The Vault Firewall

No headline, chat message, tool argument or model output can set an amount, destination, weight or approval. Every number comes from deterministic, bounded code (clamped and range-checked), not from language. One reading of language reaches a number, and only through that code: the shadow analyst's daily call, a language model that also reads the day's headlines, leans that day's purchase mix by a 25% share, never more than 3 points on any asset and always inside the 23-43% band. Its call and the model's are both stamped on-chain with the decision, so the bought mix can be recomputed from the record.

25/25 self-checks passing on this build

Every transaction that moves value is constructed on the server, its destination derived from verified identity, and its exact message hashed and bound before the vault co-signs. A tampered instruction fails the hash and is rejected.

The AI reads structured data the server already assembled and writes prose about it, and that prose is never parsed back into an action, a number or a transaction. The single exception is the shadow analyst's daily call: three weights, parsed and clamped by deterministic code, that lean the day's purchase mix by at most 3 points per asset. It never chooses an asset, an amount, a destination or a time.

Every agent-facing endpoint either returns public read-only data or passes the identical server-side policy checks a person would. Being an agent grants no shortcut. An agent acting under a holder's delegation is additionally bounded in how many claim, vote or raffle actions it may take per window, and only inside the scope the holder signed; past the bound it acts as itself, never as the holder. A human is never subject to that bound, and reads never count against it. A holder's own position reaches an AI app only after the holder signs in with their wallet and approves that app; that access is read-only, bound to the one wallet, ends when they disconnect, and its tokens are never accepted as a web session, nor a web session as one of them.

28/28 self-checks passing on this build

Machine payments are checked on-chain server-side (amount, destination, finality) with single-use references, and a payment buys exactly the scope it paid for. A standard x402 payment is held to the terms this server offers, never to the copy the buyer sends back, and is checked on-chain again after it settles. A signed receipt is proof of a payment already settled, never a credential: no endpoint accepts one as payment or identity, none is issued without an on-chain transaction to point at, and the key set that verifies receipts publishes only public components.

25/25 self-checks passing on this build

Agent responses are fixed schemas assembled server-side. Tool names are an allowlist and arguments are validated, so unknown tools and unknown arguments are rejected, not ignored. Secrets never transit an agent surface.

90/90 self-checks passing on this build

Admin and creator operations remain Ed25519-signed, session-gated and replay-guarded. No agent path can reach them.

Each capability sits behind its own feature flag. Flag off means the surface is gone (a 404, not a soft-disabled code path).

Market prices are chosen by consensus, not by whoever claims the most liquidity: a pool quoting far from the median of its peers is excluded no matter how deep it claims to be, dust pools have their prices withheld instead of served, and where an oracle publishes a price for an asset, it is preferred to any pool and refused when stale or uncertain. Refusing a number is always preferred to repeating a lie.

7/7 self-checks passing on this build

Every on-chain identifier (mint, wallet, program, price feed) lives in a small set of owner files, each documenting the authoritative source it was verified against. Everything else imports it, and the build fails if an address is hand-typed anywhere else, so a mistyped or invented address cannot enter the codebase.

Some transactions the treasury signs are built by someone else: a router quotes a swap, a launchpad builds a fee claim. Before the key touches one, it is simulated and read: the signature must actually be required, the simulation must succeed, the SOL spent must stay inside the amount the operation declared plus a fee margin, and no reserve holding may fall or change hands. A swap must also deliver at least its quote's minimum into the treasury's own account, and its route must commit to that quote at no more slippage than the vault asked for. The quote's price is checked against what the treasury itself received for that asset over the last seven days: one paying more than 15% above that is not signed. A market price can raise an alert, but never approves or refuses a swap on its own, since a pool can print a false one. Anything unreadable, unsimulatable or over budget is refused rather than signed, and the refusal is recorded so a stalled cycle is never a silent one.

A project's strategy is 2-4 assets from the certified registry, each at least 15% and summing exactly 100. Nothing outside the registry can be selected, and the frozen selection is revalidated against the registry on every fund-path read. The daily decision may tilt each asset only inside its signed band; a hostile or garbage conviction is clamped to the band, never obeyed.

14/14 self-checks passing on this build