[nniiovoo]

Documents only: nothing is built. You asked for keys to be used, not only stored, by Claude Code and Codex and no other program. As with every agent change here, the decisions come first, as ADRs. Merging this PR is what accepts them.

Your choices, recorded

• Wallet keys: sign sends. ADR-0011, Chat Wallets, is reinstated with your later answers folded in:
  • every EVM chain and Solana, not Base alone;
  • Touch ID and then the Master Password for every send;
  • an encrypted send history.
• API keys: call services. New ADR-0014: through the Agent Companion, one fixed operation at a time. Each operation gets its own Agent Key and its own ADR-0007 record. The agent never holds the key.
• Only Claude Code and Codex. New ADR-0013: on top of the separate agent account, the app checks that the tool was started by a program signed as Claude Code (Anthropic, Q6L2SF6YDW) or Codex (OpenAI, 2DC432GLL2). Both signatures were confirmed on this Mac on 2026-11-09.

Choices I made where you hadn't decided (change any of them)

• One route, not two. Chat Wallet requests join the route already built for ADR-0012: same socket, tool and grant, five more requests. A second way into the process that holds the Vault's keys would double what needs review.
• A grant covers only the Chat Wallets you tick when you choose Start. None are covered by default.
• Transfers allowed:
  • EVM: an EIP-1559 send of the coin, or transfer on a listed token;
  • Solana: a SOL transfer, or TransferChecked of a listed token;
  • one transfer per transaction, and everything else is refused.
• Solana can't be pinned to devnet. A transaction doesn't name its cluster, so a test Chat Wallet's key is a real key everywhere and must never hold real funds. ADR-0011 says this plainly.
• Signing crates: small single-purpose ones (secp256k1, Keccak, Ed25519, base58), not whole-chain SDKs, each pinned in its own PR.
• API keys through the Agent Companion, not a new broker program. It's already the reviewed home for an Agent Key outside the Vault.
• The program check covers the tool too. The connecting program must be the installed enote-agent-keys, matched by the code hash you approve in Settings. Programs whose signature lets outside code in are refused.
• Allowed programs: only the Claude Code and Codex command lines for now. The Claude app and the Codex app are added after a check shows which of their processes starts the tool.

Still open

• The first API-key service and operation. It must be a provider that enforces narrow permissions, expiry, revocation and hard caps.
• Whether the sandboxed app can read another account's process signatures. ADR-0013 starts with a spike; if the answer is no, the decision comes back to you.
• ADR-0012's hand checks, above all the signed-build socket. Everything here runs over that route, so they are step 2 of ADR-0011's build order.

Conflicts, stated

• ADR-0009 and AGENTS.md's "Never widen it" (the Agent Companion): amended by ADR-0014, which allows widening only by an owner-approved fixed operation.
• AGENTS.md's "It never signs… don't build them": replaced by a rule to build signing only by ADR-0011's build order, with fake keys and test funds, never from a Seed Phrase, a Private Key or an Agent-added Note.

Files

• New: ADR-0013 and ADR-0014.
• Rewritten: ADR-0011, with a "Reinstated 2026-11-09" section listing what changed.
• Amendment notes: ADR-0004, 0007, 0008, 0009 and 0012.
• Updated: CONTEXT.md (Agent Companion, Chat Wallet, and a new line about Claude Code and Codex) and AGENTS.md.

Checks

• All 98 relative links in the changed files resolve.
• The secret scan passed, including the new files.
• No code changed.

🤖 Generated with Claude Code