Keys live in the OS-encrypted vault
Private keys are protected with the operating system's key store and are never written to disk in plaintext or serialized across the agent boundary.
Security
Your agent can ask. It cannot take the key.
The defense is a boundary, not a promise: keys sealed away from agents, policy in front of every signature, and a receipt after every action.
Every transaction crosses one signing boundary
The guard enforces mainnet approvals and spend caps in the execution path, where a tool or skill cannot route around it.
Rules run before an approval card appears
Allowlists, transaction caps, and cluster rules evaluate every request. Unknown programs are blocked; exceptions are shown with a simulation diff.
Tools receive only the authority they need
Reads can run automatically, writes require approval, and sensitive operations require typed confirmation and execution-time validation.
Agent lanes remain isolated
Parallel lanes work in isolated worktrees with publishing disabled and secrets removed from the environment.
Every executed action leaves evidence
Receipts record the request, the approving policy, and the resulting signature so the decision trail can be verified.
Independent audit
An independent security audit has not been published yet. When it is, the full report will live here. Until then, the signer guard and vault code are open source.
Review the source