A decision made before the outcome exists
An autonomous agent has a signed intent to sell a fixed quantity of one token for another. The approval is already granted. What remains is a routing decision, and it must be made before any settlement is observable.
Three actions are available at creation time: Delegate the intent to a solver market, execute Direct against an automated market maker, or Abstain from certifying either route. Once the intent is broadcast, the agent cannot revisit the choice with hindsight.
The existing evaluation literature answers a different question. On-chain execution-quality studies report average realized quality for orders that completed, benchmarked against a baseline constructed at or near settlement. That is a useful ex-post scorecard. It is not a certification of a decision. Three gaps separate the two.
Wrong reference point
A settlement-relative baseline uses information that did not exist when the agent committed. Certification requires a baseline built from the block-start state of blocks the agent could actually reach from the decision time.
Completed executions only
Restricting analysis to filled orders conditions on the outcome. An intent that expires unfilled is not missing data and not evidence of solver failure — it is a delegated non-completion that must carry a defined payoff.
Unstable labels
If the sign of the route advantage flips across feasible execution blocks, a point estimate at one chosen block is not a decision-grade quantity. Stability has to be measured, not assumed.
This is a specification and protocol contribution supported by engineering validation evidence. No comparative route-performance result is reported. Every economic threshold and risk budget remains unfrozen pending a reviewed freeze procedure. Resolving data adequacy before model comparison is the methodological point: a negative feasibility outcome is a valid protocol outcome, and a failed gate must stop downstream claims rather than trigger a substitute analysis.
The vocabulary, without the machinery
Seven ideas carry the whole design. Each is stated here in ordinary language before the formal version appears in the paper.
Intent
A signed instruction: sell exactly this much of token s, receive at least this much of token b, before this deadline. Fill-or-kill — either the whole thing executes or nothing does. The signature fixes the budget and the minimum acceptable output.
Solver market (Delegate)
Competing agents search for a way to satisfy the intent — matching it against another user, routing it through on-chain liquidity, or batching it. The user does not pick the path. If nobody finds a satisfying execution before the deadline, the intent simply expires.
Direct execution
Swap against a single automated market-maker pool yourself. Fully predictable mechanics, but you pay gas whether or not the price is good, and concentrated liquidity means the output depends on pool state at the exact block you land in.
The envelope
Rather than guessing which block a direct swap would have landed in, simulate all three of the first canonical blocks after creation. The result is an interval, not a point — the range of outcomes the agent plausibly faced.
Abstain as a real action
If the envelope spans zero — direct looks better in one block and worse in another — no route is certified. Abstention is scored under a fixed prespecified default, so it is not free. Label fragility becomes a withheld claim instead of a coin flip.
Retained-inventory mark
When a delegated intent expires unfilled, the user still holds the sell tokens. That is a real payoff, valued at a prespecified block-start mark — not a fabricated solver loss. Waiting cost shows up as the later mark.
Information clock
A feature is admissible only if it was available strictly before intent creation. Timestamp equality counts as ambiguous and is discarded. Future status, executed amounts, the winning solver, and auction state are all forbidden as inputs.
Sealed holdout
The identifier list of the final evaluation period is hashed before any outcome is opened, with no resealing path. If a candidate holdout outcome was already inspected, the contract fails rather than quietly selecting a different period.
Both payoffs live in one unit
Every payoff is a net quantity of the buy token — never a mixture of token units, never a price ratio that hides where the fee landed. Gas is converted into buy-token terms at a block-start reference price and accounted separately, so it can never be used to waive the signed minimum-buy constraint.
A retrospective protocol built to fail closed
The design question is not which route wins. It is whether the question can be estimated precisely enough to be worth answering — decided before any model is compared.
Unit and sample
The unit is one already-approved, sell-kind, fill-or-kill intent on the studied mainnet for a single canonical token pair in either direction. The sample is machine-locked to that chain and pair, non-partially-fillable orders, explicit application-data market evidence, standard token balance sources, and empty pre/post interactions.
FulfilledExpired are the primary terminal states. Cancelled is a competing user override — reported separately and excluded from the primary target, because cancellation timing and user intent change are not consistently identified from public records.
The direct counterfactual
Let Bi1, Bi2, Bi3 be the first three consecutive canonical blocks with timestamps strictly greater than creation time. Each simulated swap starts from the end state of its parent block, which avoids using transactions that occurred earlier within the execution block itself.
