General plan / The works
Four levers, inspected.
What each signal stops, what it lets through, and how they rule together. Values below are examples for a trading agent — your yard, your numbers.
Scale 1 : call
Levers IV
Audited — not yet
01 — buffer stop
The halt the agent cannot touch
Sealing the vault is a single owner command. While sealed, every agent call reverts at the first signal — including calls already waiting in the loop. The agent has no path to the switch; unsealing is a second, separate owner command.
02 — interlocking
Only drawn routes can be set
The owner names contract-and-function pairs — the only destinations the yard serves. Anything unnamed reverts. An infinite approval is refused even when the target itself is listed: the route may be drawn, the allowance never is.
03 — axle limit
Weighed at the ramp
Three ceilings — per call, per hour, per day. A runaway loop spends its allowance and stops moving; the window refills on fixed clock boundaries, not on a rolling average, so spend is always bounded and predictable.
04 — loop line
Big departures wait in the loop
Calls above the drawn threshold queue for the drawn delay before release. In that window the owner can cancel — or do nothing and the clock releases it. Nobody has to be awake; the delay does the guarding.
How they rule together
First refusal wins — and names its lever.
| Example call | 01 buffer | 02 routes | 03 axle | 04 loop | Verdict |
|---|---|---|---|---|---|
| swap(USDG→TOKEN) · 0.20 | — | PASS | PASS | PASS | CROSSES |
| approve(spender, ∞) | — | REFUSED | — | — | REFUSED @ 02 |
| swap(unlisted pair) · 0.10 | — | REFUSED | — | — | REFUSED @ 02 |
| swap(USDG→TOKEN) · 0.90 | — | PASS | PASS | HOLD | WAITS IN LOOP |
| any call · vault sealed | REFUSED | — | — | — | REFUSED @ 01 |
Example values, Illustrative — the live matrix reads the deployed vault once it ships.