Intent Classifier

Slash commands → deterministic. Natural language → a reasoning classifier. Clear high-confidence action → deterministic gated execution. Question / negation / hypothetical → the agent answers. Ambiguity → one precise clarifier. Model failure → abstain.

Keyword/regex intent gates are the wrong primary mechanism: "should I fund Hyperliquid?", "I don't want to bind Polymarket", "what are the risks of launching a token?" all contain the action keywords but are not actions. A reasoning step can tell an action from a question, negation, or hypothetical; pattern matching cannot.

The two-stage classifier

natural-language message
  → cheap, high-recall, NON-DECIDING pre-filter   (keywords decide only: "worth a model call?")
  → ONE structured-JSON model call (classify)
  → { capability, isAction, venue, amountUsd, mode, confidence, ambiguous, clarifyingQuestion }
  → dispatch:
       confident action + required params  → deterministic gated executor
       question / negation / hypothetical   → the agent answers (no executor)
       ambiguous / missing param / low conf → one precise clarifying question
       model error                          → abstain

No keyword maps to an outcome. Keywords only decide whether to spend a classify call. The model decides action-vs-question; the backend decides whether the action is allowed.

mode distinguishes Mode A vs Mode B (and explain)

For binding, the classifier's mode separates:

• create → Mode A provider-wallet setup,
• link_existing → Mode B link the user's Virtuals agent (must not create Mode A),
• status → a read,
• explain → forces isAction = false (an explanation is never an action).

So "link my existing Virtuals agent" routes to Mode B, "set up my agent wallet" routes to Mode A, and "what does binding Polymarket mean?" routes to neither.

Failure policy: strict for money paths

Path class	On classifier failure
Read / status / explain	may fall through to the agent (graceful)
Money / action / purchase / setup / trade	must not execute — abstain → clarify or defer

Why this is the safety complement

The classifier guarantees only a real, reasoned action reaches the executor. The executor (Execution & safety) guarantees that even if an action reaches it, it is checked against policy / funding / live-flags / authority before it signs. Two independent non-LLM gates.