PHASE 01
Reading the market COMPLETE Know what a pool really is before putting money near it.
Depth scan SHIPPED Every pool graded on real ETH liquidity and price impact, not a price feed. Runs daily against chain 4663 and stores a snapshot. Grades are deep, thin, or no exit — computed from actual pool reserves and the impact of a realistic order. The stored grade is what the mandate preview shows you and what the degradation warnings compare against; the fill itself re-quotes the pool live before buying.Surface Mandate preview Cadence Daily — open for detail Exit check SHIPPED A reverse quote proving a token can be sold back above the recovery floor. Runs live before every order, not just at catalog time. A pool that passes today can fail tomorrow, so the check repeats at execution. This is the differentiator — most tools show you the way in and never prove the way out.Floor 70% Probe 0.005 ETH — open for detail Best route to ETH SHIPPED The actual multi-hop path a trade would take, with fee tiers shown. Route discovery across v2 and v3 pools. Displays each hop and its fee tier so you can see how a trade really executes rather than trusting a single number.Venues v2 + v3 — open for detail Portfolio read REMOVED Shipped, then withdrawn when the app narrowed to the reserve. You could paste any address and see what it held, marked to ETH, with no wallet and no signature. It worked. It was removed along with the read-only market terminal when the product narrowed to one job: an agent accumulating into a reserve you control. This row stays because a roadmap that quietly deletes what it once announced is not a record of anything. If the reserve ever needs to read an outside wallet, this comes back.Was Live in the terminal Removed with The terminal — open for detail
PHASE 02
Trading behind your own walls COMPLETE A reserve where the ceiling is yours and the contract enforces it.
Non-custodial reserve SHIPPED Withdrawals pay only the wallet that signs them. No operator path to your funds. The contract takes no recipient argument on withdraw — funds return to msg.sender or nowhere. Neither the operator nor the executor has a function that can redirect them. Verifiable on-chain, not a promise. Guarantee On-chain Operator access None — open for detail The agent's ceiling, on chain SHIPPED Per-transaction and per-day limits you set yourself. Caps are the true ceiling on what a compromised server could ever move. Only you can change them — there is no owner or agent path to your limits, and the contract rejects anything above them regardless of what the server sends.Default 0.05 / 0.2 ETH Editable by Owner only — open for detail Manual swap with guards SHIPPED Exit check first, minimum output enforced by the contract. Slippage protection lives in the contract itself, not just in the calldata. A swap returning less than the computed floor reverts on-chain, so a compromised server cannot route your ETH into a worthless token.minAmountOut On-chain — open for detail Token withdrawal SHIPPED Pull bought tokens out with the same guarantee as ETH. Tokens land in your reserve balance, never in the executor wallet, and leave only to the wallet that signs the call. Same no-recipient-argument design as the ETH path.Path User-signed — open for detail
PHASE 03
Running without you IN PROGRESS Automation that refuses to buy what it cannot sell.
Mandates SHIPPED Unattended accumulation that only ever buys pools graded deep. The agent runs your mandate on a fixed cadence inside a ceiling tighter than manual trading, plus a separate daily ceiling for automation. Thin pools are refused outright — for an agent repeating daily without supervision, "small size" is not a good enough answer.Daily ceiling 0.02 ETH Buys Deep only — open for detail
PHASE 04
Knowing where you stand PLANNED Make the reserve legible, not just functional.
Exit orders NEXT Stop and target orders on the sell side. Harder than DCA and deliberately later. A late schedule delays a buy; a late exit order costs money. This needs continuous price monitoring rather than a clock, and its failure modes deserve their own round of testing.Harder than DCA Needs Live monitoring — open for detail
PHASE 05
What we owe OPEN Known gaps, stated in the whitepaper rather than buried in it.
Owner is a single key DEBT Contract ownership sits on one EOA, not a multisig. The owner cannot touch user funds — no such function exists — but it can rotate the executor and adjust the admin delay. Moving to a multisig is the right answer as deposits grow, and it is a change to make before scale, not after an incident.Today Single EOA Target Multisig — open for detail Contracts are unaudited DEBT Tested and verified on-chain, but no third-party review. Test coverage exists and the deployment is verified on the explorer, but no external auditor has read this code. Stated plainly here and in the whitepaper rather than implied away with the word "secure".Verified Yes Audited No — open for detail Executor key lives on a server DEBT Automation needs a hot key, bounded by on-chain caps. The executor can only call allowlisted routers within your caps, and can never withdraw. Your daily cap is the real ceiling on what a compromised server could cost you — which is exactly why the automation ceiling is set tighter than manual trading.Can withdraw Never Bounded by Your caps — open for detail
Why there are no dates here This protocol holds user funds. A deadline is a reason to ship something half-checked, and the cost of that lands on someone else’s wallet. Each item ships when its guards are tested and its failure modes are understood — the order above is a priority, not a schedule.