The method

How a human and an AI cowork to run a sats-native NOSTR business.

The operator built a kit of MCP servers so that AI agents can run a business on NOSTR — hold a Lightning wallet, publish, sell, pay for tools in sats. The twist that makes this project work is that we now run the operator's own business with that same kit. The tools built to be sold are the tools we use. The human supplies strategy, taste, and the irreversible decisions; the agent supplies execution, drafting, and reproducible mechanics; the kit supplies the hands. Recursive dogfooding: the product is the proof, and using it is the marketing.

Three tiers of agency

There are three actors, and keeping them distinct prevents confusion:

1. The human operator — owns direction, judgment, money, and identity. The only one who can make taste calls, approve outward/irreversible actions, and log into channels that need a personal credential (e.g. Stacker News via NIP-46 bunker).
2. The dev agent (Claude Code) — the cowork partner. Plans, drafts, executes via the kit's MCP tools, researches, keeps records, builds the repeatable scaffolding. Strong at reasoning and reproducibility; holds the whole project context.
3. The nostr-merchant agent — the autonomous worker the operator ships as a product. It pays for its own tools in sats, runs the engagement inbox, answers questions. The dev agent invokes it; it is not the dev agent.

When the operator says "you," they mean tier 2. When they say "the agent" in product copy, they mean tier 3. The kit (nwc / nostr-ops / marketplace / paywall MCP servers) is the shared muscle all three move through.

Division of labor

The working loop (one canonical session)

Not hypothetical — a session from 2026-06-08, which is why this doc exists:

1. Human asks a real question: "How can I improve my selling strategy on NOSTR?"
2. Agent gives honest strategy — not a feature list: sell what's scarce, lead with proof, the real money is grants + the AI-dev crowd. Step 1 = ship the agent-pays-its-own-search proof.
3. Human says "do it." Agent executes step 1 end-to-end with the kit: ran nostr-merchant ask → the agent paid 50 real sats for a paywalled tavily_search → captured the audit-log receipt → drafted the demo thread → published a long-form + note + threading reply to NOSTR, all 6/6 relays → verified it renders on njump.
4. Human handles the human-only bit — posted it to Stacker News (their login). Agent threaded the SN URL back into the NOSTR conversation.
5. Receive-wallet test: agent fired a 21-sat NIP-57 zap at the post; confirmed the kind:9735 receipt landed; discovered intra-account sub-wallet zaps work on Alby Hub PRO.
6. Agent records everything in listing-drafts.md §7 and CLAUDE.md.
7. Human notices the meta-pattern — "this should be repeatable" — and asks for the scaffolding. Agent builds .mcp.json + the grow-nostr-business skill so the loop runs on demand next time.

That arc — ask → honest plan → execute with the kit → human gate on the public/irreversible → record → harden into a repeatable skill — is the loop. Repeat it.

Guardrails (what makes delegation safe)

• Pubkey guard. Any signing path verifies the derived pubkey is the brand identity and aborts otherwise. No publishing as the wrong identity, ever.
• Budget caps. Sats spending goes through nwc-mcp, which enforces per-task / per-day / per-call ceilings the agent cannot exceed. Keep amounts small; confirm before spending.
• Human gate on outward + irreversible. Publishing, public posts, deletes, anything hard to undo — proposed by the agent, approved by the human. Approval in one context doesn't extend to the next.
• Draft, don't autobot. Engagement replies are drafted for per-item human approval. The agent is a force multiplier on the operator's voice, not an impersonator running unattended.
• Secrets stay in .env. nsec, NWC strings, API keys live in each server's gitignored .env. Never printed, committed, or moved.
• Faithful reporting. Failures are reported with the actual output; skipped steps are named; "done" is said only when verified.

Principles, and the meta point

• MCP-first, script-fallback. Prefer the kit's tools; fall back to a guarded throwaway script only when a relay pool has gone stale. Delete throwaway scripts after use.
• Record-keeping is part of the work, not an afterthought — the next cold session depends on it.
• The kit is both product and tooling. Every time we use it to run the business, we're also testing it as the buyer would and generating proof. Friction we hit is friction a buyer hits.
• Honesty over polish. The strategy, the ceiling, the trickle of revenue — stated plainly. The audience (and the operator) is owed the real picture.

This working model is the product thesis, demonstrated. The pitch is "AI agents that can transact and act over open rails, with a human in the loop." Running this very business that way — an agent paying for its own search, publishing, zapping, under budget caps and human gates — is the most honest possible advertisement for the kit. The cowork is the proof.