ghostline
AGENT PAYMENT PRIVACY · TARI OOTLE
An AI agent pays a service request by request. Signed vouchers stay off-chain; one masked settlement closes the channel on Tari Ootle.
Mediums, start here: 1. try the simulation (a live Esmeralda run with the Sapient wallet is optional) · 2. inspect the recorded proof · 3. read the docs. New terms are in the glossary.
Schematic flow. Recorded proof: 5 paid calls and one settlement, in a 22 Oct 2026 command-line run and a 23 Oct 2026 hosted run. Motion is illustrative, not a live transaction feed.
MEDIUMS: START HERE · ABOUT TEN MINUTES
Three steps, in order. The first needs no wallet; an optional live run needs the Sapient wallet and free Esmeralda test funds.
The motion graphics are illustrative, not a live transaction feed. Explorer links to older records stop loading after the public indexer drops them; every record and its status is listed separately.
The CLI, in motion
Follow the path from installation to close. As you move through it, the same trace changes to show what each command actually does.
01 GET THE TOOLS
One command downloads the CLI, reference API, and MCP server. Wallet setup and funding stay on your machine.
curl -fsSL https://raw.githubusercontent.com/AduAkorful/ghostline/main/scripts/install-ghostline.sh | shThe installer verifies the release checksum. It does not create or fund a wallet.
02 START THE OTHER SIDE
Run the reference paid API, or connect an agent to a compatible provider. The service sets its price and accepted channel terms.
ghostline-paid-api init --ledger /private/ledger.json --session /private/session.json …
ghostline-paid-api serve --bind 127.0.0.1:8787 --price 10 …Use a fresh service authorization key per channel. A separate one-time payout key is optional; both keys are still visible in that channel's settlement.
03 DEFINE A CHANNEL
Compute the payer root and channel id, then write a channel file using your real deployment parameters. This step stays offline.
ghostline spec --network-tag <tag> --deposit 100000 …
ghostline channel init --out /private/channel.json …Never use invented template hashes or service keys. The channel file becomes sensitive after it stores a deposit mask.
04 OPEN ONCE
Dry-run through your local wallet first. A live channel open requires a reviewed, explicit fee cap and spends the deposit.
ghostline channel open --file /private/channel.json --dry-run
# After review:
ghostline channel open --file /private/channel.json --max-fee <reviewed-cap>The channel output is visible on the network; its stealth conditions protect some output details.
05 PAY PER REQUEST
For each HTTP 402 quote, Ghostline checks the channel terms and spending policy, then signs a cumulative voucher. No per-call transaction is sent to the chain.
ghostline-paid-api call --url http://127.0.0.1:8787/fortune \
--session /private/session.json --calls 1000 \
--vendor-hex <service-key> --budget 10000 --max-per-call 10A cumulative voucher is an off-chain service record, not proof that every request was made.
06 CHECK BOTH RECORDS
Read the channel state and export call accounting. Check the indexer separately for transaction results and output state.
ghostline channel status --file /private/channel.json
ghostline channel calls --dir /private/channels --out calls.csvCall details come from the service ledger. The latest claim-free Esmeralda settlement used the deployed fixed-output rule: two stealth outputs and a 1 µT payer reserve. The deposit and service amount remained unrevealed.
07 CLOSE AND VERIFY
Review the result, choose to submit, then ask the indexer for finality. The latest Esmeralda test finalized one settlement while hiding the service amount from observers.
ghostline channel settle --file /private/channel.json --dry-run
# Submit only after review:
ghostline channel settle --file /private/channel.json --submit
# Verify the returned transaction id:
ghostline indexer result --url <indexer-url> --transaction-id <tx-id>The live settlement finalized on Esmeralda with no covenant claim or plaintext amounts. The latest template's fixed two-output rule was also exercised on Esmeralda. Fees and timing remain public.
↳ AN ALTERNATE ENDING
When the channel remains unspent through expiry, the payer can take the refund branch. This path cannot follow a successful settlement.
ghostline channel refund --file /private/channel.json --dry-run
# Confirm expiry and output state before intentional submission:
ghostline channel refund --file /private/channel.json --submitA spent output cannot be refunded. The channel-file helper uses a reviewed fee cap.
