[{"data":1,"prerenderedAt":302},["ShallowReactive",2],{"project-\u002Fprojects\u002Fsweeai":3},{"id":4,"title":5,"body":6,"description":279,"extension":280,"featured":281,"github":282,"live":282,"meta":283,"metric_source":282,"navigation":284,"order":285,"path":286,"pr_links":287,"proof_url":132,"seo":288,"status":289,"statusColor":290,"stem":291,"subtitle":292,"tech":293,"tier":299,"verification_tier":300,"__hash__":301},"projects\u002Fprojects\u002Fsweeai.md","Swee AI",{"type":7,"value":8,"toc":269},"minimark",[9,13,34,39,71,75,78,122,137,141,176,180,211,215,238,242],[10,11,5],"h1",{"id":12},"swee-ai",[14,15,16,17,21,22,26,27,30,31],"p",{},"AI agents are starting to spend real money — and run away with it. (A single Claude Code session once dispatched ~300 sub-agents and burned ",[18,19,20],"strong",{},"$333"," before anyone caught it.) Swee AI is the layer that governs an agent ",[23,24,25],"em",{},"fleet",": a custody cage ",[18,28,29],{},"caps and revokes"," the spend, and a routing oracle answers the question every fleet-runner actually has — ",[18,32,33],{},"\"is the marginal spend worth it?\"",[35,36,38],"h2",{"id":37},"the-cage-enforced-at-consensus-not-by-prompt","The cage — enforced at consensus, not by prompt",[14,40,41,42,46,47,50,51,54,55,58,59,62,63,66,67,70],{},"The agent's budget lives in an on-chain ",[43,44,45],"code",{},"Balance\u003CT>"," inside a shared ",[18,48,49],{},"SpendCage","; the agent's own wallet holds only gas. The single exit is ",[43,52,53],{},"withdraw_and_pay",", which is ",[18,56,57],{},"bounded"," (per-call + lifetime caps), ",[18,60,61],{},"recipient-allowlisted"," (it can only pay addresses you pre-approved), and ",[18,64,65],{},"revocable"," (a shared kill-switch registry). The withdraw and the payment are ",[18,68,69],{},"fused into one transaction"," — a compromised agent can't withdraw-then-redirect.",[35,72,74],{"id":73},"evidence-live-verified-on-sui-testnet","Evidence — live-verified on Sui testnet",[14,76,77],{},"I ran a compromised-agent script against the deployed cage and watched the kill-switch fire, with real Move abort codes:",[79,80,81,89,99,108],"ul",{},[82,83,84,85,88],"li",{},"in-budget spend → ",[18,86,87],{},"settles",", the seller is paid",[82,90,91,92,95,96],{},"over the per-call cap → aborts ",[43,93,94],{},"MoveAbort 803","  ",[43,97,98],{},"EPerTxLimitExceeded",[82,100,101,102,95,105],{},"a non-allowlisted payee → aborts ",[43,103,104],{},"MoveAbort 811",[43,106,107],{},"ERecipientNotAllowed",[82,109,110,111,114,115,95,118,121],{},"after ",[43,112,113],{},"revoke"," → the next spend aborts ",[43,116,117],{},"MoveAbort 805",[43,119,120],{},"ERevoked","; reclaim returns the remainder",[14,123,124,125,128,129,136],{},"Package ",[43,126,127],{},"0x01d90f…7274"," on testnet — ",[130,131,135],"a",{"href":132,"rel":133},"https:\u002F\u002Fsuiscan.xyz\u002Ftestnet\u002Fobject\u002F0x01d90f7ae7347a1b4aca581fc7905704b9ac32a626600261a4f4e33a2ddb7274",[134],"nofollow","verifiable on SuiScan",". 509\u002F509 Move unit tests green.",[35,138,140],{"id":139},"the-routing-oracle-is-it-worth-the-spend","The routing oracle — \"is it worth the spend?