Classify On-Chain Owner (primitive probes)

These are the raw probes for determining what an owner address IS on chain. A caller runs the relevant probe, interprets the result per the tables below, then applies its OWN policy (reject EOA, ask-the-user for non-Safe, existence-only sanity check, controller classification, etc.). This skill supplies the primitives and their interpretation only — it does not decide policy.

EVM / Tron — code probe (EOA vs EIP-7702 vs contract)

cast code <address> --rpc-url <rpc> (or the multiProvider equivalent):

Result	Meaning
0x (no code)	Plain EOA.
0xef0100<20-byte-delegate> — 46 chars, matches ^0xef0100[0-9a-fA-F]{40}$	EIP-7702-delegated EOA. Still has a private key behind it; treat as an EOA for ownership purposes.
any other bytecode	Contract (Safe / ICA / timelock / custom multisig / …) — probe further.

EVM — Safe probe

cast call <address> "VERSION()(string)" --rpc-url <rpc>:

Result	Meaning
a version string (e.g. "1.3.0")	Gnosis Safe — record the version.
reverts / no return	Not a Safe — some other contract; probe further or ask the user.

EVM — ICA derivation

Derive the deterministic ICA address for (origin, controlling-owner) read-only — view calls only, no transaction — with get-owner-ica.ts and NO --deploy:

pnpm --silent tsx typescript/infra/scripts/keys/get-owner-ica.ts \
  --environment mainnet3 --ownerChain <origin> --owner <controlling-owner> --chains <chain>

⚠️ Never use hyperlane ica deploy for this probe. That CLI command has no read-only mode: it deploys the ICA (spends gas, creates a contract) whenever the derived account is absent. Probing a non-ICA owner therefore mints an unrelated ICA — the exact failure a read-only classifier must avoid. get-owner-ica.ts without --deploy only calls InterchainAccount.getAccount (a view) and prints the address.

Compare the derived address to the on-chain owner:

Result	Meaning
derived address == the on-chain owner	The owner is an ICA controlled by <controlling-owner> on <origin>. Classify the controller by re-running the code + Safe probes on it.
derived address != the owner	Not an ICA from that origin/controller — try another origin/controller, or ask the user.

Sealevel — account existence

getAccountInfo(<pubkey>) via the SVM SDK provider:

Result	Meaning
null	Address has never had state on this chain (transferring ownership here would brick the route).
non-null	Account exists (may be executable / PDA / plain wallet).

Open-set note

Contract-but-not-a-Safe is NOT automatically an ICA. These probes cover only the cheap cases (EOA via code, Safe via VERSION(), ICA via a known origin/controller derivation). Everything else — Squads multisig PDA, Turnkey, Privy, MPC, custom multisig, timelock — the caller must resolve with the user; never guess.

Consumers

/warp-deploy-validate-owners (per-chain classify + reject-EOA policy), /warp-update-resolve-artifacts (per-artifact classify + governance-map shortcut + open-set + controller classification), /warp-deploy-update-owners (target-owner existence sanity check).