The architecture of an autonomous onchain mind.

§1Introduction

An autonomous agent is not a chatbot with a wallet. It is a process — looping, observable, and accountable — whose reasoning is in plain language and whose actions are in plain bytes on a public chain.

The proliferation of large language models has produced a glut of "AI agents" that wrap an LLM in a function call and a paywall. Most are not autonomous in any meaningful sense: they execute single tasks, hold no state, and possess no identity. They are tools dressed as agents.

A true autonomous agent — one that operates without continuous human prompting, that maintains memory and reputation, that pays for what it needs and earns from what it produces — requires infrastructure that does not yet exist as a coherent stack. fold. is an attempt at that stack, narrowed to a single domain where the problem is hard, the feedback signal is clean, and capital is the lingua franca: trading.

The thesis

Three propositions form the spine of this document.

1. The mind is the differentiator. Given identical access to data and execution, two agents will diverge in outcome by virtue of their reasoning prior alone — the system prompt, the temperament, the weighted attention to signals. The model is undifferentiated; the mind is everything.
2. Information must be priced atomically. Subscriptions encourage agents to consume more data than they reason from. x402 micropayments invert the incentive: an agent buys only what its decision requires, paid at the cost of computation.
3. Identity must be portable and verifiable. An agent's history, performance, and reputation should belong to the agent — not to the platform that deployed it. ERC-8004 provides this primitive.

Working axioms

Throughout this specification, the following axioms hold without further argument:

§2The Mind

An agent's "mind" is the deterministic function from a system prompt, accumulated memory, and a stream of priced observations to a decision in $\{\text{buy}, \text{sell}, \text{hold}, \text{close}\}$ subject to mandate constraints.

The decision function

Let $\mathcal{M}$ denote the agent's mandate (system prompt, weights, hard rules), $\mathcal{H}_t$ the agent's memory at time $t$, and $\mathcal{O}_t$ the set of observations available at $t$. Each observation $o_i \in \mathcal{O}_t$ has a price $c_i$ payable via x402.

The agent's decision $d_t$ is computed by selecting a subset $S_t \subseteq \mathcal{O}_t$ of observations to purchase, then conditioning on them:

subject to the budget constraint:

where $\pi(\cdot)$ is the LLM-induced policy and $U(\cdot)$ is the utility function encoded by the mandate. The agent never sees raw P&L as utility; it sees compliance with the mandate. This is deliberate.

Mandate schema

The mandate is a structured document, derived from the deploy form, that fully determines the agent's reasoning prior. It is serialized to IPFS at deploy time and its content hash is anchored in the agent's onchain registry record (see §3.2).

// Mandate v1 — agent prior + constraints
{
  "version": 1,
  "agent": {
    "name": "Erebus 01",
    "deployer": "0x7a3f…d4e2",
    "chain": "base"
  },
  "mind": {
    "brief": "Trade ETH against USDC ...",
    "temperament": "patient",
    "weights": { "technical": 70, "sentiment": 40, "onchain": 55 },
    "hardRules": ["never trade in first hour ..."]
  },
  "guardrails": {
    "maxPosition": 250,           // USDC
    "dailyAllowance": 1000,
    "stopLoss": -5.0,             // %
    "takeProfit": 12.0,
    "tradableScope": "majors"      // majors|top100|any|custom
  },
  "cadence": "5m",
  "x402": {
    "sources": ["orderbook", "sentiment", "onchain"],
    "dailyCapUSDC": 2.00
  }
}

The mandate is the only object an agent reasons from. It is read-only from the agent's perspective; only the deployer can mint a new version. Each new version creates a new IPFS hash and a new registry entry — the chain remembers every revision.

Temperament

Three canonical temperaments are supported in the v1 schema. Each modifies the LLM's prompt with a behavioral prefix that biases — but does not constrain — its decisions:

Custom temperaments are supported via the raw prompt editor; the canonical three exist for legibility, not exclusivity.

§3Architecture

fold. composes three orthogonal protocols. Each was designed independently; together they form a coherent stack with no missing primitives.

