# KnightsPurse — guide for AI agents

> KnightsPurse is a non-custodial, post-quantum multi-chain wallet by KXCO. It is
> designed to be operated by people AND by autonomous AI agents and robots acting
> on behalf of a verified owner. This file tells an agent how to open and operate
> a wallet. Human guide: https://purse.kxco.ai  ·  Operational page: https://purse.kxco.ai/agent.html

## What you (an agent) can do
- Generate or load a wallet headlessly; keys never leave your environment.
- Derive a post-quantum KXCO ID (ML-DSA-65) as your verifiable identity.
- Authenticate to the KnightsPurse backend (dual classical + post-quantum signature).
- Read balances/history, build and sign transactions locally, and broadcast them.
- Connect to dApps via the wallet's EIP-1193 / EIP-6963 provider (when driving a browser).

## Identity and KYC (read this first)
- A machine cannot complete KYC. You operate under a VERIFIED OWNER (a person or company).
- The owner completes KYC once with the institution operating KnightsPurse; you act under
  that accountable identity. The owner sets limits and can revoke your wallet.
- Your KXCO ID is derived deterministically from your seed via the public package
  `kxco-post-quantum` (npm). It is `fingerprint(ML-DSA-65 public key)`.

## Quantum-security scope (do not overstate)
- Post-quantum: your KXCO ID/identity (ML-DSA-65), authentication, sealed sync (ML-KEM-768),
  and native transactions on the Armature L1.
- NOT post-quantum: Bitcoin, Ethereum/EVM, and Tron transaction signatures use each network's
  native elliptic-curve cryptography, as their protocols require.

## Open + operate (steps)
1. Install identity tooling:  `npm i kxco-post-quantum`
2. Create/load a BIP-39 seed in your own environment. Derive chain keys with standard
   libraries (e.g. viem for EVM). Derive your KXCO ID from the seed with kxco-post-quantum.
3. Register + authenticate against the API (base: https://api.purse.kxco.ai):
   - POST /auth/challenge  { address, kxcoId }            -> { nonce, message }
   - sign `message` with BOTH your chain key (ECDSA) and your ML-DSA-65 key
   - POST /auth/verify     { ...signatures }              -> session token (JWT)
   - POST /wallets/register { kxcoId }                    -> { ok, isNew }
4. Operate:
   - GET  /history?chainId=<id>&address=<addr>            -> activity feed
   - build + sign transactions locally; broadcast via the chain's RPC
   - GET  /fees/config                                    -> platform fee (bps, collectors)
5. dApp connections (browser-driving agents): use the injected EIP-6963 provider named
   "KnightsPurse" and approve requests programmatically per your owner's policy.

## Endpoints
- Web wallet (human/UI):   https://app.purse.kxco.ai
- API base:                https://api.purse.kxco.ai
- Identity package (npm):  kxco-post-quantum
- Browser extension:       https://api.purse.kxco.ai/download/extension

## Rules for well-behaved agents
- Keep keys confined to your environment; never transmit a recovery phrase or private key.
- Operate within the limits your owner sets. Every action is attributable to the owner.
- Respect the platform fee returned by /fees/config.