NotYet
Scheduled agent authority — spend keys, API keys, any secret — that doesn't exist until its time.
Demo
About
NotYet gives an autonomous agent a budget on a schedule — without ever handing it a key it can drain early. The problem: • Hand the agent the whole budget up front → one hack or prompt injection drains it all. • Run a key server that releases keys just-in-time → that server is a honeypot holding every future key. • Session keys solve expiry; nothing solves start — authority always exists the moment it's issued. Why it matters — every one of these was a key that existed before it was needed: • Grok / Bankr wallet drain — May 2026, ~$175K. • Lobstar Wilde trading bot — Feb 2026, ~$250K. • Malicious LLM routers — Apr 2026, ~$500K. How NotYet fixes it: • Each period's key is timelock-encrypted (drand/tlock) to a future round — before its time it doesn't exist in usable form, not even for the owner. Ask early → NOT_YET. • Not just payments — the same lock seals ANY secret (an API key, a credential, a token): the agent holds only ciphertext up front and gets it at its time, not before. No key server to breach or coerce. • Spends settle as real x402 pay-per-call on Hedera, gated on-chain by a PeriodVault (window + budget + per-tx cap) and audited on HCS. • Hacked today = one period's budget. Never the treasury, never a future period.
How it's made
• Issuance: each period's spend key is generated in software, its EVM address committed to a PeriodVault contract, then tlock-encrypted (tlock-js) to a future drand quicknet round and the plaintext wiped. The agent holds only ciphertexts. • Unlock + spend: the agent calls withdraw(i, amount, sig); the vault enforces on-chain the time window (useless before AND after its period), ecrecover identity, per-period budget, and a per-tx ceiling. A real x402 pay-per-call then settles via the keyless Blocky402 facilitator; encrypted receipts land on HCS. • Hedera: PeriodVault runs on Hedera EVM via @hiero-ledger/sdk (no ethers) — money, x402, HCS audit, and an optional HIP-423 scheduled-tx mode, all on one chain, no bridge. • Ledger: the schedule is signed on-device via the Device Management Kit (headless on Speculos, RFC 6979, ERC-7730 descriptor); the device also co-signs over-cap spends and holds the audit view keys the agent can never reopen. • Bazantic: wrapped as an MCP server + a published recipe chaining two services (NotYet + Hedera Mirror Node) — any agent integrates in one line. • Stack: TypeScript ESM, viem, tweetnacl, drand-client, solc. Also an npm SDK: @keccak002/notyet.