Most agent safety asks a single question: should the agent be allowed to do this? Elpis asks the second question too — if an authorized agent is wrong, what happens next?
Runs against a real EVM and real Solidity, with Arc testnet as the production target. No mainnet value is ever moved.
We do not claim an agent will never make a mistake. We build a financial system where it can safely act anyway, because the damage a mistake can do is bounded by design.
The safer an action is to recover from, the more autonomy the system permits. The more irreversible an action becomes, the stronger the controls before execution.
“Don't just constrain agents. Make their mistakes survivable.”
Model reasoning can suggest. It cannot authorize. The execution path depends on deterministic state and code, never on a language model's confidence.
Balances, reserves, committed obligations, duplicate detection, ceilings and runway are ordinary code. A model cannot argue its way past them.
The Lazarus vault holds funds in escrow, enforces ceilings and the recipient allowlist, and lets only a guardian freeze. Some violations are impossible, not merely discouraged.
Soft rules in the owner's own words are interpreted into structured constraints. They can tighten controls. They can never loosen them, and they never release money.
Irreversible actions, new recipients, changed wallets and amounts beyond trust require one click. The reason is always shown.
The class is computed from how the action will actually be executed — never from an arbitrary AI score. If the execution layer cannot hold the funds, Elpis says the action is irreversible rather than pretending it can take it back.
Internal movements and pre-execution proposals. Nothing leaves the treasury.
Escrowed or timelocked payments inside the Lazarus Window. Cancellable until release.
Settlement cannot be undone, but a defined corrective action exists.
Unrestricted settlement. Strongest approval, and Elpis says so plainly.
An authorized action does not become final immediately. It is staged, and while the Lazarus Window is open the owner can cancel it, the supervisor can freeze it, and new evidence can halt it automatically. Only when the window closes — and independent verification passes — does it settle.
This is the lineage of the Lazarus Protocol, adapted from destructive infrastructure actions to financial settlement.
A wallet balance is not available capital. Elpis subtracts committed obligations and protected reserves, and the agent may only deploy what is left. The total is never called available.
Built for Arc testnet with Circle's USDC and developer-controlled wallet tooling. The same vault that runs on the local EVM deploys to Arc unchanged.
Transactions are signed and executed against a real EVM. Hashes come from real receipts, or the action reports failure — they are never invented.
Every state transition, control decision and recovery is written once, in order, and can be reconstructed end to end.
Most systems try to make autonomous agents incapable of mistakes.
We assume mistakes will happen.
Elpis makes autonomy proportional to how survivable those mistakes are.