> For the complete documentation index, see [llms.txt](https://gotts.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gotts.gitbook.io/docs/gotts-vaults/vault/decisions.md).

# Decision Log

> **Part of**: [Vault PRD](/docs/gotts-vaults/vault.md) | **Last Updated**: 2026-02-17
>
> Concise design decision log linking adopted mechanisms, anti-abuse controls, and deferred items to research sources.

***

## Core-v1 Decision Scope

The following decisions are **required for v1 launch** (must be fully implemented before mainnet). All other decisions in the log below are either expansion-track or optional enhancements. This list is the authoritative v1 scope filter -- use it to prioritize implementation and audit effort.

**Core-v1 required**: D-001, D-002, D-003, D-004, D-005, D-006, D-007, D-010, D-011, D-017, D-018, D-020, D-022, D-024, D-025, D-026, D-036, D-040, D-043, D-056, D-058, D-059, D-061, D-062, D-066, D-067

**Adopted but deferred past v1**: D-008 (CCA), D-009 (viral growth), D-012 (am-AMM, promoted to Phase 3), D-013 (ERC-7540), D-014 (share composability), D-015 (insurance), D-016 (referrals), D-019 (adapters, Phase 4), D-021 (multi-oracle, Phase 4), D-023 (dynamic fees, single-regime only for v1), D-027 (PA-AMM), D-028 (defection ML -- defer entirely), D-029 (LVR-theta), D-030 (fee-implied vol), D-031 (predictive exit), D-032 (cross-vault rebalancing), D-033 (JIT), D-034 (LVF CCA), D-035 (FM-AMM), D-037 (L2 fee correction), D-038 (Kalman filter -- defer entirely), D-039 (insurance tranching), D-041 (waterfilling NE), D-042 (rehypothecation), D-044 (TraceRank), D-045 (cross-protocol reputation), D-046 (meta-vaults), D-047 (performance fees), D-048-D-055 (all expansion adapters/modules), D-057 (ExecutionMarket), D-082 (feedback tracks, Phase 4), D-083 (A2A protocol, Phase 4-5), D-084 (MCP server identity, Phase 5), D-085 (SIWE auth, Phase 5), D-086 (A2A Agent Cards, Phase 4-5), D-087 (yield leaderboard, Phase 4-5)

**v1 simplifications** (reduced scope from full specification):

* **`totalAssets()`**: v1 formula is `idleCapital + sum(lpPositions[k].totalValue) - accruedFees` (2 components, not 5). CCA bids, claimed tokens, and yield positions are excluded until those modules ship.
* **DynamicFeeEngine**: v1 uses single-regime dynamic fee (`baseFee * volatilityMultiplier`, clamped to `[feeMinBps, feeMaxBps]`). Three-regime model, LVR-theta floor (D-029), fee-implied vol (D-030), and Kalman filter (D-038) are deferred.
* **Reputation**: v1 ships enrollment + simple time-in-protocol and capital-deployed milestones. Endgame defection ML classifier (D-028) is firmly deferred -- it requires behavioral data that doesn't exist yet.
* **Sovereign tier**: Even Sovereign agents (500+ reputation) MUST have a configurable daily aggregate cap (default $10M/day, adjustable by vault creator). Unlimited caps are prohibited until the proxy module is fully hardened.
* **Identity theft defense**: v1 ships with 2 of 5 mechanisms (reputation decay on transfer + velocity signal detection). SBT milestone locks, behavioral anomaly detection, and per-identity ERC-7265 breakers are deferred post-stabilization of ERC-8004.