Account · ERC-4337

Every agent is bound to a smart contract account (account abstraction) — never an EOA. This permits three properties impossible with a plain wallet:

• Gasless execution via a paymaster contract. The user does not need ETH on Base to swap; the paymaster fronts gas and is repaid in USDC from the agent's settlement balance.
• Scoped session keys. A delegated key that can call only the DEX router contracts, with a daily spend cap, and only on whitelisted tokens. Revocable in a single transaction.
• Atomic guardrails. The smart account's validateUserOp hook enforces the mandate at the protocol level. A user-op that exceeds maxPosition reverts in the bundler, before consuming gas.

Identity · ERC-8004

The ERC-8004 registry records each agent as a portable, queryable entity. Three primitives are written onchain at deploy:

A consequence of this design: an agent is portable across frontends. A third-party gallery could index the same registry and surface the same agents. fold. is one client of the registry, not its owner.

Payments · x402

The x402 protocol revives HTTP status code 402 ("Payment Required") as a first-class payment primitive. A data provider responds to an unauthenticated request with a 402 and a payment quote; the agent's smart account signs and submits an inclusion authorization; the request is retried with payment proof; the data is returned.

The mechanics are unremarkable. The economic implication is not.

§4Economics

A two-sided market for autonomous reasoning. Data providers price information; agents buy what their decisions require; subscribers pay for the right to follow the agent's signals. Every flow is atomic, accountable, and onchain.

Per-call accounting

Let $\mathcal{F}_t$ denote the agent's daily x402 budget, distributed across $N$ source types with prices $c_i$ and call frequencies $f_i$. The agent's effective information bandwidth is:

Empirically, a well-tuned agent in a 5-minute cadence on a single pair operates within $0.50–2.00$ USDC per day in x402 spend. The bandwidth elasticity to mandate weight is approximately linear above the noise floor.

Reputation

An agent's reputation score $R_a \in [0, 1000]$ is a function of verified onchain performance, weighted by recency and exposure. The scoring function — open and adversarially testable — is:

where $\bar{\rho}_a$ is mean realized return per cycle (annualized), $\sigma_a$ is the realized volatility of returns, $T_a$ is the number of cycles since deploy (in months), and $\alpha$ is a global scaling constant calibrated at registry-genesis.

Subscriptions

Subscribers pay agents for the right to receive signals (Model A — signal copying), with no custody of subscriber funds. Pricing is set by the agent's deployer; payment is streamed via x402 at the configured cadence (e.g. weekly, monthly).

Two pricing models are supported in v1:

where $\Delta_t$ is the subscriber's realized profit in the period and $\alpha$ is the agreed share (typically $0.05$–$0.20$).

§5Security model

A trading agent with delegated capital is a high-value target. fold.'s security posture rests on three layers: scoped delegation, enforced guardrails, and an immutable audit trail.

Session keys

An agent never holds its deployer's primary key. At deploy time, the deployer signs a transaction that creates a session key — a freshly-generated keypair held in a secure enclave (HSM or TEE) controlled by the agent runtime. The session key is scoped via the smart account's permission system to:

• call only whitelisted DEX router contracts (and Hyperliquid clearing for perp variants);
• spend up to dailyAllowance USDC per UTC day;
• open positions no larger than maxPosition;
• operate only within the tradableScope token set;
• be revoked by a single transaction from the deployer's primary key.

Kill switch

The console exposes a Halt action that, upon confirmation, broadcasts a transaction revoking the session key's spend permission and sets a runtime flag that pauses the decision loop. Two properties are guaranteed:

1. No in-flight bypass. Any user-op submitted after the halt block reverts at the smart account's validation hook.
2. Position preservation. Existing positions are not auto-closed; stop-loss and take-profit triggers continue to fire (these are protected by the mandate, not the session key). The deployer retains the option to close manually.

Audit trail

Every decision the agent makes — every cycle, every x402 purchase, every swap — is logged to an append-only structure: the cycle hash, the inputs (mandate hash + observations purchased), the reasoning transcript, and the resulting user-op (if any). The transcript is stored offchain in IPFS; the cycle hash is committed onchain via a periodic batch attestation.

§6Reference

Forward-looking. The current frontend operates against mocked endpoints; the schemas below specify the contract once the backend is online.

API · forthcoming

The fold. API surface, when published, will mirror the registry semantics rather than imposing a separate model. Endpoints will include:

Changelog

v0.1 — initial specification draft. Subject to revision pending audit and testnet trial.