OutLayer

Verifiable OS for agents with full-stack infrastructure: wallets with policies, gasless payments, secrets, storage, and VRF — all verified via TDX attestation.

[OutLayer @out_layer]

@AlexAuroraDev @therollupco haha would you wanna get OutLayer on for an interview? tho feels like you already know the project pretty well

[OutLayer @out_layer]

NEAR just moved its Chain Signatures network, the MPC that signs for 35+ chains, fully inside Intel TDX enclaves, with proofs checked on-chain. For OutLayer this is not news to retweet. It is the ground floor of our own building getting poured in concrete.

Why it matters to us. Every OutLayer agent wallet starts from a secret that NEAR's MPC network derives for an OutLayer enclave. Nobody at OutLayer holds a wallet key. The agent's code never touches it either. The agent gets buttons, not keys.

Until now there was one place in that story you had to take on trust: the MPC nodes themselves, 17 operators running on their own servers. Today those nodes run inside the same kind of encrypted hardware our keystore does, and anyone can check it on-chain.

So the whole path is now proven, not promised:
> 17 operators, 11 needed to sign, every node in TDX, verified on-chain
> the wallet's secret is derived for an OutLayer keystore build the chain has approved; the code is open source, anyone can rebuild it and compare
> every agent run executes in TDX and comes back with its own proof

What NEAR cannot do, and OutLayer does: decide what the agent is allowed to do with that key. Spending limits, allowed venues, owner confirmation for the actions you mark sensitive, a refusal for anything outside the policy, and connectors to Hyperliquid, Polymarket, Mercury, Gmail and GitHub, all running inside the same proven enclave. NEAR made the key trustworthy. OutLayer makes the agent's actions trustworthy.

Not a whitepaper. Running on mainnet, on top of the most decentralized MPC network NEAR knows of.

[NEAR Protocol @NEARProtocol]

https://t.co/GAHmqZMUUy

[OutLayer @out_layer]

We're aware of the security incident Phala disclosed on October 19: a vulnerability in the dstack guest-agent, combined with a host isolation gap on Phala Cloud. OutLayer was not affected.

1) We don't run on Phala Cloud. OutLayer runs on its own Intel TDX servers, with its own dstack deployment, its own key management service and its own gateways. None of the Phala Cloud infrastructure involved in the incident (their gateways, host nodes and KMS) is part of our stack, and none of our secrets were stored there.

2) The guest-agent flaw is in dstack, the open-source software we also run, but the path used against Phala Cloud was never open on our nodes. The affected endpoint is not reachable from the internet. Our confidential VMs run only our own attested images, and customer code runs inside a WASM sandbox that cannot connect to internal or host addresses. On top of that, we have isolated our confidential VMs from host services at the host level.

Even so, we are rolling out the patched dstack release across our fleet.

[OutLayer @out_layer]

Start here: https://t.co/zZgua2XOGv

[OutLayer @out_layer]

Excited to be a NEAR HACKATHON partner, come build with us! Going for Autonomous Business, AI Security or Agent Economy? On OutLayer your agent gets a TEE wallet under the owner's rules, plus Polymarket and Hyperliquid actions.

[NEAR Protocol @NEARProtocol]

NEAR HACKATHON is now live with $250K+ in prizes.

No signup. Just ship a public repo + public demo post between November 1st & Nov 14, 23:59 UTC.

Build on NEAR Intents, chain signatures, chain abstraction, NEAR AI Cloud, & more.

Full details: https://t.co/mkP9hKatU4

[OutLayer @out_layer]

@NEARProtocol Love seeing this. OutLayer agent wallets get their key root from this MPC network via Confidential Key Derivation, so no single party holds it whole.

[OutLayer @out_layer]

@svrn_ai Love this for agent custody. Our agent wallets get their key root from that same MPC network through Confidential Key Derivation, and our workers run in Intel TDX. Now the network holding the key root and the enclaves using it both run on hardware anyone can check.

[OutLayer @out_layer]

@NEARProtocol Your agent can move into the bunker too. An OutLayer wallet shields into a confidential balance on intents.far, swaps privately and unshields when done. The keys never leave the enclave, and the owner's spending rules still apply to every move.

[OutLayer @out_layer]

@Cameron_Dennis_ Love this, and it's close to what we run on OutLayer. Rules execute inside the Intel TDX enclave before anything reaches the outside service, and every run is signed with its code, input and output hashes. An auditor checks it against Intel's root cert without asking us.

[OutLayer @out_layer]

@ilblackdragon @NEARProtocol Happy 6th! One more for the list from us. OutLayer went live on NEAR mainnet this year. Your AI agent gets a wallet and access to your bank, Gmail and GitHub, but never the keys. It acts only under your rules, and every run is signed by the Intel chip it ran on.

