Core concepts

Security and execution

Assume the model can be wrong or adversarially steered. Oracle keeps proposal separate from authorization and verifies the boundaries in code.

Disarmed by defaultFail closedExact grants

Three planes

DataChain state, prices, protocol health, reads, and quotes. No key custody.

PolicyDestination allowlists, slippage, caps, attestations, and approval binding.

ExecutionUser wallet or optional self-hosted local signer. Never model authority.

The public import boundary is checked by tests. Hosted and keyless Oracle prepares unsigned artifacts. Self-hosting does not automatically enable signing.

Grants and confirmation

A grant is authorization. A prompt is not. Live grants bind chain, surface, action, destination, value, expiry, and other action-specific limits. Empty allowlists refuse rather than widening access.

One exact action cannot be silently reused for another destination or calldata
Policy is rechecked near sign and broadcast time
Slippage input is a maximum, not permission to widen automatically
Disarm and revoke remain dominant

Optional self-hosted local signer

The optional self-hosted local signer uses an encrypted vault, sealed policy, loopback-only service, and one-use confirmation. It stays inert until the owner initializes it.

local signer

oracle sign init
oracle sign import --key-file /protected/key --passphrase-file /protected/passphrase
oracle sign policy --policy-file /protected/policy.json
oracle sign doctor
oracle signer --credential-service oracle-local-signer --session-seconds 120
oracle sign lock

Never paste secrets

Use hidden terminal entry or owner-only files. Do not place a key, passphrase, signer token, bot token, or provider credential in chat or argv.

Autonomous trading

Unattended trading is a separate opt-in for trusted self-hosted code. It requires ORACLE_AUTONOMOUS_TRADING=1, compatible policy mode, and a verified trigger attestation. The environment flag alone does not bypass local policy or grant bounds.

Receipt proof

Broadcast acceptance is not success. Oracle reports success only when a transaction hash and a successful receipt are coherent with the prepared artifact and observed chain state. Missing finality or balance evidence stays unknown.

Secret handling

Hosted surfaces do not accept wallet keys
Local vault material stays on the self-hosted machine
Provider status commands do not print credentials
Secret-shaped fields are rejected or redacted from model context and logs
Public HTTP services bind to loopback by default and need a controlled admission layer before hosted exposure