AVALANCHEAI
Phase 1 liveUpstream

Avalanche intelligence runtime

One runtime.
Seven domains.
Verifiable execution.

Avalanche AI hosts seven Avalanche intelligence domains on one shared DeepSeek Harness runtime — with deterministic routing, a default-deny capability policy, a hash-chained evidence ledger, and tamper-evident execution receipts.

Explore the runtime Read the documentation
Build19 packages / Phase 1
RuntimeOne bundle, one process
SafetyRead-only / Fuji & mocks
RUNTIME_001REMOTION / 30FPSREAD-ONLY
dsh --profile avalancheFuji 43113default-deny
7 DOMAINS1 RUNTIME
avalanche / verifiable execution infrastructure

01 / Runtime

One composition.
Every layer accountable.

Avalanche AI extends the upstream harness in place. It adds one bundle, one patch block, and nineteen packages — all sharing the same process, tool registry, and policy engine.

COMPOSITION / AVALANCHETOP → BASE
L4Operator surfacesCLI shipped · dashboard Phase 4 · SDK planned
L3avalanche-orchestratorIntent → plan → dispatch → verify → receipt
L2avalanche-agentsSeven domain descriptors · deterministic keyword routing
L1Shared servicespolicy · tooling · evidence · verification · network · context · memory
L0dsh-base / DeepSeek HarnessAgent loop · sessions · tools · prompts · approvals
Domains07
Packages19
Read tools05
No second runtime. No microservice split. No Next.js in the product stack.

Architecture notes

What the fork adds.

The upstream harness keeps ownership of the agent loop, sessions, tools, prompts, and approvals. Avalanche AI adds the intelligence layer above it: domain routing, capability policy, evidence, and verification.

01

One bundle, one insert block

The entire Avalanche runtime is a single cordis.patch.yml over dsh-base, registered as PROFILE_TEMPLATES.avalanche. Seven domains are rows in the same composition — never separate processes or profiles.

02

Deterministic by construction

Routing is lexical, not model-based. The same objective always produces the same plan, and the matched keywords are inspectable in the task record.

03

Model-provider neutral

Nothing in the Avalanche layer names a provider. The orchestrator reads the current model selection and passes it to agents.create; any adapter or local model works.

CordisTypeScriptdsh-basecordis.patch.ymlMIT

$ dsh --profile avalanche doctor
7 domains · 3 networks · 5 tools · 6 rules · 1 verifier

02 / Domains

Seven domains.
One registry.

Every domain is a data package: a name, a summary, routing keywords, a capability set, and a prompt. Adding a domain is a package and one row — not a new runtime.

01low risk

Developer

Smart contracts, subnets, and client applications built on Avalanche.

code:generatechain:read
Solidity reviewFoundry scaffoldsICM clients
02moderate risk

Security

Smart contract, key handling, and deployment risk review.

code:generatechain:read
Threat modelsKey-handling reviewDeployment risk
03critical risk

DevOps

Node, validator, RPC, and deployment operations.

chain:readinfra:operate
Validator runbooksRPC healthRollback plans
04low risk

Data

On-chain indexing, metrics, and analytics for Avalanche networks.

chain:read
Block windowsBalance readsReproducible metrics
05low risk

Protocol

Consensus, staking, subnets, and Avalanche protocol mechanics.

chain:read
Consensus rulesStaking mechanicsL1 configuration
06moderate risk

Testing

Test plans, fork tests, fuzzing, and invariant checks.

code:generatelocal:executechain:simulate
Invariant suitesFork testsFuzz plans
07moderate risk

DeFi

Liquidity, lending, oracles, and yield mechanics on Avalanche.

chain:readchain:simulate
Pool analysisOracle reviewSlippage assumptions
+ 01

Adding a domain
is a package.

Descriptors are data. Routing reads keywords, the orchestrator installs the prompt, and the policy engine judges the capabilities its tools declare.

Read the architecture

03 / Lifecycle

Nine stages.
No skipped gate.

