Agents can reason. They still cannot spend.
We are building the settlement layer that closes that gap without handing a language model a private key. A small distributed team, one protocol, nothing on mainnet, and a strong preference for saying what does not work yet.
A promise is worth the collateral standing behind it. Everything else in the protocol is machinery for making that sentence enforceable.
— the first design memo, and still the whole argument
Every existing answer is a bad trade
An agent that can read a market, price a trade and write the calldata still has to stop at the last step and ask a human to sign. The workarounds all share a shape: they move the risk somewhere you cannot see it.
Give the agent a hot key. Now a prompt injection is a wire transfer. Put it behind a custodian. Now you have re-invented a broker with worse uptime and no deposit protection. Approve every action manually. Now it is not an agent; it is a very slow trading terminal with extra steps.
What is missing is not intelligence. It is a place to put the authority — bounded, revocable, and enforced somewhere the model cannot reach.
What we decided to build
A commerce layer where the unit of work is an intent, not a transaction. The agent states what it wants. The protocol decides whether it is allowed, simulates whether it works, auctions how it should be routed, and writes down what happened — including when the answer was no.
The model is never trusted
It is assumed compromised on every request. That single assumption produced the policy engine, the simulation gate and the session-key design.
Agents need collateral, not permission
Sybil resistance priced in capital rather than detected with heuristics. It is the only mechanism that works against an adversary who can spin up identities for free.
Refusals are a first-class output
An intent that is held is not an error. It is the system doing its job, and it produces a receipt of the same weight as a settlement.
Six decisions, in the order they were forced
Not a timeline — there is not enough history behind this to make one honest. This is the sequence of decisions the design actually walked, including the one that had to be thrown away.
-
Ask about clearing, not about AI
The first memo asked a narrow question: what would it take for a non-human counterparty to be creditworthy? Not how to make a model safer, and not how to detect a bad one. The answer was collateral, and everything else in the protocol is downstream of that.
-
Delete the permissioned relayer
The first prototype was a relayer that co-signed agent transactions after checking them. It worked, and it was wrong: it made us the counterparty for every action, which is exactly the custodial trade we were trying to avoid. It is gone, and the reasoning is in the repository history.
-
Move policy into the user’s own account
Enforcement lives in the user’s smart account and the policy hash is committed onchain, which reduces us to an executor that can be replaced. The point of this decision is that the security model stops depending on us being honest.
-
Seal the solver auction
An open book lets the last solver to quote win by a tick rather than on execution. Sealing costs a fixed auction window and removes the incentive to wait. We have the argument; we do not yet have the traffic to publish the measurement, and we will not publish one before we do.
-
Accept that there are two clocks
Adding an equity leg forced the hardest product decision so far: a token that settles in a block against a register that settles T+1. The gap is documented rather than hidden, because a product that pretends the two clocks are one is lying in the direction of its own convenience.
-
Publish the not-yet state
Where we are now. Testnet only, no external audit, no mainnet contracts, no token. Every page on this site that used to imply otherwise now says which of those it is — and the same rule applies to anything we add next.
Six rules we actually enforce in review
Not values on a wall. Each of these has killed a feature or a piece of copy in the last year.
- Publish the gap. Anything the system does not protect against goes on the same page as what it does. The security page’s honest-limits section is not a footnote; it is a section.
- Enforce in code, document second. If a rule lives only in documentation, it is a suggestion. The capability map, the policy hash and the allow-list gate all exist because a doc was not enough.
- A number without a source is a lie. Every figure on this site says where it came from. Simulated data is labelled simulated, on the page, next to the number.
- The user’s account, not ours. Anything we can unilaterally change is a thing we can be compelled to change. Policy enforcement lives in the user’s smart account for that reason.
- Refusal is a feature. Held intents are recorded, surfaced and never penalised in reputation. A system that hides its refusals teaches operators to widen their limits.
- Write it down before you build it. Every meaningful decision has a memo with the alternatives we rejected. The relayer we deleted is still in the repository history with the reasoning attached.
Eight disciplines. No names, yet.
We are not publishing headshots, bios or prior employers, because a small pre-mainnet team using résumés as a credibility argument is the exact move this site is trying not to make. What is published instead is the shape of the work: who owns what, and which areas are unowned. Select any discipline for what it is responsible for.
The marks are generated deterministically from each discipline name, the same way agent portraits are — they are not portraits of anyone. The team is small, fully remote across UTC−8 to UTC+3, and writes everything down between the two times a year it is in a room together. Names go up when there is a mainnet to attach them to.
No investors, no round, no grants
There is nothing to announce and nobody to name. Strix Hood has taken no institutional investment, run no token sale, and received no grants. If that changes, the terms go here — including any token warrants, which we would rather never have to disclose because a backer who profits from token velocity is a backer arguing for the wrong roadmap.
What the work is pointed at instead, roughly in order:
An external audit is the single largest line item ahead of mainnet and it is not booked, which is the real reason the audit table on the security page reads not started rather than in progress. Until it is done, nothing goes to mainnet — the sequence is not negotiable, and stating it here is how we make it expensive to quietly reorder.
Four ways in, all of them read by a person
Come and argue with us.
Six roles open, all remote, all with a written take-home you get paid for. The interview is mostly us asking what you built and what broke.
- Strix Hood Labs — remote-first, UTC−8 to UTC+3
- No outside investment, no token sale, no grants
- Contracts on three testnets · none audited · none on mainnet
- No $STRX token · TGE unscheduled