Cypher Brain

Demo

About

Cypher Brain is an existing open-source project that encrypts a personal AI "second brain" (gbrain) every night, then publishes a pointer to it so the brain can be restored elsewhere. That nightly job is run by an AI agent, not a human — which meant giving the agent broad, unverifiable trust: either the owner's real wallet key, or a centralized server nobody outside its operator could audit. This submission replaces that with ENSv2's Enhanced Access Control. The owner grants a separate agent wallet a role scoped to exactly one text-record key on the name's existing Permissioned Resolver — no custom smart contract. Routine pointer updates then use only the agent key; the owner's real key is never touched again. The scope is proven, not claimed: our ens-verify command reads the granted key back to confirm the write, then simulates a write to a different key and requires the resolver itself to reject it with EACUnauthorizedAccountRoles. We ran the full flow live on Sepolia — registered a real ENS name, granted three independent keys, wrote and verified each one, and captured every transaction hash. A stolen agent wallet can update one field. It cannot move funds, write anywhere else, or act as the owner.

How it's made

This project is a TypeScript CLI (cypher-brain) that already handled encryption and storage of a personal AI second brain; this submission adds four new subcommands on top of it: agent-wallet keygen, ens-setup, ens-set-text, and ens-verify. age encrypts the second-brain snapshot on-device before it ever reaches a storage backend (local file, Arweave/Turbo, or TON storage for this demo). The ENS text record only ever holds a pointer to that ciphertext — never the plaintext or its decryption key. For the ENSv2 side, viem talks to Sepolia and to the name's Permissioned Resolver. ens-setup lets the owner grant ROLE_SET_TEXT for one text key to a locally generated agent wallet, using a hidden interactive prompt so the owner's key is never written to disk. ens-set-text then lets that agent wallet alone write the granted key. ens-verify closes the loop: it reads the key back to confirm the value, then simulates (not broadcasts) a write to a different key, requiring the resolver's Enhanced Access Control to revert it with EACUnauthorizedAccountRoles. The hacky-but-deliberate part: we did not write a new smart contract. Everything here — the Permissioned Resolver, its Enhanced Access Control roles, the ENSIP-10 wildcard resolution path text records now go through — already existed in ENSv2's fresh Sepolia redeployment. We just wired an existing OSS project's agent wallet into permissions ENSv2 already offers, and proved the scope holds by making the agent try to break it and fail, live, on-chain.