- Candidate pools: every pool emitted by the official factory for the exact pair at frozen fee tiers, initialized, with executable block-start liquidity. One single pool — no split routes, no aggregators.
- A pool is executable only if its gross receiver output satisfies the signed minimum. Gas is accounted separately.
- Baselines past expiry are marked time-authorization-failed and excluded even if the price would be favorable. Blocks are never skipped until a favorable price appears.
- Ties resolve deterministically: lower fee tier, then lower checksummed pool address. The rule is applied without reference to the delegated outcome.
Gas scenarios as a stress test, not a menu
Baselines D1 and D2 use median gas units and median priority fee; D3 uses 95th-percentile gas units and 90th-percentile priority fee. The operational Direct action is D1 — D2 and D3 exist to test whether certification survives latency and gas perturbation. They are not three actions an ex-post policy may cherry-pick from. Cells fall back deterministically through a fixed hierarchy; a short pooled cell forces the row to non-certifying Abstain rather than picking a statistic ad hoc.
The certification rule
Delegate if lower(π) > +ε
Direct if upper(π) < −ε
Abstain otherwise // mixed signs · ties · any inadmissible endpoint
A route is certified only when the entire envelope clears the threshold in one direction. ε is prespecified from an economically meaningful smallest effect size of interest and frozen before the sealed holdout is opened. It is not tuned on Train, Calibration, or Holdout data, and never chosen to make a route win.
Leakage control
- Rolling-origin cohorts. A discovery window followed by an evaluation window at fixed step. Owner eligibility requires a public settlement event strictly before the evaluation window opens — which prevents an intent's own later settlement from selecting its owner into the cohort that evaluates it.
- Macro partitions. Pilot, Train, Calibration, and a sealed Retrospective holdout. Boundaries are selected from coverage metadata only; no label, premium, stability value, loss, or model output may move a boundary.
- Labels flow one way. Counterfactual outcomes may use later public history, because they are labels. They may never feed back into decision-time features, owner selection, calendar boundaries, threshold selection, or hyperparameter search.
- Clustered inference. The primary 95% interval is the convex hull of an owner-cluster wild bootstrap-t, a seven-day moving-block interval, and a two-way owner-by-week interval. Order rows are never treated as independent replicates.
- Ex-ante power only. Minimum detectable effect is computed before the holdout is opened, by simulating the complete pipeline — sampling, fitting, calibration-only bound correction, matched coverage, abstention, rare-expiry handling, recalibration. Post-hoc observed power is forbidden.
Before any result may be claimed, thirteen named checks must pass: validated scope with downstream gates closed; recomputation of every check by its allowlisted deterministic verifier in an isolated clean worktree; bounded public retrieval with provenance replay; mechanical boundary resolution; lagged-only owner and pagination semantics; raw-cache replay with quarantine of opened identifiers and no reseal path; reconstruction accuracy and route-reversal thresholds; projected coverage and effective-cluster support; projected clustered power; leakage and contamination ledgers where access time never substitutes for event time; absence of paid data, permissioned endpoints, and any prospective collector; two independent reviews with zero correctness blockers; and deterministic artifact replay. A boolean assertion receipt, a self-hash, or review prose containing pass markers is never decision authority.
Two halves that must never touch
The architecture exists to enforce one asymmetry: retrospective labels may train the models, and nothing may flow back from a label into a decision-time feature.
Creation-time inference
Retrospective label construction
Because the direct baseline is an interval rather than a point, the sign of the advantage can be undetermined. A conventional pipeline would collapse that to whichever block it happened to pick. Here it becomes Abstain by construction — the fragility is surfaced instead of averaged away. That is what makes the label decision-grade: a certified route is one whose advantage held across every feasible execution block the agent could have reached.
What the pipeline proved, and where the gate stopped it
Everything below is engineering-validation and feasibility evidence, not
comparative route-performance findings. The Phase-0 gate returned
FEASIBILITY_FAIL on accrual, so no sealed holdout exists and no scientific claim
about route premiums, completion rates, or selective-risk trade-offs may be drawn.
