AttestationClient: verify TEE agent runs on-chain

Reference for the @agentbank/sdk AttestationClient — verifyRun, isVerified, computeRunId, and getAttestedRuns for verifying TEE-attested agent runs on-chain.

AttestationClient wraps the TEEAttestationVerifier contract. Access it via client.attestation. Use it to verify that an AgentBank agent ran specific code in a hardware-secured Trusted Execution Environment (Phala Cloud or Marlin Oyster).

TEEKind enum

import { TEEKind } from "@agentbank/sdk";

TEEKind.Phala  // 0 — Phala Cloud (Intel SGX)
TEEKind.Marlin // 1 — Marlin Oyster

Methods

verifyRun

Submit a hardware attestation proof for an agent run.

const txHash = await client.attestation.verifyRun({
  kind: TEEKind.Phala,
  promptHash: "0x...",    // keccak256 of the prompt
  outputHash: "0x...",   // keccak256 of the output
  codeHash: "0x...",     // keccak256 of the agent code
  signature: "0x...",    // SGX quote signature from the TEE
});

Parameters (VerifyRunParams):

Field	Type	Description
kind	TEEKind	Phala or Marlin
promptHash	Hex	keccak256 of the prompt
outputHash	Hex	keccak256 of the output
codeHash	Hex	keccak256 of the agent code
signature	Hex	Hardware attestation signature

Returns: Promise<Hash>

---

isVerified

Check if a specific run has been verified on-chain.

const runId = client.attestation.computeRunId(promptHash, outputHash, codeHash);
const verified = await client.attestation.isVerified(runId);

Returns: Promise<boolean>

---

computeRunId

Compute the runId that the contract uses, matching the on-chain derivation.

const runId = client.attestation.computeRunId(
  "0x...", // promptHash
  "0x...", // outputHash
  "0x..."  // codeHash
);

Returns: Hex

---

getAttestedRuns

Fetch multiple attested run records.

const runs = await client.attestation.getAttestedRuns([runId1, runId2]);
for (const run of runs) {
  console.log("Kind:", run.kind);
  console.log("Verified:", run.verified);
  console.log("Timestamp:", run.timestamp);
}

Returns: Promise<AttestedRun[]>

The AttestedRun type:

interface AttestedRun {
  kind: TEEKind;
  promptHash: Hex;
  outputHash: Hex;
  codeHash: Hex;
  attesterPubKey: Address;
  timestamp: bigint;
  verified: boolean;
}