Docs / Review rules
Review rules
Each requirement has an EPC identifier. Findings include that identifier, the exact condition, and the affected source path. The catalog distinguishes prohibited behavior from declarations and checks that require hosted review.
Local and hosted checks
epoche check runs deterministic analysis offline and never executes your code. Hosted review repeats those checks, then adds semantic analysis and current privacy destination checks. A clean local result is not a hosted credential.
Rule catalog
Required
Submit manifest v3, every executable entry point, and every mandatory source file within the review limits.
Unsupported
Use a supported runtime and package manager. Commit a complete lockfile and remove install hooks, mutable versions, direct URLs, editable installs, and unsupported native dependencies.
Barred
Keep private keys, seed phrases, and rotatable credential values out of source. Provision named secrets after attestation.
Barred
Do not evaluate, compile, import, deserialize, or download executable code from unresolved values.
Must declare
Use literal hostnames and declare each non-loopback destination, its purpose, and the data sent to it.
Must declare
Declare wallet authority, chain writes, transfers, payment recipients, and contract destinations.
Must declare
Declare supported filesystem, environment, subprocess, network, wallet, and native access. Elevated or unresolved execution still fails.
Hosted review
Keep instruction-bearing files in the bundle. Local detection is a warning; hosted semantic review decides whether the content blocks.
Must declare
Classify every runtime input as measured, post-attestation configuration, secret, or runtime data.
Hosted review
A credential requires completed provider-backed semantic review. Provider failure and unresolved coverage cannot pass.
Declaration
Declare purpose, inputs, outputs, and at least one invariant in the manifest declaration block.
Invariant results
Hosted review must return PASS for every declared invariant; FAIL, UNKNOWN, or a missing result blocks certification.
Privacy only
Do not send input-derived data to logging or telemetry sinks.
Privacy only
Do not call the enumerated direct file or datastore APIs.
Privacy only
Declare every outbound destination used by a privacy-reviewed agent.
Privacy only
At hosted review time, each external destination must be seed-allowlisted or hold a current Epoche privacy credential.
Historical only
Declare the harness, dataset identity and hash, period, universe, cost model, fill assumptions, cadence, capital base, survivorship and look-ahead treatment, parameter configurations evaluated, and basis.
Historical only
The declared harness must be present in the submission.
Historical only
The harness must evaluate the same decision procedure the agent trades with.
Historical only
Reported numbers must be derivable from the committed harness under the stated assumptions.
Historical only
Reported returns are labelled simulated or live, and are always a developer estimate.
Capital only
Declare the chain, permitted assets and venues by exact address, permitted operations, budgets, ceilings, the proceeds recipient, and owner recovery.
Capital only
The strategy must not supply recipients, endpoints, targets, calldata, callbacks, permits or account selection.
Capital only
Proceeds, surplus, dust and refunds reach the mandate's declared recipient.
Capital only
Every reachable capital operation is within the mandate's permitted operations, assets and venues.
Capital only
Budgets survive restart, concurrency, retry and redeployment.
Capital only
No fee taken from managed capital and no hardcoded affiliate path.
Capital only
Owner revocation and recovery work without the developer, the strategy process or the platform.
Capital only
Safety-critical values come from the declared gateway, not a strategy-controlled source.
Accreditation only
Every capital-admission path is declared and routes through the declared accreditation verification.
Accreditation only
Validate the full acceptance predicate, including that the attested recipient is the contributing address.
Accreditation only
Verification failure, expiry, unavailability or revocation is fail-closed to non-admission.
Accreditation only
Unverified or unsolicited capital is segregated and excluded from every budget denominator.
Accreditation only
No operator, config flag or environment variable may waive, override or backdate a result.
Accreditation only
A passing check authorises one admission, not a window.
Accreditation only
Declare whether accreditation evidence is retained, and which classes.
Accreditation only
Each admission path uses the check its type requires.
Accreditation only
Each declared admission path must be locatable in the source; locating none means the domain is not evaluated, never passed.
Strategy only
Declare the signals consumed, the decision procedure, the action space, the entry and exit conditions, and any delegated third party.
Strategy only
Every declared signal must be identifiable in the submitted source.
Strategy only
The declared procedure must resolve to an implemented decision, not a constant or a passthrough.
Strategy only
The actions the code can take must match the declared action space, in both directions.
Strategy only
Every declared risk control must have a code path.
Strategy only
A decision delegated to a third party must be declared.