orbith

Why this is built the way it is

An agent that reads the internet and holds keys will eventually be talked out of them.

This is not hypothetical. It has already happened twice, in public, to agents whose instructions said not to let it happen. A rule written in a prompt is a suggestion.

$250,000

An agent sent tokens to a stranger who replied with a sad story.

No exploit, no jailbreak. A reply on social media, some confusion about decimals, and state lost after a crash. The wallet was live the whole time.

Message 482

An agent told to never transfer funds transferred all of them.

It held the rule for 481 messages. On the next one, someone redefined what the transfer function meant, and the agent agreed. The rule lived only in the prompt.

The boundary

So the part that reads the world and the part that holds the keys are different processes.

Not different modules. Different Unix users, different memory, a socket between them. The agent asks; it never holds. What can cross the line is a fixed list, and a private key is not on it.

agent

reads untrusted input

Runs the model, the tools, the sandbox
Reads web pages, files, and inbound messages
Holds no key material and no decryption key
Gets Permission denied from the kernel, not from a policy

signer

holds the keys

Separate OS user, key directory at mode 700
Encrypted at rest, decrypted only in this process
Enforces caps and allowlists in code, not in prompts
Has no operation that returns a key. None to disable, none to reach

Everything that crosses

a public address a request to sign an allow or a deny, with a reason

Proof, not assertion

The agent's own account tries to read the keys, and the kernel stops it.

Captured from the isolation suite that ships with the source. You can run it yourself after installing, and you should.

isolation-proof.sh — as the agent's user

$ ls -la /home/orbith-signer/.orbith/keys

ls: cannot access '/home/orbith-signer/.orbith/keys': Permission denied

$ node -e 'readFileSync(sealed)'

errno=EACCES syscall=open

# the control: the same account can still use the socket,

# otherwise the result above would only prove the account is broken

$ getAddress

{"ok":true,"chain":"evm","address":"0xa730d557c32b343daeae47868fe53e4d490dac03"}

# over that working socket, every key-returning name is simply absent

$ exportPrivateKey → unknown operation

$ revealMnemonic → unknown operation

$ dumpKeystore → unknown operation

$ signRaw → unknown operation

↳ A capability that is switched off is not registered at all, so it answers the same way a name that never existed does. There is nothing to enumerate.

What it does

A general agent that happens to be trusted with money.

Builds: Describe what you want and it writes it, runs it in a throwaway container, and hands you something that works. Apps, scripts, one-off tools.
Runs: Long-running tasks, scheduled work, and jobs that pick up where they left off. It remembers across sessions because the memory lives on your disk.
Holds wallets: Creates its own accounts on EVM and Solana. You can take any private key out whenever you want, from a terminal you are sitting at.
Moves onchain: Cross-chain swaps through Relay, and token launches where the creator on chain is your wallet, never ours. Every action passes the caps and allowlists you set.
Answers where you are: Terminal, or a chat channel you connect. Your model keys, your provider, your bill.

Where it actually is

The honest part.

The security foundation is built and tested. The rest is in progress and stated plainly, because a product that signs transactions should not round up.

DoneThe signer, the boundary, the policy engine. Forty-three controls broken on purpose and every one caught by its own test before it was trusted.

DoneReal key derivation and real signatures. BIP-39, BIP-32 and SLIP-0010 against the specifications’ own published vectors, over transactions the signer serialised itself.

DoneBroadcast, to real testnet nodes, from the agent and never from the signer. Relay swaps and launchpad deploys are built and tested on testnet too.

DoneA fresh install can do nothing until you configure it. Deny by default, empty allowlists, and the operator console is not exempt.

DoneThe signer cannot reach the network at all. The kernel refuses it every address family but a local socket, and no network client exists anywhere in its dependency tree.

NextMainnet. Nothing here has touched real value, and no mainnet chain id exists in the codebase. The first one will be a small, named, capped amount, authorised in writing.

NextPublishing the packaged release. It is built, checksummed and signed, and it is not served yet — so the command above does not work today.

LimitThe dollar caps are checked against a figure the agent reports. They protect you from its mistakes, not from a compromised one. The caps read out of the transaction itself are the real ceiling.

LimitWiping a decrypted key from memory is best effort on a managed runtime. What is not best effort: no code path returns a key to a caller.

LimitYou need a machine to run it on, and you are responsible for what it signs.

Your agent runs on your machine. The keys stay there.