[OutLayer @out_layer]

Welcome, Voulai agents. Our Hyperliquid and Polymarket connectors are live, and Voulai is the first to run them in production.

Here is what a connector on OutLayer means: a small published program runs inside a hardware enclave, derives the venue keys there, signs the orders there, and the agent never touches a key. Every run is attested, and anyone can check it against the exact build that ran.

The same model works for the web2 side. We already have connectors for business banking, Gmail and GitHub. A bank login, an inbox, a repo: web2 credentials, held and used with web3 security guarantees, and an agent that can only do what the owner's policy allows.

Any agent can try it!

[Vadim (AI, ⋈) @zacodil]

Voulai agents now trade Hyperliquid perps and bet on Polymarket, live, with real money, next to spot on NEAR Intents.

How it works: you describe a strategy in plain English, set the limits, and the agent runs it. It checks the market on a schedule, opens and closes positions by your rules, and you watch every decision, fill and PnL in a live feed. One strategy can use all three venues at once. A complete mandate looks like this: "Hold NEAR spot on NEAR Intents. On pullbacks in an uptrend, add a 2x long on Hyperliquid, take profit at +7%. When a 'Bitcoin above X' market on Polymarket is mispriced by 8+ points, take the other side." The agent moves the money between the venues itself when the strategy needs it.

The part I want to talk about is how an AI agent gets to touch real money without ever holding a key. That is OutLayer, and this is the first product running fully on it.

> Every Voulai strategy gets its own wallet on OutLayer. The keys are derived and kept inside Intel TDX enclaves. The agent never sees them, Voulai never sees them, I never see them.
> Hyperliquid and Polymarket orders are signed by small published programs that run inside the same enclave. Each program is registered on NEAR with a code hash, and any execution can be checked against the exact build that ran.
> No API key is pasted anywhere. The venue keys are born inside the enclave, so there is no server they can leak from.
> The owner sets policy in code, not in a prompt: which markets, max order size, daily volume, leverage cap. Withdrawals can only go back to the agent's own wallet.
> USDC moves between the wallet and the venues through NEAR Intents. A $10 deposit to Polymarket arrived as $9.99.

Two sponsors make it free to start. OutLayer covers every new Voulai strategy: $10 of integration calls for 50 days, no cap on deposits and withdrawals. NEAR AI covers the thinking: every new account gets $1 of private inference, about a week of an agent checking every 10 minutes, with 40+ models to choose from. Trading perps and prediction markets from day one costs the user nothing.

Your strategy stays private. If you choose to make it clonable, every copy pays you a share of its profit.

Not only for Voulai. Any agent can claim a free trial on OutLayer in its first week, 50 integration calls, no card, no deposit. Live integrations today: Hyperliquid, Polymarket, Mercury business banking, GitHub, Gmail. Skills for agents -> @out_layer and 👇

[OutLayer @out_layer]

@elonmusk The smarter it gets, the less it should hold your passwords. Give SI fixed actions under your own rules, never the keys.

[OutLayer @out_layer]

@NEARProtocol @token2049 If anyone at the bar asks how a NEAR agent can start using Intents, send them this skill. The agent reads it, registers its own wallet with one POST and swaps gasless under its owner's rules. The keys never leave the enclave. https://t.co/1ZIc429v7J

[OutLayer @out_layer]

Building something from @ilblackdragon's list on NEAR? Use our skills and primitives. Just give them to your AI agents, they'll love it.

[Vadim (AI, ⋈) @zacodil]

Great list. To make building these faster, take a look at @out_layer. It gives you verifiable compute and custody for AI agents on NEAR, all inside one Intel TDX enclave:

> a multi-chain agent wallet (NEAR, EVM, Bitcoin, Solana and 20+ chains). Its keys never leave the TEE, and it acts under a policy the owner sets. The policy is decrypted and enforced inside the enclave on every transaction.
> swaps, limit orders and confidential (shielded) balances through NEAR Intents
> connectors that run in the same enclave: Hyperliquid, Polymarket, GitHub, Gmail and Mercury banking
> your own WASM code, callable from a NEAR contract (yield/resume) or over HTTPS. Secrets are decrypted only inside the TEE, and every run gets an attestation.
> payment keys, payment checks and per-call earnings, so payments are built in from day one

Every part of it ships as an agent skill, so Claude Code, Codex or any other agent can build on it directly. Entry point: https://t.co/XIUwdQOPQt

Here is how it fits the ideas:

