# angeyobo/oxwrit architecture

> Architecture diagram of the GitHub repository angeyobo/oxwrit, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-14). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/angeyobo/oxwrit
- Repository: https://github.com/angeyobo/oxwrit
- Video tour (about a minute): https://gitdiagram.com/angeyobo/oxwrit/video

## Overview

OxWrit is a NEAR on-chain policy enforcement vault: a policy decision point (PDP) evaluates a proposed transfer and, only on ALLOW, issues a signed AuthorizationV1; an agent submits that authorization with the action to the vault, which verifies it, rejects replay, and schedules the transfer. The graph also shows canonicalization as a verifier layer and the documented cross-check capability. Source excerpts establish the contract and signing flow; the xcheck connection is documented in the README, while unsampled details are omitted.

Main entry points: [`vault/src/lib.rs`](https://github.com/angeyobo/oxwrit/blob/main/vault/src/lib.rs) (Vault contract), [`pdp/sign.mjs`](https://github.com/angeyobo/oxwrit/blob/main/pdp/sign.mjs) (Policy signer), [`verify/src/lib.rs`](https://github.com/angeyobo/oxwrit/blob/main/verify/src/lib.rs) (Authorization verifier), [`xcheck/gen.mjs`](https://github.com/angeyobo/oxwrit/blob/main/xcheck/gen.mjs) (Core/Rust cross-check)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_decision["Policy decision"]
  node_pdp["Policy signer<br/>[sign.mjs]"]
  node_policy["Transfer policy<br/>[policy.json]"]
  node_core["OxDeAI core"]
end

subgraph group_enforcement["On-chain enforcement"]
  node_vault["Vault contract<br/>[lib.rs]"]
  node_intent["Intent binding<br/>[lib.rs]"]
  node_replay[("Replay protection<br/>[lib.rs]")]
  node_transfer["NEAR transfer<br/>[lib.rs]"]
  node_receipt["Execution outcome<br/>[lib.rs]"]
end

subgraph group_verification["Authorization verification"]
  node_verifier["Authorization verifier<br/>[lib.rs]"]
  node_canonical["Canonical JSON<br/>[canonical.rs]"]
end

subgraph group_interop["Cross-verification"]
  node_xcheck["Core/Rust cross-check<br/>[gen.mjs]"]
  node_artifacts["Signed test artifacts<br/>[cases.json]"]
end

node_agent(("Agent"))
node_runtime["NEAR runtime"]

node_agent -->|"proposes transfer"| node_pdp
node_pdp -->|"reads policy"| node_policy
node_pdp -->|"signs authorization"| node_core
node_pdp -->|"returns execute args"| node_agent
node_agent -->|"calls execute"| node_vault
node_vault -->|"hashes action"| node_intent
node_vault -->|"verifies authorization"| node_verifier
node_verifier -->|"parses and canonicalizes"| node_canonical
node_vault -->|"consumes auth_id"| node_replay
node_vault -->|"schedules transfer"| node_transfer
node_transfer -->|"executes promise"| node_runtime
node_runtime -->|"invokes callback"| node_vault
node_vault -->|"emits outcome"| node_receipt
node_xcheck -->|"creates core verdicts"| node_core
node_xcheck -->|"writes artifacts"| node_artifacts
node_artifacts -->|"cross-checks Rust"| node_verifier

