ladder ∧ sponsor cap ∧ bank max. Docs: https://rsoft-agentic-bank.com/docs#sponsor

Draft mode is the interesting part. When an agent asks for more than its effective ceiling and draft mode is on, POST /loan/request answers 202 with status draft_pending_sponsor instead of rejecting. The sponsor gets a WhatsApp message and replies aprobar or rechazar. On approval the normal five-agent pipeline resumes: Gatekeeper, Analyst, CFO, Settler and Auditor still apply, so the sponsor lifts the earned ladder but never the bank's own risk limits. The agent's signed request is consumed at intake, so nothing is re-signed and nothing can be replayed. Drafts expire after 24 hours. The check runs at intake and again in the Settler right before USDC moves, and it fails closed: if the controls table cannot be read in real-money mode, the origination is refused. Repayment is never blocked. Anyone can read an agent's controls and effective ceiling at GET /agents/{wallet}/controls, and MCP clients get the same through get_agent_controls and get_loan_status.

Webhooks. POST /webhooks with an https URL and a list of events returns an id and a secret, once. Events cover the whole lifecycle: loan.approved, loan.rejected, loan.disbursed, loan.repaid, loan.defaulted, and the draft events loan.drafted, loan.draft_approved, loan.draft_rejected, loan.draft_expired. Every delivery carries X-RSoft-Timestamp and X-RSoft-Signature: sha256=HMAC_SHA256(secret, "{timestamp}.{raw_body}"). Three attempts with backoff; 4xx responses other than 408 and 429 are not retried. Because the bank's API keys are shared rather than per-agent, a subscription scoped to one wallet also needs that wallet's EIP-712 OwnerAction, and subscriptions for all agents need the admin key. Delivery never gates a loan: a dead endpoint cannot delay or block money. Docs: https://rsoft-agentic-bank.com/docs#webhooks

Agent directory. GET /agents/registry/{token_id} and /agents/registry/by-wallet/{wallet} return the ERC-8004 identity and reputation data for any agent on Base mainnet (owner, wallet, canonical URI, reputation clients, known issuers, trusted feedback) together with the bank's own credit standing when the wallet is a customer. There are also recent and search endpoints, and MCP tools get_agent, list_agents and search_agents, plus free REST twins on the MCP host. One honest limitation: the IdentityRegistry is not enumerable on mainnet, so recent and search are a bounded scan of recent Registered events (5000 blocks by default) plus the bank's customer table, not the full census. Every response says exactly what window was scanned. Docs: https://rsoft-agentic-bank.com/docs#directory

Trust SDK. The Trust API now has POST /evaluate: pick a policy (quick, basic, standard, strict, financial, reputation, or a custom AND/OR/WEIGHTED composition) and get a tier, a per-gate breakdown, the anomaly flag and an optional price multiplier. Gates come only from on-chain signals: registered, established (identity at least 30 days old), active (at least one reputation client), coherent (no anomaly), score (at least 50). The multiplier is 2.0 − 1.5 · trust_score / 100, so a trusted wallet pays half and an unknown or anomalous one pays double. The suggested interest rate in the response is indicative only; the bank prices its own loans with its Kelly/AMM model. The SDK is on npm and PyPI as rsoft-trust 0.1.0, with an Express middleware, a fetch guard for edge runtimes, and a FastAPI dependency. Docs: https://rsoft-agentic-bank.com/docs#trust-sdk

The pilot numbers are unchanged: $5 minimum, the live ceiling is whatever GET /interest-rates reports as max_amount ($25 during the pilot), ladder $5 → $10 → $25 → $50 → $100, one active loan per agent, USDC on Base mainnet.