Horos
Horos makes a change of payment address a succession ceremony. contracts/src/CounterpartyRegistry.sol derives a portable counterparty id (counterpartyIdFor), keeps a public lineage(), and only moves an active account through proposeSuccession, role-bound attest signatures and activate, so the recipient can never complete its own replacement; contracts/src/CustodyVault.sol exposes pay(bytes32 counterpartyId, uint256 amount, bytes32 ref) with no address parameter, under caps, an executor allowlist and replay-protected references, with 57 forge tests including an adversarial suite. lib/policy.ts decide() returns a deterministic RELEASE/HOLD/ESCALATE verdict with reasons, and applyModelProposal() lets signals from lib/judgment.ts escalate but never release; lib/invoice.ts extractWithModel() uses Claude for field extraction only. lib/circle.ts signs through Circle Developer-Controlled Wallets (createContractExecutionTransaction), lib/watch.ts classifies succession states, and the Cloudflare Worker in worker/src/index.ts serves the read-only decision site with a 20-minute cron. 104 vitest cases cover the TypeScript.
dreaming is my dope.
1 (Solo) — Kiter
A change of payment address is a succession ceremony, not a field update. An agent that pays a business's invoices on Arc and cannot move money to an address it cannot prove.