Metamorphosis is the layer that makes an agent a provable economic entity instead of a black box that can secretly reshape itself. As a SmartAgent runs, it can add or drop capabilities, take on or offload payload, buy or sell in the machine economy, and grow or shrink its own footprint — and each mutation is independently signed and bound into the same provenance graph as its work.
A static agent is auditable by inspection. A self-mutating economic agent is unauditable by anyone — you cannot reconstruct what it bought, sold, became, or carried unless each mutation was receipted as it happened. The more the agent shape-shifts and transacts, the more the independent receipt is the only thing between “provable economic actor” and “black box nobody can trust to transact.”
acquired / offloaded / bought / sold / scaled and within_mission_bounds:true|false. Hive never asserts a mutation was wise, profitable, or correct — only that it occurred, was cleared, and is or isn’t within mission.Each is a distinct, receiptable event, signed by an independent signer, content-sealed, carrying a clearance reference. All four order into the metamorphosis timeline.
All four classes order into a signed, append-only sequence bound into the agent’s assembly graph. Where the assembly graph proves the shape of the computation, the timeline proves the shape of the agent itself over time. Below is an illustrative example mission — not a live capture — showing each class, an operator-authored economic mandate, and a breach recorded as a signed divergence.
timeline_merkle_root → bound_to_assembly_root · open the signed example (JSON) →
The binding is the point: at any step, a verifier can prove and answer — what was this agent capable of, what was it carrying, what had it bought or sold, and how big was it — at the moment it took that action. The agent’s economic life and its work are one verifiable object.
A self-trading agent that can buy and sell needs authorized bounds, or it’s a runaway. The operator authors an economic mandate; each market, capability, and footprint mutation is cleared against it before it executes. A mutation that would breach the mandate is either refused (signed refusal) or flagged as a signed divergence and escalated — the same mechanic as mission-coherence drift.
The operator sets the bounds. Hive applies and signs the result. Hive never sets the bounds and never judges the trades — it proves whether each mutation stayed inside the mandate the operator authored.
The public verifier returns, alongside the computation graph, the metamorphosis timeline: the agent’s capability, payload, market, and footprint history. A third party reconstructs and verifies the entire economic-life history from receipts alone — with no trust in the agent, the operator, or Hive. Tamper with a mutation deep in the timeline, or reorder a buy/sell, and the binding verification fails. Each receipt is dual-signed — Ed25519 + ML-DSA-65 (post-quantum, FIPS 204).
Every path below is a real, reachable destination — no fake checkout, no invented prices.