session key
Limits on chain.
The agent signs with a session key that can only pay the escrow.
01
What Orvyn is
An agent pays through Orvyn into an escrow on Arc, not straight to the store. If the owner reports a problem, the agent opens a claim and a judge on GenLayer decides.
rules.json · claims
The owner decides what matters.
Rules say which claims the agent opens alone and which need the owner.
verdict
A judge, not the store, decides.
Tenet's judge on GenLayer decides under the store's terms, settled on Arc.
02
How it works
-
01
The owner sets rules and approves the agent's session key for one day with the owner's tool (see Session key).
owner's tool -
02
The agent places an order at a store that sells through Tenet Pay and gets a payment link.
-
03
The agent calls
pay_link. Orvyn checks the owner's rules and the store's terms against the escrow, then pays. The money is held in escrow.pay_link -
04
If something goes wrong, the agent calls
open_claim. For "not as described", Orvyn asks the owner for the proof through MCP elicitation.open_claim -
05
The store has a window to answer. The judge decides; the result is settled on Arc.
store's window Judge · GenLayer -
06
The agent calls
withdrawand the refund goes back to the owner's account.withdraw
03
Connect an agent
Orvyn is an MCP server (stdio). Any MCP client can use it. A client that supports elicitation can ask the owner; without it, claims that need the owner are not opened.
The server runs under Node's permission model: it can read only its own folder, the session key, the owner's approval and its ledger. Node 24 takes one --allow-fs-read per path.
VariableWhat it is
MCP client config
paths are placeholders
04
The six tools
The owner has 10 minutes to answer a question from Orvyn. With no answer, nothing is signed and the agent is told the step waits for the owner.
05
The owner's rules
Applied in code before anything is signed. The limit per order and the number of orders are also on chain (see Session key); the daily total and the weekly claims are counted in code.
FieldMeaning
rules.json
06
The session key and its limits on Arc
The owner's account is an ERC-4337 smart account (ZeroDev Kernel 3.3, EntryPoint 0.7). The agent never holds the owner's key. It signs with a session key that the owner approved, and the chain enforces what that key may do.
pay
Pay permission
- approve USDC to the escrow only, up to the limit per order;
- pay into the escrow in USDC only, up to the limit per order;
- a number of orders per key, counted from the time it was issued;
- an end date (one day);
- a gas budget;
- no native value.
claims
Claims permission
- open a claim, submit evidence and withdraw USDC on the escrow, nothing else;
- an end date and a gas budget; no native value.
How the owner approves a key
The agent creates a session key and gives the owner only its address. The owner's tool signs an approval with the limits. The approval holds no private key. On a local fork of Arc, an approval with a limit changed by the agent was refused by the chain.
Keep the owner's key on another device or a hardware wallet, never on the agent's machine.
Today the owner's tool reads the key from a file (testnet); signing the approval from a wallet or a hardware wallet is not built yet.
Refused on Arc testnet
Each was signed and simulated against the real network, and the policy refused it.
- a USDC transfer to another address
- an approve to another spender
- an approve or pay above the limit per order
- native value
- a third order on a key approved for two
Refused on a local fork
The real contracts copied locally, not the live network.
- the claims permission trying to pay or transfer
- a withdraw of another token
- a spent gas budget
- a key past its end date
- an approval with a limit changed
07 ·
Demo: a real agent buys and claims
Both were settled on Arc: the full amounts went to the buyer and 0 to the store.
A note on this run
08
Network and contracts
09
Status
Orvyn runs on Arc testnet with testnet USDC. There is no mainnet deployment.
Not built yet
delivery verificationOrvyn does not check whether an order arrived; the owner says so. A
late claim needs a delivery email verified by Lacre, which is not live on this network yet.signing the owner's approval from a wallet or a hardware wallet
a daily USDC total on chainOn chain today: the limit per order, the number of orders, the end date and the gas budget.
mainnet
Not shown on this page yet: a store that disputes a claim with a fact and the closing round that follows (a separate test).