Verification in place of trust.

Suwappu is a cross-chain execution layer at suwappu.bot, built so that an AI agent is a first-class user: register with one call, then quote, simulate, and swap over plain REST, the Model Context Protocol, or A2A, and pay per call over HTTP 402 (x402) without ever opening an account. People use the same engine through Telegram, WhatsApp, Discord, a web terminal, and an iOS app. The codebase is public at github.com/0xSoftBoi/suwappubot under the Apache License 2.0 (the three published npm packages are MIT), with CodeQL, Scorecard, and a checked-in SBOM in the repository (verified 31 August 2026, UTC).

Its discipline is containment rather than proof. Agent wallets live in Turnkey hardware enclaves; the agent never sees a key. Every swap can be simulated before funds move. Spending limits, withdrawal whitelists, cooldowns, and two-factor thresholds bound what any actor, human or machine, can do. Quotes are raced in parallel across 21 routing providers, gated per chain; no single swap races all 21, and the winning route is shown on every trade. That count is derived from source at build time, and the repository's continuous integration fails the build when published numbers drift from code (checked 31 August 2026). This is the doctrine's execution line in production form: the agent acts only inside bounds a human pre-authorised.

An honest note on rails. Suwappu routes across today's interoperability providers, including committee-secured bridge designs of exactly the kind the FAEI brief criticises. That is deliberate: running production routing across these rails is how their failure modes become measurable rather than theoretical. The brief describes where settlement should go; Suwappu executes where settlement is. The engineering log behind that sentence, money-path fixes named by commit, disclosure chosen over silence, and the repository's own security caveats, is kept on the ledger.

The Suwappu Lattice Protocol (the Entanglement Transfer Protocol of its whitepaper) rejects the assumption that transferring data means moving bytes from A to B. The sender commits an entity: erasure-coded into shards, encrypted, distributed to nodes, entered into an append-only, signed Merkle log. The sender then seals a lattice key to the receiver: about 1.3 KB, whether the entity is a kilobyte or a gigabyte. The receiver materializes: verify the commitment, fetch enough shards, decrypt, reconstruct. The payload never crosses the sender-to-receiver link. Shards live with storage nodes, fewer than k of which reveal nothing, and the proof decides who may reconstruct.

Sealing and signatures use ML-KEM-768 and ML-DSA-65, the FIPS 203 and 204 families regulators have already named for the post-quantum migration, and the library refuses to load without real implementations of both. The post-quantum scope today is data confidentiality and signatures; the settlement layer's trust root remains classical and administrative while the proof machinery matures. Two zkVM verifier circuits for ML-DSA-65 signatures, one RISC0 and one SP1, now sit in the repository, and the SP1 circuit executes under the real prover toolchain (first execution 24 July 2026, commit c50d2eb). The remaining distance to an end-to-end proof, and the project's own trust-model paper that measures it, are on the ledger.

The verification culture is the strongest thing about it. Byte-exact digest parity is locked between the Rust and Python implementations, and state-machine parity between the Python library and its Solidity contracts. In May 2026 an internal red team replayed ten historical bridge exploits against the stack across 33 scenarios, and a second campaign, aimed at the bridge's economic mechanism, was chartered in June. The standing findings catalogue stays open on purpose, and all of it is public in the repository: counts, severities, deferrals, and the fixes shipped alongside disclosures, itemised on the ledger.