OurGlass: recurring payments for Safe treasuries

OurGlass is the thing i just shipped, and the one i'm most quietly proud of on the contract side. it's a Safe App for recurring on-chain payments: the kind of plumbing DAOs actually need but nobody wants to babysit.

the problem

DAOs run on recurring obligations: retainers to other DAOs, contributor payroll, infra subscriptions. today every cycle is another proposal, another signature round, another chance for a payment to land late. the multisig is the bottleneck, every single month.

what i shipped

the paying Safe signs one agreement. after that, the payee charges itself each period, within a hard cap enforced on-chain, never above the agreed amount, never twice in the same period. revocable unilaterally whenever.

the part i like: there's no escrow, no streaming contract, no relayer. funds stay in the treasury until the moment they're charged. it's built on the MetaMask Delegation Framework (ERC-7710): you enable a minimal DeleGator module once, sign an EIP-712 delegation, and an ERC20PeriodTransferEnforcer caveat does the capping on-chain.

what i learned

two things stuck.

first, binding the signature to the exact terms. the delegation's salt is keccak256(terms), and the agreement itself is pinned to IPFS. change a comma in the terms and the signature is void. the legal-ish document and the cryptographic authorization are the same object. that's a cleaner guarantee than i expected to get.

second, the relayer was a crutch. i started with a hosted "1Shot" relayer to redeem the delegation, then ripped it out for a direct on-chain redeem where the payee (the one collecting the money) just pays the gas. removing the middle service made the whole trust story simpler to explain, which is usually the sign it was the right call.

what fought back

the boring-but-real stuff: routing disableDelegation through the module's execute correctly so revoke actually sticks, and Safe-iframe quirks (clipboard copy behaves differently inside the Safe App frame). most of the last mile was making it behave as an embedded Safe App, not the delegation logic itself.

what's next

• harden the revoke + end-date paths and write more tests around the period enforcer.
• real DAO-to-DAO retainer as the first live agreement.
• see how it composes with the rest of the intuition payments stack (the fee proxy).