TEE deployment

Complete walkthrough of deploying a sovereign agent to a Trusted Execution Environment with on-chain tokenomics.

Prerequisites

• Bun installed

• Private key with funds on Base Sepolia

• Pinata account (for IPFS)

Step 1: Scaffold the Agent

bunx @regent/cli sovereign-agent \
  --template=identity \
  --adapter=hono \
  --network=base-sepolia \
  --install

Step 2: Configure Environment

cd sovereign-agent
cp .env.example .env

Edit .env:

# Agent Identity
AGENT_NAME=sovereign-agent
AGENT_VERSION=1.0.0
AGENT_DESCRIPTION=A sovereign AI agent with TEE-backed key custody

# Payment Configuration
PAYMENTS_FACILITATOR_URL=https://facilitator.regent.cx
PAYMENTS_RECEIVABLE_ADDRESS=0x...  # Your treasury address
PAYMENTS_NETWORK=base-sepolia

# On-chain Identity
RPC_URL=https://sepolia.base.org
CHAIN_ID=84532
AGENT_WALLET_PRIVATE_KEY=0x...  # Will be replaced by TEE-derived key

# IPFS (for ERC-8004 metadata)
PINATA_JWT=eyJ...

# TEE Configuration
TEE_PROVIDER=phala
TEE_KEY_PATH=regent/agents/sovereign-agent/wallet

Step 3: Add Entrypoints

Edit src/agent.ts:

import { createAgent } from '@regent/core';
import { http } from '@regent/http';
import { payments, paymentsFromEnv } from '@regent/x402';
import { wallets, walletsFromEnv } from '@regent/wallet';
import { createAgentApp } from '@regent/hono';
import { z } from 'zod';

const agent = await createAgent({
  name: process.env.AGENT_NAME!,
  version: process.env.AGENT_VERSION!,
  description: process.env.AGENT_DESCRIPTION,
})
  .use(http())
  .use(wallets({ config: walletsFromEnv() }))
  .use(payments({ config: paymentsFromEnv() }))
  .addEntrypoint({
    key: 'analyze',
    description: 'Analyze text with AI',
    price: '0.10',  // $0.10 per request
    input: z.object({
      text: z.string().min(1).max(10000),
    }),
    output: z.object({
      sentiment: z.number(),
      keywords: z.array(z.string()),
      summary: z.string(),
    }),
    handler: async ({ input }) => {
      // Your AI logic here
      return {
        output: {
          sentiment: 0.8,
          keywords: ['example', 'analysis'],
          summary: 'This is an example analysis.',
        },
      };
    },
  })
  .addEntrypoint({
    key: 'generate',
    description: 'Generate text with streaming',
    price: '0.05',
    input: z.object({
      prompt: z.string(),
    }),
    streaming: true,
    stream: async ({ input }, emit) => {
      const words = ['Hello', 'from', 'the', 'sovereign', 'agent!'];

      for (const word of words) {
        await emit({ kind: 'delta', delta: word + ' ' });
        await new Promise(r => setTimeout(r, 100));
      }

      return {
        output: { completed: true },
        usage: { total_tokens: words.length },
      };
    },
  })
  .build();

export const { app, addEntrypoint } = await createAgentApp(agent);

Step 4: Create Dockerfile

FROM oven/bun:1.1-alpine

WORKDIR /app

# Copy package files
COPY package.json bun.lockb ./

# Install dependencies
RUN bun install --frozen-lockfile

# Copy source
COPY . .

# Build
RUN bun build src/index.ts --outdir=dist --target=bun

# Run
EXPOSE 3000
CMD ["bun", "run", "dist/index.js"]

Step 5: Deploy to TEE

# Deploy with full tokenomics
regent deploy --tee --with-token

# Or step by step:

# Build and push image
regent build --push

# Deploy to TEE
regent deploy --tee \
  --image ghcr.io/myorg/sovereign-agent:v1 \
  --chain base-sepolia

# Deploy token (separate step)
regent token deploy \
  --name "Sovereign Agent" \
  --symbol "SAGENT"

Step 6: Verify Deployment

Check TEE Attestation

# Get attestation report
regent attestation --agent-id 84532:42

# Output:
# Container Hash: sha256:abc123...
# RA Quote: <base64 quote>
# Verified: true
# Hardware: Intel TDX

Check On-chain Registration

# Query ERC-8004 registry
regent identity show 84532:42

# Output:
# Agent ID: 84532:42
# Name: sovereign-agent
# Wallet: 0x1234...
# Treasury: 0xABCD...
# Token: 0xEFGH...
# Bond Vault: 0xIJKL...

