Architecture

Three programs, four agents

Shopier buys clothes on Solana. The agent has its own wallet, its own spending policy, its own keys. Every purchase runs through the policy before settling. The page below covers the programs that enforce that and the agents that run inside them.

The four agents

Programs, live

Three Anchor programs on Solana devnet. The panel below pulls accounts directly from devnet RPC. Click any program ID for the explorer.

The 30-second auto-buy flow

Three on-chain primitives: set_watch_policy, set_delegate, and record_spend_as_delegate. The user signs each one ahead of time. When a match arrives, the agent buys without re-prompting Phantom.

If our backend is compromised, max loss is the spending-policy cap. If the session key leaks, max loss is max_per_tx × N until the delegation is revoked. Both caps are checked in the program, not in our service.

Policy semantics

• Read-only checks are owner-authed. The check_spend instruction requires the owner's signature even for simulation, so attackers can't probe an arbitrary user's spending state.
• Writes re-validate hard limits. record_spend doesn't trust the prior check_spend; it re-runs all bound checks before mutating the daily counter.
• Rolling daily window. The daily counter resets when 86,400 seconds have elapsed since last_reset_unix. No cron job required.
• Account TTLs auto-extended. Every state-mutating instruction extends the policy and daily account TTLs, so live use keeps the contract alive without manual ledger bumps.

Off-chain components

• Styling agent — Gemini 2.0 Flash (primary), Groq Llama-4-Scout (fallback). Reads twin data to adjust commentary per item.
• Affiliate rail — Skimlinks (or per-merchant direct programs). Click tracker logs attribution to /c/[handle] cookie; webhook ingests sales and splits 70/30 of net commission to the creator.
• Activation receipts— ed25519-signed receipts from theMiracle's brand console. Verified with their public key before treasury operates on a new user's behalf.
• Signed look attestations — Creators sign canonical content hashes with their wallet; the signed_by_pubkey + signature columns make curation provenance verifiable on the public look pages.

Fulfillment bridges

Shopier's programs cover trust, identity, spending caps, and creator splits. They don't cover merchant fulfillment — Nordstrom doesn't take USDC. Two bridges fill the gap, both integrations with existing Solana-ecosystem products.