> AI Tamagotchi
The character contract calls OutLayer with request_execution and attaches NEAR, and that deposit pays for the run. Your WASM reads the onchain prompt, calls NEAR AI inference and resumes the contract with the answer plus a TEE attestation. Each character's state lives in OutLayer storage. Battle and arena outcomes come from VRF, so nobody can rig a fight. Contract integration: https://t.co/yjoRh187jX
Inference example: https://t.co/FN4H69RBtu
VRF: https://t.co/AJAn6VfYId
Storage: https://t.co/ArPC4YbPK2
Skill: https://t.co/3Wna8qUd6T

> Universal checkout widget
Each merchant gets an agent wallet with deposit addresses on 20+ chains. The buyer pays from whatever chain and asset they hold, and the wallet swaps it into the merchant's stablecoin through NEAR Intents, with no gas tokens needed on the destination chain. Payment checks act as escrow and handle refunds without a smart contract. For the fiat side, the Mercury connector issues invoices and reads incoming payments from the merchant's bank account.
Docs: https://t.co/ZbxPnteFp0
Payment checks: https://t.co/NS0zKcJOFm
Skills: https://t.co/zGVhEcjNZq, https://t.co/zHWFg5NwTA, https://t.co/v9yxwlDewJ

> Private OTC market
The order book lives in sealed storage inside the enclave, so a maker shows the market only what they choose (pair, size band) and the rest stays private. When a taker accepts, the TEE matches the two sides and settles with confidential transfers and swaps on the NEAR Intents private shard. A payment check works as a commitment deposit, so a counterparty can't post a deal and walk away.
Confidential intents: https://t.co/nhclTjLkRG
Sealed records: https://t.co/t76epcpTN4
Skills: https://t.co/FSltrNN0FE, https://t.co/bW1AqPg7DY

> "Never get liquidated" and delta neutral anything
The Hyperliquid connector opens, manages and closes perps from the agent wallet and moves funds in and out of the perp account. The spot leg goes through NEAR Intents swaps and limit orders. A scheduler wakes the agent to check margin, top up collateral, rebalance the hedge and collect funding. The owner's policy caps what the agent may spend and where it may send funds, and large moves can require the owner's approval. You can drive the same flow from a NEAR contract through yield/resume.
Skills: https://t.co/ImQTSDoUGT, https://t.co/1abVKbpcHL
Policy engine: https://t.co/ka6e8Qawax
Scheduler: https://t.co/3mve0NJjfz

> Kickback for events, on any chain
Guests deposit any asset from any chain into the event's wallet, and it gets swapped into one asset. After check-in, the wallet issues payment checks to the guests who showed up. Partial claims split the pot, and unclaimed checks expire and come back. You need no escrow contract and no per-chain integrations.
Payment checks: https://t.co/NS0zKcJOFm
Skills: https://t.co/bW1AqPg7DY, https://t.co/zHWFg5NwTA

> Fully private code review
The GitHub connector reads every changed file in a private PR with its patch (pr_files) and posts the review with line comments (pr_review), as the repo owner and under their policy. The code goes from GitHub into the enclave and then to NEAR AI private inference, so no human or server operator sees it. The GitHub token stays sealed in the TEE. Each review links to its attestation.
Skill: https://t.co/NAF7ke1hsl
Connectors: https://t.co/S2Ub0zHLku
Inference example: https://t.co/FN4H69RBtu

> Company cap table, crypto and banking
The company treasury becomes a multi-chain wallet with multisig approvals, so investors can pay in on any chain. The Mercury connector covers banking: paying recipients, issuing invoices and reading transactions, all under the same approval policy.
Multisig: https://t.co/KasmBztLoD
Skills: https://t.co/zGVhEcjNZq, https://t.co/v9yxwlDewJ

> Private trading with paid viewing access
The trader holds confidential balances, so positions are invisible onchain. The enclave can still read them, so it publishes PnL with a TEE attestation, which proves it without revealing a single trade. Subscribers pay per call or per period with payment keys and receive the position feed. The trader earns directly through OutLayer earnings.
Confidential: https://t.co/FSltrNN0FE
Payment keys: https://t.co/8bQFegfAL3
Earnings: https://t.co/HTfVFH2gTT

> Private medical second opinion
The frontend encrypts the patient's data to a key that exists only inside the enclave. The WASM decrypts it inside TDX, calls NEAR AI and returns the answer. Expert prompts become author secrets: they are decrypted into every run, users never see them, and the prompt author earns on each call. Users pay in crypto through payment keys.
Encryption keys: https://t.co/ukARqVb5XA
Secrets: https://t.co/1RrOOZtYkY: https://t.co/HTfVFH2gTT
Skill: https://t.co/m7499vxB0q

> AI benchmarking with private test sets
The test set is stored as an author secret and decrypted only inside the enclave. The harness runs there against the submitted model, and the result comes back with an attestation tied to the exact WASM build and the hash of the test set. The score is certified and the data never leaves the TEE.
Secrets: https://t.co/midVcTV9jQ
TEE attestation: https://t.co/hDOmDPlHoI
HTTPS API: https://t.co/JJ2BYhFhwa

If you're building any of these and have questions or want code examples, come to https://t.co/T9GOHkALWT and we'll help.

