Aomi universal on-chain execution: agentic chat, Solana venues and Aave

[CeciliaZ030]

Operator outcome

Adds an attended agentic-chat path for Jupiter Lend, Kamino Earn and PumpSwap through one Aomi execution interface, alongside the existing shared execution screen and Aave V3 lending workflow. Aomi discovers supported recipes and constructs and simulates the protocol calls; Hummingbot retains the agent, executor lifecycle, spending limits, human approval and receipt presentation.

Depends on hummingbot/hummingbot-api#230 and Aomi backend support in aomi-labs/product-mono#1070. Ready for maintainer review; operational boundaries and evidence are below.

Agentic chat V2

The Aomi On-chain Trader agent now uses typed discovery, market inspection, position reads and prepared actions for all three Solana venues. A short-lived prepared-action ID binds execution to the exact reviewed SVM v0 instruction batches; cluster, wallet and client mismatches fail closed. Pending web confirmations are recovered after socket reconnects without approving anything automatically.

The recorded Condor chat supplies 2 USDC to Jupiter Lend after terminal simulation and explicit UI approval. Independent local-mirror verification records an exact 2,000,000-raw USDC debit, 1,887,166 raw lending shares received and a 5,000-lamport network fee. The same agent then prepares passing, uncommitted simulations for a 2 USDC Kamino Earn deposit and a PumpSwap liquidity add with the proportional SOL leg. Those two previews are intentionally not submitted.

Watch the 2:42 agentic-chat V2 and review its narration and evidence. The recording uses an actual Condor chat on a local Solana mirror with a test wallet; it does not claim production signing or live-network execution.

Changes

• /executors/onchain selects and inspects supported protocol markets, prepares unsigned actions, previews exact wallet movements and fees, and confirms through the same Hummingbot executor. Protocol-specific official-SDK recipes live in Aomi; Condor does not add a separate connector for each venue.

• Confirmation retains the previewed instruction hash and wallet/market/program/asset limits. Missing fee or balance evidence refuses submission. Ambiguous outcomes remain locked and display “Confirmation unavailable”; transaction identifiers are not labeled receipts until confirmed.

• Wallet-wide positions distinguish raw wallet token shares from farm-valued shares. Deposits and exits are position changes, not realized trading profit. The UI supports arbitrary market addresses within the supported protocol families, not zero-shot execution against arbitrary new protocols.

• /executors/lending provides exact six-decimal amount entry, preview, fresh simulation on confirmation, duplicate-submission protection and an uncertainty lock after a potentially accepted request.

• Executor evidence distinguishes simulation from confirmation and shows wallet, chain, exact asset movements, approval authority, gas estimate, receipts and typed errors. A deposit is not trading profit.

• Persistent lending positions show controller contributions separately from live wallet-wide receipt-token balances and retain unknown outcomes. Read failures never display an empty portfolio.

• Catalog/read/skill routines and the optional defi_positions provider expose Aomi through the typed create_lending_executor and create_onchain_executor tools. The provider reads the full durable lending ledger separately from recent transactions, scopes contributions to its controller, labels wallet-wide balances, preserves exact token precision, and reports unavailable history as unknown exposure. Agent instructions describe granted lending and the dry-run restriction on other automatic operations. The token is scrubbed from sharing. Optional client installation is pinned to public aomi-python v0.1.3 commit caa72d5225dd60e482835e0341a91293d7549dd3.

• Automatic lending requires an active server-owned grant, require_lending_policy: true, exact account/controller/wallet/market matching and fresh USDC/USDT valuation. Durable contributions enter each tick’s risk state, and admitted amounts are not counted twice when they appear in history. The API independently serializes allocation admission. Unpriced or unavailable history refuses approval. Raw-call and catalog-operation automatic commits remain blocked.

• Aomi executor pages do not require an unrelated exchange-key setup overlay. Existing exchange pages retain their setup flow.

Validation

• Current agentic-chat change: 157 focused Python tests passed across tool contracts, prepared-action binding, evidence formatting, routes and permission gates. The reconnect confirmation regression has 6 focused frontend tests passing; production build and the lint baseline gate pass. Black, isort and diff checks pass.

• Latest full Python suite: 5,251 passed, three live skips, one dependency deprecation warning. Black and isort pass. Local Hummingbot API client was aligned to the already-pinned 1.5.9 release. The unsigned preparation route is tested separately from execution deeds; the tool-schema contract includes instruction mode.

• Previous Aave revision: upstream main 1890c0871694c8b1c7c93ecdadb6350cd20eab6a merged, preserving typed tools, controller ownership, leverage and book-drift safeguards.

• Previous Aave full Python suite: 5,233 passed, 3 live skips.

• Current frontend suite: 1,870 passed on Node 22.22.2. Production build and upstream lint gate pass (45 pre-existing lint errors remain baselined). An initial Node 25 run failed with local-storage errors; the Node 22 run passes.

• Changed Python routine/tool checks: 48 passed. Two changed Python files were formatted; import sorting passes.

• Grant/provider tests cover durable exposure beyond the recent transaction window, shared-wallet attribution, precise amounts, unavailable history and independent USDC valuation. UI regressions separate estimated gas from incurred fees, allow a new action after confirmation, and retain the uncertainty lock after an ambiguous request. Empty recent executor history no longer bypasses durable lending exposure; failed ledger reads block risk admission.

