The reserve holds capital. The other six instruments compose the grammar of programmable custody. When an agent may spend, where it may spend, how much, and under what supervision. Each one is opt-in. Each one is enforced by the runtime.
The reserve is a single on-chain contract. A custody account that nobody can sign for, including you. Capital moves only when the program authorises it, against rules stored on the chain. The reserve is the spine; everything else is grammar around it.
Specification
Lanes are sub-accounts within the reserve, addressed by a deterministic derivation from the reserve and a label. They hold balance, count transactions, and carry their own constraint envelope. Lanes are sovereign. One agent cannot reach another's funds.
Specification
Every payment is verified against governance rules in a single call. Per-tx and rolling 24-hour caps are kept on-chain and reset by the chain's clock. Fail one. The entire transaction reverts. There is no partial spend, no race, no off-chain queue.
Specification
Every outbound payment is checked against a roster of approved addresses, each entry tagged with a human-readable label. The roster is mutable, but only by the authority. A compromised agent literally cannot pay an unapproved address. The program will not sign.
Specification
Time rules use the chain's clock as truth. Define windows in UTC. Weekdays 09–17, no weekends, whatever shape. And any transaction outside the window is rejected. Multiple windows compose. Even if the agent's server is offline, the clock discipline still applies.
Specification
Set a floor on any lane. When the balance crosses below, the program refills it from the reserve up to a target. Anyone can crank the instruction. The rules are on-chain. But only the program can move the funds. Agents never stop because they ran low.
Specification
Above a threshold you define, payments need quorum approval. A proposal account is created on-chain, signers approve, and once the threshold is met anyone can execute. Proposals expire. Signer sets are stored on-chain. Not on a server, not in a database.
Specification
Custos does not ask you to choose a tier. It asks you to choose a posture. Compose the primitives. Strict or open, narrow or wide. Each lane has its own constitution. Each constitution can be amended. The chain remembers everything.
CUSTOS