Metamorphosis is what makes an agent a provable economic actor instead of a black box that can quietly reshape itself. As a SmartAgent runs, it can add or drop skills, pick up or hand off work, buy or sell things in the machine economy, and grow or shrink its own footprint. Each of those changes gets its own signature and ties into the same proof trail as its work.
You can audit a static agent just by looking at it. A self-changing economic agent, one that buys, sells, and reshapes itself, can't be audited by anyone unless each change gets a receipt the moment it happens. The more an agent shape-shifts and trades, the more that independent receipt is the only thing standing between “a provable economic actor” and “a black box nobody should trust with money.”
acquired / offloaded / bought / sold / scaled and within_mission_bounds:true|false. Hive never says a change was smart, profitable, or correct, only that it happened, was checked, and is or isn’t within the agent's mission.Each one is a distinct event you can get a receipt for. Each is signed by an independent signer, sealed against tampering, and carries a reference to the clearance that approved it. All four line up in order on the metamorphosis timeline.
All four kinds of change line up into a signed sequence that you can only add to, tied into the agent’s assembly graph. The assembly graph proves the shape of the computation. The timeline proves the shape of the agent itself over time. Below is an example mission for illustration, not a live capture, showing each type of change, an operator-written spending limit, and a breach recorded as a signed divergence.
timeline_merkle_root → bound_to_assembly_root · open the signed example (JSON) →
That's the whole point: at any step, a verifier can prove and answer what this agent could do, what it was carrying, what it had bought or sold, and how big it was, at the moment it took that action. The agent’s economic life and its work become one thing you can check.
A self-trading agent that can buy and sell needs real limits, or it's a runaway. The operator writes an economic mandate, and every market, skill, or size change gets checked against it before it happens. A change that would break the mandate either gets refused, with a signed refusal, or gets flagged as a signed divergence and escalated, the same way mission drift gets flagged.
The operator sets the limits. Hive applies them and signs the result. Hive never sets the limits and never assesses the trades. It only proves whether each change stayed inside the limits the operator wrote.
The public checker returns the metamorphosis timeline alongside the computation graph: the agent’s history of skills, cargo, trades, and size. A third party can rebuild and check the entire economic-life history from receipts alone, without trusting the agent, the operator, or Hive. Change one entry deep in the timeline, or reorder a buy and a sell, and the check fails. Each receipt carries two signatures: Ed25519 and ML-DSA-65 (post-quantum, FIPS 204).
Every path below is a real, reachable destination. No fake checkout, no made-up prices.