Solana runtime evidence

Six Condor confirmations were independently checked against local Solana mirror receipts and final positions: Jupiter Lend supply/redeem, Kamino Earn vault supply/withdraw, and PumpSwap direct liquidity add/remove. Reviewed executor bindings, balance/fee completeness, and zero remaining positions were verified. The demo uses an explicitly substituted local test wallet and locally registered Aomi application fixture. Hosted activation and production Para signing are not demonstrated; the completed V2 video is linked below.

Earlier Aave runtime evidence

Current upstream code was exercised through both the Condor UI and typed create_lending_executor tool, the authenticated API, durable PostgreSQL policy admission and actual Aomi Pipeline on a Base fork at block 51,161,414.

• Typed granted flow: supplied 5 USDC and withdrew 4.999999 USDC. A 10.000001 USDC request was refused under a 10 USDC per-action limit.
• Recorded UI: supplied 2 USDC and withdrew 1.999999 USDC. All six receipts across these two flows were independently re-read from the live fork with successful status and matching block hash. Remaining approval allowance is zero.
• A 1 USDC preview with a 0.000001 USDT execution-gas budget is refused before wallet submission. Contribution accounting survives completion and is shown separately from shared wallet balances.
• Final accounting correction: simulated gas stays in custom_info.estimated_gas_quote; it is never booked as incurred executor fees, including on non-submitting previews. Receipt-derived quote fees are currently unavailable. History navigation follows upstream's groupBy=ctrlType contract.

Exact versions, receipt and balance evidence, reproduction boundaries, and narration script. A 148-second walkthrough and individual before/supply/withdraw/refusal/ledger recordings are completed local deliverables; videos are not hosted in the repository. The supply/withdraw footage predates the accounting-only correction and is labeled with its actual source versions.

Operational boundaries

These are local fork transactions, using a bounded loopback Anvil test signer and a fresh public Kraken gas-conversion adapter. Automatic USDC valuation uses the real Hummingbot Binance endpoint. No model inference or production Para signing is claimed. Eight Para envelope regressions pass, covering empty calldata and explicit fee/nonce validation before HTTP; live signing-provider verification remains a deployment check.

Gas estimates exclude Base data fees and signing-provider surcharges. The allocation policy bounds recorded contributions, not external deposits, interest or the full portfolio. Unknown submissions retain reservations for reconciliation. No realized yield is claimed.

The earlier Aave revision merged the upstream baseline listed above; current mergeability is reported by GitHub. Supporting backend CI run 34591678160 passed at 2439db38, including the fresh upstream merge. All three PRs are out of draft. Backend deployment and maintainer merge are separate from this contribution.

Finished 2:30 V2 video, final narration, fresh receipts and recording notes. Six local transactions were verified, all three positions exited, and a 2 USDC action exceeded its 1.9 USDC limit and was refused before commit. The video is silent with a separate voiceover script; it uses a local Solana mirror and substituted test wallet.

Prepared catalog/market/position reads no longer refetch on focus or reconnect and collide with a new action. Explicit refresh and executor polling remain. Six focused UI tests and the production build passed after this correction; the full-suite counts above precede it. Refusal footage was captured on this revision.

[greptile-apps]

Confidence Score: 4/5

The PR is not yet safe to merge because a durable lending-ledger outage can still block unrelated agents that do not use lending.

Findings

1.  Optional ledger blocks trading ▶

Summary

• Introduces typed preparation, simulation, confirmation, and evidence flows for supported DeFi venues.
• Adds durable lending contribution accounting, operator-grant enforcement, and fail-closed valuation checks.
• Adds Aomi catalog/read/skill routines and an optional wallet and lending-position provider.
• The latest revision prevents React Query focus or reconnect events from silently replacing reviewed market reads.

Diagram

sequenceDiagram
    actor Operator
    participant UI as Condor UI
    participant API as Hummingbot API
    participant Aomi as Aomi Pipeline
    participant Ledger as Durable Lending Ledger

    Operator->>UI: Inspect market and configure bounds
    UI->>API: Prepare unsigned action
    API->>Aomi: Build and simulate
    Aomi-->>API: Instructions, movements, fees, plan hash
    API-->>UI: Preview evidence and expiry
    Operator->>UI: Confirm reviewed action
    UI->>API: Commit with reviewed plan hash
    API->>Aomi: Submit bounded action
    Aomi-->>API: Outcome and transaction evidence
    API->>Ledger: Persist contribution or uncertainty
    API-->>UI: Executor status and evidence

Loading

_{Reviews (6) · Last reviewed commit: "Keep reviewed Aomi market queries stable..."}

[greptile-apps]

Optional ledger blocks trading

This core provider now requests the durable lending ledger on every agent tick, even when the agent does not use lending. If the API lacks /executors/lending/positions or the endpoint temporarily fails, the provider reports unavailable exposure. The risk engine then blocks the tick, stopping unrelated trading until the endpoint becomes available. Gate this fail-closed behavior on lending participation or compatible lending configuration instead of applying it to every agent.

[greptile-apps]

Too many files changed for review (120 files, 100 file limit).

Bypass the limit by tagging @greptile-apps to review.