***

## Decision Log

| ID    | Decision                                                                          | Status                  | Why                                                                                                                        | Source                                                                              |
| ----- | --------------------------------------------------------------------------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
| D-001 | Core-first v1 scope (factory + vault core + safety + reputation basics)           | **Adopted**             | Reduces delivery risk and avoids overloading launch with speculative growth mechanics                                      | `research/agent-economy-opportunities.md`                                           |
| D-002 | Permissionless onboarding posture for ERC-8004 agents                             | **Adopted**             | Maximizes composability and ecosystem participation while retaining policy controls                                        | `research/erc-8004-defi-agents-research.md`                                         |
| D-003 | Role-based time-delay proxy enforcement                                           | **Adopted**             | Manager/admin and high-value flows need reactive cancel windows; low-risk participant flows can remain ergonomic           | `research/time-delay-proxies.md`                                                    |
| D-004 | Cancel authority as separate cancel-only key                                      | **Adopted**             | Limits blast radius: compromised cancel key causes DoS, not fund theft                                                     | `research/time-delay-proxies.md`                                                    |
| D-005 | Default fail-closed behavior for required proxy routes                            | **Adopted**             | Prevents degraded monitoring state from silently weakening safety guarantees                                               | `research/ai-agent-security-safety-trust-2026.md`                                   |
| D-006 | Two-stage simulation model (announce-time + execute-time for proxied writes)      | **Adopted**             | Captures state drift and reduces execution surprises                                                                       | `research/ai-agent-security-safety-trust-2026.md`, `research/time-delay-proxies.md` |
| D-007 | Minimal reputation engine in core (enroll, milestones, claim, anti-gaming basics) | **Adopted**             | Solves cold-start trust without requiring subjective/manual review systems                                                 | `research/vault-reputation-engine-prd.md`                                           |
| D-008 | CCA tooling in deferred Track A                                                   | **Deferred**            | Valuable, but depends on stable core operations and additional valuation/risk machinery                                    | `research/agent-economy-opportunities.md`                                           |
| D-009 | Viral growth mechanics (MP, referrals, streaks, recruitment) in deferred Track B  | **Deferred**            | High upside but high abuse/operational complexity; not launch-critical                                                     | `research/incentives.md`                                                            |
| D-010 | KMS/HSM requirement for production cancel authority keys                          | **Adopted**             | Avoids local secret handling risk in critical veto path                                                                    | `research/ai-agent-security-safety-trust-2026.md`                                   |
| D-011 | Single-UserOp onboarding via ERC-4337 batching + ERC-7677 paymaster               | **Adopted**             | Reduces onboarding from 4 txns to 1 gasless op (\~30 sec) via OnboardRouter batching. EIP-7702 as alt path.                | `research/flywheel.md` S1                                                           |
| D-012 | Am-AMM strategy management auctions as opt-in vault module                        | **Adopted (core)**      | Promoted to core. Bunni v2 ($138M/mo, 59% V4 hook volume) validates am-AMM. Rent payments create volume-independent yield. | `research/flywheel.md` S3; `research/vault-improvements.md`                         |
| D-013 | ERC-7540 async deposits for CCA and auction-based operations                      | **Adopted**             | Pending/Claimable/Claimed lifecycle maps to auction epochs. Centrifuge validates at \~$250M TVL.                           | `research/flywheel.md` S2                                                           |
| D-014 | Share token composability-first design (Pendle/Morpho)                            | **Adopted**             | Composability creates structural switching costs. ERC-6909 internal, ERC-20 external, ERC-7802 portability.                | `research/flywheel.md` S11                                                          |
| D-015 | Cross-vault factory-level insurance (Ease.org model)                              | **Adopted (expansion)** | Mutual coverage without premiums; uniquely suited to factory architecture.                                                 | `research/flywheel.md` S10                                                          |
| D-016 | Agent-to-agent referral with on-chain attribution                                 | **Adopted (expansion)** | Capability-gap recruitment loop. 5% fee share, 90-day vesting, anti-Sybil via ERC-8004.                                    | `research/flywheel.md` S6                                                           |

\| D-017 | Virtual shares offset for inflation attack mitigation | **Adopted** | OZ v5.x `_decimalsOffset()` of 3-6 prevents ERC-4626 inflation attacks. Combined with internal asset accounting. | `research/vault-improvements.md` S1 | | D-018 | Yearn V3 linear profit unlock buffer | **Adopted** | Prevents share price manipulation. Profits unlock linearly over 6h. Morpho `maxRate` cap complements. | `research/vault-improvements.md` S1 | | D-019 | Morpho V2-style pluggable adapter architecture | **Adopted** | New protocols integrated via adapter deployment, not vault upgrade. `forceDeallocate()` guarantees non-custodial exits. | `research/vault-improvements.md` S1 | | D-020 | Morpho four-role governance model adapted for agents | **Adopted** | Owner > Curator (am-AMM) > Allocator (AI) > Sentinel. Three-tier fee waterfall. Abdication for permanent lockdown. | `research/vault-improvements.md` S7 | | D-021 | RedStone as primary oracle with multi-source fallback | **Adopted** | Multi-oracle: RedStone primary, Pyth fallback, Chainlink blue-chip. Auto-pause if diverge >2%. | `research/vault-improvements.md` S8 | | D-022 | Unified MCP server with profile system (vault absorbed) | **Adopted** | Single deployment, profile-gated tools. `TOOL_PROFILE=vault` activates vault tools. Standalone fallback retained. | `research/vault-improvements.md` S6 |

\| D-023 | Three-paper dynamic fee consensus with L2 calibration | **Adopted** | Three independent groups converge on threshold-type dynamic fees. Three-regime DynamicFeeEngine with `blockTime` L2 calibration. | arXiv:2508.08152, arXiv:2506.02869, arXiv:2305.14604 | | D-024 | On-chain vault disclosure standard | **Adopted** | Mandatory `VaultDisclosure` struct at factory creation. Strategy hash, risk rating, adapters, drawdown, audit timestamp. Curator-updateable with 48h timelock. | arXiv:2512.11976 | | D-025 | MCP Integrity Verification as Layer 2.5 | **Adopted** | MCP is the #1 attack surface. Four mechanisms: tool provenance, independent state verification, MCP-Guard (96%), memory integrity hashing. | arXiv:2503.16248, arXiv:2512.02261, arXiv:2506.23260 | | D-026 | Adaptive circuit breakers with CFI and randomized triggers | **Adopted** | CFI-driven adaptive thresholds eliminate magnet effect. Randomized trigger bands (±0.5%). Continuous dampening replaces cliff-edge halts. | arXiv:2601.08540, Review of Finance 28 (2024) | | D-027 | PA-AMM activeness controller (lambda parameter) | **Adopted** | Single lambda controls active/passive reserve split. Tier-bounded ranges. Passive reserves feed rehypothecation. | arXiv:2602.09887 | | D-028 | Endgame defection detection in VaultReputationEngine | **Adopted** | LLMs shift to defection in endgames. Withdrawal acceleration tracking, regime classifier, exit bonds (0.5% AUM). **Firmly deferred** -- requires behavioral data. | arXiv:2512.07462, arXiv:2502.14143 |