The fixed lifecycle is the contract. Every task crosses it in order, and every stage leaves a record that can be inspected afterwards.

01

Intent

The objective becomes an IntentSpec: action, capabilities, constraints, expected outcomes, and risk. Recorded before any decision.

In this build
02

Policy check

Rules are unioned and the strictest verdict wins. Unknown capabilities are denied. Risk understatement is denied.

Policy-enforced
03

Execution plan

Deterministic keyword routing selects up to maxSteps domains. The same objective always produces the same plan.

In this build
04

Tool execution

Every call crosses the executor-level policy gate before dispatch. The tool catalog is the only registration path.

In this build
05

Simulation

Empty by construction for read-only capabilities. chain:simulate is reserved for the Phase 3 fork simulator.

Later phase
06

Approval

A require-approval verdict parks the task. Approvals are fingerprint-bound, single-use, and cannot be overwritten.

Policy-enforced
07

Execution

Read-only tool execution in this phase. Write, sign, and infrastructure execution are absent by design.

In this build
08

Verification

The chain-id verifier compares what the endpoint reports with the registered descriptor. Unknown means unverifiable — never verified.

In this build
09

Evidence receipt

A SHA-256 digest over canonical JSON, appended to the hash-chained ledger. The receipt carries a fixed disclaimer.

In this build

Receipt disclaimer / Attests that this action passed policy evaluation and that the referenced evidence records are unmodified. It does not attest that model reasoning, generated code, or operator intent was correct.

Full stage map

04 / Security

Trust is a gate,
not a prompt.

The model is untrusted. Policy is enforced in the executor pipeline — after tool lookup and before dispatch — for every caller, not as a prompt instruction or a UI state.

01tools/pre-execute

Default-deny policy

Every tool declares a risk profile and a capability set. Unknown capabilities are denied; understated risk is denied; the gate fails closed when policy is absent.

02fingerprint-bound

Single-use approvals

A require-approval verdict parks the task. Approvals bind to the exact request fingerprint, cannot be decided twice, and cannot be consumed twice.

03hash-chained

Tamper-evident evidence

Every tool result is appended to a SHA-256 hash chain. Receipts digest all content and cite the evidence ids that support them; verifyChain() recomputes every link.

Security invariants enforced by tests

  • A catalogued tool with no policy engine is denied
  • Mainnet chain:write is denied before any executor exists
  • An approval cannot be consumed or decided twice
  • A modified evidence record fails verifyChain()
  • A non-allowlisted RPC method fails before transport
  • A receipt carries the fixed disclaimer
POLICY SIMULATORBASELINE RULES / NON-AUTHORITATIVE
Network environment
Requested capabilities
VerdictALLOW
rule idallow-read-and-generate
declared risklow

Every capability is explicitly allowed without human review.

Illustrative re-implementation of the baseline rules for this public site. The shipped policy engine is the authority.
Try a mainnet write → deniedThreat model →

05 / Evidence

A receipt is
a proof, not a story.

The ledger is append-only in memory and mirrored to JSONL. Receipts survive restarts, and every digest is recomputed on load.

EXECUTION_RECEIPT.JSONSHAPE ILLUSTRATIVE / FIELDS FROM SCHEMA
{
  "id": "rcp_01j9f2k4x8",
  "taskId": "tsk_01j9f2k3aa",
  "intentId": "int_01j9f2k3ab",
  "executionId": "exe_01j9f2k3ac",
  "action": "read-chain-status",
  "risk": "low",
  "policy": {
    "effect": "allow",
    "ruleId": "allow-read-and-generate",
    "permissions": ["chain:read"]
  },
  "evidenceIds": ["evd_01j9f2k3ad"],
  "verification": { "kind": "chain-id", "verdict": "verified" },
  "disclaimer": "Attests that this action passed policy
    evaluation and that the referenced evidence records
    are unmodified. It does not attest that model
    reasoning, generated code, or operator intent was
    correct.",
  "digest": "sha256:9f2c…c41a"
}
sha-256 / canonical jsonverifyChain() / ok
01

The executor records, not the model

Evidence subscribes to tools/result at the executor. A tool call exists in the ledger because it ran — not because the model said it ran.

