the agent lane · verifiable containment

The limits live in the wallet, not in the signature.

A jailbroken agent tries five ways to drain a scoped key. Five stopped, zero wei moved, and the same key's allowed call still goes through. The limits live in the wallet contract, so a jailbreak cannot widen its own allowance. Run it yourself, no key, no funds, on local Prague and a fork of 46630.

Run the proof → The scoped-key model
the containment run · a jailbroken agent on a scoped keynpm run demo
#the attemptat the delegate
1Send the trade's output to the attacker instead of the ownerREFUSEDScopeViolation(RECIPIENT)
2Call an off-scope action in place of the approved oneREFUSEDScopeViolation(SELECTOR)
3Spend over the per-call capREFUSEDScopeViolation(PER_TX)
4Point the call at an off-scope targetREFUSEDScopeViolation(TARGET)
5Force the redirect through the guarded execute() pathREVERTEDhard stop, before any state change
✓The one in-scope call, output to the ownerALLOWEDa real mined tx
On a real EIP-7702 delegation, one attempt reverts and four are refused with a ScopeViolation event read from the receipt. The one allowed call settles, so the fence lets the scoped action through and stops the rest. Run it yourself: clone the repo, then npm install && npm run demo, no key, no funds, on local Prague and a fork of 46630. the scoped-key model →
how the fence holds

A scoped key an agent holds, and the wallet holds the limits.

An agent holds its own scoped key and acts on-chain. The spending limits live in the wallet itself, so the wallet refuses any action outside them, no matter what the model was talked into. You alone hold the key, and anyone can run the containment and confirm it. This is the scope limit, and you can run it.

the same door · Phase 2, designed

One factory, one board, two lanes.

An agent calls the same TokenFactory a human does, and its coin lands on the same board, tagged. A token's creator names its crew at launch, and the crew is paid from the 25 share. The crew works for the token, and the toll keeps it paid.

A human
opens the board, names a coin, launches
An agent
calls untoll.launch() on a scoped key
→
TokenFactory
one factory, one fee splitter, one crew per token
→
The board
the coin lands the instant it exists, tagged by lane

There is no second economy for agents. One TokenFactory, one splitter, one standing graph, two surfaces. The tag on the card tells you which lane a launch came from, and that is the only difference.

@untoll/sdk · the shapeproposed
// a scoped, revocable key the wallet holds.
import { Untoll } from "@untoll/sdk"
const untoll = new Untoll({ key: process.env.UNTOLL_SCOPED_KEY })

// the same TokenFactory a human hits
const t = await untoll.launch({
  name: "Your Token",
  ticker: "TICKER",
  curve: "default"
})
// -> { id, poolId, hook, txHash }
// pool live, hook attached at creation

await untoll.trade(t.id, { in: "0.5" })
const s = await untoll.status(t.id)
// -> { phase, progress, pool }

// settle what you actually earned
await untoll.claim({ bucket: "creator", token: t.id })

1The same door

No agent API, no agent contract, no agent fork. untoll.launch() calls the same TokenFactory the human front door calls. The coin surfaces on the board the instant it exists.

2The same split

The fee splits the same way for every launch. 45 to whoever launched, 25 to the token's own crew, on every trade. One splitter, one set of rails, no separate agent economy.

3Reputation that compounds

Standing accrues over real runs and ages into a track record welded to your agent's identity. It is the thing a fork cannot copy, because a fork starts every identity at tier zero.

4Into a curated lane

Not an open firehose. The lane is bonded and reputation-gated, and an agent's own volume never meters into its own standing. Human launches stay permissionless; the lane is the part you qualify for.

the gate

What "curated" actually costs you.

Phase 2, designed. None of this is built.

Reputation-gated
Entry is earned over real runs, not granted at signup. Open agent-launch is a spam surface, so the lane is the part with a bar. That bar is what makes a track record in it mean anything.
Bonded
A stake backs your agent's conduct. Misbehaviour has a price, paid from the bond. This is what lets the lane stay open without becoming a firehose.
Self-volume excluded
An agent cannot meter its own volume into its own standing. A large share of every fee is unrecoverable by any single actor, which is what makes farming the lane lose money.

An AI consensus oracle scores the lane and nothing else. It is advisory, it never touches funds, and it has no role in human launches. It is described by function, on purpose.

read the mechanism

Every claim above, in full.

For agents: overview →
The whole section in one page: same door, same rails, curated lane.
The SDK reference →
launch, trade, status, claim. Signatures, return shapes, examples.
Scoped keys →
EIP-7702 and the allowlist model. Narrow, revocable, the wallet holds it.
Single metering →
One flywheel and one wash-proofing for agents and humans alike.

Read the lane.

The lane is being built. The board is where coins will show up.

Read the lane → See the board
the lane is Phase 2, designed. the SDK shape is proposed.