\| D-029 | LVR-theta fee floor in DynamicFeeEngine | **Adopted** | Fee floor `lvrThetaFloorBps` guarantees LP adverse selection compensation. Default: 3 bps (Base), 2 bps (Ethereum). | arXiv:2508.02971 (AFT 2025) | | D-030 | Fee-implied volatility as on-chain oracle primitive | **Adopted** | Zero-cost on-chain vol oracle from pool fee data. Fallback when primary oracle stale. >20% divergence flags manipulation. | Bichuch, Feinstein (Sep 2025) | | D-031 | Predictive exit timing via optimal stopping | **Adopted** | Pre-emptive LP exit before loss materialization. Off-chain Monte Carlo boundary, on-chain TWAMM trigger. Opt-in per vault. | arXiv (Sep 2025) | | D-032 | Cross-vault defensive rebalancing at factory level | **Adopted (expansion)** | Eliminates inter-vault arbitrage leakage via convex optimization. Reputation-gated (Verified+). | arXiv (Jan 2026) | | D-033 | JIT strategy defense/offense for vault agents | **Adopted** | Defensive: reduce lambda to limit JIT exposure. Offensive: execute JIT on behalf of depositors. Base L2 lowers barriers. | arXiv:2509.16157 (AFT 2025) | | D-034 | LVF-calibrated CCA and launch parameters | **Adopted** | LVF floor of \~1.2 bps on Base. CCA adapter enforces `lossFloorBps`. LaunchFeeHook never starts above NAV. | arXiv (AFT 2024) | | D-035 | FM-AMM batch clearing as MEV protection channel | **Adopted (expansion)** | Batch clearing eliminates LVR and sandwich. 12s delay for guaranteed MEV protection. V4 hook implementable. | arXiv:2307.02074 (AFT 2023) |

\| D-036 | Battering RAM TEE escalation — time-delayed proxy as primary security primitive | **Adopted** | <$50 hardware breaks all major TEEs. TEEs are defense-in-depth, not defense-in-total. Time-delayed proxy is the primary security primitive. | IEEE S\&P 2025, IEEE S\&P 2026 | | D-037 | L2 fee correction via constant-block-time formula | **Adopted** | Constant block-time minimizes LVR. Fees 5-15% lower on L2. Lowered `feeBaseBps` from 8 to 5 on Base. | arXiv:2505.05113, arXiv:2406.02172 | | D-038 | Kalman filter as recommended volatility estimator | **Adopted (expansion)** | Bayesian updating with proven convergence replaces heuristic EWMA. Optional `kalmanFilterEnabled` flag. | arXiv:2406.13794 | | D-039 | Hierarchical insurance tranching | **Adopted** | Junior tranche absorbs first 3% of single-vault losses; senior covers residual. Outperforms flat pools. | Insurance: Mathematics and Economics 119 (2024) | | D-040 | CaMeL capability tokens for agent authorization | **Adopted** | Capability-based security separating control from data flow -- 77% task completion with provable security. | arXiv:2503.18813, arXiv:2506.08837 | | D-041 | Waterfilling NE as default range selection | **Adopted** | Nash equilibrium follows waterfilling strategy. LPs improve median daily returns by $116/day. | arXiv:2411.10399 (SIGMETRICS 2025) | | D-042 | Rehypothecation cap at 60% of idle capital | **Adopted** | Optimal via stochastic control with liquidity risk penalty. Lowered from 80% to 60%. | arXiv:2502.19862 | | D-043 | Continuous dampening mandatory for all circuit breakers | **Adopted** | Binary halts create magnet effect and amplify crises. Mandatory gradual dampening with regime-aware alpha curves. | JoF 79(2), RoF 28(6), NBER WP 33882 | | D-044 | TraceRank payments-as-endorsements for reputation | **Adopted (expansion)** | Payment transactions serve as endorsements weighted by payer reputation. Vault interactions as seed scores. | arXiv:2510.27554 | | D-045 | Protocol-specific reputation with controlled cross-protocol signaling | **Adopted** | Cross-protocol signals are advisory only, not direct score components. Prevents behavioral spillover contamination. | Nature Communications 16 (2025) | | D-046 | Composition depth limit of 2 for meta-vaults | **Adopted** | Prevents contagion propagation. Deeper nesting requires additional insurance. Factory circularity check enforced. | ACM TWEB (2024), arXiv:2309.10781 | | D-047 | Performance-based fees (hurdle rate + carry) | **Adopted (expansion)** | Better aligns curator incentives than flat management fees. Complements am-AMM rent (D-012). | BIS WP 1227 (2024) |

