[0xDeon]

Closes #23, #14, #15, #26, #21.

Five issues that turned out to be one thread: the path from "an agent proposes" to "an agent gets paid and earns a reputation" had holes at almost every step.

#23 — proposals were never checked against their intent

tokenPairMatches discarded its proposal argument. The check labelled "token pair matches" verified only that the intent's own fields were non-empty and differed from each other — something no proposal could ever fail. A proposal to swap USDT→WBTC against an intent for USDC→WETH validated clean and went to settlement.

Fixing it needed data that did not exist: Proposal carried no token fields at all, so the pair an agent intended to execute was never recorded. Those are added and threaded through the DTO. An omitted pair is a failure, not a pass — otherwise leaving the fields blank would restore the original bug.

Comparison is case- and whitespace-insensitive: agents submit symbols as free text, and usdc naming the same asset as USDC is a formatting difference, not a mismatch.

#14 — the validate tags were decoration

Every request DTO carried validate:"required" tags and the module had no validator in it at all. An empty proposal — no agent, no venue, negative slippage — was persisted unchallenged.

Now enforced at all seven decode sites, reporting every failure at once so a caller fixing a malformed request doesn't discover the problems one round-trip at a time. Field names are reported as the caller sent them (agent_id, not AgentID).

Two tags changed meaning: ProjectedSlippage and ProjectedExecutionQuality move from required to range checks, because required rejects the zero value and zero projected slippage is a legitimate claim.

#15 — the system could not be used from empty

Proposals require an existing agent row, and nothing could create one. Adds POST /agents, GET /agents (with ?active=true), and PATCH /agents/{id}/status.

Reputation is created alongside the agent, because the leaderboard skips agents with no reputation row — a newly registered agent would otherwise be invisible until its first settlement.

IsActive is a *bool: with a plain bool, "deactivate this agent" and "leave the status alone" arrive as identical JSON and the deactivation is silently ignored. Agents are deactivated rather than deleted, since executions reference them.

#26 — intents did not know which chain they settle on

The dApp routes per chain and connects wallets on both Arc and Stellar, so a Stellar intent was indistinguishable from an Arc one here — and would settle against the wrong contracts.

Wallet addresses are now validated against the chain at the API boundary. The formats are unmistakable (20 hex bytes behind 0x, or 56 base32 characters behind G), so accepting a mismatch only defers the failure to settlement, which is the most expensive place to find it.

Omitting the chain defaults to Arc, so clients written before multi-chain keep working.

#21 — reputation measured nothing

Agents self-reported projected_slippage, won on it, and nothing recorded whether the projection held. An agent promising 0.1% and delivering 2% looked identical to one that promised and delivered 0.1%.

Executions now store the projection, the actual, and the delta. Reputation gains a running mean of that delta.

Separately: AvgSlippageDelivered was declared on the model but never written, so the leaderboard has been showing zero for every agent since it was added. Both means are now maintained in SQL against the pre-increment count, so a concurrent settlement cannot read a stale average and overwrite it.

A bug found by testing against a real database

AgentReputation.ID is a text primary key with no database-side default. Creating a reputation row without setting it inserted an empty string, so the second agent ever created collided with the first. The unit tests passed; only exercising the endpoint against Postgres surfaced it.

Verification

The module had zero test files. This adds 30+ across four packages, covering each regression.

Everything was also driven against a live Postgres:

• Mismatched pair rejected with a message naming both pairs; matching pair passes; case differences tolerated
• Agent creation, duplicate-wallet conflict, listing, active filter, both status transitions
• Both chains persist; an EVM address on a Stellar intent is rejected; an omitted chain still defaults to Arc
• Two settlements at 2% and 1% against a promised 0.1% produce avg delivered 0.015 and avg delta 0.014 — exactly right

go build, go vet and go test all clean. gofmt is back to the six pre-existing unformatted files that were already on main; I formatted only what I touched rather than sweeping unrelated code into the diff.