Built on
Poison the invoice. Watch the agent say PAY.
The agent can be fooled. The kernel and the vault cannot be sweet-talked. Every release leaves a receipt you can check without trusting us.
Poison the invoice
Hide a changed payout address inside a supplier invoice.
More details ->A logo isn’t a security check.
One altered address can redirect a payment.
An invoice can look routine while naming a different payout wallet. Warifu checks the payee against signed terms and evidence before the vault can release USDC.
Put the loss bound on the page.
The Loss Bound Certificate recalculates maximum exposure from current on-chain state and empirical results. It keeps assumptions and exclusions beside the bound, and becomes stale when its inputs change.
One payment gate for every agent stack.
Any agent stack plugs in the same way: it sends a proposal, and the gate decides. Evidence, signed terms, policy, balances and history are checked before a vault release.
Proposal
An agent or an invoice extractor suggests a payee and an amount. Nothing is paid yet.
Signed terms
Signed terms bind the payee, budget cap and milestones.
Kernel checks
The kernel checks evidence, policy, balances and history.
Re-check at release
Fresh state is checked again at release time.
Vault
The vault applies the cap and prevents a second release.
From invoice to receipt, one bounded flow.
The agent proposes
Invoice text becomes a suggested payee, amount and evidence set: a claim to be checked, not a command.
The kernel checks
Deterministic rules check evidence, signed payment terms, policy, balances and history before returning a verdict.
The vault releases
A valid attestation gates the release. The on-chain event anchors a receipt that can be checked later.
Built on Arc and USDC. Claude reads the invoice; it never decides.
- Arcchain, USDC as gas
- USDCwhat the vault holds and pays
- Circle walletsdeveloper-controlled relayer wallet (live on Arc testnet)
- Claude / Geminiinvoice readers (a Gemini pair ran live); advisory only
- viem + Foundrychain access and contract tests
Instructions hidden in a document are data, never commands. They are flagged, and they cannot change a payee, an amount or a limit.
A familiar sender or channel proves nothing about who should be paid. The signed engagement binds the payout address, and the kernel checks every payment against it.
Every release leaves a signed receipt tied to the vault event, so the decision can be checked after the fact.
The audit record keeps the checks and reason codes inspectable alongside the verdict.