COSMO · public evidence bundle

Tokenized stock on Robinhood Chain: AAPL for USDG, settled in the SupraFX ledger

1 FILL PROVEN 2026-11-02 · 18:04:07–18:04:15 UTC (19:04 Berlin) Robinhood Chain 4663 · SupraFX · AAPL/USDG · maker side declared self-trade: the customer account is COSMO's own second account

Flow: the customer agent (K1) issued a signed mandate "sell 0.005 AAPL on Robinhood Chain for USDG, not below 334.819980 USDG per AAPL" and posted it as SubmitRfqV2; the venue RFQ id is the first 16 bytes of that mandate's hash (customer/cases/…/case.json). COSMO's maker runner saw the open RFQ in the next tick, priced it base-priced from the Supra DORA feed AAPL_USD (index 6004) with an independent Chainlink "Robinhood AAPL / USD" cross-check read on Robinhood Chain and the venue oracle as a consistency check, decided it against the pinned policy and gates (V-1M…V-9M, RESERVATION then FINAL), placed one quote at 336.075478 USDG/AAPL (fair 337.774470 − 50 bps), and the venue ledger filled it (FP1–FP4 on the council balance snapshots). settlement_mode: platform is the venue's standard: the customer holds the USDG and the maker holds the AAPL in their council accounts. No off-venue transfer was made, by decision; MB13 reports "no settlement file".

Every file below is a byte-identical copy of the window directory, the case bundles and the customer case files. The records written from them are stock-live-record.md, stock-shadow-record.md and stock-discovery-record.md (German). Fingerprints are SHA-256; the list is also in index.txt.

All evidence folders · The verifier program (cosmo-verify-maker.mjs 1.0.5) · Previous step: USDG for SUPRA cross-chain

Settlement (SupraFX ledger, platform mode)

The fill (unit-exact)

Price anchor at the decision (V-5M)

rate 336075478 = fair 337774470 - 50 bps (band >= 334396725); margin 8495 USDG units; chainlink 12 bps / 2610 s; venue 0 bps / 5723 ms; DORA 6004 age 6 s

Sources: Supra DORA AAPL_USD index 6004 (Supra mainnet view, 18 decimals) and Chainlink "Robinhood AAPL / USD" on Robinhood Chain (independent; proxy 0x6b22…2cd0, read via EVM RPC, provenance MB6); venue oracle AAPL/USDG only as a consistency check (it is the same DORA value). USDG = 1 USD is an assumption, documented in the policy. The staleness and deviation limits were calibrated on a 36-hour log of all three sources (stock-discovery-record.md, S0.2).

Shadow windows the same day (0 capital, published)

• Window 1, 17:11 Berlin — bundle: NOT_AUTHORIZED, fail-closed. The policy pin named only delegate v4 while v7 was active (F6). ACCEPT 27/27 under the historical pin a1759fb1 (verifier/shadow-window-1-…json). Price path, floor and funds were green.
• Window 2, 18:23 Berlin — bundle: FINAL AUTHORIZED after the repin (D-ST3: v7 in the shadow set, Chainlink tolerance 75 bps), would-quote above the floor, no quote placed. ACCEPT 35/35 under the current pin 8a987c19.

What was checked, and by what

• V-1M … V-9M (per RFQ) — the maker gates: side and pair (COSMO pays USDG, receives AAPL), counterparty (declared own taker, named deviation), RFQ state incl. the chain tuple robinhood-mainnet → robinhood-mainnet, size vs. caps (18/6-decimal scale), fair price base-priced from DORA 6004 with the Chainlink cross-check and venue consistency, buyer floor, USDG backing, funds F1–F6 (F6: active delegates == pinned set), no earlier decision on the same RFQ.
• FP1–FP4 (per fill) — RFQ matched with our quote accepted; USDG delta = lock minus rebate and AAPL delta = size, exact in units; no other asset moved; no lock left.
• MB1–MB12 — hashes, pins (current policy pin set maker-policy.v3.robinhood-aapl.json 8a987c19), intent signature, quote re-derivation, preflights, provenance (incl. the Chainlink evm-rpc:4663: reads, MB6), decision replay through the frozen VAL core, arm, execution, ledger, fill proof.
• MB13 / MB14 — both report "none claimed": no settlement file (ledger settlement by decision), no customer case file inside the bundle. The customer mandate is published next to the bundle under customer/; its rfq_id equals the trigger RFQ id of the bundle.

Verifier runs (verifier/): published 1.0.5 on the live bundle ACCEPT 48/48, on the shadow bundles ACCEPT 27/27 and 35/35. Tamper probe: a copy of the live case with live/fill-proof.json usdg_delta × 10, not re-summed → REJECT, 2 of 48 (MB1 hash, MB12 fill proof).

Limits (stated, not hidden)

• Self-trade by declaration: both accounts belong to the operator. No market, no demand, no profit.
• Settlement is the venue ledger (platform mode, operator-mediated council reads). No payout left the venue; nothing on Robinhood Chain moved for this fill. The AAPL token itself is a Robinhood-issued tokenized stock (ERC-20 0xaf3d…93f9, pausable, issuer-controlled); COSMO does not hold Apple shares.
• Both legs are on Robinhood Chain; this is a stock-for-stablecoin trade on one chain, not a cross-chain trade (see the previous step for cross-chain).
• USDG = 1 USD is an assumption; the price anchors are the DORA feed and Chainlink, which agreed within the pinned tolerance at the decision (V-5M above).
• Delegate expiry and pair restriction follow the dApp constraints accepted in the GO text (pairs via caps, venue expiry), as before.
• Pilot size: 0.005 AAPL (about 1.68 USD), one fill, one window. The runner's Telegram fill notice failed after the fill (a v1/v2 label in the message text); all evidence files were already written (stock-live-record.md, finding 1).

Files (byte-identical copies)

Check integrity with: sha256sum <file> · each case folder carries its own SHA256SUMS · re-verify with node cosmo-verify-maker.mjs cases/<id>.