no hosted keys
Public routing never holds signing keys
Use your wallet for ordinary artifacts, or a local signer you run yourself. Keys never leave your machine.
Security
The wallet stays yours.
Public routing stays unsigned. Self-hosted execution stays local, owner-gated, bounded, and receipt-verified.
bound grants
Agents get temporary, capped permission
Max value, chain, venue, destination, and expiry. Outside the grant is a hard refuse, not an agent with a free wallet.
evidence
See it before you approve. Prove it after.
Before: what you receive, the expected cost, which app gets permission. After: whether it worked, what changed, and what permission is still open.
fail closed
Unconfigured means refused
A fresh install signs nothing. Prepare is not sign, sign is not broadcast. An empty allowlist refuses everything until you add entries.