The numbers come from code, not words.

No headline, chat message, tool argument or model output can set an amount, destination, weight or approval. Every number comes from deterministic, bounded code (clamped and range-checked), not from language.

23/23 adversarial fixtures passing

Every transaction that moves value is constructed on the server, its destination derived from verified identity, and its exact message hashed and bound before the vault co-signs. A tampered instruction fails the hash and is rejected.

The AI reads structured data the server already assembled and writes prose about it. Its output is never parsed back into an action, a number or a transaction.

Every agent-facing endpoint either returns public read-only data or passes the identical server-side policy checks a person would. Being an agent grants no shortcut. An agent acting under a holder's delegation is additionally bounded in how many claim, vote or raffle actions it may take per window, and only inside the scope the holder signed; past the bound it acts as itself, never as the holder. A human is never subject to that bound, and reads never count against it.

22/22 adversarial fixtures passing

Machine payments are checked on-chain server-side (amount, destination, finality) with single-use references, and a payment buys exactly the scope it paid for. A signed receipt is proof of a payment already settled, never a credential: no endpoint accepts one as payment or identity, none is issued without an on-chain transaction to point at, and the key set that verifies receipts publishes only public components.

15/15 adversarial fixtures passing

Agent responses are fixed schemas assembled server-side. Tool names are an allowlist and arguments are validated, so unknown tools and unknown arguments are rejected, not ignored. Secrets never transit an agent surface.

83/83 adversarial fixtures passing

Admin and creator operations remain Ed25519-signed, session-gated and replay-guarded. No agent path can reach them.

Each capability sits behind its own feature flag. Flag off means the surface is gone (a 404, not a soft-disabled code path).

Market prices are chosen by consensus, not by whoever claims the most liquidity: a pool quoting far from the median of its peers is excluded no matter how deep it claims to be, dust pools have their prices withheld instead of served, and the vault's own assets are priced by an oracle first with the DEX as fallback. Refusing a number is always preferred to repeating a lie.

5/5 adversarial fixtures passing

Every on-chain identifier (mint, wallet, program, price feed) lives in a small set of owner files, each documenting the authoritative source it was verified against. Everything else imports it, and the build fails if an address is hand-typed anywhere else, so a mistyped or invented address cannot enter the codebase.

Some transactions the treasury signs are built by someone else: a router quotes a swap, a launchpad builds a fee claim. Before the key touches one, it is simulated and read: the signature must actually be required, the simulation must succeed, the SOL spent must stay inside the amount the operation declared plus a fee margin, and no reserve holding may fall. Anything unreadable, unsimulatable or over budget is refused rather than signed, and the refusal is recorded so a stalled cycle is never a silent one.

A project's strategy is 2-4 assets from the certified registry, each at least 15% and summing exactly 100. Nothing outside the registry can be selected, and the frozen selection is revalidated against the registry on every fund-path read. The daily decision may tilt each asset only inside its signed band; a hostile or garbage conviction is clamped to the band, never obeyed.

14/14 adversarial fixtures passing