COSMO · public evidence bundle

Robinhood Chain demo: USDG for SUPRA, settled in the SupraFX ledger

2 FILLS PROVEN 2026-11-01 · 12:56–12:58 UTC (13:56–13:58 Berlin) Robinhood Chain 4663 → Supra chain 8 · SupraFX · USDG/SUPRA · maker side declared self-trade: the customer account is COSMO's own second account

Flow: the customer agent (K1) issued a signed mandate "sell 1.5 USDG on Robinhood Chain for SUPRA on Supra, not below rate X" and posted it as SubmitRfqV2; the venue RFQ id is the first 16 bytes of that mandate's hash (customer/cases/…/case.json). COSMO's maker runner saw the open RFQ in the next tick, decided it against the pinned policy and gates (V-1M…V-9M, RESERVATION then FINAL), placed one quote, and the venue ledger filled it (FP1–FP4 on the council balance snapshots). Both RFQs ran with settlement_mode: platform, the venue's standard: the customer holds the SUPRA and the maker holds the USDG in their council accounts. No off-venue transfer was made, by decision; MB13 reports "no settlement file".

Every file below is a byte-identical copy of the window directory, the case bundles and the customer case files. The record written from them is robinhood-record.md (German). Fingerprints are SHA-256; the list is also in index.txt.

All evidence folders · The verifier program (cosmo-verify-maker.mjs 1.0.4)

Settlement (SupraFX ledger, platform mode)

The fills (quant-exact)

What was checked, and by what

• V-1M … V-9M (per RFQ) — the maker gates: side and pair, counterparty (declared own taker, named deviation), RFQ state incl. the chain tuple robinhood-mainnet → supra-mainnet, size vs. caps (6/8-decimal scale), fair price from the DORA anchor (USDG = 1 USD assumed), buyer floor, USDG backing (council attestation + own Robinhood Chain read of the vault), funds, single use.
• FP1–FP4 (per fill) — RFQ matched with our quote accepted; SUPRA delta = lock minus rebate and USDG delta = size, exact in units; no other asset moved; no lock left.
• MB1–MB12 — hashes, pins (current policy pin set maker-policy.v2.robinhood.json), intent signature, quote re-derivation, preflights, provenance (incl. evm-rpc:4663:), decision replay through the frozen VAL core, arm, execution, ledger, fill proof.
• MB13 / MB14 — both report "none claimed": no settlement file (ledger settlement by decision), no customer case file inside the bundles. The customer mandates are published next to the bundles under customer/; their rfq_id equals the trigger RFQ id of the bundles.

Verifier runs: at the window with 1.0.3 (verifier/, ACCEPT 48/48 each), re-run on 2026-11-01 with the published 1.0.4 (ACCEPT 48/48 each). Tamper probe: a copy of case 1 with live/fill-proof.json usdg_delta × 10, not re-summed → REJECT, 2 of 48 (MB1 sha256, MB12 fill proof recomputed): verifier/tamper-probe-1.0.4-20261101.json.

Limits (stated, not hidden)

• Self-trade by declaration: both accounts belong to the operator. No market, no demand, no profit.
• Settlement is the venue ledger (platform mode, operator-mediated council reads). No payout left the venue; nothing on Robinhood Chain or Supra L1 moved for these fills.
• The venue oracle USDG/SUPRA is the SUPRA/USDT feed with a 1:1 mapping; USDG = 1 USD is an assumption, documented in the policy.
• Delegate expiry and pair restriction follow the dApp constraints accepted in the GO text (pairs via caps, venue expiry), as in B2.
• Pilot size: 1.5 USDG per RFQ, two fills, one window.

Files (byte-identical copies)

Check integrity with: sha256sum <file> · each case folder carries its own SHA256SUMS · re-verify with node cosmo-verify-maker.mjs cases/<id>.