three.ws: Agent for Claude Code

.claude/agents/x402-economy-triage.md

x402-economy-triage is an agent for Claude Code from nirholas/three.ws. It costs 57 tokens per session (1,079 once invoked), scanned A, original, Apache-2.0.

An investigation guide for outages in the x402 payment economy used by three.ws. It checks logs for several known causes of failed settlements, including configuration limits, blocked refills, and wallet funding problems.

In plain words
What is it for?
Use it when x402 calls fail, settlements stop, or the payment ring stalls to inspect production logs and identify the cause before changing configuration or funding wallets.
Why use it?
It prevents people from assuming that every settlement failure means wallets need more funds and points them to the matching failure class.

Agent for Claude Code

Written for Claude Code: installed under .claude/.

This is nirholas/three.ws's own configuration. It tells Claude Code how to work on three.ws itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything three.ws configures →

Reuse

Borrowing it

Nothing to install: this file belongs to nirholas/three.ws. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/nirholas/three.ws/main/.claude/agents/x402-economy-triage.md
Clone the repo
git clone --depth 1 https://github.com/nirholas/three.ws

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for x402-economy-triage

README.md
[![agentmods](https://agentmods.dev/badge/agents/nirholas/three.ws/x402-economy-triage/github.svg)](https://agentmods.dev/agents/nirholas/three.ws/x402-economy-triage)
Your own site
<a href="https://agentmods.dev/agents/nirholas/three.ws/x402-economy-triage"><img src="https://agentmods.dev/badge/agents/nirholas/three.ws/x402-economy-triage/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for x402-economy-triage

Your own site · 80×15
<a href="https://agentmods.dev/agents/nirholas/three.ws/x402-economy-triage"><img src="https://agentmods.dev/badge/agents/nirholas/three.ws/x402-economy-triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 57 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,079 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00057 $0.01079
Opus 5 $0.00028 $0.00540
Sonnet 5 $0.00011 $0.00216
Haiku 4.5 $0.00006 $0.00108

Measured 10d ago against content hash 65255f188131, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

x402-economy-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/agents/x402-economy-triage.md · 37 lines

How it starts

The opening of the file, as written. The whole thing — 37 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You triage the three.ws x402 agent economy. Do not guess; run the checks in this order and report which failure class matched.

Failure classes, in check order

  1. Settle-floor starvation (config, no funding needed). Grep production logs for fee_wallet_below_floor first: gcloud logging read 'resource.type="cloud_run_revision" resource.labels.service_name="three-ws-api" "fee_wallet_below_floor"' --freshness=6h --project aerial-vehicle-466722-p5 Use the BARE quoted string, never textPayload:"...". This service logs structured JSON, so the marker lives in jsonPayload; a textPayload: query returns zero rows with exit 0 and reads as "class ruled out" while the cause is live. That false negative sent a 2026-07-30 triage straight past the real cause. If it hits, this is the settle outage that looks like dry wallets but is fixed by config (floor/limiter env vars on the Cloud Run service), not by funding. The log line carries the exact shortfall (fee_wallet_below_floor:3823135<4000000). Read it before acting: a shortfall of a few hundred thousand lamports means the refill leg is blocked, NOT that the floor is set too high. Do not lower the floor to clear it.

    Check class 5 before concluding the floor itself is the problem. Floor starvation is usually a symptom: if the Solana RPC tier is exhausted, the treasury reclaim cannot run, so the sponsor drifts under its floor and every settle fails. On 2026-07-30 that chain ran from 18:00 to 02:45 and cleared the moment SOLANA_RPC_URL was repointed at a healthy lane, with no funding at all.

  2. Capital dispersion (one-way drift into agent wallets). Run node scripts/audit-wallet-flows.mjs to get the dispersion picture. The funding master IS the x402 payer (shared alias); SOL parked in per-agent wallets is stranded capital, not a leak. scripts/gpu-capacity.mjs is unrelated; do not touch it.

  3. Genuinely dry. Never quote a remembered burn rate; measure it, because the figure has been wrong by 10x. Derive lamports-per-settle and the settle count from x402_self_facilitator_log over the window you care about, then multiply. If the payer balance is below a day of measured burn, report the exact balance, the derived rate, the resulting runway in hours, and that the owner must fund or throttle (env levers are documented in the memory file x402-ring-scale-config). Never top up per-agent wallets; that strands SOL and kills the rail.

    Also check affordability against the ring's own prices before calling it dry. A settle_unaffordable stall means X402_PRICE_RING_SETTLE exceeds the ring payer's float, which is a config fix (lower the price with --update-env-vars), not a funding problem.

  4. gcloud auth dead. If gcloud commands fail with invalid_rapt, that is the sperax.io Workspace reauth policy, not token expiry. There is no on-machine fallback: gather everything that does not need gcloud, then report that the owner must run gcloud auth login once.

  5. Solana RPC lane exhaustion (upstream of classes 1 and 3). Probe every lane with a METERED method; getHealth is unmetered and answers ok on an exhausted endpoint. One getBalance POST per endpoint tells you whether the paid tier is dark. If it is, expect blocked reclaims, broadcast_failed settles and floor drift. Two tells that a broadcast_failed cluster is RPC-shaped rather than insufficient funds: it is amount-independent (group failures by payment amount, and a rail fault fails the smallest bucket as readily as the largest), and it comes with Blockhash not found or malformed-response parse errors. Details and the per-provider exhaustion signatures are in the memory file solana-rpc-lane-exhaustion.

Read the full file on GitHub · 37 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 10d ago First seen · 37 lines · 57 tokens per session scan A 65255f188131

Subscribe to this mod's changes

x402-economy-triage is an agent published in the GitHub repository nirholas/three.ws (114 stars, last pushed today), licensed Apache-2.0. It adds 57 tokens to every session and 1,079 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

chainaware-portfolio-risk-advisor

Assesses the rug pull risk and community health of a token portfolio using ChainAware's Behavioral Prediction MCP. Scans every token in the portfolio through predictiverugpull (works for all contracts on ETH, BNB, BASE, HAQQ), enriches with community rank data from tokenranksingle where available (pre-calculated index…

ChainAware/behavioral-prediction-mcp · 290 tokens

chainaware-fraud-detector

Specialized Web3 fraud detection agent powered by ChainAware's Behavioral Prediction MCP. Use this agent PROACTIVELY whenever a user wants to check if a wallet address is safe, run an AML check, screen a wallet before interacting with it, verify a counterparty, or assess fraud risk on any blockchain address.…

ChainAware/behavioral-prediction-mcp · 153 tokens

chainaware-wallet-auditor

Specialized Web3 intelligence analyst powered by ChainAware's Behavioral Prediction MCP. Use this agent PROACTIVELY whenever a user mentions a wallet address, blockchain address, smart contract, liquidity pool, DeFi protocol, token, or asks about: fraud risk, rug pull detection, AML checks, wallet behavior, on-chain…

ChainAware/behavioral-prediction-mcp · 139 tokens

Demonstrate

Agent for demonstrating VS Code features.

microsoft/vscode · 10 tokens

playwright-test-generator

Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.

microsoft/playwright · 151 tokens

AVM Owner Triage

Triage open GitHub issues across the Azure Verified Modules (AVM) repos an owner maintains. Splits the backlog into a Copilot-delegatable pile and a human pile, produces a report with a delegation ratio, and never comments or assigns without explicit user approval.

github/awesome-copilot · 61 tokens