5.1 — Reconstruction validation: exact
The swap-output reconstruction component was validated against 562 real on-chain WETH/USDC swap transactions, sampled across size quartiles and both directions over a 100,000-block window. Two independent verification methods confirmed 182 of them.
| Metric | Method A (quoter replay) | Method B (event replay) |
|---|---|---|
| Swaps checked | 81 | 101 |
| Exact match (Δ = 0) | 81 | 101 |
| Nonzero errors | 0 | 0 |
| Label flips possible | 0 | 0 |
| Prefix challenges passed | 20 | |
Every reconstructed output matched the on-chain record exactly (182/182). No reconstruction error
was large enough to change the route-advantage sign for any non-tied order. This establishes that
historical amountOut is recoverable from public event data alone, with no paid
archive access. Gas estimation, route selection, and the full envelope remain subject to the
protocol freeze review.
5.2 — Pilot engineering summary
A 3.2-day development window, every row marked final_test_eligible=false. The
numeric values are not the finding; two structural facts are.
| Item | Count / rate |
|---|---|
| Orders evaluated | 68 |
| Fulfilled | 40 |
| Expired (non-completion) | 28 |
| WETH→USDC / USDC→WETH | 42 / 26 |
| Fulfilled, all 3 baselines admissible | 17 (42.5%) |
| Fulfilled, ≥1 baseline inadmissible | 23 (57.5%) |
| Gas-infeasible D1 | 13 |
| Limit-infeasible D1 | 16 |
| Comparable: solver-favored (robust) | 14 / 17 |
| Comparable: direct-favored (robust) | 1 / 17 |
| Comparable: abstain | 2 / 17 |
| Median robust premium | 4.2 bps |
| Median direct envelope width (D1–D3) | 1.8 bps |
| Sign-instability rate (→ abstain) | 11.8% (2/17) |
| Distinct comparable owners | 12 |
Inadmissibility is routine, not an edge case
57.5% of fulfilled orders had at least one inadmissible baseline — primarily because the
assumed gas budget rendered direct execution economically inadmissible after gas accounting.
GAS_UNAVAILABLE and INFEASIBLE_LIMIT are ordinary outcomes of the
certification filter, which is why comparison coverage must be tracked as a primary
endpoint.
Non-completion labels work
28 expired orders were recovered as non-completion labels with defined retained-inventory payoffs. The pipeline handles the non-completed-delegation case without inventing solver-loss values — which was the point of defining the mark in the first place.
The window is too short to support any scientific claim. The 95% Wilson interval on comparison coverage alone spans [0.29, 0.57].
5.3 — Power, accrual, and the gate
| SESOI | DEFF 1 | DEFF 1.5 | DEFF 2 | DEFF 3 |
|---|---|---|---|---|
| 5 bps | 131 | 196 | 261 | 392 |
| 10 bps | 35 | 52 | 69 | 103 |
| 20 bps | 11 | 16 | 21 | 31 |
σ = 17.5 bps (winsorized pilot estimate); raw pilot σ = 36.3 bps. The primary design candidate uses a 10 bps SESOI at DEFF 2, requiring 69 comparable orders winsorized, or 281 raw.
Observed accrual was 17 comparables over 3.2 days ≈ 5.3/day. A 12-day near-term projection yields ≈ 64 comparable orders — below both the winsorized target (69) and the conservative target (281). Reaching 281 at the observed rate would take roughly 53 calendar days.
| Check | Status |
|---|---|
| Scope and authorization | PASS |
| Delegated-market pipeline | PASS |
| Uniswap reconstruction (182/182 exact) | PASS |
| Counterfactual signal pipeline | PASS |
| Reproducibility | PASS |
| Accrual | FEASIBILITY_FAIL |
The infrastructure is validated; the failure is a calendar constraint, not a methodological defect. This is the designed behaviour of a fail-closed protocol — the gate prevents an underpowered scientific claim rather than producing one. An independent panel audit on a separate 20,000-block frame reproduced the same pattern from the other direction: 2,216 eligible intents passed the sample-size check, but only 108 expired orders were identifiable against a 200 requirement, and the machine finalizer emitted a pivot rather than authorizing modeling. Two independent frames, the same fail-closed outcome, no claim manufactured in either.
What this frame cannot support
Each limitation below constrains a specific claim. None is rhetorical hedging; they are the boundaries the protocol enforces on itself.
