The Luma team has answered a critical question for agentic commerce: Can an AI facilitate a Bitcoin or RGB asset purchase without ever holding the user's private keys? After building and breaking their system across regtest, Signet, and mobile hardware, the answer is a definitive yes. The architecture relies on a strict separation of concerns where agents reason about money but lack the authority to spend it. This approach challenges the current trend of 'trusted agents' by enforcing a non-custodial model where the wallet remains the sole enforcement boundary.

The Alice, Bob, and Carol Experiment

The proof of concept centered on three independent wallets running on real regtest Bitcoin and RGB Lightning nodes. Alice and Bob demonstrated basic wallet-to-wallet transfers, but the introduction of Carol, a merchant running her own node with products and orders, changed the project's trajectory. Carol’s node allowed Alice to buy coffee for 5 R402USD and Bob to buy a sandwich for 8 R402USD. Crucially, every purchase crossed a human approval boundary before exactly one payment was executed, proving that agents can interact with merchant inventory without bypassing user consent.

Authority Resides on the Phone

Luma moved the node directly into the mobile wallet, meaning each installation owns its keys, RGB state, channel state, and payment journal. While shared infrastructure provides connectivity, liquidity, and discovery, it cannot sign for the user. The Android build has progressed from local regtest to public Signet, featuring Bitcoin Core, Electrs, RGB transport, and a custom LSP. The division of responsibility is explicit: the phone owns authority, the network supplies connectivity, the merchant publishes intent, the agent assists in decision-making, and the wallet enforces the actual transaction limits.

Failure Modes and Recovery Challenges

The team embraced failure as a design tool, learning that a healthy container does not equal a payable wallet, and on-chain sats are not Lightning liquidity. They discovered that owning an RGB asset does not guarantee usability in a channel, and a UI status of 'Opening' does not mean the node is ready. Recovery emerged as the hardest problem; restoring keys without channel monitors and journals results in dangerous partial recovery. While they demonstrated an isolated recovery capsule, they explicitly note that this does not yet prove production-grade recovery capabilities.

Open Source Strategy and Future Roadmap

Luma plans to open-source the mechanisms that prove user sovereignty, including the Alice/Bob/Carol prototype, protocol interfaces, and the payment state machine. However, competitive advantages like liquidity allocation, merchant ranking, and agent orchestration prompts will remain private. The roadmap includes freezing the prototype for public review, finishing mobile proof-of-concept tests with two fresh phones, and making liquidity invisible to the end user. They aim to turn merchants into network nodes by normalizing Shopify and WooCommerce catalogs, allowing agents to discover inventory programmatically while humans browse visually.

Key Takeaways

  • Agents prepare transactions but cannot change recipient, amount, or asset after user approval.
  • The mobile wallet embeds the node, ensuring keys and state never leave the device.
  • Recovery requires restoring the entire economic state machine, not just a seed phrase.
  • Luma is a codename; the team is open to rebranding to avoid trademark conflicts with existing financial services.

The Bottom Line

This is the architecture agentic commerce needs. Stop trusting the agent with your money; trust the protocol to enforce your limits. If Luma can stabilize mobile recovery, they’ve solved the custody crisis before it even starts.