Money stays safe when it never enters a model.
Selo keeps it inside an audited binary boundary.
Selo uses strict dependency inversion, what it calls the Brain and Hands pattern. All accounting logic, tax lot state machines, and ZK commitment math live in selo-core with zero network or I/O dependencies. Network transport, disk persistence, and the CLI live in selo-tool. A model can suggest intent, but it cannot construct a transaction or touch a private key, and no RPC response ever enters a context window.
A user installs the stock ZeroClaw binary, adds config and skills, and Selo runs the money path. One implementation, one threat model, one place to audit.
selo-core processes identification, net deltas, PTAX valuations, and Poseidon Merkle trees. selo-tool handles Solana JSON-RPC, disk persistence, and report rendering.
Reading and matching are custody T0 with no key. The period anchor and refunds render an unsigned transaction a human signs (T1), using a durable nonce so it never expires.
The 6-Stage Money Path
Discovery
Payment intents are generated as Solana Pay URIs with a single-use reference key and an amount tag, so the settlement amount itself identifies which order was paid.
The Watch
The binary polls Solana USDC, USDT, and PYUSD activity. Ingestion evaluates net balance deltas at the transaction boundary, protocol-agnostic and free of instruction-level parsing.
The Match
Selo queries each open intent's reference key with getSignaturesForAddress and confirms settlements on chain, keylessly, without exposing hot keys.
Cost Basis
Cost basis is computed directly in BRL using the official BCB PTAX rate (series 10813) at block time; SOL prices combine Jupiter with PTAX to avoid compound rounding from intermediate hops.
The Entry
Events are written to an append-only book and rebuilt into an integer-exact FIFO/HIFO lot book from persisted raw events, so an interrupted ingest resumes without corrupting positions.
Human Signature
The daily close folds the day into a Poseidon BN254 root, then renders an unsigned durable-nonce transaction carrying an SPL Memo. A human signs once daily to broadcast it.