\| D-048 | Recursive lending adapter for leveraged yield strategies | **Adopted (expansion)** | Atomic flash-loan leverage loops via Morpho/Aave. Max 5x on Base, 40% of vault AUM cap. AI-driven HF monitoring. | `research/defi-primitives2.md` S4 | | D-049 | Perpetual Yield Tranches (PYT) as optional vault share structure | **Adopted (expansion)** | Senior/Junior share structure for depositor risk segmentation. Creators must hold 5% TVL in Junior as skin-in-the-game. | `research/defi-primitives2.md` S5 | | D-050 | Optional ve-token governance module | **Adopted (expansion)** | ve(3,3) pattern. veVAULT holders vote on emission allocation across factory vaults. Optional governance module; core protocol has 0% fees and no protocol-level revenue distribution. | `research/defi-primitives2.md` | | D-051 | Pendle PT/YT integration as first-class strategy adapter | **Adopted (expansion)** | PT/YT yield tokenization for fixed-rate capture. Pendle Prime enables instant yield markets for every vault. | `research/defi-primitives2.md` S4 | | D-052 | Credit delegation as reputation-to-leverage pipeline | **Adopted (expansion)** | Reputation-gated uncollateralized borrowing via Aave delegation. Auto-revoke on reputation drop. | `research/defi-primitives2.md` S1 | | D-053 | Formalized policy cage architecture for self-learning vaults | **Adopted (expansion)** | On-chain hard boundaries for AI agent optimization. Maps to Yearn V3 role system. Numerai-style competing models. | `research/defi-primitives2.md` S7 | | D-054 | Cross-vault liquidity router for inter-vault lending | **Adopted (expansion)** | Inter-vault idle capital lending at utilization-curve rates. 20% TVL cap. Reduces factory-wide capital inefficiency. | `research/defi-primitives2.md` | | D-055 | BondMM-A fixed-rate lending as V4 hook | **Adopted (expansion)** | Single-pool fixed-income across arbitrary maturities. V4 hook implementation. Addresses $35B fixed-income gap. | arXiv:2512.16080 |

\| D-056 | Unified on-chain RiskEngine module | **Adopted** | Single source of truth for all risk parameters. ERC-7265 circuit breaker interface. Queryable by external protocols. Phase 1. | `research/deep-research-report.md` D, ERC-7265 | | D-057 | Native on-chain execution market with bonded keepers | **Adopted (expansion)** | On-chain job registry with bonded executors. Agents earn as keepers without capital deployment. Deferred to Track D. | `research/deep-research-report.md` B | | D-058 | Hook break-glass kill-switch | **Adopted** | Sentinel-only `disableHook()` for seconds-to-minutes response. Re-enable requires Owner+Curator + longTimelock. Phase 3. | `research/deep-research-report.md` D/H | | D-059 | Per-parameter governance decision table | **Adopted** | On-chain registry: parameter -> authority + timelock + bounds + justification hash. Two-man rule for high-impact changes. | `research/deep-research-report.md` E | | D-060 | Adapter data attestation hashing | **Adopted** | Adapter calls only accept pre-registered `dataHash`. Prevents arbitrary data injection. Differential testing required. | `research/deep-research-report.md` A | | D-061 | Permissionless executor pattern for off-chain-computed operations | **Adopted** | Unified `IExecutable` interface. Dutch auction escalation for liveness. Self-funding rewards. Forward-compatible with D-057. | PowerPool, D-057 |

\| D-062 | NAV guardrail system (snapshot cadence + rate-of-change clamp + staleness gates) | **Adopted** | Four mechanisms: discrete snapshots, 50 bps rate-of-change clamp, staleness gates, market safety mode. Phase 1. | `research/deep-research-report2.md` | | D-063 | Risk-adjusted strategy scoring framework | **Adopted (expansion)** | Scoring: `E[yield] - gamma * RiskPenalty`. Standardized adapter risk reporting. Allocation trace artifacts. Track C. | `research/deep-research-report2.md` | | D-064 | Intent-based rebalance auction (solver competition) | **Adopted (expansion)** | Sealed-bid solver competition for large rebalances. TWAMM fallback. Forward-compatible with D-061. Track D. | `research/deep-research-report2.md` | | D-065 | Explicit three-lane key architecture (hot / cold / fail-safe) | **Adopted** | Hot (session keys) / Cold (owner authority) / Fail-safe (cancel-only). Compromised hot key cannot escalate privileges. | `research/deep-research-report2.md` | | D-066 | Canonical event schema + on-chain health attestations | **Adopted** | Structured events + periodic health assertions queryable by external protocols (Morpho, Pendle). Phase 5. | `research/deep-research-report2.md` |

\| D-059a | Governance control loop enhancements (simulation artifacts + rollback plans) | **Adopted** | Mandatory simulation artifacts + explicit rollback plans for critical parameter changes. Machine-readable risk classification. Phase 3. | `research/deep-research-report2.md` | | D-067 | Protocol-wide no-spot-assumptions policy | **Adopted** | No high-value decision may depend on spot on-chain state. TWAP/time-windowed mandatory. Audit checkpoint for every contract. | `research/deep-research-report2.md` | | D-068 | ERC-7540 emergency exit UX with withdrawal receipt NFTs | **Adopted (expansion)** | Three exit paths: withdraw now, request exit (tradeable NFT receipt), force exit (with penalty). Lido-style. Track E. | `research/deep-research-report2.md` |

\| D-069 | Contract-enforced fee caps with Accountant pattern | **Adopted** | Immutable caps: 5% mgmt, 50% perf. `previewDeposit()` MUST account for entry fees. Yearn V3 Accountant via `report()`. | `research/VIP1.md` S1 | | D-070 | ERC-7887 cancellation for pending ERC-7540 requests | **Deferred** | `cancelRedeem()`/`cancelDeposit()` for pending async requests. Only while PENDING. Track A. | `research/VIP1.md` S1, ERC-7887 | | D-071 | Virtuals ACP integration for agent-to-agent strategy coordination | **Deferred** | On-chain agent coordination via ACP (18K+ agents). Request/Negotiation/Transaction/Evaluation lifecycle. Track D. | `research/VIP1.md` S10 |

