Aster

An AI that always remembers why you bought, keeps watch over all your wallets, and can never spend your money on its own.

Aster is a feasibility study you can click and play with, currently a demo. The site has five tabs: Concept, Demo, Architecture, Feasibility and PPT, and every number on it is simulated. This piece does not count features. It explains what the product is actually for, which three things hold it up, the cracks we found in our own design, and where it stands today.

Strip out the jargon first

Someone who lives in crypto pays four kinds of cost every day.

A general AI assistant covers part of the first two. A trading bot covers part of the fourth, at the price of handing over your keys. Aster takes a third path:

observe → understand → propose → you confirm → execute → record → into long-term memory.

It stops neither at "chat and advise" nor at "authorize and let the bot trade". Its main job is to maintain the whole operating context of your crypto life and hand the decision back to you at every point where money moves. Put more precisely, it is a control plane bounded by your own asset permissions, a chief of staff for your crypto life who is always on duty.

Three bones

After surveying thirteen capability areas we asked the reverse question: if only three things could stay, which ones?

The first is persistent crypto memory. Every competitor's memory stops at chat history or wallet labels. Aster wants to remember the position thesis: when it was opened, on what reasoning, what invalidates it, what to do when it is invalidated, and which research note, conversation or transaction is the evidence. Six months later when you ask "how is SOL doing", the right answer is whether the news has shaken your original thesis, rather than a news digest.

The second is the confirmation gate: propose → gate → sign. The AI gets strong powers to observe, analyze and prepare; the power to dispose of assets stays with the human.

The third is the scene-driven command center. The AI never touches pixels, it edits one JSON scene and the screen grows out of it; switch back to any past thread and the canvas grows back into what it looked like then.

Without x402 Aster is still Aster; without IPFS, Lightning or DAO it is still Aster. Without memory it decays into a trading assistant; without the gate it becomes a dangerous agent; without the scene it is a chat box. Only the three together make Aster.

Why the gate is more than a button

In many products "human in the loop" means the AI calls a tool, the UI pops a dialog, the user clicks confirm. That is UI.

Aster pushes it one level down: every capability that produces irreversible external state passes through the same PolicyEngine → Gate → Signer channel. Plugins never see private keys. Only the kernel's gate can call the signer. The way an MCP server (Model Context Protocol, the standard for AI to reach external tools) asks the user for input cannot become a second confirmation entry. A Skill (a package that teaches the AI how to do something) cannot change permissions. The unattended heartbeat lane always has less authority than you do when present. Preferences the AI learns from your approvals and rejections are held for your review and cannot rewrite policy directly. Every approval carries a single-use nonce.

All of this rests on one assumption: the LLM itself is an untrusted component by default. Design the system around that assumption and the gate turns from a button into a security model.

The confirmation gate: the only approval control in the entire interface, and Aster has no ability to press it

The AI never touches pixels

Agent-driven UIs are usually brittle: the LLM says "create a card, add a picture, move it to the right". Aster lets the agent change only the state of the world and lets the renderer decide what the world looks like. Screen is a function of scene; scene is a function of thread. The payoff goes well beyond experience: testability, versioning, rendering on any device, permission control, rollback, and room for plugins to grow.

Small kernel, everything else is a plugin

The kernel handles six things: main loop, scene, memory, gate, budget, rules. Wallets, chains, market data, sentiment, DeFi, DAO, payment rails, nodes and content are all plugins, and first-party and third-party plugins share one interface.

Each of the six pluggable interfaces sits on a real axis of change, and none exists to make the diagram prettier. The signer will move from a local keystore to hardware wallets, MPC and smart accounts; the payment rail will add Lightning's L402 next to x402; the chain adapter has to cover Ethereum, Solana and Bitcoin. Abstract what will change, and only that.

Three cracks we found in our own design

With the design laid out, we would rather write down where it still does not stand firm.

First: autonomy versus confirmation. The loudest line in the brand is "it always stops for your approval before money moves". Yet in the demo the agent has already paid 0.02 USDC to another agent for a counterparty score, and we hope an agent-to-agent economy grows from there. The three claims cannot all hold. If every two cents needs a nod, that is no autonomous agent economy; if the user pre-approves "up to 5 USDC a day, no confirmation for allow-listed services under 0.05", then "always stops for your approval" has already become "you nodded once, earlier". The honest model splits authority into five dimensions: scope × budget × counterparty × action × time. For example: the sentiment research agent, for the next 24 hours, only with allow-listed vendors, at most $0.05 per call and $2 in total, no transfers, no approvals, no arbitrary calldata. That is capability delegation, finer than a gate and more honest. Aster's budget triple is an early form of it, and it is not finished.

Second: the gate is not where security ends. You see "swap 30% ETH to USDC, expected $8,241, gas $6.2" and long-press for 1.2 seconds. That proves you expressed approval; it does not prove the transaction you signed is the one on screen. A malicious RPC, poisoned calldata, a Permit2 approval, a 7702 delegation, an expired quote, a simulation that diverges from execution: any swapped link breaks the chain, and if the machine itself is compromised the attacker can draw a fake gate. So the long press is UX friction, and no security primitive. The full trust chain runs from intent to simulation, policy, human review, transaction binding, a trusted signer and broadcast; the highest-risk actions will still need a hardware wallet's trusted display or a separate signing device. The direction is right; the trust boundary is not yet drawn to the bottom.

