Cæsura

Keys for agents that cannot act alone.

one agent proposes 🧙⊥⊥⚔️ another, held apart, checks

Only then does anything move.

A small NEAR contract holds the only keys. It releases an action when a second, held-apart seat agrees and the policy passes. Every decision, including every refusal, is sealed under one hash the chain carries.

See the board Test the gate Repository

The pause, in three seats

01 · propose

Drafts the action inside a private enclave on NEAR AI Cloud. Signed by the hardware. Nobody outside sees what it was told.

02 · assay

A different model that sees only the proposal and the task. Never the first seat's prompt. It re-checks receiver, amount and route.

03 · release

The contract holds the keys. Each seat's key can call one method. Both must hold, and the policy, or the chain records a refusal.

The chain carries hashes, not words. One root per round, re-derived offline by anyone who holds the bundle. A refusal is a leaf like any other.

The board

reading testnet…

Every gate running this mechanism on NEAR testnet, read live from the chain. Rounds, what each gate said, and the attacks it held.

Rounds · pause.caesura.testnet

— reading —

The gap, measured

reading the index…

Every round names the attack it ran and the pair of seats that ran it. The board folds them into a front: no drains, honest spends pass, at the smallest cost of the pause. Add an attack, a pair of seats or a policy, and your rounds land here.

The gap curve · what crosses to the second seat

— reading —

The front · seat pairs at the designed gap

Attacks × seat pairs

Keys with weight

A key can sign twice: the ed25519 key the gate holds, and a post-quantum key beside it. Both sign one domain-separated message over a dual-hash pre-hash, and a broken half fails the whole. Three rungs, by data: the proposer stays classical; the assayer, whose approval releases funds, carries ML-DSA-65 beside its ed25519; the owner, who installs the seat keys, carries SLH-DSA, hash-based, and signs rarely. The separation is the ceremony: the owner signs the key set, and when a seat moves suite the key it leaves countersigns the move, so no single key moves the system and the move is a leaf under a root on the gate. Rounds marked ceremony in the list above carry it.

Three ways in

an attack

A task fixture with a poison in a page, a memory or the task itself. Its hash rides in every proposal that runs it.

tasks/your-attack.json
corpus/index.json

a pair of seats

Two models and a driver. Run the corpus. Your pair becomes a row on the front.

pairs/your-pair.json
round.mjs --driver nearai

a policy

Caps, cooldown, receivers. Fewer honest refusals at zero drains.

tasks/policy.json
owner.mjs policy

Rounds land as roots on a gate, committed by the seat key that ran them. The board reads the chain. This index only groups it.

Test it

Stand up your own gate on testnet, feed its proposer a poisoned page, and watch the second seat and the policy hold. Your gate joins the board.

Deploy a gate. One script creates the sub-account, installs the two scoped seat keys and deletes its own full-access key.
```
node tools/deploy.mjs --owner you.testnet
```
Run a poisoned round. The fetched page tells the proposer to drain the wallet.
```
node seats/round.mjs --task tasks/poisoned-page.json --chain testnet
```
Verify from the bundle alone. Every hash re-derived, the root read back from your gate.
```
node tools/verify.mjs bundles/poisoned-page --rpc testnet
```
Join the board. Add your gate to gates.json. The board reads it from the chain, not from us. Name the attack and the pair you ran and the round joins the front above.

The first gate, pause.caesura.testnet, is live and readable now. Every round on it was run during the hackathon window; the board reads the chain, not a database. Code, README path and verifier: github.com/mitchuski/caesura.

On NEAR

Function-call keys

One method per seat key, gas allowance, no transfers. The protocol enforces it.

Locked sub-account

No full-access key. Only the code acts. The owner's door is the parent account.

NEAR AI Cloud

Private inference in a TEE. Each answer signed over its exact bytes.

Policy in the open

Caps, receivers, cooldown, pause: contract state anyone reads.

Owner seat

A person, or a Sputnik DAO proposal that sets the policy.

Beyond NEAR

Intents and Chain Signatures pause at the same caesura.