skip to content

Published for public analysis

The Operator's Constitution

edition of 14 Aug 2026

These are not promises — this is a description of mechanisms wired into the autonomous operator's code. Every article is checkable: the operation journal and positions are published in transparency.

PHASE 1: until the first two rounds close, only the founder commands the operator. After that — YLDX holders (voting token, decision recorded 29 Aug 2026). Stage recorded 14 Aug 2026.

01

The registry decides where money returns

Funds and positions return only to the address recorded in a code-reviewed registry. The sender field of a transaction is never used as a destination — address-poisoning attacks target exactly that reflex.

unknown sender → QUARANTINE · no action · human alert

02

Top of the approved queue — never the hottest APY

The operator does not scan the market for the highest yield: ranking by APY systematically surfaces broken pools. Humans and the analytics pipeline approve a queue; the operator takes the top entry. Empty queue = it does nothing, and says so.

every queue job carries the full instruction: pool · limits · slippage · expiry · approver

03

Hard limits live on the key

Per-operation cap, total cap, an allowlist of contracts the operator may call, and exactly one job per incoming transaction event (chainId + txHash + logIndex). A restart can never double-execute.

cap / op · total cap · contract allowlist · idempotency key

04

No single pool holds more than 2.5%

Diversification is enforced before entry: if a deposit would push one pool past 2.5% of capital, the operator stops and reports. Fees of a money operation must not exceed 1% of its size.

share(pool) ≤ 2.5% · fees(op) ≤ 1% — checked before signing

05

Tokens only by contract address

Assets are recognized by contract address, never by ticker: a fake token with an identical symbol can sit next to the real one in any wallet. The operator saw such a mirror-fake arrive 3.5 minutes after a real transfer — the registry rejected it. The public record does not state the incident date.

symbol lies · contract address does not

06

Exit never locks

Any guard may block entry: stale data, limits, alarms. None may block exit. Exit still respects a minimum acceptable output — if that minimum cannot be built, the operator raises an emergency alert instead of selling at any price.

entry: any guard may block · exit: always open

The autonomy ladder

Autonomy is enabled in steps, each proven on the previous one. "No human in the loop" is the end state; the path there runs through explicit approvals.

L0Observe — read-only, no key loaded
L1Test mode — full plan printed, nothing signedNOW
L2Micro amounts with explicit founder GO per operation
L3Bounded autonomy inside fixed limits
L4Full autonomy under Safe-module custody (planned)

Live engine status is not connected — showing the conservative stage from the charter (ANALYZE_ONLY, execution disabled); the stage is never overstated. Governance is Stage 0 · Founder Controlled: governance model (DAO plan) · ecosystem map.

The YLDX token is access and a vote: not equity, not a promise of income; its future value may be zero. DeFi carries risk; not financial advice.