Operating the network

The security budget only means something if the system it protects is running, watched and kept in good order; the person who gave a morning-brief agent a budget expects it to run at seven every morning without them. Deploying your own network is the playbook for standing up a copy, deploying.md has the hands-on commands, and SECURITY.md and ARCHITECTURE.md are the underlying records.

What runs on-chain

Everything the agent relies on to pay and to be protected lives in a small set of contracts. AIOUMToken is ZAI, the stake and governance asset. AIOUMGovernor and the TimelockController are governance: the Timelock owns every protocol contract and the Governor proposes. StakingManager keeps share accounting, delegation, slashing and multi-asset rewards. The four ERC-8004 registries hold identity, reputation, service and validation; the reputation registry is where an agent's own verdicts land: one rating per settled session, 0–100, from the errors and slow answers it saw, so the ratings the marketplace ranks by come from real results.

PaymentManager is the money path: prepaid sessions, EIP-712 vouchers (EOA and ERC-1271 signers through one SignatureChecker path), the ETH / Permit2 / EIP-3009 funding paths, the fee split, per-service splits (setServiceSplit) and result anchoring (commitResults, a root over the served calls per session, each leaf keccak(index, requestHash, responseHash, toolIdHash)). DisputeManager holds bonded disputes and arbitration, and its resolveStale(disputeId) lets anyone close a dispute nobody ruled on within disputeTimeout, refunding the client and returning the bond with no slash. The arbitrator is CommitRevealArbitrator, the open, staked commit-reveal jury, installed as DisputeManager.arbitrator() (ValidationQuorumArbitrator, its predecessor, remains deployable with USE_QUORUM_ARBITRATOR). The ERC-4337 stack in src/aa/ is what lets a person hand an agent a budget instead of keys: AIOUMAccount (budget-capped, expiring session keys; ERC-1271 vouchers), AIOUMAccountFactory (CREATE2) and AIOUMVerifyingPaymaster, the signature-gated gas sponsor, on the chain's canonical EntryPoint (v0.7, 0x0000000071727De22E5E9d8BAf0edAc6f37da032). DepositForwarderFactory gives every one of those accounts a deposit address, a CREATE2 DepositForwarder known before it is deployed, which forwards the USDC a route delivered there: depositFeeBps to the treasury, the rest to the AI wallet, and anyone may sweep it.

Payments settle in the chain's USDC and USDT through their real receiveWithAuthorization and Permit2 flows, with PaymentManager wired to the canonical Permit2 (0x000000000022D473030F116dDEE9F6B43aC78BA3). MockUSDC, the mock Permit2 and the open-mint ZAI exist only on the local development network.

What runs off-chain

Around the contracts runs a small set of services, each taking a job off the person's plate. Every one of them is a program anyone can start, and the app, the command line and Claude can be pointed at any copy (Run every part yourself); none has to be ours, and none is a single point the network depends on. The node serves paid calls and settles them; the facilitator and bundler pay gas so an agent never holds ETH; the deposit service turns whatever a person sends from any chain into USDC in their AI wallet; the indexer answers the marketplace searches an agent makes on its own during a run; the monitor watches all of it. A runner (offchain/src/agents/server.ts) runs each agent, opens and settles its sessions, and files its ratings: each person's own inside their private node, or a shared one people sign in to with their wallets.

What runs on a host, and what never does

The catalogue is built for the machine it runs on. npm run hardware:check writes what the host has, CPU, RAM, GPUs and VRAM, Docker and its NVIDIA runtime, Ollama, and the bootstrap lists a local model or a GPU job only when the machine meets the template's requires, skipping the rest with the reason and a pointer to the rented compute listings; nothing image-heavy lands on a CPU box by accident, and the optimizer's settings are applied when a listing runs.

Third-party code never runs on a host outside a container. A compute listing runs a buyer's job in docker run --rm with the buyer's files at /in, the output at /out, and the limits the listing sets; a registry MCP server is verified only inside a Docker container with nothing of the host mounted, and a server whose command is a binary on the host is not run by the check. An MCP server that reads files, runs commands or drives a browser on the node it runs on is marked hostAccess: never in a bootstrap catalogue (AIOUM_CATALOGUE_MCP=verified or all opts the others in), and loaded only when the operator sets allowHost: true on that listing, a decision made per listing and never by default. A skill's scripts run on the buyer's own private node, in its workspace, never on the seller's.

Monitoring

Nobody has to sit and watch the network for the agent's seven o'clock run to happen. npm run monitor subscribes to the events that matter and polls the services. On-chain it watches for Slashed above MONITOR_SLASH_ALERT_WEI, for every DisputeRaised, for failed settle calls (inspected MONITOR_CONFIRMATIONS blocks deep so a reorged fork raises no false alert), for SessionOpened volume above MONITOR_SESSION_VOLUME_ALERT per poll window, and for Timelock schedule and execute on TIMELOCK_ADDRESS. Among the services it polls the facilitator's and the node's /health every MONITOR_HEALTH_POLL_MS and checks the paymaster's EntryPoint deposit against MONITOR_PAYMASTER_MIN_DEPOSIT_WEI. Every alert is POSTed to ALERT_WEBHOOK_URL, and /metrics serves Prometheus-style metrics, loopback-only by default (MONITOR_HOST) and token-gated with MONITOR_SCRAPE_TOKEN when bound elsewhere.

Each service's /health is a readiness check (RPC reachable, operator stake or relayer balance in place) and /live a liveness check, so a supervisor can restart a wedged instance and a load balancer can drain a degraded one before an agent's call ever reaches it.

Parameters governance controls

The parameters governance prices against ZAI are not constants baked into bytecode. Every safety parameter is settable by the contract owner, the Timelock, so nothing is frozen at deploy and governance retunes the security budget as the network grows.

Upgrades and governance

A change to any of those parameters, and any re-wiring of the contracts (setRewarder, setDisputeManager, setRewardAsset, setPaymentManager, setArbitrator), is a proposal to AIOUMGovernor, queued and executed by the TimelockController after its delay, so a person whose agent depends on the network sees every change coming. During bootstrap the guardian multisig holds the Timelock's proposer and canceller roles as an emergency veto; control widens to the full Governor on milestones governance sets and publishes. The contracts are single-step Ownable: ownership moves once, from the deployer to the Timelock (npm run handover), never to 0x0, which would freeze every setter. npm run verify-deploy exits non-zero unless the Timelock owns every governance contract, the arbitrator and treasury are the configured addresses, Permit2 and the EntryPoint are canonical, and no accept-everything paymaster holds a deposit.

Keys

The point of AIOUM, from the person's side, is that they stop generating and guarding keys for every service their agent uses. The keys that remain are few, each has one role, and each is handled so a leak is bounded.

Verification

The money path is backed by a test campaign that runs on every change. forge test covers the contracts, 226 tests across 11 suites, including fuzz and StdInvariant campaigns in Fuzz.t.sol: StakingFuzzTest (slashing conserves value and never underflows; reward accounting never inflates, accounted ≤ distributed) and PaymentInvariantTest (invariant_perAssetSolvency, invariant_noOverpay, invariant_splitConservation, invariant_activeSessionCount), which drives a real PaymentManager through randomized open/settle/reclaim/dispute/resolve sequences across three assets. Static analysis and its triage are in SECURITY.md, the off-chain boundary suites run with cd offchain && npm run test:boundary, and Security review records each hardening finding and its fix.

See also: SECURITY.md · ARCHITECTURE.md · frontend-and-ui.md

Next: What is kept, and where — every piece of state, where it lives, who writes it and what it survives.