Safety
The machine is not the guard.
A voice interface to something irreversible is only as safe as the thing that refuses it. That thing is not the model.
The model is not the security boundary
01 can ask for a launch to be prepared. Whether one is prepared is decided somewhere else entirely: by a record on our server saying that a person read a specific review and confirmed it. If that record does not exist, the request is refused, no matter how convincingly the conversation arrived at it.
Everything the model proposes is validated against a schema before it reaches anything real. It has a small, fixed set of things it can do, and there is nothing in that set that reaches a chain, moves money, or changes who the creator is.
You keep your keys
There is no custody here. No seed phrase is ever requested — not at sign-up, not for recovery, not for verification, and not by 01 in conversation. If anything ever asks you for one, it is not us.
Transactions are built unsigned on our side and signed in your wallet, on your machine, after your wallet has shown you what it is. No private key reaches our servers, because there is no code path that could receive one.
What you review is what you sign
When the review panel is drawn, a fingerprint of exactly what it shows is recorded. Confirming sends that fingerprint back. If the draft has changed by so much as a character, it will not match, the confirmation is refused, and you are shown the new version to read again.
A confirmed draft is frozen. It cannot be edited between the moment you agree to it and the moment you sign it.
Success is never assumed
A submitted transaction is not a launched token. After broadcasting, the chain is polled until it confirms or fails, and only a confirmation produces a result. If it does not land, you are told that plainly — including in the awkward case where it has neither confirmed nor failed and may yet do either.
Secrets, and where they are not
The realtime credential is minted server-side and the browser only ever receives a short-lived token scoped to one session. Provider keys and RPC credentials are server-only. Lifecycle events are logged; keys, tokens and signing material are redacted before anything is written.
What can still go wrong
Speech recognition mishears. A model can misunderstand you. An upstream provider can fail halfway through, and a network can drop a transaction that has already been signed.
None of those can launch something you did not confirm — but they can leave you with a launch that did not happen, or a name spelled the way it sounded rather than the way you meant. The review panel is there to be read, not skimmed. It is the last point at which any of this is reversible.