The Deterministic Policy Engine (packages/policy-engine/src/index.ts) is the heart of MOI security. Every proposed transaction must pass every rule before a signature or broadcast is permitted.
| # | Rule Identifier | Check Description | Failure Action |
|---|---|---|---|
| 1 | MANDATE_NOT_PAUSED | Verifies treasury and mandate are not under emergency stop. | REJECT with 403 Forbidden |
| 2 | FIRST_TRADE_OWNER_AUTHORIZATION | Enforces explicit owner signature if treasury has 0 settled executions. | REQUIRE_OWNER_APPROVAL |
| 3 | OPERATING_MODE | Confirms current mode permits automated or staged execution. | STAGE for approval if not autonomous |
| 4 | NO_DUPLICATE_LOCK | Prevents race conditions by rejecting if an execution is already in flight. | REJECT with 409 Conflict |
| 5 | SIGNER_HEALTHY | Confirms restricted signer environment is operational and separated. | ABORT with 500 Error |
| 6 | CHAIN_ID_CELO_MAINNET | Verifies target network is strictly Celo Mainnet (42220). | REJECT immediately |
| 7 | FIRM_QUOTE_PRESENT | Requires a firm executable RFQ quote, rejecting indicative previews. | REJECT unexecutable quote |
| 8 | TAKER_WALLET_MATCH | Ensures quote taker matches the authorized agent wallet address. | REJECT spoofed taker |
| 9 | QUOTE_NOT_EXPIRED | Validates current timestamp is strictly before quote accept deadline. | REJECT with 410 Expired |
| 10 | ALLOWLISTED_CORRIDOR | Validates sellToken and buyToken match the approved mandate corridor. | REJECT unauthorized corridor |
| 11 | APPROVED_REACTOR_TARGET | Target contract must strictly be Textile LimitOrderReactor (0xa9AA...). | REJECT invalid destination |
| 12 | CALLDATA_AND_VALUE_GUARD | Requires msg.value == 0 and valid Permit2/Reactor calldata encoding. | REJECT unsafe calldata |
| 13 | PER_TRADE_CAP | Ensures sell amount in atomic units does not exceed maxTradeAtomic. | REJECT trade cap breach |
| 14 | DAILY_SELL_CAP | Ensures 24h rolling cumulative volume does not exceed dailySellCapAtomic. | REJECT daily limit breach |
| 15 | MINIMUM_RESERVE_PRESERVED | Validates post-trade balance will strictly remain >= minimumReserveAtomic. | REJECT reserve exhaustion |
| 16 | MIN_BUY_OUTPUT_THRESHOLD | Verifies buy output satisfies minimum amount after maxSlippageBps. | REJECT price impact / slippage |
| 17 | PROTOCOL_FEE_BOUND | Verifies Textile protocol fee does not exceed fee ceiling (default 25 bps). | REJECT excessive fee |
| 18 | DAILY_LOSS_CIRCUIT_BREAKER | Trips if daily realized negative drift exceeds maxDailyLossAtomic. | TRIP circuit breaker & pause |