How the agent trades without your key.

Three places

The work is split between three places, and only QR codes cross between the first two. Your phone runs Locker Vault, offline: it holds the account's key and signs by QR. Your computer runs lpa and its guardian, which holds an agent key. Hyperliquid holds your account and its positions.

Reads of markets, quotes, positions and balances are public and need no signature. Everything else is signed in one of the first two places, never on a server of ours: there is none.

Two keys

The account key lives in Locker Vault, on an offline phone or tablet, never on the computer. It can do everything: withdraw, send, approve an agent, sign a mandate.

The agent key is made on your computer by lpa init, sealed on disk under a password you choose, and approved once by the vault. Hyperliquid lets it place, change and cancel orders and set leverage, and refuses it every withdrawal and every send. It expires on its own, after 180 days at most.

The guardian

lpa unlock starts the guardian, a background process that holds the agent key in memory. Whoever asks for an order, you, a script or an AI assistant, never sees the key or the password.

The guardian checks every order a second time against your local policy and, once you signed one, against the mandate. It signs a closed list of trading actions only, and answers only the requests that carry the token it wrote when it started. lpa lock takes the key out of memory: from then on, nothing can be signed.

The mandate

The mandate is the agent's limits, signed once on the phone: the markets, the largest order, the highest leverage, the orders and the notional per day, the daily loss stop, the service fee and its recipient, the uses allowed (trading, copies, the pilot), and its end, thirty days at most.

Locker Vault decodes the request itself and shows every bound on its own row before you sign. The guardian reads the mandate again before each opening, never lets it widen your local policy, and remembers the highest mandate signed and any revocation, so an older file put back opens nothing.

One order, end to end

1. The quote. The order is priced on Hyperliquid's live book: entry, notional, margin, fees and a liquidation estimate.
2. The local policy. The largest order, the leverage, the markets you allow. A refusal names the limit, with its figures.
3. Your go. In a terminal you confirm. A script or an assistant needs your agreement, and through MCP a quote you saw, good for ten minutes and once.
4. The guardian. The policy again, then the mandate, then the signature with the agent key.
5. The journal. The order, its quote and the limits that judged it are written on your computer.

The daily pilot

The pilot decides once a day, at 00:30 UTC by default. The code first gathers and freezes a dossier: candles, funding, open interest, the week's economic calendar, the fear and greed index, and the headlines of the Fed, the ECB and CoinDesk.

A first voice reads the texts alone and gives the day's climate. The trader then reads the charter, the dossier, the climate and its own lessons, and proposes long, short or nothing: a side, a market and a first entry. It never decides the size.

The code then judges the proposal: the market is allowed, the figures are figures, the entry sits in its zone, no high-impact release is within twelve hours, there is room for a position, the costs are counted. One no, and nothing opens. A yes places the first step of a ladder the code sizes itself.

If everything were stolen

A program that steals the sealed key file and your password can talk to Hyperliquid without lpa. It still cannot withdraw, and the key still expires. It can trade the account badly, or deposit it into someone else's Hyperliquid vault.

That is why the real bound is an account that holds only what you are ready to lose. Revoke the key with your phone through lpa agent revoke, and stop every opening at once with lpa mandate revoke.