A payment agent that runs on your machine. A 1B model reads the instruction, the wallet's own policy engine decides, the key signs offline, and exactly one step touches the network — the broadcast. Recorded run below: four instructions, one signature, three refusals.
Model inference (Llama 3.2 1B Q4_0, local GGUF), payee resolution, WDK policy evaluation, ECDSA signature. Egress guard installed: 0 external connections.
Nonce and gas price reads, and the broadcast. That is the whole list.
Denied intents throw PolicyViolationError inside the wallet, before a signature exists. Prompt rules are not enforcement; policy rules are.
Code: github.com/kaminariouji/pocket-cfo · Chain: local anvil, id 31337, no real funds.