click node_pdp "https://github.com/angeyobo/oxwrit/blob/main/pdp/sign.mjs"
click node_policy "https://github.com/angeyobo/oxwrit/blob/main/pdp/policy.json"
click node_vault "https://github.com/angeyobo/oxwrit/blob/main/vault/src/lib.rs"
click node_intent "https://github.com/angeyobo/oxwrit/blob/main/vault/src/lib.rs"
click node_replay "https://github.com/angeyobo/oxwrit/blob/main/vault/src/lib.rs"
click node_transfer "https://github.com/angeyobo/oxwrit/blob/main/vault/src/lib.rs"
click node_receipt "https://github.com/angeyobo/oxwrit/blob/main/vault/src/lib.rs"
click node_verifier "https://github.com/angeyobo/oxwrit/blob/main/verify/src/lib.rs"
click node_canonical "https://github.com/angeyobo/oxwrit/blob/main/verify/src/canonical.rs"
click node_xcheck "https://github.com/angeyobo/oxwrit/blob/main/xcheck/gen.mjs"
click node_artifacts "https://github.com/angeyobo/oxwrit/blob/main/xcheck/cases.json"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_pdp,node_policy,node_core toneBlue
class node_vault,node_intent,node_replay,node_transfer,node_receipt toneAmber
class node_verifier,node_canonical toneMint
class node_xcheck,node_artifacts toneRose
class node_agent,node_runtime toneIndigo
```

## Components

### Policy decision

- [Policy signer](https://github.com/angeyobo/oxwrit/blob/main/pdp/sign.mjs): `pdp/sign.mjs`
- [Transfer policy](https://github.com/angeyobo/oxwrit/blob/main/pdp/policy.json): `pdp/policy.json`
- **OxDeAI core**

### On-chain enforcement

- [Vault contract](https://github.com/angeyobo/oxwrit/blob/main/vault/src/lib.rs): `vault/src/lib.rs`
- [Intent binding](https://github.com/angeyobo/oxwrit/blob/main/vault/src/lib.rs): `vault/src/lib.rs`
- [Replay protection](https://github.com/angeyobo/oxwrit/blob/main/vault/src/lib.rs): `vault/src/lib.rs`
- [NEAR transfer](https://github.com/angeyobo/oxwrit/blob/main/vault/src/lib.rs): `vault/src/lib.rs`
- [Execution outcome](https://github.com/angeyobo/oxwrit/blob/main/vault/src/lib.rs): `vault/src/lib.rs`

### Authorization verification

- [Authorization verifier](https://github.com/angeyobo/oxwrit/blob/main/verify/src/lib.rs): `verify/src/lib.rs`
- [Canonical JSON](https://github.com/angeyobo/oxwrit/blob/main/verify/src/canonical.rs): `verify/src/canonical.rs`

### Cross-verification

- [Core/Rust cross-check](https://github.com/angeyobo/oxwrit/blob/main/xcheck/gen.mjs): `xcheck/gen.mjs`
- [Signed test artifacts](https://github.com/angeyobo/oxwrit/blob/main/xcheck/cases.json): `xcheck/cases.json`

### Other components

- **Agent**
- **NEAR runtime**

## Connections

- Agent → Policy signer: proposes transfer (evidence: `README.md`)
- Policy signer → Transfer policy: reads policy (evidence: `pdp/sign.mjs`)
- Policy signer → OxDeAI core: signs authorization (evidence: `pdp/sign.mjs`)
- Policy signer → Agent: returns execute args (evidence: `pdp/sign.mjs`)
- Agent → Vault contract: calls execute (evidence: `README.md`)
- Vault contract → Intent binding: hashes action (evidence: `vault/src/lib.rs`)
- Vault contract → Authorization verifier: verifies authorization (evidence: `vault/src/lib.rs`)
- Authorization verifier → Canonical JSON: parses and canonicalizes (evidence: `verify/src/lib.rs`)
- Vault contract → Replay protection: consumes auth_id (evidence: `vault/src/lib.rs`)
- Vault contract → NEAR transfer: schedules transfer (evidence: `vault/src/lib.rs`)
- NEAR transfer → NEAR runtime: executes promise (evidence: `vault/src/lib.rs`)
- NEAR runtime → Vault contract: invokes callback (evidence: `vault/src/lib.rs`)
- Vault contract → Execution outcome: emits outcome (evidence: `vault/src/lib.rs`)
- Core/Rust cross-check → OxDeAI core: creates core verdicts (evidence: `xcheck/gen.mjs`)
- Core/Rust cross-check → Signed test artifacts: writes artifacts (evidence: `xcheck/gen.mjs`)
- Signed test artifacts → Authorization verifier: cross-checks Rust (evidence: `README.md`)