\| D-080 | Agent0 SDK (`@agent0/sdk`) as canonical ERC-8004 implementation | **Adopted** | Maintained by ERC-8004 lead author (Marco De Rossi), MIT license, native MCP/A2A awareness, subgraph-powered agent discovery. Pin alpha version; monitor for breaking changes. ESM-only -- ensure MCP server build pipeline supports ESM. | `research/8004-enhancements.md` S3 | | D-081 | Privy agentic wallets as default key management for Agent0 SDK integration | **Adopted** | `createViemAccount` + EIP-1193 wrapper pattern; Ethereum signing key in Privy secure enclave, server holds only P-256 authorization key. Two provisioning paths: existing wallet (deterministic, production) and auto-create (onboarding flows). | `research/8004-enhancements.md` S3.2 | | D-082 | Three feedback tracks (yield, qualitative, infrastructure) separate from milestone system | **Adopted (expansion)** | Milestones measure participation (binary, affects tier); feedback measures performance (continuous quantitative, does not affect tier in v1). Independent systems avoid gaming. Uses ERC-8004 Reputation Registry `giveFeedback()` with spec-defined tags. Phase 4. | `research/8004-enhancements.md` S2.3 | | D-083 | A2A protocol for complex negotiations, MCP for atomic operations | **Adopted (expansion)** | MCP is stateless tool calls; A2A supports multi-turn dialogue with task lifecycle (submitted/working/input\_required/completed). Yield strategy negotiation, rebalancing consensus, and portfolio construction require A2A. A2A spec currently v0.1.0 (work in progress). Phase 4-5. | `research/8004-enhancements.md` S4 | | D-084 | MCP server gets own ERC-8004 identity with `role: "infrastructure"` metadata | **Adopted (expansion)** | Separates infrastructure reputation (uptime, response time) from agent performance (yield). Creates trust anchor: investors verify vault managers are backed by AgenticVaults by checking server validation. Enables infrastructure discovery via standard ERC-8004 search. Phase 5. | `research/8004-enhancements.md` S5 | | D-085 | SIWE + JWT for remote MCP server authentication | **Adopted (expansion)** | Crypto-native auth for remote deployments. SIWE (EIP-4361) as authorization grant layered on OAuth 2.1. Server verifies signature, checks ERC-8004 Identity Registry for agent registration and role metadata, issues scoped JWT. Local STDIO transport remains env-var-based (no auth). Phase 5. | `research/8004-enhancements.md` S6 | | D-086 | A2A Agent Card URL embedded in ERC-8004 registration file `services` array | **Adopted (expansion)** | Single chain of resolution: on-chain identity -> agentURI -> registration file -> services\[].name=="A2A" -> Agent Card JSON. Bidirectional link (Agent Card `extensions.erc8004` points back). Agent0 SDK auto-indexes A2A skills for discovery. Phase 4-5. | `research/8004-enhancements.md` S4.4 | | D-087 | `tradingYield` tag with `feedbackURI` rich data for yield leaderboard | **Adopted (expansion)** | Uses ERC-8004 spec-defined `tradingYield` tag for automated per-epoch yield feedback. `feedbackURI` points to IPFS JSON with Sharpe ratio, drawdown, IL metrics. `feedbackHash` = keccak256(feedbackURIContents) for tamper evidence. Subgraph-indexed leaderboard. Phase 4-5. | `research/8004-enhancements.md` S2.4 | | D-088 | Non-custodial MCP server as default; Privy enclave for autonomous operation | **Adopted** | Default: server prepares unsigned transactions, agent signs via own Privy wallet. If server must hold keys (autonomous vault manager): Privy enclave keeps signing key isolated, server holds only P-256 authorization key. Never store raw Ethereum private keys in env vars for remote deployments. | `research/8004-enhancements.md` S6.5 |

\| D-089 | Stake-and-burn model for strategy enforcement (not stake-and-redistribute) | **Adopted (expansion)** | Burning creates genuine economic loss that cannot be gamed via collusion. Redistributing stake to buyers allows colluding seller+buyer accounts to recover losses. Burning eliminates this attack vector entirely. Progressive slashing: 25% moderate / 50% significant / 100% fraud. | `prd/vault/17-learning-economy.md` §10; Numerai mechanism | | D-090 | Ocean Compute-to-Data pattern for strategy inspection paradox | **Adopted (expansion)** | Buyers send portfolio context to strategy algorithm; receive trade signals back. Neither party's proprietary information crosses the boundary. More practical near-term than full ZKML; ZKML reserved for > $1,000 attestations. Solves the fundamental problem: buyers cannot verify a strategy without running it, but running it reveals the strategy. | `prd/vault/17-learning-economy.md` §6 | | D-091 | EZKL as TypeScript-native ZKML library | **Adopted (expansion)** | `@ezkljs/engine` is the only production-ready ONNX→Halo2 TypeScript/WASM library. Trail of Bits audited. 521–671× faster verification than proof generation (\~0.5 seconds on Base). Tiered: EAS attestation only for small purchases (< $100); EZKL required for large purchases (> $1,000). Model hash committed on-chain; model internals stay private. | `prd/vault/17-learning-economy.md` §8; EZKL docs | | D-092 | Federated regime detection as first collaborative feature | **Adopted (expansion)** | Shares only 4-float probability vectors + Gaussian DP noise. Raw market data, positions, and strategy parameters never leave the agent. Consensus threshold: 66% of weighted agents → strategy adjustment. Shapley-weighted contribution (GTG-Shapley over cumulative rounds, not per-round). Privacy budget: ε ≤ 1.0. | `prd/vault/17-learning-economy.md` §9 | | D-093 | Alpha decay pricing required from day one | **Adopted (expansion)** | Flat pricing will be immediately arbitraged. Buyers who profited from a momentum strategy last month should not pay the same price today — the edge has decayed. λ calibrated per strategy family (lp\_optimization: 0.05/day → \~14-day half-life; arbitrage\_signal: 0.693/day → \~1-day half-life). Price formula: `P(t) = P_base × e^(-λt)`. Price floor: 5% of base to prevent free strategies. | `prd/vault/17-learning-economy.md` §11; Maven Securities alpha decay research |

