Session keys, not wallet keys — a Stylus (Rust) vault that cages AI trading agents with hard on-chain limits.
AI agents can trade autonomously, but they need signing authority — and a wallet key is all-or-nothing. One prompt injection or runaway loop empties the account. Every existing safeguard lives off-chain, in the same process as the thing it guards.
Vigiles is a self-custody vault on Robinhood Chain. The user deposits tokenized stocks into a contract that never releases them to anyone but the user, then mints a revocable session key for their agent. Eight guards are enforced inside executeTrade, in a fixed order, before any external call: spend caps (per-trade + rolling 24h), token/venue whitelist, trading window, velocity limit, position cap, dead-man heartbeat, mandatory intent receipts (keccak256 of the agent's rationale, emitted on-chain), and a per-user Chainlink-priced floor with sequencer-uptime check. No admin key.
Written in Rust on Arbitrum Stylus (21.9 KB brotli, zero unsafe), with a line-for-line Solidity twin so Foundry fuzz/invariant suites exercise the same rules (50 Foundry + 35 Rust tests, invariants over 128k calls). Ships with a live dashboard (in-browser agent key, six one-click attack scenarios, tamper-evident intent verifier) and an MCP server so Claude Desktop / Cursor can trade through the cage.
Pre-event (as "AgentShield"): a v2 scaffold — spend caps, whitelist, epoch revocation, Solidity twin with tests, mocked UI. Not deployable (WASM over the 24 KB limit), no chain integration.
During the buildathon: the five agent-specific guards (trading window, velocity limit, position cap, dead-man switch, intent receipts); oracle price floor ported to Stylus with per-user feeds; size engineering that made the contract deployable (limb-wise U256 division, immediate-abort panic strategy, wasm-opt) — 21.9 KB brotli; three security fixes found in review (exported reentrancy helpers, wrong ABI type on calldata, global feed registry); real viem dashboard with attack scenarios and intent verifier; MCP server on the official SDK; deployment to Robinhood Chain testnet verified end-to-end on-chain (7 guards + revoke exercised live).
Bootstrapped / not raising