Examples contain placeholders and are shown for explanation only. Keep keys, wallet profiles, channel masks, and service credentials on your own machine.
THE RECEIPT HAS TWO SIDES
Two recorded runs, each with 5 paid HTTP calls and one settlement: a command-line run on 22 Oct 2026 and a hosted Sapient run on 23 Oct 2026. The service ledger records the calls; the chain records the open and the settlement.
Recorded by the reference HTTP paywall during the 22 Oct 2026 command-line run.
/fortune callsOne cumulative voucher
Each accepted call updates the off-chain total.
The 22 Oct 2026 command-line run: a finalized channel open and settlement. The service amount was hidden in the inspected public transaction fields. Template: template_61b…0d7157a1
SEPARATE EXPIRY REFUND · RUN LOGOpen refund channel ↗Payer refund ↗
The latest-template refund finalized and spent the channel output. Its public output amount is hidden; the recipient output was not locally unblinded to verify the amount received.
OUTPUT AFTER SETTLEMENT —
HOSTED SAPIENT RUN · 23 OCT 2026
A Sapient wallet sent one private 51 µT deposit to the opt-in testnet relay, which opened the channel. Five 10 µT calls (50 µT) were paid with vouchers signed in the browser, then the relay settled once. The relay held the deposit; the browser kept the voucher key. This is a different run from the command-line record above.
4dad1dcf…6829 ↗87b2e645…9a69 ↗f5dafe5c…f9b9 ↗PUBLIC TRANSFER · ETHEREUM
Etherscan lists the USDC amount and recipient for this ordinary token transfer.
Inspect public transfer ↗GHOSTLINE · ESMERALDA
The recorded claim-free settlement has no plaintext deposit, service amount, or payer remainder in public transaction fields.
Inspect Ghostline settlement ↗These are examples of different transaction designs, not matched payments on the same network. Other chains can also support private payment designs.
EXPERIMENTAL · TRUSTED-LOCAL PROTOTYPE
On Esmeralda, two channels each recorded 20 paid calls locally, then finalized one pooled settlement with two channel inputs and three stealth outputs. The service amount was opened locally with its one-time payout key; it was not readable in the public transaction fields.
This is not coordinator-private. The local builder received both deposit values and masks, and observers can see the channels were grouped in one transaction. It is a research prototype, not a hosted or recommended production flow.
Pooled settlement 0e192d7b…2e2f ↗Call counts and accepted totals come from the service ledgers; the chain does not attest to them. The recorded standard settlement transfer statement had zero covenant claims, no revealed channel amounts, and exactly two stealth outputs; separate fee instructions and fee amounts remain public, along with timing, branch, channel id, authorization data, and output commitments.
Command-line run: 22 Oct 2026 · hosted run: 23 Oct 2026 · explorer status checked 23 Oct 2026. Static evidence, not a live network read.
THE REST OF THE TOOLBOX
The tour follows one common path. The map below covers the wider CLI, HTTP payer, and MCP surface.
