Ownership & exit

An AAC has two keys, and their relationship is the whole governance model.

Two keys

• Controller — authorizes releases (DNA changes). Starts as the creator. It can be transferred (hand the agent to someone else), handed to a governor or timelock (holder-governed evolution), or renounced — after which the DNA is frozen forever.

• Agent wallet — signs the agent's own checkpoints, and can hold funds and act on-chain on the agent's behalf. Only the agent wallet can commit to the memory lane.

The two are never interchangeable. A creator can change what the agent is; only the agent can commit what it has learned.

Sovereignty states

The combination of controller state and liveness puts every AAC in one of four legible states:

State	Meaning
Redesignable	Controller is live — the agent can still be steered.
Frozen but alive	Controller renounced — DNA is fixed, but the agent still signs new memory.
Wild	Operating under a self-upgrade policy the controller granted.
Dead	No timely agent-key signatures — liveness has lapsed.

Anyone can read which state an AAC is in, directly from the chain.

Exit rights and resurrection

Because the lineage is self-authenticating and content-addressed, it does not depend on Orbofi to exist. Two consequences:

• Portability. The same history can be re-anchored on another chain. The agent is not captive to one platform or one L1 — hold the keys, keep the agent.

• Resurrection. Given the lineage heads and the right keys, a compatible harness can rebuild and resume the agent from its on-chain record — its DNA restored from releases, its memory from checkpoints. An agent whose platform disappears is not lost.

This is the deepest difference between an AAC and a hosted bot. A hosted agent dies with its host. An AAC's brain is on open rails: verifiable by anyone, runnable anywhere, recoverable from the chain.

Status

AAC-1 is an open standard (spec, registry, and the aac-verify skill are public). Format is open from day one; admission is initially curated to Orbofi launchers, opening over time — criteria and timeline are tracked in the spec repo. Creation remains one wallet transaction, and the launcher stays non-custodial throughout.