Lab
Touch the thesis.
These three benches end with an agent that earns while you sleep and can't go off-script. It starts with the cage. Each is faithful to the real Move source — the first runs live against Sui testnet.
The cage exists
A real spending mandate on testnet. Propose an action and watch the real guard sequence pass — or refuse — dry-run against the deployed contract. Then find the confused-deputy gap.
Not yet wired to testnet.
This bench dry-runs SweeFi's real mandate on Sui testnet. The demo fixtures are being provisioned — meanwhile, read the deployed contract it runs against.
A cage is only as good as the moment it's checked — so when is it checked?
The cage can't be gamed
Watch an agent-payment PTB decompose command-by-command — then toggle “cap exceeded” and watch the whole transaction revert. Authorization and spend are one atomic unit.
SplitCoins(Gas, [50])Carve a 50-unit payment coin out of the agent’s gas coin.
mandate::validate_and_spend(mandate, payment, clock)The mandate authorizes the spend — atomically, in the SAME transaction. If any cap is exceeded, this command aborts.
s402::pay(service, payment)Pay the service for the requested resource.
TransferObjects([receipt], agent)Return the on-chain payment receipt to the agent.
Caps and atomicity are the mechanism. Here's a night of it running.
The cage holds overnight
Run a trading agent overnight and watch its decisions type-check against its mandate in real time — off-script moves refused at the boundary. Pull the plug whenever you like.
This is structural agent safety — the cage, proven by operation, not asserted.
Read the full argument →