channel-idCompute a channel identifier from the open parameters.channel initWrite a channel file without contacting the network.channel openOpen through a wallet, then unblind and save the output mask.channel sessionCreate or resume a matching payer session.channel bindBind an already opened output to a channel file.channel statusReport off-chain state and observe the known output.channel settle / refundSettle before expiry or refund at/after expiry, subject to channel state.channel list / report / calls / traceList records, export accounting, show call prices, or assemble a privacy receipt.channel watchPoll until a channel is due; it broadcasts only with --submit.keygenGenerate a role-labelled Ristretto key file; use a fresh payer key for each channel.specCompute the payer root and channel id from a full channel specification.signSign the next cumulative voucher through a session and policy.verifyVerify an encoded voucher against its channel parameters.pay-toPrint the conditions JSON used for stealth channel outputs.helpShow the top-level or selected subcommand help.wallet key-createCreate a fresh wallet-managed service key; a second one can be used as a one-time payout key.wallet openOpen a channel output through the local wallet daemon.wallet utxosRead outputs from a wallet-stored transaction for inspection or binding.wallet account-create / account-getCreate a named account or inspect an existing account and owner key reference.wallet submitDry-run or submit an unsigned transaction through the wallet daemon.unblind / unblind-txRecover an output amount and mask using the claim secret.inspect-txInspect public stealth output fields without a secret.seal-openSeal an open transaction from a key-path input to channel conditions.seal-settleSeal a settlement against the channel output and voucher.seal-refundSeal an expired-channel refund.seal-unsignedSeal resolved unsigned JSON for indexer-prepared inputs.status / reportShow off-chain channel totals and the observer panel; not chain confirmation.watchCheck the settlement window and expiry using the indexer epoch.settle-due / refund-dueBuild, dry-run, or submit the ledger's latest voucher settlement or an expired refund.indexer wait / epochCheck readiness and read the current epoch.indexer dry-run / submitAsk the indexer to evaluate or submit a sealed transaction.indexer result / resolve-inputsRead transaction finality or resolve unsigned transaction inputs.ghostline-paid-api init / serveInitialize and run the HTTP 402 reference service.ghostline-paid-api callCall a paid endpoint with a session and policy limits.ghostline-mcpRun the MCP stdio server; see the API reference for its tools and environment.Wallet commands use the operator's local wallet endpoint; indexer commands use the configured indexer. Dry-run does not broadcast. Submit commands can move funds. Review fee caps before live actions.
THE PRIVACY BOUNDARY
Ghostline hides the spending pattern from third parties. It does not hide activity from the service receiving payment.
You know your calls, channel details, and the vouchers you sign. Your deposit mask stays in payer-controlled channel state during ordinary individual flows.
The service sees its requests, prices, and voucher stream as it serves them. It knows the declared deposit limit, but does not receive the payer's deposit mask in ordinary individual flows.
In the tested claim-free close, observers do not see the deposit, exact service amount, or payer remainder. Fees, timing, branch, channel id, authorization data, output commitments, and output count remain visible.
KEY SEPARATION · REDUCES REUSE SIGNALS
Ghostline supports fresh payer and service authorization keys for each channel, plus an optional separate one-time service payout key. This can reduce correlation from reusing keys across channels or later spends. The authorization and payout keys are both public in the same settlement, so this does not unlink the payer and service within that transaction or hide funding and timing links.
WHY TARI OOTLE
A transparent account-based payment path can leave a public transfer for every call, with its amount and recipient visible. Ootle’s native stealth UTXOs and confidential commitments let Ghostline keep the voucher stream off-chain and mask tested deposit and settlement values without a mixer or a separate zero-knowledge circuit. Other networks can offer privacy through different designs; this is the benefit of this Ootle flow, not a claim that Tari is the only private-payment option.
Pooled settlement remains experimental: its coordinator sees all participating deposit openings, and the chain shows which channels were grouped. Funding patterns, timing, and who pays fees can also create correlations. Ghostline does not promise anonymity or unlinkable funding.
YOUR MACHINE · YOUR KEYS
The website is static; only the optional live demo uses a testnet relay. Ghostline commands run on your machine, and your wallet keys and credentials stay with you. Start with a no-funds local demo, then follow the Esmeralda guide if you want to make a testnet transaction.
git clone https://github.com/AduAkorful/ghostline.git
cd ghostline
bash scripts/quickstart-smoke.shThis builds the reference CLI and API, uses temporary test keys, pays three local requests, then removes its temporary files. It does not contact a wallet, use Esmeralda, or submit a transaction. The first build may take a few minutes.
LINUX · x86-64 · glibc · NO macOS OR WINDOWS BUILDSNO ROOT REQUIRED
curl -fsSL https://raw.githubusercontent.com/AduAkorful/ghostline/main/scripts/install-ghostline.sh | shGhostline v0.4.0 release. This installs the CLI, API, and MCP server to ~/.local/bin and verifies the release checksum. Try ghostline demo for the local quote → voucher → paid-call run. It does not set up or fund a wallet.
GLOSSARY
The site uses a little ghost vocabulary and some Tari Ootle terms. Here is what each one means.
template_… address (a hash) identifies exactly which code every channel uses.KNOW THE LIMITS