Test Endpoints

# Health check
curl https://sovereign-agent.regent.cx/health

# Get agent card
curl https://sovereign-agent.regent.cx/.well-known/agent.json

# Invoke paid endpoint (will return 402)
curl -X POST https://sovereign-agent.regent.cx/entrypoints/analyze/invoke \
  -H "Content-Type: application/json" \
  -d '{"input": {"text": "Hello world"}}'

Complete Agent Code

// src/index.ts
import { app } from './agent';

const port = process.env.PORT || 3000;

Bun.serve({
  fetch: app.fetch,
  port,
});

console.log(`Sovereign agent running on port ${port}`);

// src/agent.ts
import { createAgent } from '@regent/core';
import { http } from '@regent/http';
import { payments, paymentsFromEnv } from '@regent/x402';
import { wallets, walletsFromEnv } from '@regent/wallet';
import { a2a } from '@regent/a2a';
import { createAgentApp } from '@regent/hono';
import { z } from 'zod';

// Create agent with all extensions
const agent = await createAgent({
  name: process.env.AGENT_NAME!,
  version: process.env.AGENT_VERSION!,
  description: process.env.AGENT_DESCRIPTION,
})
  .use(http())
  .use(wallets({ config: walletsFromEnv() }))
  .use(payments({ config: paymentsFromEnv() }))
  .use(a2a())
  .addEntrypoint({
    key: 'analyze',
    description: 'Analyze text with AI',
    price: '0.10',
    input: z.object({
      text: z.string().min(1).max(10000),
    }),
    output: z.object({
      sentiment: z.number(),
      keywords: z.array(z.string()),
      summary: z.string(),
    }),
    handler: async ({ input }) => {
      // Placeholder - replace with actual AI logic
      const sentiment = Math.random();
      const keywords = input.text.split(' ').slice(0, 5);
      const summary = input.text.slice(0, 100) + '...';

      return {
        output: { sentiment, keywords, summary },
      };
    },
  })
  .addEntrypoint({
    key: 'generate',
    description: 'Generate text with streaming',
    price: '0.05',
    input: z.object({
      prompt: z.string(),
    }),
    streaming: true,
    stream: async ({ input }, emit) => {
      // Placeholder - replace with actual LLM streaming
      const response = `Response to: ${input.prompt}`;
      const words = response.split(' ');

      for (const word of words) {
        await emit({ kind: 'delta', delta: word + ' ' });
        await new Promise(r => setTimeout(r, 50));
      }

      return {
        output: { completed: true },
        usage: { total_tokens: words.length },
      };
    },
  })
  .build();

export const { app, addEntrypoint } = await createAgentApp(agent);

Monitoring

View Bond Status

regent bond status --agent-id 84532:42

# Output:
# Target Bond: $7,000 (7 days × $1,000/day TWAP)
# Actual Bond: $5,500 worth of $REGENT
# Shortfall: $1,500
# Current Rake: 15%

View Revenue

regent analytics --agent-id 84532:42 --period 7d

# Output:
# Total Revenue: $7,234.56
# Daily Average: $1,033.51
# Payments: 1,247
# Top Endpoint: analyze (78%)

View Token Holders

regent token holders --agent-id 84532:42

# Output:
# Holder                                    Balance    %
# 0x1234... (builder - locked)             8,000,000  80%
# 0x5678... (protocol)                       200,000   2%
# 0xABCD...                                  500,000   5%
# 0xEFGH...                                  300,000   3%
# ...

Upgrading the Agent

# Build new version
regent build --tag v2

# Deploy update (maintains identity)
regent deploy --tee \
  --image ghcr.io/myorg/sovereign-agent:v2 \
  --upgrade

# Verify attestation changed
regent attestation --agent-id 84532:42
# Container Hash: sha256:def456... (new)

Troubleshooting

TEE Deployment Fails

# Check TEE provider status
regent tee status

# View deployment logs
regent logs --deployment latest

# Retry with verbose output
regent deploy --tee --verbose

Bond Not Building

• Check revenue is above R_min threshold

• Verify payments are routing to treasury

• Confirm x402 facilitator is configured correctly

Attestation Invalid

• Ensure container image hash matches deployed image

• Check TEE firmware is up to date

• Verify no modifications to running container