Architecture

Cross is organized into five layers. Each layer has a clear responsibility, and each one can be understood independently before seeing how they compose.

The five layers

Layer	Responsibility
Protocol Layer	x402 and MPP HTTP handshake. Defines how agents and services negotiate payment.
Settlement Layer	Robinhood Chain mainnet. Native standard tokens (USDC, USDT). Sub-second finality, sub-cent fees.
Program Layer	Robinhood Chain programs for subscription delegation, plan registry, and session management.
Facilitator Layer	The network of nodes that verify payment headers and trigger on-chain settlement.
SDK Layer	TypeScript libraries that abstract all of the above into `cross.pay()` and `cross.subscribe()`.

Request flow

The following describes what happens when an agent requests a paid resource for the first time.

Agent
  |
  |  1. GET https://api.example.com/v1/data
  v
Service Provider API
  |
  |  2. 402 Payment Required
  |     X-Cross-Payment: { plan, amount, token, network, ... }
  v
Agent + Cross SDK
  |
  |  3. Reads payment terms
  |     Signs delegation or transfer via wallet
  v
Cross Facilitator
  |
  |  4. Verifies authorization on-chain
  |     Executes or schedules transfer via Robinhood Chain program
  |     Returns confirmation header
  v
Service Provider API
  |
  |  5. Validates confirmation
  |     200 OK + requested resource
  v
Agent

On subsequent requests within an active subscription, steps 2 through 4 are skipped. The service verifies the subscription on-chain directly and serves the resource.

Protocol Layer

The Protocol Layer is the HTTP-level negotiation. Cross follows the x402 specification: a service responds to unauthenticated requests with a 402 Payment Required status code and a structured payment object in the response headers. The agent reads those terms and responds with a signed payment or subscription authorization.

Cross’s payment header schema is also designed to be parseable by MPP-compliant agents. Where MPP routes to Stripe/Tempo infrastructure, Cross routes to Robinhood Chain. An agent needs no code changes to use Cross endpoints; only the network field in the payment object changes.

Settlement Layer

All value moves on Robinhood Chain mainnet. Cross uses the chain’s native token standard, with USDC as the primary payment token during beta. Robinhood Chain’s throughput (65,000+ TPS), finality (~400ms), and fee structure (~$0.00025 per transaction) make it practical for both high-frequency per-request payments and low-value metered billing.

Cross does not operate its own ledger. Every plan, subscription, allowance, and payment is a publicly readable Robinhood Chain account. The chain is the ledger.

Program Layer

The core on-chain logic is built on Robinhood Chain’s native Subscriptions and Allowances Program (De1egAFMkMWZSN5rYXRj9CAdheBamobVNubTsi9avR44), audited by Cantina and Spearbit. Cross extends it with:

Cross Plan Registry: an on-chain catalog where service providers publish pricing plans. Plans are immutable once created; subscribers remain on their original terms even when a provider releases a new plan.
Subscription accounts: on-chain records linking an agent wallet to a plan, including status, billing cycle, and authorized amount.
Allowance accounts: on-chain spend caps for metered or one-time billing, with accumulated spend tracked transparently.

Facilitator Layer

The Facilitator is the off-chain component that handles the mechanics of verifying payment headers and triggering on-chain settlement. During beta, Cross operates the Facilitator as a centralized service. Centralization during beta is disclosed clearly; the roadmap includes a permissionless Facilitator Network where any operator can run a facilitator node by staking collateral.

The Facilitator also issues Payment Session tokens for high-frequency agents. A session token authorizes a burst of requests against a pre-committed balance. The Facilitator batches the underlying on-chain settlements, reducing per-request latency to near zero while maintaining full on-chain auditability. Payment sessions ship in general availability.

SDK Layer

The SDK abstracts all of the above. Agent developers do not need to understand x402 headers, Robinhood Chain programs, or facilitator interactions to make their first payment. They install @crossprotocolorg/sdk, initialize a CrossAgent with their wallet, and call agent.pay() or agent.subscribe().

See the Agent SDK and Provider SDK references for the full API.

On-chain transparency

Because all state lives on Robinhood Chain, any observer can verify any payment or subscription without trusting Cross. This is a core design principle. Cross provides block explorer integration and an indexed event log, but neither is a gatekeeper. The chain is always the authoritative source.