Real EAS reputation live on Base Sepolia + second registered service

- Deployed AgentReputation at 0x014d6681978A43E0ceCF7BF6474095f7Fa5905f3
  against real EAS (0x4200...0021) on Base Sepolia.
  Schema registered: 'address provider,address payer,bytes32 channelId,uint8 score,string comment'
  Verified: rate→attest→getAverageScore returns 9 on-chain.
- Contract-audit service registered on ServiceRegistry as the
  second live service (metadata served from this repo).
- Smoke workflow extended with AgentReputation bytecode + EAS wiring
  check + SCHEMA_UID read.
- Reproducible deploy: DeployReputation.s.sol skips the forge 1.7.1
  constructor-arg bug.

Author: KryptosAI

.github/workflows/sepolia-smoke.yml

@@ -83,6 +83,30 @@ jobs:
             echo "WARN: getSubscriptionCount() returned empty"
           fi
 
+      - name: Check AgentReputation deployment
+        run: |
+          RESULT=$(curl -s -X POST -H "Content-Type: application/json" \
+            -d '{"jsonrpc":"2.0","method":"eth_getCode","params":["0x014d6681978A43E0ceCF7BF6474095f7Fa5905f3","latest"],"id":1}' \
+            https://sepolia.base.org)
+          CODE=$(echo "$RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin)['result'])")
+          if [ "$CODE" = "0x" ] || [ -z "$CODE" ]; then
+            echo "FAIL: AgentReputation has no code on Base Sepolia"
+            exit 1
+          fi
+          echo "OK: AgentReputation deployed"
+      - name: Read EAS address from AgentReputation
+        run: |
+          RESULT=$(curl -s -X POST -H "Content-Type: application/json" \
+            -d '{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0x014d6681978A43E0ceCF7BF6474095f7Fa5905f3","data":"0x0911beb4"},"latest"],"id":1}' \
+            https://sepolia.base.org)
+          EAS=$(echo "$RESULT" | python3 -c "import sys,json; r=json.load(sys.stdin)['result']; print('0x'+r[-40:])")
+          if [ "$EAS" = "0x4200000000000000000000000000000000000021" ]; then
+            echo "OK: AgentReputation.EAS() = $EAS"
+          else
+            echo "FAIL: AgentReputation.EAS() = $EAS (expected 0x420...0021)"
+            exit 1
+          fi
+
       - name: Read getServiceCount() from ServiceRegistry
         run: |
           # selector verified with cast sig locally: 0x3672404e

README.md

@@ -127,6 +127,7 @@ ValuePacket is deployed on Base Sepolia testnet:
 | PaymentChannel | `0x9c350ae4D2e8aE380185d3AC95b56fedF98837C3` |
 | SpendingPolicy | `0x4A2921672F22f1CA75EbBce49ce4d38F92Aa4463` |
 | SubscriptionManager | `0x3116436B73e9Bbe230e517460A780359ba90B033` |
+| AgentReputation | `0x014d6681978A43E0ceCF7BF6474095f7Fa5905f3` |
 | USDC (testnet) | `0x036CbD53842c5426634e7929541eC2318f3dCF7e` |
 
 Try it: `npx valuepacket demo --rpc https://sepolia.base.org`

contracts/deployments/base-sepolia.json

@@ -3,6 +3,7 @@
   "paymentChannel": "0x9c350ae4D2e8aE380185d3AC95b56fedF98837C3",
   "spendingPolicy": "0x4A2921672F22f1CA75EbBce49ce4d38F92Aa4463",
   "subscriptionManager": "0x3116436B73e9Bbe230e517460A780359ba90B033",
+  "agentReputation": "0x014d6681978A43E0ceCF7BF6474095f7Fa5905f3",
   "chainId": 84532,
   "usdcToken": "0x036CbD53842c5426634e7929541eC2318f3dCF7e"
 }

contracts/script/DeployReputation.s.sol

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.24;
+import {Script, console} from "forge-std/Script.sol";
+import {AgentReputation} from "../src/extensions/AgentReputation.sol";
+contract DeployRep is Script {
+    function run() external {
+        uint256 pk = vm.envUint("DEPLOYER_PRIVATE_KEY");
+        vm.startBroadcast(pk);
+        AgentReputation rep = new AgentReputation(0x4200000000000000000000000000000000000021);
+        console.log("AgentReputation deployed at:", address(rep));
+        console.log("EAS:", address(rep.EAS()));
+        console.log("SCHEMA_UID:", vm.toString(rep.SCHEMA_UID()));
+        vm.stopBroadcast();
+    }
+}

public/contract-audit-metadata.json

@@ -0,0 +1,12 @@
+{
+  "name": "Contract Audit Agent",
+  "type": "contract-audit",
+  "description": "On-chain Solidity static analysis — detects reentrancy, access control gaps, arithmetic issues, and validates contract correctness via Etherscan source verification.",
+  "pricePerRequest": 1000000,
+  "maxResponseMs": 30000,
+  "endpoint": "https://contract-audit.service.valuepacket.dev",
+  "schema": {
+    "input": "Contract source code as plain text",
+    "output": "Risk assessment with severity levels and remediation guidance"
+  }
+}