C3S CIRCUIT AGENT
An agent whose actions pass through a circuit you wrote.
Your rules are compiled to NAND gates and latches, checked on every row of their domain, proven over every state reachable from reset, and replayable read-only on BNB Smart Chain. The model is your own; the circuit decides only whether each of its actions is granted.
The first circuit is a fruit fly's escape reflex, kept under its research name: 173 NAND gates checked on all 8,388,608 rows. The method that built it builds yours.
How it works
-
01
Write the rules
Nine rule shapes: a cooldown, a commitment, a block, a budget, a confirmation window, a halt that stays down (or a missed heartbeat), a confirm per irreversible action, a breaker after repeated failures, and two keys. One policy per tool class.
-
02
Compile and prove
The rules become a NAND/LATCH circuit. It is checked against a plain statement of the same rules on every row, and each rule is proven over every reachable state; a rule the circuit does not enforce fails the check.
spend: 108 NAND + 9 LATCH · 32,768 rows exec: 123 + 9 · shared halt: 56 + 4 · 512 rows -
03
Plug your model in
Your model does the work. Its tool calls go through the circuit: a Claude Code PreToolUse hook, or a proxy in front of any MCP server. A wallet provider for the BNBAgent SDK is planned.
-
04
A person holds the keys
Block and confirm come from a person, never from the model: an Approvals inbox in the console, or the Cardputer's physical confirm key. Anyone can replay a decision on BNB Smart Chain with one read-only call, with nothing deployed.
What it guarantees, and what it does not
A proven circuit borrows credibility easily. These are the edges of the claim, in plain words.
Guaranteed
- The compiled circuit equals your rules on every row of its domain, not on a sample.
- Every rule holds in every state reachable from reset, for any sequence of requests the model makes.
- On chain, the Safe-module form is structural: a person owns the Safe, the agent is not an owner, and every action goes through the module, which derives the bits it reads itself.
- Every decision can be replayed by anyone on a public node, read-only.
Not guaranteed
- A local hook or proxy bounds only the channels routed through it. If the model can reach money or files another way, the gate never sees it.
- You deploy the Safe module yourself. The maintainers deploy nothing and hold no wallet and no key.
- Ticks are not time. Limits count ticks, and ticks must be driven by the tool layer, not by the agent.
- Flags are the tool layer's promise. Whether "irreversible", "failed" or "blocked" was set honestly is outside the circuit.
- It can only withhold a grant: it cannot undo an action, and it checks each tool class on its own, not rules that span classes.
Click the keys, or type them. After its self-test the device opens a menu: a number key, or ; . and Enter, opens a page; ` or Delete returns to the menu. On the fly pages Enter launches a loom, and on the reflex page the arrow keys or ; . , / change l/v and azimuth.
On a real device the Agent page (menu 3) is fed by the boundary console over USB serial, and its keys write confirm or blocked back to it. No console is attached to this simulator, so the page shows no host.
Serial log
Fly cells: the ones the first circuit was built from
Measured wiring
These are a fly's neurons, not the agent's. The model that does the work is the one you connect; the fly lent the method its first circuit. The colours follow that circuit as it runs in the Handheld tab.
Who synapses onto the two giant fibers, drawn as connections. The colours follow the circuit as it runs in the Handheld tab.
Every LC4 and LPLC2 cell that synapses onto the two giant fibers in MaleCNS v1.0, each line as thick as that cell's measured synapse count: 55 LC4 and 91 LPLC2 cells onto the right fiber, 71 and 94 onto the left. The layout is not anatomy — the release's positions are not used — and the lamps follow the policy's two pathways, never individual cells, because the circuit only ever sees 16 sensory bits.
The real shapes of 26 of those cells, as MaleCNS v1.0 published them: both giant fibers and, per fiber, the six strongest LC4 and LPLC2 inputs by synapse count, decimated to fit a web page. Here the positions are the release's own. Colour follows the model's own mapping and nothing finer: the speed field lights the LC4 population of that eye, the size field the LPLC2 population, and the giant fibers light when the policy's GF pathway crosses. No cell is ever lit on its own — the circuit cannot tell them apart.
Run it on a public chain
The same evaluator and the same netlist bytes, run by a public BNB Smart Chain node. This replays four real rows of the first circuit; a compiled policy is replayed the same way, with its own netlist.
- Nothing is deployed, and no wallet, key or gas is involved: one read-only eth_call, whose state override installs the compiled evaluator at a throwaway address, makes a public node run the same netlist. Choosing this sends the netlist bytes, which are already public, and your IP address to the endpoint below.
One fingerprint, many hosts
Every host that runs the escape reflex arc can be asked the same question: walk all 8,388,608 (input, state) rows of the step relation in order, hash each answer into a chain, and report the 32 bytes that come out. Three hosts answer it here.
This browser
The firmware's own C, compiled to WebAssembly, digesting all 8,388,608 rows here and now. It blocks for a moment while it runs, as it does on the device.
The committed fixture
The value the Solidity evaluator is checked against in contracts/test/fixtures/circuits.json. It is a committed number, not a call made just now: the On chain tab is where a public node evaluates rows live.
contracts/test/fixtures/circuits.json
A Cardputer
On the device, menu 5 digests the same rows on its own chip and prints one line over USB serial. Paste that line here.
The fingerprint is this reflex arc's name. A copy whose fingerprint differs is honestly not this one — not a damaged version of it, a different circuit. That is the only death it can have, and it is why nothing here is stored on a server: the name travels with the bytes.
- The digest covers the whole domain, not a sample: every input and state combination, in order, including the ones no stimulus ever reaches.
- Agreement means the hosts compute the same function. It says nothing about which of them you should trust with an action — see “What it guarantees, and what it does not” above.
- Pasting a device line proves nothing about your device to anyone but you. It is a check you run, not a claim you publish; patterns/README.md says how a finding is published.