[OutLayer @out_layer]

OutLayer Agent Custody now reaches Web2.

The same model that lets an agent hold crypto without holding the keys now covers your bank account, company email, GitHub and trading accounts. Delegate them to an AI agent the Web3 way: the login stays locked to your account, the agent gets fixed actions, your policy sets the limits, and anything you choose waits for your review before it goes out. Every run verifiable.

Mercury Bank, Gmail, GitHub, Hyperliquid, Polymarket, a wallet across chains. Or build your own for any API.

Walkthrough in the post below

[Vadim (AI, ⋈) @zacodil]

Thanks to a new @out_layer feature, I gave my AI agent my company's bank account, corporate email and GitHub.

It can't leak a single key. It can't pay a stranger. It can't email my biggest client at 2am.

Here's how.

It never sees the keys. You lock each login with your own blockchain account and lend it to the agents you name, for as long as you choose. Take it back in one step. Neither the agent nor we can read it.

It gets buttons, not keys. A program with fixed actions: pay an invoice, send an email, open a pull request. There is no "show me the key" action. Your rules live outside the AI, so no prompt talks its way past them.

Email goes only to people you allowed, from your work address. It can't read your inbox.

Anything that matters comes back to you. Approve a payment above your line, read an email before it's sent, answer the agent's question, give it the data it's missing. You see exactly what will happen, approve once, and that exact action runs. Nothing else.

You get it on the site or at your own webhook. One inbox for all your agents, encrypted to your devices.

And you don't take any of this on trust. Every request comes from a secure hardware enclave, with proof of the program that made it, signed by the Intel chip it ran on: which code ran, what went in, what came out. Check it yourself.

The same agent trades. One skill does the whole job: you deposit from any chain NEAR Intents supports, and the agent takes it from there. It funds the venue, opens perp positions on Hyperliquid and bids on Polymarket with one call each, and brings the money back. No venue APIs to learn, no order signing, no bridges to figure out. And it stays inside the limits you set.

Give your agent a wallet across chains, with confidential, gasless swaps, and access to Mercury Bank, Gmail, GitHub, Hyperliquid and Polymarket. Or build your own for any API, no approval from us.

The skill for your agent and all the links are in the reply below.

[OutLayer @out_layer]

Something's cooking at OutLayer 👀

AI agents that act on your real accounts (bank, email, code, trading) without ever holding your keys.

Now your agent can prepare an action as a sealed envelope and send it to you to approve, or ask you for what it's missing. Before you decide, you see exactly which code built it and verify the full certificate chain yourself, down to the Intel chip it ran on.

Or skip the clicks: set automatic policies by amount, recipient or venue, and let the routine go through on its own.

Mainnet soon. Stay tuned.

[OutLayer @out_layer]

"Who checks the attestation?" — the right question, and most providers don't have a good answer.

Same gap exists one layer up. For AI agents it's not enough to prove the environment was genuine — you need proof of which code ran inside it, and a third party has to be able to check it.

That's what we build.

[SVRN @svrn_ai]

Twenty years ago, shared infrastructure was close to unthinkable for a systemically important bank. Today it's the default at those same banks, after controls became auditable and third-party certifications started carrying real weight with examiners.

@sal_ternullo was at State Street when cloud was still off the table, and later built risk and audit frameworks there for machine learning and blockchain. Here he explains what confidential AI needs to follow the same path:

https://t.co/fiDpQ6oZEd

[EAS (Ethereum Attestation Service) @eas_eth]

TEE attested data 👀

[OutLayer @out_layer]

Post-quantum on NEAR mainnet, live in production 🧬🔐
Our TEE workers now sign on-chain with ML-DSA-65 (FIPS-204). The key is generated inside the Intel TDX enclave — hardware isolation + quantum-resistant signatures on the same trust anchor.

[Vadim (AI, ⋈) @zacodil]

OutLayer just went post-quantum on NEAR mainnet

Our workers already run your code inside hardware nobody can open, not even us. Now the results they deliver on-chain are sealed too: the signing key is born inside the same Intel TDX enclave, proven by the hardware itself, and signs with ML-DSA-65 - the NIST post-quantum standard NEAR just shipped.

Nothing to peek at. Nothing to steal. Nothing to forge.

From enclave to chain — no weak link 🛡️

[OutLayer @out_layer]

@zacodil Docs https://t.co/KchApM7m2K
API https://t.co/H1tbv6A0Dr