# Eclipse

> Eclipse is a payment firewall for AI agents on NEAR. Steps in front of the bad payment, stays in the background otherwise. The agent can only ask a Guardian contract for a payment; the contract holds the funds and pays only after an off-host checker returns allow. Every verdict leaves an on-chain receipt. NEAR HACKATHON 2026 build, NEAR testnet, MIT licence.

## Key facts

- Problem: prompt injection can make an AI agent pay an attacker, and guardrails on the agent's own host can be skipped by a compromised agent.
- Custody: the Guardian contract (guardian-v2.jimuelle-firewall.testnet) holds a mock tUSDC token (NEP-141, 6 decimals). The agent account has only a function-call key limited to request_payment.
- Decision: a checker runs policy rules, an injection classifier and counterparty signals; TypeSafe Jev fuses them into allow, hold or block, with no human step. The checker runs on OutLayer (Intel TDX TEE).
- Safety: the verdict binds receiver, token, exact amount and a one-time request id. No AI decides an amount. Hard caps in contract code: 200 tUSDC per payment, 500 tUSDC per UTC day.
- Results (150 benign, 150 attack payments, six attack families): missed attacks 19.33% vs 100% with no defense; false blocks 0%; false holds 5.33% (in-sample, above the 5% target).
- Not built: the masked re-run (MELON) and a re-check during the hold window.

## FAQ

### What is Eclipse?

Eclipse is a payment firewall for AI agents on NEAR. The agent holds only a function-call key that can ask a Guardian contract for a payment. The contract holds the funds, pauses each request, and pays only after a checker running off the agent's host returns allow.

### How does it stop prompt-injection payments?

Each payment request runs a checker: policy rules (the amount must match the request or invoice), an injection classifier on everything the agent read, and counterparty signals such as account age and lookalike distance to known payees. TypeSafe Jev fuses these signals into allow, hold or block.

### When is a payment held or blocked?

A payment is held when Jev's "unusual" score is above the conformal threshold (q̂ 0.84, ε = 5%) or when a non-Jev detector raises an attack flag. It is blocked only when the score is above the threshold and two attack signals from different detectors agree, at most one of them from Jev. Thresholds live in the checker's configuration, not in prompts.

### What does NEAR do in this design?

NEAR holds the funds in the Guardian contract, limits the agent's key to one method, pauses each request with yield and resume, pays only on an exact match of receiver, token, amount and request id, enforces hard caps (200 tUSDC per payment, 500 tUSDC per UTC day) and writes an on-chain receipt for every payment.

### Does a human approve payments?

No. Allowed payments are paid at once, unless the amount is above the payee's budget (a new payee starts at 20 tUSDC), in which case they wait like a hold. Held payments wait in escrow for a window set by the amount (10 minutes under 20 tUSDC, 1 hour up to 100, 6 hours above) and are then released by a release_held call, which any account can send. The owner can cancel a hold. No AI decides an amount.

### How well does it work?

On 150 benign and 150 attack payments across six attack families, Jev fusion with the conformal threshold missed 19.33% of attacks (100% with no defense), with 0% false blocks and 5.33% false holds. The false-hold figure is in-sample and above the 5% target. Fake-invoice and memory-poisoning attacks are the weakest families.

### What are the limits?

Detection covers the six evaluated attack families; new or adaptive attacks are bounded only by the hard caps in contract code. The masked re-run (MELON) and a re-check during the hold window are not built. The false-hold bound assumes live payments look like the calibration set.

### Is it live on mainnet?

No. It is a NEAR HACKATHON 2026 build that runs on NEAR testnet with a mock tUSDC token (6 decimals). The receipts panel on this page reads the testnet Guardian live.

### Can I try it without keys?

Yes. From the repository, build the checker with cargo build -p checker --release, then in agent/ run uv sync and uv run firewall-demo --scenario benign-hosting, then the attack-morse-lookalike scenario. The dry-run needs no keys and no funds.

## Links

- [Site](https://eclipse-9le.pages.dev/)
- [How it works](https://eclipse-9le.pages.dev/#how)
- [Results](https://eclipse-9le.pages.dev/#results)
- [Live testnet receipts](https://eclipse-9le.pages.dev/#receipts)
- [Guardian contract on NearBlocks](https://testnet.nearblocks.io/address/guardian-v2.jimuelle-firewall.testnet)