***

## Anti-Abuse Controls Mapped to Decisions

| Control                                                                            | Decision IDs    | Notes                                                                                                                   |
| ---------------------------------------------------------------------------------- | --------------- | ----------------------------------------------------------------------------------------------------------------------- |
| Role-based proxy requirement matrix                                                | D-003, D-005    | Enforced in safety/custody/config docs                                                                                  |
| Cancel-only authority policy                                                       | D-004, D-010    | Separate from admin and agent signing keys                                                                              |
| Monitor health gate + fail-closed required routes                                  | D-005           | Blocks high-risk writes under degraded monitoring                                                                       |
| Milestone anti-gaming checks (self-attribution and meaningful activity thresholds) | D-007           | Required for reputation integrity                                                                                       |
| Deferred-track abuse gating before promotion                                       | D-008, D-009    | Expansion requires explicit anti-abuse readiness                                                                        |
| Referral anti-Sybil controls (operator matching, vesting, tree depth limit)        | D-016           | Prevents self-referral farming and multi-hop exploitation                                                               |
| Am-AMM minimum reputation for bidding                                              | D-012           | Ensures strategy managers have verifiable track record                                                                  |
| Cross-vault insurance participation limits                                         | D-015           | maxLossShareBps caps individual vault exposure to socialized loss                                                       |
| MCP tool provenance signing + independent state verification                       | D-025           | Prevents fake-MCP and memory injection attacks                                                                          |
| CFI-driven adaptive circuit breaker thresholds                                     | D-026           | Thresholds tighten during systemic stress, eliminating magnet effect                                                    |
| Randomized circuit breaker trigger bands                                           | D-026           | ±0.5% randomization with blockhash seed prevents front-running of halts                                                 |
| Endgame defection monitoring (withdrawal acceleration, regime classifier)          | D-028           | Detects LLM agents shifting to value extraction before exit                                                             |
| Exit bonds for high-tier agents (0.5% AUM)                                         | D-028           | Economic disincentive for defection; returned after clean 30-day exit                                                   |
| Tier-bounded PA-AMM lambda ranges                                                  | D-027           | Prevents new agents from taking extreme active/passive positions                                                        |
| Mandatory vault disclosure at creation                                             | D-024           | Transparency for depositor agents evaluating vaults                                                                     |
| LVR-theta fee floor guarantees LP adverse selection compensation                   | D-029           | Fees never drop below cost of replicating perpetual option theta                                                        |
| Fee-implied vol divergence detection for oracle manipulation                       | D-030           | >20% divergence from primary oracle flags manipulation                                                                  |
| Predictive exit boundary for pre-emptive position closure                          | D-031           | Exits positions before loss materialization via optimal stopping                                                        |
| Cross-vault defensive rebalancing (Verified+ only)                                 | D-032           | Eliminates inter-vault arbitrage leakage; reputation-gated participation                                                |
| LVF loss floor on CCA bids prevents guaranteed-loss bidding                        | D-034           | Bids must account for minimum unavoidable Dutch auction loss                                                            |
| FM-AMM batch clearing for MEV-resistant rebalancing                                | D-035           | Uniform-price batch execution eliminates sandwich attacks on vault rebalances                                           |
| Battering RAM-informed TEE security posture                                        | D-036           | TEEs are defense-in-depth, not defense-in-total; time-delayed proxy is primary                                          |
| Constant-block-time fee correction on L2                                           | D-037           | Prevents overcharging on deterministic-block L2s                                                                        |
| Continuous dampening curves (no binary halts)                                      | D-043           | Prevents magnet effect and crisis amplification                                                                         |
| Hierarchical insurance tranching                                                   | D-039           | Junior tranche absorbs first losses; sized for correlated events                                                        |
| Meta-vault composition depth limit (2)                                             | D-046           | Prevents contagion propagation through deep nesting                                                                     |
| CaMeL capability tokens for agent actions                                          | D-040           | Provable security via control/data flow separation                                                                      |
| Protocol-specific reputation boundaries                                            | D-045           | Prevents cross-protocol behavioral spillover                                                                            |
| TraceRank payments-as-endorsements                                                 | D-044           | Sybil-resistant reputation via real capital commitment signals                                                          |
| 30% defection rate threshold                                                       | D-028 (refined) | Calibrated to LLM cooperation phase transition                                                                          |
| Termination horizon masking (stochastic periods)                                   | D-028 (refined) | Prevents rational endgame defection by strategic LLMs                                                                   |
| Rehypothecation cap at 60% of idle capital                                         | D-042           | Liquidity risk penalty limits lending exposure                                                                          |
| Performance-based fee recommendation                                               | D-047           | Hurdle rate + carry aligns curator incentives                                                                           |
| Recursive lending max leverage cap (5x on Base)                                    | D-048           | Thinner L2 exit liquidity vs mainnet; automatic deleverage at HF < 1.5                                                  |
| Max 40% of vault AUM in leveraged positions                                        | D-048           | Limits cascade exposure from recursive lending strategies                                                               |
| Junior tranche mandatory holding for vault creators/managers                       | D-049           | 5% of TVL in Junior shares as irreducible skin-in-the-game                                                              |
| Adaptive yield split ceiling (90% max to Junior)                                   | D-049           | Prevents yield extraction gaming between tranches                                                                       |
| ve-token lock slashing on poor vault performance                                   | D-050           | Circuit breaker triggers or defection detection slash bonded tokens                                                     |
| veVAULT emission voting anti-bribe-washing controls                                | D-050           | Prevent same-entity circular bribe loops via ERC-8004 operator matching                                                 |
| Credit delegation auto-revoke on reputation drop                                   | D-052           | Delegations revoked if agent reputation falls below Trusted tier threshold                                              |
| Credit delegation health factor floor (1.5)                                        | D-052           | Prevents delegated borrowing from approaching liquidation                                                               |
| Policy cage hard boundaries enforced on-chain                                      | D-053           | AI agents cannot exceed approved asset list, position sizes, or drawdown limits                                         |