02

Every link recomputes

Each record carries prevHash and a digest over its canonical body. verifyChain() walks the ledger from genesis and reports the first index that breaks.

03

Receipts cite, never summarize

A receipt references evidence record ids and a verification verdict. Narrative text from the model never becomes the audit trail.

11test files
95tests passing
0mainnet writes

Known limit / the JSONL mirror is append-only by convention. A writer with filesystem access can truncate the whole file; off-box anchoring is deferred. Receipts are tamper-evident, not tamper-proof.

Read the threat model

06 / Roadmap

Delivered first.
Claimed second.

Phase 0 and Phase 1 are complete and tested. Everything after this line is a plan, not a capability — the site will never present it as shipped.

PHASE 0Delivered

Foundation

Fork, audit, 19-package skeleton

PHASE 1Delivered

Vertical slice

Runtime, 7 domains, CLI, receipts

PHASE 2Next

Knowledge

MCP docs surfaces with source labels

PHASE 3Planned

Write prep

Unsigned tx building + fork simulation

PHASE 4Planned

Dashboard

Vite + React operator console

PHASE 5Planned

Guarded writes

Fuji-only signed execution

PHASE 6Planned

Analytics

Semantic memory + metrics worker

PHASE 7Planned

Hardening

External review + release

Sequencing rule / no phase skips the policy gateFull phase detail →

08 / Tools & networks

Five read tools.
Three networks.

The network package exposes 5 catalogued read-only tools over a fixed JSON-RPC allowlist. Mainnet is present as a read-only descriptor; signing and submission are disabled.

Read-only RPC allowlist
eth_chainIdeth_blockNumbereth_getBalanceeth_getTransactionByHasheth_getTransactionReceipteth_getBlockByNumbereth_getCodenet_version
01
avalanche_networks

List the Avalanche networks this runtime may read.

chain:read
02
avalanche_chain_status

Read the chain id and latest block number reported by one network.

chain:read
03
avalanche_balance

Read the native AVAX balance of one address on one network.

chain:read
04
avalanche_transaction

Read one transaction and its receipt; report pending instead of guessing.

chain:read
05
avalanche_contract_code

Read deployed bytecode at one address on one network.

chain:read
Network descriptorWrites
Avalanche Fuji Testnetfuji / fuji
policy-gated
Avalanche C-Chain Mainnetmainnet / mainnet
disabled
Local Avalanche Networklocal / local
policy-gated

09 / Status

The honest state
of the build.

Phase 0 and Phase 1 are delivered and gated. This table mirrors the checks that actually ran; it does not turn a plan into a pass.

PHASE 0–1PASSEDTEST / THEN CLAIM
GateCommandStateEvidence
Avalanche suitepnpm exec vitest run packages/avalanchePASS11 files / 95 tests
Typecheckpnpm run typecheckPASS5 / 5 gates
Lintpnpm exec oxlintPASS0 diagnostics
Docspnpm run test:docsPASS21 / 21 gates
Docs buildpnpm run docs:buildPASSexit 0 / 5302 fragments resolved
Mainnet writespolicy + executorNONEabsent by design; denied at the gate
External auditPhase 7LATERnot claimed
Reported at commit 87d3e6ae34 / masterNo claim is stronger than its test.

07 / Get started

Read the map.
Inspect the gates.

The architecture, threat model, test strategy, and phase report are published in full. Start with the runtime map or run the CLI against a Fuji read-only profile.

Browse documentation Read the phase report
QUICKSTART.SHREAD ONLY

$ git clone https://github.com/deepseek-ai/deepseek-harness.git

$ cd deepseek-harness

$ pnpm install

$ pnpm exec vitest run packages/avalanche

expect: 11 files / 95 tests passing
then: dsh --profile avalanche doctor

NO MAINNETNO KEYSFUJI / MOCKS
Built on DeepSeek HarnessMIT license