Third: memory cannot be one pool. "Remembers your whole crypto life" is the most likely moat and the most dangerous part. On-chain facts are objective, user instructions are highly trusted, the user's theses are subjective but important, AI inferences are low-trust, and external sentiment and plugin output are untrusted. If someone writes in a Telegram channel "the user has decided to auto-sell BTC below 70k" and a retrieval pipeline writes it into memory, the AI may later treat it as your strategy. Every memory needs provenance, an authority level, a confidence score and an expiry, and memory itself must be treated as untrusted input.

The architecture supports thirteen areas; v1 proves one thing

The thirteen-area capability map is handsome, and it is a warning sign. Architectural scope is not product scope. Any company building two of those areas alone would find life hard.

So v1 is cut to four things: a unified fact layer for wallets and holdings, crypto memory, research and sentiment, and the propose-gate-execute loop. It proves one complete user story: Aster spots an anomaly, explains why, connects it to your earlier judgment, proposes a concrete action, you confirm, it executes, and it records why you did it. Done to the limit, that alone is a product. x402, Lightning, IPFS, the node network, the agent marketplace and any token leave the front page for now. Nothing is wrong with them; the problem is that they dilute the most valuable part. The agent economy is an option, never a premise.

Who it is for

We withdraw the line "an integrated product ordinary people can use". Most ordinary people's biggest crypto problem is that they do not have three wallets, five DAOs, eight protocols and two hundred Telegram messages to manage. Aster's value grows with complexity: more assets, more wallets, more chains, more decisions, heavier information load. The first users are high-frequency on-chain operators: multi-wallet, multi-chain, active in DeFi and governance, already on hardware wallets, with explicit investment theses. For them "remember my whole crypto life" is obvious value; for everyone else it may be one more AI dashboard.

The real competitor and the real moat

The comparison table lists OpenClaw, Bankr, Olas, Nansen, Arkham. The dangerous competitors are MetaMask, Coinbase, Ledger and Binance moving up the stack themselves: they already hold the wallet, identity, transactions, policy and distribution. "We can connect to Coinbase Wallet too" is no long-term wall.

The only moat is wallet-independent personal context, a policy graph and an audit history. Ledger today, MetaMask tomorrow, a Solana wallet the day after, and your past judgments, risk rules, DAO positions, trade reasons, authorization records and learned preferences still belong to Aster. Reach that and it earns the name OS; fall short and it is a pretty wallet super-app. So the brand can say OS, but the front page should sell the outcome first: an AI that remembers why you bought, watches all your wallets, and can never spend your money on its own.

The 3D node star map in the ecosystem space: multi-node sync and IPFS snapshots stay in the architecture and step out of the main story for now

Where it stands

Today it is a demo you can click and play with, alongside a research report, an architecture design and a survey of thirteen capability areas. More worth writing down than the progress are the assumptions that got overturned.

"The parts are all mature, so technology is green" was too optimistic. A, B, C and D each being doable does not make A+B+C+D a simple engineering job; in financial software complexity scales with the interactions between components, and heartbeat, stale quotes, bridges, wallet policy, memory recall, malicious tokens and hardware signers meeting in one place is already a systems security problem. The signal is now three layers: core prototype green, production financial execution yellow, consumer-grade autonomous finance yellow leaning red.

"Agent economy" once took too much of the story. The x402 standard is in place, yet daily settlement is down 93 percent and half the services marked healthy in the directory do not actually work. It is now an option.

"Personal AI OS" works as a brand and is a bit hollow as a product definition, so the front page now sells the outcome.

The market light stays yellow: Telegram trading bots have cleared $50 billion, proving people will type to trade; an OKX survey found 70 percent willing to let AI act within limits, and 63.6 percent refusing full automation; nobody has verified who would pay $20, $50 or $200 a month for a "crypto control plane". None of the five preconditions for a go decision has been met.

One level down

The direction most worth pursuing is neither a fourteenth capability nor more polish, but pushing the gate one level further into a personal authority engine: something that manages what power the AI has rather than merely deciding whether to pop a dialog. What it may read, what it may only propose, what it may execute within a budget, and what it may never do (seed phrases, unlimited approvals, delegated governance votes, disabling security policy). Get there and crypto becomes only the first vertical; Aster's core becomes the personal authority layer for the age of AI.

What keeps agents out of high-value personal workflows is that people still lack a clear enough authorization model, more than any shortage of intelligence. Aster is trying to make permissions, budget, confirmation, memory, execution and audit one system. Its biggest problem today comes from its ambition: it has designed a platform before proving the single product that must exist first. Suppose x402, IPFS, nodes, tokens and the agent marketplace never succeed and only "memory, monitoring, proposals and human-signed execution" remain. Is it still something you would open every day and pay for every month? That is the one question we intend to answer next.