LLM agents are good at judgment and terrible at being trusted. So split the system in two: a brain that can only propose, emitting schema-validated intents while never holding keys and never building transactions, and a deterministic signer that verifies every intent through a layered fail-closed pipeline where only the final layer touches a key. No LLM in the signing path, ever.
This pattern has run in production against real funds. This repo is the write-up: docs only, no code. It describes the architecture generically so you can build your own.
The architecture is here. The running system is not.
Deliberately withheld, and proprietary: the live contract and vault addresses, the keys, the address registry, and the tuned strategy parameters. Those secure real money, and a strategy's edge decays the moment its numbers are public. What's published is the transferable half, the design, the invariants, and the reasoning behind them. That half is MIT-licensed and yours to reuse. The other half stays private for the same reason you would not publish your keys. A write-up you can learn the architecture from is the point; a repo someone could point at a live vault is not.
An LLM deciding when to rebalance a position is a good use of an LLM. An LLM holding a private key is not. The failure modes are different in kind: bad judgment loses you an edge, a leaked or misused key loses you everything. Most agent frameworks blur the two by giving the model a wallet tool. This architecture refuses to.
| Brain (proposer) | Signer (verifier) | |
|---|---|---|
| Runs | an LLM, or anything else | deterministic code only |
| Holds keys | never | one scoped session key |
| Builds transactions | never | yes, in one layer |
| Output | a typed intent over HTTPS | a receipt or a rejection |
| Replaceable | freely, zero signer changes | changes are treated as capital-contract changes |
The brain says "reduce exposure to market X by amount N". The signer decides whether that is allowed, resolves every address itself, simulates it, and only then signs. The brain can be swapped for a different model, a cron job, or a human with curl, and the signer does not change. That is the test that the boundary is real.
sequenceDiagram
participant B as Brain (proposer)
participant S as Signer (verifier)
participant C as Chain
B->>S: intent: typed action, params, nonce, timestamp
S->>S: auth, schema, freshness, policy, registry, simulation
alt any layer rejects
S-->>B: rejection with layer id and reason
else all layers pass
S->>C: build, sign, broadcast
C-->>S: transaction result
S-->>B: receipt
end
- No LLM in the signing path. The brain proposes, the pipeline decides. Ever.
- Fail closed. Any error, any empty registry, any missing field: reject. Nothing defaults to permit.
- No raw hex from the agent. The intent has no address fields. Every address comes from a registry that only a human can promote into.
- One side-effecting layer. Everything before it is read-only and can run a thousand times with no effect on the world.
- The kill switch does not depend on the system being healthy. It is a human-held path straight from the root key.
- docs/architecture.md: the full pattern. Intent schema, the layered pipeline, the address registry and its human gate, bounded approvals, the kill switch, the key hierarchy, and how the two sides stay wire-compatible without a shared package.
- docs/evm-patterns.md: the EVM-specific enforcement. Bounded approvals, registry-pinned calldata with factory and source attestation, simulation before signing, per-category caps and the promotion gate, and the receipt gate.
- docs/autonomous-lp-agent.md: a worked example built on the split. An autonomous DLMM liquidity agent that screens deterministically, lets an LLM choose only among pre-approved candidates, exits on deterministic rules, and self-tunes within bounds, while never holding a key.
- docs/failure-modes.md: what the design defends against, and what it does not.
MIT. See LICENSE.