Architecture
Signatures and relaying
Clients and suppliers sign; the relayer submits and pays gas.
What each person signs (EIP-712)
| Signer | Message | Binds |
|---|---|---|
| Client | Fund + USDG permit | Package id, config hash (every slot's payee, amounts and terms), amount, auto-confirm, nonce, deadline |
| Supplier | Accept | Package id, slot, slot hash (payee, amounts, terms hash, version), package revision, nonce, deadline |
| Supplier | Decline | Package id, slot, nonce, deadline |
| Client | ClientAction | Confirm, Release or Cancel for one package, nonce, deadline |
Why the permit alone isn't enough
A USDG permit only grants an allowance. The funding instruction is what ties the money to one package and one configuration, so a relayer can't point a client's permit at another package.
Agency transactions
Creating and changing a package are sent from the agency's own embedded wallet, so the agency pays a small test-ETH fee. Setlo tops it up when needed.