How this works

The agent holds AGENT_ROLE on the vault and executes directly with its own key. There is no human override after genesis. The mandate is the only thing constraining it, and only the agent may amend it.

That is a deliberate scope choice rather than an oversight. The thesis being tested is whether an agent can do the job a human vault curator does, and a system with a human veto is not testing that. The cost is that the trust model rests entirely on the agent and its harness, which is why every decision it makes is shown in full rather than summarised.

This is the question the interface did not previously answer, and it matters more than it looks.

Off-chain

The mandate itself

One JSON file per vault, held by the agent harness under AGENT_STATE_DIR. The full text (objective, constraints, permitted sources and venues) never goes on-chain.

On-chain

Its keccak hash only

mandateHash, bound at deploy time and immutable thereafter.

That hash is the depositor's entire verification handle. It is what lets you check that the mandate you were shown at genesis is the one the vault was actually deployed with. Compare the hash on the vault page against the keccak of the mandate text. Nothing else binds the two together.

The honest consequence: a mandate is only as available as the harness holding it. Losing that state does not put the vault at risk, since custody is on-chain, but it does lose the human-readable rules behind the hash.

The vault is the sole custodian of everything it holds. Capital does not move to a strategy contract, a router, or a venue. It stays put, and totalAssets() is always the truth about what is there.

This is what makes the 1inch Aqua integration work rather than merely appear. Aqua is a shared-liquidity registry that tracks virtual balances: the vault posts a market-making quote as a maker, and the tokens remain in the vault until a taker actually fills. So a holding marked committed is encumbered, not sent away. Reading it as “sent away” is the one misreading that would make you conclude the share price is wrong when it is exactly right.

The badge in the header reports the worst source feeding the page, and it is there because the failure that matters is not a crash. It is a page that looks fine while showing invented data.

• LIVEThe agent API is reachable and reports itself running against real data sources.
• ON-CHAINThe agent API is unreachable, so the vault's own numbers were read straight from the ERC-4626 contract. Still real: the API only reads the same chain.
• FIXTURESSomething on the page is sample data. That includes the case where the API is up and answering perfectly while itself running in fixture mode.

• Not audited. These contracts were written during a hackathon and have never been reviewed by anyone outside the team.
• Not a product. There is no upgrade path, no incident response, and no one on call.
• Not protected against a bad model. Output validation rejects malformed and mandate-breaching decisions before they reach the chain, and rejected decisions are kept in the feed as evidence that the layer does something. It cannot catch a decision that is well-formed, permitted, and simply wrong.

Proof of concept for ETHGlobal Lisbon. Do not deposit real funds.