chapter2

Demo

About

As organizations and DAOs delegate real financial operations to autonomous AI agents such as paying for compute, data feeds, and service bills they face a dangerous all-or-nothing dilemma. AI models are non-deterministic, vulnerable to prompt injections, logic loops, and hallucinations. Because blockchain transactions are final and irreversible, giving an AI agent direct access to a treasury wallet means a single compromised instruction or software bug can instantly drain millions of dollars with zero recourse. Conversely, forcing humans to manually review and approve every single micro-payment creates an operational bottleneck that destroys the speed and autonomy of AI agents entirely. Chapter 2 solves this by establishing bounded autonomy through an asymmetric control system. Rather than treating wallet access as all-or-nothing, the system splits transactions into distinct risk tiers. Routine micro-payments, such as x402 web resource payments, proceed automatically without human delays, while any transaction that exceeds spending limits, sends funds to untrusted addresses, or shows anomalous intent is immediately halted for human sign-off. The platform coordinates this across an Ethereum and Base Sepolia smart contract foundation, a NestJS supervisory backend for policy checks and injection filtering, Privy and World ID for agent identity and human personhood verification, Flutter for mobile monitoring, and Ledger for hardware authorization. Smart contracts are essential because security guarantees cannot depend solely on off-chain servers that could crash, misconfigure, or suffer unauthorized tampering. Chapter 2 implements a custom transaction guard on Gnosis Safe that sits directly in the blockchain execution path. The contract enforces dual execution routes. Under the autonomous route, the contract verifies mathematical spending caps, including single-transaction limits and rolling 24-hour budgets, while strictly prohibiting administrative or contract-upgrade calls. If an action breaches these parameters, the smart contract immediately reverts the transaction unless it enters the human-approved route, which requires a valid EIP-712 cryptographic signature from the human owner. Mobile phones serve as the primary operational interface because autonomous AI agents operate around the clock, requiring immediate, portable oversight. When an agent attempts an action that exceeds its autonomous allowance, the human supervisor receives an instant push notification on their phone. Crucially, modern mobile devices provide hardware-isolated security environments, such as Apple's Secure Enclave on iOS and StrongBox Keystore on Android. Chapter 2 utilizes these dedicated hardware chips to store human authorization keys, gating every high-value approval behind native biometrics like Face ID or fingerprint scanning. This ensures that no software-level exploit on the backend can forge human approvals without physical biometric authorization. Ledger hardware wallets provide the final, highest tier of physical protection for high-value disbursements and core governance changes. While mobile biometrics handle daily operational alerts, high-value treasury reserves require true cold-storage isolation where private keys never enter internet-connected memory. Ledger devices support EIP-712 clear-signing, rendering the exact token, amount, recipient address, and stated purpose on an un-hackable, physical device screen. This prevents blind-signing attacks and gives human custodians ultimate, uncompromised physical authority over the treasury.

How it's made

Chapter 2 was built as a multi-tier monorepo designed to connect on-chain smart contracts, an event-driven supervisory backend, native mobile security hardware, and a cross-platform mobile client into a cohesive execution loop. The core protocol layer is written in Solidity using Foundry and deployed on Base Sepolia. At the center of the on-chain architecture is Chapter2Guard, a smart contract implementing the Gnosis Safe transaction guard interface. The contract acts as an immutable checkpoint that inspects all transaction calldata in real time, calculating rolling twenty-four-hour cumulative spend totals, checking single-transaction ceilings, and recovering EIP-712 cryptographic signatures directly in the pre-execution hook. The orchestration and policy logic are implemented in a NestJS backend written in TypeScript, using Ethers.js and Viem for on-chain interactions. When an autonomous agent attempts an action, such as buying server compute or paying an x402 HTTP resource fee, the backend intercepts the proposal before it touches the blockchain. The request passes through an intake pipeline that performs adversarial prompt-injection classification, semantic intent verification, and deterministic mandate validation. To prevent race conditions and double-spending across multiple concurrent agents, an atomic reservation engine locks required token amounts in memory. If an action is within safe spending caps, the agent submits it directly through the autonomous path on the Gnosis Safe. If the action exceeds limits or attempts an unapproved interaction, the backend serializes the request into an EIP-712 typed data payload and pushes an escalation event over a real-time WebSocket gateway. Partner technologies play a foundational role in enabling each layer of this architecture. Base Sepolia provides the low-latency, sub-cent transaction environment necessary for autonomous micro-disbursements and continuous on-chain guard checks. Gnosis Safe serves as the institutional treasury base, allowing us to enforce spending policies and signature thresholds at the EVM level without altering core Safe logic. World ID is integrated using proof-of-personhood verification, cryptographically binding every autonomous agent to a verified human principal to eliminate Sybil bot manipulation. Privy provides the agent key lifecycle and embedded wallet provisioning, authenticating agent owners through verified bearer tokens. Ledger hardware wallets and the Ledger Key Ring protocol provide physical cold-storage isolation, enabling EIP-712 clear-signing on device screens to neutralize blind-signing exploits. Furthermore, the x402 protocol enables standardized machine-to-machine HTTP micropayments, allowing agents to pay for live API endpoints and compute resources with verifiable cryptographic payment headers. The mobile command center is built in Flutter using the BLoC state management pattern, connecting directly to the backend WebSocket stream. To bridge the Flutter client to the device's physical security hardware, custom native modules were written in Swift for iOS and Kotlin for Android. These modules interface directly with Apple's Secure Enclave and Android's StrongBox Keystore. When an escalated transaction arrives, the human supervisor reviews the decoded parameters—recipient address, token type, amount, and business rationale—and authorizes the payment using Face ID or fingerprint biometrics. The native security module generates an EIP-712 signature directly inside the hardware enclave without exposing the private key to application memory, and the signed transaction is dispatched to the Gnosis Safe where Chapter2Guard validates the human signature on-chain. Several notable engineering challenges and clever workarounds were implemented during development. Inside Chapter2Guard, we built custom calldata parsers directly in Solidity to dynamically extract ERC-20 transfer targets and amounts from raw bytes during the pre-execution hook, allowing the contract to distinguish between autonomous agent micro-disbursements and human-signed multisig actions on the fly. To solve concurrency bottlenecks across fast-acting agents, we built an in-memory atomic reservation lock synchronized with on-chain twenty-four-hour timestamp windows, preventing parallel agents from exceeding daily limits through burst transactions. Additionally, we created a native mobile bridge that formats structured EIP-712 domain separators and typed schemas directly within hardware keystores, enabling biometric unlocks to generate Ethereum-compatible signatures without key leakage. Finally, for local agent tooling, we built a zero-plaintext subprocess adapter for the Ledger Key Ring CLI that passes encrypted payloads through memory buffers without writing plaintext keys or seed phrases to disk.