\"",[14,142,143,144,147,148,151,152,155,156,159,160,163,164,167,168,171,172,175],{},"The other half of fleet cost isn't ",[23,145,146],{},"theft",", it's ",[23,149,150],{},"waste",": running Opus on work a $0.10 model would nail. The comparator fires one prompt at N models in parallel and reports real ",[18,153,154],{},"cost · latency · quality"," side by side — on one Sui-consensus question it measured a ",[18,157,158],{},"~30× cost spread"," for comparable answers. Every run appends a ",[43,161,162],{},"routing.comparison"," event (bitemporal, content separated from metadata) — the seed of a ",[18,165,166],{},"data flywheel",": ",[23,169,170],{},"which model wins at which task",", routed on ",[18,173,174],{},"verifiable"," outcomes, not vibes. That data is the moat a price-only router (OpenRouter) can't buy.",[35,177,179],{"id":178},"a-genuinely-elegant-detail","A genuinely elegant detail",[14,181,182,183,186,187,190,191,194,195,198,199,202,203,206,207,210],{},"The cage binds its kill-switch to ",[18,184,185],{},"one"," registry ",[18,188,189],{},"by object identity"," (",[43,192,193],{},"object::id","), not by the registry's ",[23,196,197],{},"owner",". The owner-bound version is a one-to-many check — a delegator owns many registries, so a compromised agent can present a ",[23,200,201],{},"second"," same-owner registry that was never revoked in, and walk around the kill-switch. ",[18,204,205],{},"22 passing tests missed this; an adversarial audit of the actual bytecode caught it."," The fix pins the exact registry at creation and asserts it on every spend and reclaim. Saltzer & Schroeder's ",[23,208,209],{},"complete mediation",", the honest way — and a working reminder that green tests are not verification.",[35,212,214],{"id":213},"the-honest-claim","The honest claim",[14,216,217,218,221,222,225,226,229,230,233,234,237],{},"A compromised agent ",[18,219,220],{},"can't exceed your caps"," and ",[18,223,224],{},"can only pay addresses you pre-approved","; ",[18,227,228],{},"revoke recovers the remainder."," It does ",[18,231,232],{},"not"," make theft impossible — the delegate key is the authority, capped. Custody ",[18,235,236],{},"bounds the blast radius","; it is not a co-signer. (The line matters: it's defensible, and it's true.)",[35,239,241],{"id":240},"proof","Proof",[79,243,244,257,263],{},[82,245,246,249,250,190,252,256],{},[18,247,248],{},"Cage:"," deployed + live-verified, testnet ",[43,251,127],{},[130,253,255],{"href":132,"rel":254},[134],"SuiScan",").",[82,258,259,262],{},[18,260,261],{},"Comparator + flywheel:"," runs locally against live model APIs; each run mints a routing-outcome event.",[82,264,265,268],{},[18,266,267],{},"Agent memory"," on Walrus (decentralized, owned by the user — not a provider's server).",{"title":270,"searchDepth":271,"depth":271,"links":272},"",2,[273,274,275,276,277,278],{"id":37,"depth":271,"text":38},{"id":73,"depth":271,"text":74},{"id":139,"depth":271,"text":140},{"id":178,"depth":271,"text":179},{"id":213,"depth":271,"text":214},{"id":240,"depth":271,"text":241},"A custody cage that caps and revokes an AI agent's spending (deployed on Sui), plus a routing oracle that answers \"is the marginal spend worth it?\" from verifiable, per-task model-performance data.","md",false,null,{},true,12,"\u002Fprojects\u002Fsweeai",[],{"title":5,"description":279},"Testnet","blue","projects\u002Fsweeai","Governing an agent fleet — cap the spend, route the cost",[294,295,296,297,298],"TypeScript","Sui","Move","OpenRouter","Walrus","working","testnet","_VoQ4n4smaCfp085jqb5BYJjcky01dMF3JwXd1JaShk",1788226714071]