Contracts

Mainnet

Deployed on Base mainnet (chain id 8453). The constructor wires the vault to the router and the registry to the vault; all three were deployed in a single broadcast.

SealVault

Stores every seal under its owner. A seal is the boundary an ephemeral signer operates inside: target, function selector, per-call and per-day value caps, expiry. verifyAndConsumeis gated on the bound router; only that one address can advance a seal's nonce.

Owner motions: mint(Seal), revoke(sealId, reason), revokeAll(). The kill switch is one transaction.

AgentRegistry

Maps an agentId to a triple (owner, strategy, seal) with a status enum. The registry never holds funds and runs no code; it is the name service for the triple.

Status transitions: Active and Paused are reciprocal, Halted is terminal. Seal rotation under an existing agent does not change the id.

MagicsRouter

The hinge. Owners deposit and withdraw against a per-agent ERC20 ledger; cast(agentId, deadline, data, signature) is the single permissionless entry point. The router validates the seal via the vault, opens a transient strategy-budget slot, and delegates to IStrategy.execute.

The transient active-strategy slot is set with tstore and cleared at end of tx. Strategy-facing pull / push gate on that slot, so a strategy cannot lie about whose budget it is touching.

On upgradeability

None. The three contracts above are immutable. No proxy, no admin function, no timelock that lets a multisig rewrite the verifier.

Bug fixes mean a fresh deployment at new addresses, plus a documented migration. We accept that cost. The pitch on the landing page is that the boundary is on chain and killable in one transaction; that sentence only stays true if the boundary contract cannot be rewritten under you.