Selection — an Active-Trader panel
The panel is conditional on prior successful settlement: settlement logs discover completed orders and their owners, then owner history recovers later fulfilled, expired, and cancelled orders for those owners. Public sources cannot enumerate never-settling users or establish an unbiased frame for all intents. Panel rates may not be transported to the full user population.
The counterfactual is market-side only
The direct envelope is a route, price, liquidity, and gas object. It is conditional on sufficient sell-token balance, allowance or permit, valid nonce and signing authority, and permission to use the receiver and route. Those wallet facts are not reconstructed from an event-only panel, so the envelope may not be described as unconditional wallet-level executability. Any live deployment must re-check them.
Retrospective, not prospective
Every market observation predates the protocol freeze, and engineering pilot outcomes were inspected beforehand. Pilot observations extend past the mechanical candidate horizon and are recorded as later external development evidence — admissible for engineering validation, but not for features, thresholds, model choices, effect sizes, or claims.
Label semantics
Expired means delegated non-completion, not solver failure. Cancelled orders are excluded from the primary terminal target because cancellation timing and user intent change are not consistently identified from public records.
Ordering and extraction
Adversarial inclusion and ordering are not fully reconstructed. The envelope is a deterministic block-start simulation, not a guarantee about contested inclusion. That literature is precisely why a single-block counterfactual is treated as an unstable target.
Component novelty
Abstention, gradient boosting, and conformal calibration are not individually novel. The contribution is the identification contract that binds them to a two-route economic certification in which Abstain carries a defined payoff and the route label may be unidentified.
What transfers to a production router
The gate stopped the scientific claim. It did not invalidate the machinery — and several pieces are directly reusable by anyone building an execution agent.
Block-start preflight before broadcast
Simulate the swap against the parent block's end state and check the signed minimum before broadcasting. When no candidate pool satisfies the constraint, the policy never broadcasts an invalid swap, so attempted-swap gas is zero. Cheap to implement, and it eliminates a whole class of wasted gas.
Three-way routing with a real abstain
A router that must always pick a side will pick noise roughly as often as signal when the advantage is inside the noise band. Emitting Abstain — and scoring it under a fixed default — converts that into a measurable withheld decision with a known cost.
Gas-aware admissibility codes
GAS_UNAVAILABLE, INFEASIBLE_LIMIT,
DIRECT_UNAVAILABLE, VALUATION_UNAVAILABLE. Pilot evidence showed
these fire on 57.5% of fulfilled orders. Any router reporting a route comparison without
tracking them is reporting a filtered subsample without saying so.
Envelope width as a live confidence signal
The D1–D3 spread is computable at decision time from pool state and gas percentiles. A wide envelope means the route advantage is not stable across the blocks you might land in — useful as a throttle on order size or an escalation trigger, independent of any trained model.
Leakage-controlled backtesting
The information clock, rolling-origin cohorts with settlement-before-evaluation owner eligibility, and the hashed no-reseal holdout are protocol patterns, not protocol-specific code. They apply to any backtest where an entity's later outcome could select it into the sample that evaluates it.
Fail-closed gates in a research pipeline
Deciding data adequacy before model comparison — with a verifier that recomputes rather than trusting an assertion receipt — is why this project reports a negative outcome instead of a plausible-looking positive one. That pattern is the most portable result here.
Reproducibility posture
Every source is public: settlement events, the public owner-orders endpoint, and official factory and pool events with block, receipt, and gas evidence. No paid dataset, paid archive access, quote subscription, or permissioned endpoint is required. Rate limits affect engineering throughput but never the sample definition — a bounded failure is reported rather than silently substituting a paid source.
Acquisition is a bounded, explicitly invoked, resumable backfill — not a daemon, scheduler, or continuously running collector. Every artifact is content-addressed. The coverage ledger requires raw rows to equal emitted rows plus explicitly classified exclusions, and the builder independently recomputes row identities from raw caches, requiring equality among cache replay, seal ledger, and materialized tables. Recomputing a hash after altering a timestamp, identifier, status, amount, token, owner, or provenance field does not make a forged row admissible.
The accrual failure is a calendar constraint with a known remedy: roughly 53 calendar days of accrual at the observed comparable rate would reach the conservative target. Under the protocol that is a resumption condition, not a re-analysis — the thirteen checks, the frozen ε, and the unopened sealed holdout all remain exactly as sealed.