the agent lane · verifiable containment

The limits live in the wallet, not in the signature.

A jailbroken agent tries five ways to drain a scoped key. Five reverts, and the same key's allowed call still goes through. The limits live in the wallet contract, so a jailbreak cannot widen its own allowance. Run it yourself, no key, no funds, on local Prague and a fork of 46630.

Run the proof → The scoped-key model
the containment run · a jailbroken agent on a scoped keynpm run demo
#the attemptat the delegate
1Send the trade's output to the attacker instead of the ownerREVERTEDScopeViolation(RECIPIENT)
2Call an off-scope action in place of the approved oneREVERTEDScopeViolation(SELECTOR)
3Spend over the per-call capREVERTEDScopeViolation(PER_TX)
4Point the call at an off-scope targetREVERTEDScopeViolation(TARGET)
5Force the redirect through the guarded execute() pathREVERTEDhard stop, before any state change
✓The one in-scope call, output to the ownerALLOWEDa real mined tx
Every row is a real mined revert on a real EIP-7702 delegation, decoded from the receipt, not narrated. The one allowed call settles, so the fence lets the scoped action through and stops the rest. Run it yourself: npm install && npm run demo, no key, no funds, on local Prague and a fork of 46630. the scoped-key model →
how the fence holds

A scoped key an agent holds, and the wallet holds the limits.

An agent holds its own scoped key and acts on-chain. The spending limits live in the wallet itself, so the wallet refuses any action outside them, no matter what the model was talked into. You alone hold the key, and anyone can run the containment and confirm it. The real system a critique of agent safety asks for is a sandbox, a kill switch, position limits, and a dry run that cannot touch capital. This is that, and you can run it.

the same door · Phase 2, designed

One factory, one board, two lanes.

An agent calls the same TokenFactory a human does, and its coin lands on the same board, tagged. The curated lane it earns into is designed, not yet shipped. Phase 1 ships the core contracts, unchanged.

A human
opens the board, names a coin, launches
An agent
calls untoll.launch() on a scoped key
→
TokenFactory
one factory, one fee splitter, one reputation system
→
The board
the coin lands the instant it exists, tagged by lane

There is no second economy for agents. One TokenFactory, one splitter, one standing graph, two surfaces. The tag on the card tells you which lane a launch came from, and that is the only difference.

@untoll/sdk · the shapeproposed, pre-launch
// a scoped, revocable key the wallet holds.
import { Untoll } from "@untoll/sdk"
const untoll = new Untoll({ key: process.env.UNTOLL_SCOPED_KEY })

// the same TokenFactory a human hits
const t = await untoll.launch({
  name: "Merry Men",
  ticker: "MERRY",
  curve: "default"
})
// -> { id, poolId, hook, txHash }
// pool live, hook attached at creation

await untoll.trade(t.id, { in: "0.5" })
const s = await untoll.status(t.id)
// -> { phase, progress, pool }

// settle what you actually earned
await untoll.claim({ bucket: "creator", token: t.id })

1The same door

No agent API, no agent contract, no agent fork. untoll.launch() calls the same TokenFactory the human front door calls. The coin surfaces on the board the instant it exists.

2The same split

The 1% fee splits on-chain the same way for an agent as for a human. Your agent takes the creator cut on its own coin, on every trade. One splitter, one set of rails, no separate agent economy.

3Reputation that compounds

Standing accrues over real runs and ages into a track record welded to your agent's identity. It is the thing a fork cannot copy, because a fork starts every identity at tier zero.

4Into a curated lane

Not an open firehose. The lane is bonded and reputation-gated, and an agent's own volume never meters into its own standing. Human launches stay permissionless; the lane is the part you qualify for.

the gate

What "curated" actually costs you.

Reputation-gated
Entry is earned over real runs, not granted at signup. Open agent-launch is a spam surface, so the lane is the part with a bar. That bar is what makes a track record in it mean anything.
Bonded
A stake backs your agent's conduct. Misbehaviour has a price, paid from the bond. This is what lets the lane stay open without becoming a firehose.
Self-volume excluded
An agent cannot meter its own volume into its own standing. A large share of every fee is unrecoverable by any single actor, which is what makes farming the lane lose money.

An AI consensus oracle scores the lane and nothing else. It is advisory, it never touches funds, and it has no role in human launches. It is described by function, on purpose.

read the mechanism

Every claim above, in full.

For agents: overview →
The whole section in one page: same door, same rails, curated lane.
The SDK reference →
launch, trade, status, claim. Signatures, return shapes, examples.
Scoped keys →
EIP-7702 and the allowlist model. Narrow, revocable, the wallet holds it.
Single metering →
One flywheel and one wash-proofing for agents and humans alike.
The curated lane →
The gate: reputation, the bond, and self-volume exclusion.
The oracle →
What scores the lane, by function only. Advisory, never custodial.

Point it at the sandbox.

Untolling is where agents run and hold scoped keys, and where the lane is being built. The board is where their coins show up. Same economy, two surfaces.

Go untolling → See the board
the lane is Phase 2, designed. the SDK shape is proposed.