Protocol

01What the protocol is

LaCrew encodes an organization of AI agents as a tree of onchain accounts. Human roots sit at the top; a treasury streams allowances downward; every agent action passes a stack of policy modules before funds move; overages climb the reporting tree as escalations; and constitutional changes — hire, fire, budgets, policy upgrades — pass through governance that humans ultimately control.

Human root(s)
 └── Treasury
      ├── Manager agent
      │      ├── Worker
      │      └── Worker
      └── Manager agent
             └── Worker

Five invariants hold everywhere, and the rest of this page is those invariants made concrete:

• Non-custodial. No off-chain component ever holds root keys or an unmediated treasury path. Orchestrators act through scoped, expiring session keys; revocation runs from the root key.
• All enforcement onchain. Budgets, permissions, escalation, and governance are contract-enforced. The cloud is replaceable.
• First DENY wins. A node's policy is a stack of modules; DENY short-circuits, and any ESCALATE routes the action up the reporting tree.
• Audit trail by construction. Every intent, verdict, approval, vote, stream, and session event is emitted onchain — no separate logging system.
• Composability. Third parties extend by writing policy modules and adapters, never by forking the protocol.

The normative surface is SPEC.md (v0.1.1 (draft)), rendered in full at /spec; this page is the summary.

02How an agent action settles

Agents never call the treasury. An agent acts by proposing an intent to the EscalationRouter, which first checks the agent's session key (valid, unexpired, value within its cap, target allowed), then evaluates the node's policy stack to one of three verdicts:

• ALLOWThe action finalizes immediately: allowance is spent, the target is called, ActionExecuted is emitted.
• ESCALATEA pending intent is created awaiting the agent's parent. An approval is re-checked against the approver's own policy stack — within bounds it finalizes, over bounds the intent keeps climbing toward the human root.
• DENYThe proposal reverts. Nothing is created, nothing moves.

Escalation is a purchase order, not a governance vote: operational spend never votes. Managers may auto-approve within their own policy bounds; anything beyond them terminates at a human root, whose approval is a signature from the user's own key path. Read the escalation flow.

03Policy modules

IPolicyModule is the protocol's extension point — one view function, check(agent, target, value, data), returning a verdict. Modules stack per node through a PolicyStack: the first DENY wins, any ESCALATE is sticky, otherwise ALLOW. The reference modules:

Third parties extend the protocol by deploying their own module and binding it — never by forking. Binding is governor-gated, and an installed module is appended behind the stack the org already voted for, so a bought module can only ever narrow what the existing stack lets through.

04Governance

LaCrew splits decisions into two regimes and refuses to confuse them. Operational actions — spend, execute, escalate — go through the policy stack and the escalation tree. Constitutional actions — hire or fire agents, change budgets, upgrade policy modules, admit humans — go through the GovernanceModule, in two risk tiers:

• Low tier executes as soon as all-seat yes-weight meets quorum — no timelock.
• High tier — anything touching the treasury, policies, or the module itself — additionally requires human yes-weight, a timelock, and stays vetoable by any funded human seat until execution.

Seats are role-weighted: agent seats carry review authority, but human seats hold final say on high tier, and human seats can only be granted or revoked by an executed high-tier proposal — there is no key that can hand out a human seat. Two guarantees hold unconditionally: the last human seat cannot be revoked, and agent yes-weight never satisfies high tier — an org can be frozen, but never agent-run. Read the governance doc.

05Session keys & custody

Session keys are scoped and expiring. A full compromise of our cloud leaks bounded authority for the rest of an epoch, never your treasury. Concretely: agents boot with ephemeral keys issued through SessionRegistry, each bounded by an expiry, a max value per action, and optionally pinned targets — and fail-closed, so a consumer that cannot read a session's full target list denies rather than allows. Root revocation never depends on the issuer: the root key can always kill a session.

The hosted cloud holds session keys only. It provisions agents and proposes intents, and it is architecturally incapable of taking user funds — revocation runs from the user's key, not ours. Read the security model, including the honest list of what is still scaffolding.

06Audit status

No professional audit report is published yet, so mainnet stays blocked and the chip stays orange. When the report ships it will be linked here.

The rule is mechanical, not aspirational: mainnet stays blocked in the deployments config until a report is published and linked here.

07Contracts & addresses

The protocol ships as 8 core contracts plus the 5 reference policy modules above, all Apache-2.0 in the public repo:

Addresses per network below — a network with no table has nothing published yet, which is a different claim from having nothing deployed.

Source: packages/core/deployments

08Audit trail

There is no separate logging system to trust. Every consequential act emits an event, and indexing five families reconstructs everything that ever happened in an org:

09Repositories & spec

• github.com/marc-aurele-besner/lacrew: Apache-2.0 contracts, SDK, orchestrator
• Protocol specification: the normative surface, including the conformance checklist an implementation must meet
• Protocol docs: narrative walkthroughs of escalation, governance, and policy modules
• SECURITY.md: disclosure policy, honest about what is still mocked