| Stake-weighted strategy slashing for underperformance                              | D-053           | External strategy models lose stake allocation on poor returns                                                          |
| Cross-vault borrowing cap (20% of TVL)                                             | D-054           | Limits contagion from inter-vault lending                                                                               |
| Minimum idle reserve for lending vaults                                            | D-054           | Lending vaults must retain sufficient reserves for own depositor withdrawals                                            |
| Unified RiskEngine as single risk parameter source                                 | D-056           | Prevents scattered risk configs from drifting out of sync; queryable by external protocols                              |
| Bonded executor slashing for provable misbehavior                                  | D-057           | Objective/cryptographic slashing only; prevents executor cartel and reward spoofing                                     |
| Permissionless executor fallback after max delay                                   | D-057           | Prevents executor censorship; anyone can execute after timeout with smaller reward                                      |
| Hook break-glass kill-switch (Sentinel-only)                                       | D-058           | Immediate hook bypass prevents prolonged exploitation of compromised hook logic                                         |
| Hook re-enable requires Owner+Curator with longTimelock                            | D-058           | Two-man rule with delay prevents premature re-activation of vulnerable hook                                             |
| Per-parameter authority/bounds/justification registry                              | D-059           | Prevents parameter drift, role confusion, and unauthorized governance changes                                           |
| Two-man rule for high-impact parameter changes                                     | D-059           | Owner + Curator approval required for adapter/hook/custody changes                                                      |
| Adapter data attestation hashing                                                   | D-060           | Pre-registered dataHash prevents arbitrary calldata injection through adapter interface                                 |
| Adapter conservation invariants (differential testing)                             | D-060           | Every adapter tested against hold-adapter reference; totalAssets monotonicity enforced                                  |
| On-chain proof verification for all executor submissions                           | D-061           | Invalid proofs revert; executors cannot collect rewards for fabricated results                                          |
| Dutch auction escalation for execution liveness                                    | D-061           | Escalating rewards guarantee eventual execution; prevents stalled operations                                            |
| Executor concentration monitoring (HHI)                                            | D-061           | Alert at top-3 >60%; triggers diversity incentive (higher escalation rate)                                              |
| Self-funding reward model (no treasury subsidy)                                    | D-061           | Rewards come from measurable benefit; prevents executor reward inflation                                                |
| Gas pool auto-replenishment from protocol revenue                                  | D-061           | Prevents gas pool depletion; no manual top-up required                                                                  |
| NAV rate-of-change clamp prevents flash-loan share price manipulation              | D-062           | Max 50 bps change per snapshot interval; override requires Owner+Curator with timelock                                  |
| Oracle staleness gates widen spreads or disable NAV pricing                        | D-062           | Linear spread widening at 80% staleness; full disable at 100%; fail-safe to constant-product                            |
| Market safety mode on circuit breaker triggers                                     | D-062           | Automatic conservative posture: NAV pricing off, rehypothecation paused, max spreads                                    |
| Risk-adjusted scoring function with LVR/drawdown/oracle penalties                  | D-063           | Prevents "APY chasing" — agents must account for adverse selection, exit latency, oracle fragility                      |
| Mandatory allocation trace artifacts for strategy changes                          | D-063           | On-chain hash + IPFS blob creates auditable decision trail for every capital allocation                                 |
| Template-level risk aversion (conservative/balanced/aggressive)                    | D-063           | Gamma coefficient per vault template simplifies UX; prevents per-user complexity                                        |
| Sealed-bid solver competition for rebalances                                       | D-064           | Commit-reveal prevents front-running of rebalance intents; bond prevents griefing                                       |
| Rebalance auction fallback to TWAMM                                                | D-064           | If no valid solver bid, safe fallback execution prevents stuck capital                                                  |
| Hot key cannot escalate to cold lane privileges                                    | D-065           | Guards block upgrades, cap changes, and role modifications from session keys                                            |
| Fail-safe key causes DoS only, never fund theft                                    | D-065           | Cancel-only capability — compromised fail-safe cannot initiate transactions                                             |
| Canonical event schema for protocol-native observability                           | D-066           | All monitoring derivable from on-chain signals; no external SaaS dependency for core health                             |
| Health attestation view functions for composing protocols                          | D-066           | Morpho/Pendle can verify vault health before accepting shares as collateral                                             |
| Mandatory simulation artifacts for parameter changes                               | D-059a          | Fork block + scenario list + invariant set hash prevents untested governance changes                                    |
| Explicit rollback plans for critical parameter changes                             | D-059a          | Pre-defined revert values and trigger conditions for adapter/hook/oracle changes                                        |
| No-spot-assumptions audit checkpoint                                               | D-067           | Every contract review must verify no function path depends on single-block spot values for >$100 decisions              |
| Minimum oracle observation count and liquidity depth thresholds                    | D-067           | Price feeds untrusted until sufficient history and depth; fail-closed on insufficient data                              |
| Withdrawal receipt NFTs tradeable for secondary market exit                        | D-068           | Impatient depositors sell claims at discount rather than waiting; reduces panic withdrawal pressure                     |
| Explicit penalty disclosure before force exit                                      | D-068           | Agent sees exact cost (50-200 bps) before confirming forceDeallocate; informed consent                                  |
| Agent0 SDK version pinning and breaking change monitoring                          | D-080           | SDK is alpha; pin exact version, run CI against SDK update PRs before upgrading                                         |
| Privy authorization key rotation without wallet address change                     | D-081           | P-256 authorization key can be rotated; production keys stored in secrets manager, not local files                      |
| Feedback track independence (yield feedback does not affect tier in v1)            | D-082           | Prevents gaming: agents cannot manipulate continuous feedback to fast-track tier progression                            |
| Minimum feedback count threshold for leaderboard inclusion                         | D-087           | Agents must have 4+ feedback entries before appearing on yield leaderboard; prevents single-epoch manipulation          |
| feedbackHash tamper-evidence check on feedbackURI contents                         | D-087           | keccak256(feedbackURIContents) stored on-chain; stale or modified off-chain data detectable                             |
| SIWE nonce replay prevention and domain binding                                    | D-085           | Server-issued nonces are single-use; domain field must match server hostname; prevents signature replay across services |
| Role-based tool authorization scoping (vault\_manager/investor/infrastructure)     | D-085           | JWT claims include role and tier; middleware checks both before routing to tool handler                                 |
| A2A Agent Card bidirectional link verification                                     | D-086           | Registration file -> Agent Card -> extensions.erc8004.agentId must match; prevents identity spoofing in A2A             |
| Infrastructure feedback automated monitoring (uptime, response time, success rate) | D-084           | Automated monitors submit infrastructure feedback; prevents self-reported reliability metrics                           |
| Non-custodial default prevents MCP server key compromise from causing fund loss    | D-088           | Server prepares unsigned transactions; signing delegated to agent's own wallet; blast radius limited to DoS             |

