How angeyobo/oxwrit works
OxWrit is a NEAR on-chain policy enforcement vault: a policy decision point (PDP) evaluates a proposed transfer and, only on ALLOW, issues a signed AuthorizationV1; an agent submits that authorization with the action to the vault, which verifies it, rejects replay, and schedules the transfer. The graph also shows canonicalization as a verifier layer and the documented cross-check capability. Source excerpts establish the contract and signing flow; the xcheck connection is documented in the README, while unsampled details are omitted.
Main entry points: src/lib.rs Vault contract · sign.mjs Policy signer · src/lib.rs Authorization verifier · gen.mjs Core/Rust cross-check
Components 14
Policy decision
- Policy signer
pdp/sign.mjs - Transfer policy
pdp/policy.json - OxDeAI core
On-chain enforcement
- Vault contract
vault/src/lib.rs - Intent binding
vault/src/lib.rs - Replay protection
vault/src/lib.rs - NEAR transfer
vault/src/lib.rs - Execution outcome
vault/src/lib.rs
Authorization verification
- Authorization verifier
verify/src/lib.rs - Canonical JSON
verify/src/canonical.rs
Cross-verification
- Core/Rust cross-check
xcheck/gen.mjs - Signed test artifacts
xcheck/cases.json
Other components
- Agent
- NEAR runtime
Connections 16
- Agent → Policy signer: proposes transfer
README.md - Policy signer → Transfer policy: reads policy
pdp/sign.mjs - Policy signer → OxDeAI core: signs authorization
pdp/sign.mjs - Policy signer → Agent: returns execute args
pdp/sign.mjs - Agent → Vault contract: calls execute
README.md - Vault contract → Intent binding: hashes action
vault/src/lib.rs - Vault contract → Authorization verifier: verifies authorization
vault/src/lib.rs - Authorization verifier → Canonical JSON: parses and canonicalizes
verify/src/lib.rs - Vault contract → Replay protection: consumes auth_id
vault/src/lib.rs - Vault contract → NEAR transfer: schedules transfer
vault/src/lib.rs - NEAR transfer → NEAR runtime: executes promise
vault/src/lib.rs - NEAR runtime → Vault contract: invokes callback
vault/src/lib.rs - Vault contract → Execution outcome: emits outcome
vault/src/lib.rs - Core/Rust cross-check → OxDeAI core: creates core verdicts
xcheck/gen.mjs - Core/Rust cross-check → Signed test artifacts: writes artifacts
xcheck/gen.mjs - Signed test artifacts → Authorization verifier: cross-checks Rust
README.md