Trust model

A protocol that is vague about its assumptions is asking to be trusted about trust. This page is the opposite: it lists what holds unconditionally, what depends on someone, and what is simply not built yet.

What is trustless

A short reserve. The certificate claims a reserve; the vault holds a balance; the ChallengeManager reads both and compares them. Anyone can call resolve, the answer does not depend on who calls it, and settlement happens in the same transaction. There is no oracle, no arbiter and no vote on this path.

The locks. release_to_operator() reverts before unlock_at. release(auditor) reverts before locked_until. Those are contract conditions, not policies.

The reads. verify, get_balance and get_stake are public views that anyone can simulate for free. You never have to accept a reported number.

What requires trust

BoundExceeded and FakeSignature. Proving that an agent spent more than its bound, or that a signature was forged, means judging something that did not happen on-chain. These settle through resolve_by_arbiter, called by a named arbiter set at initialization. That is a trusted party, and it is scoped to exactly these proof types.

Naming the victim. Even on the trustless path, the challenger names who was harmed. The contract proves the reserve was short; it does not prove who suffered from it.

The auditor's diligence. The protocol guarantees the auditor loses their stake for a false vouch. It does not guarantee they checked carefully — it makes not checking expensive.

Known limits of the current deployment

• One vault per operator, single balance. No per-certificate segregation. An operator with several certificates backs them all from one pot; read the actual balance rather than assuming exclusive claim.
• Testnet only. No mainnet deployment exists. Amounts are testnet USDC.
• Stake sizing is a policy question. The protocol enforces that a stake exists and is slashable, not that it is large enough relative to the bound. That is the reader's call — both numbers are on the certificate.
• Expiry is not revocation. An expired certificate stops being valid; it does not become invalid. Invalid means a challenge succeeded.
• Pre-production. Contracts are tested but not audited. Treat this as a working system to evaluate, not one to secure real value with.

The line the design draws

The honest edge is narrow and worth stating plainly: a short reserve is provable on-chain with zero trusted parties. Who was harmed, and how much an agent really spent, are not. Bound keeps the two apart and marks which is which, instead of extending the trustless label over the part it cannot back.

If that distinction matters to your use case, read proof_type before you read anything else.