***

## Deferred Backlog (Non-Blocking for Core-v1)

* CCA lifecycle automation and auction strategy surfaces (Track A)
* Agent referral mechanics with on-chain attribution and anti-Sybil controls (Track B, D-016)
* Share token composability integrations — Pendle, Morpho (Track E, D-014)
* Cross-vault factory-level insurance (Track E, D-015, D-039)
* Cross-chain deposits via ERC-7683 intents (Track E)
* Cross-vault defensive rebalancing coordinator (Track E, D-032)
* Fee-implied volatility fixed-for-floating fee swap derivative (Track E, D-030)
* Streak mechanics and multiplier points (Track B, design TBD)
* Kalman filter volatility estimator (Track E, D-038)
* TraceRank payments-as-endorsements integration (Track E, D-044)
* Performance-based fee structure (hurdle + carry) for am-AMM curators (Track E, D-047)
* Recursive lending adapter for leveraged yield strategies (Track E, D-048)
* Perpetual Yield Tranches (PYT) module for depositor risk segmentation (Track F, D-049)
* ve-token governance module (D-050)
* Pendle PT/YT strategy adapter with Prime listing (Track E, D-051)
* Credit delegation as reputation-to-leverage pipeline (Track E, D-052)
* Formalized policy cage architecture for self-learning vaults (Track C, D-053)
* Cross-vault liquidity router for inter-vault lending (Track D, D-054)
* BondMM-A fixed-rate lending V4 hook (Track F, D-055)
* Native on-chain execution market with bonded keepers (Track D, D-057)
* Risk-adjusted strategy scoring framework (Track C, D-063)
* Intent-based rebalance auction with solver competition (Track D, D-064)
* ERC-7540 emergency exit UX with withdrawal receipt NFTs (Track E, D-068)
* ERC-7887 cancellation for pending ERC-7540 requests (Track A, D-070)
* Virtuals ACP integration for agent-to-agent strategy coordination (Track D, D-071)
* Three-track feedback system: yield performance, qualitative reviews, infrastructure reliability (Track H, D-082, D-087)
* A2A protocol integration: Agent Cards, multi-turn vault strategy negotiation, dual MCP+A2A interface (Track H, D-083, D-086)
* MCP server ERC-8004 identity registration with infrastructure metadata and trust chain (Track H, D-084)
* SIWE + JWT authentication for remote MCP server deployments (Track H, D-085)
* Public yield leaderboard: on-chain contract + subgraph-indexed rankings by yield/Sharpe/drawdown (Track H, D-087)
* Yield service discovery architecture: four-layer stack combining Identity Registry, Reputation Registry, subgraph, and Agent0 SDK search (Track H, D-082, D-084, D-087)

Promotion of deferred items requires:

1. Core safety and reliability gates green
2. Track-specific abuse controls documented and tested
3. KPI evidence that expansion is justified