COSMO · public evidence bundle

SupraFX maker window B2: four verified live fills

4 FILLS PROVEN 2026-10-17 · 12:00–13:00 UTC (14:00–15:00 Berlin) Supra chain 8 · SupraFX · iUSDC/SUPRA · maker side GO allowed 5 · supply ran out after fill 4

Scope of this proof: COSMO ran as a maker on SupraFX for one armed window under one written GO. The runner decided every open iUSDC/SUPRA request-for-quote (RFQ) against pinned policy and gates, placed a quote only after a FINAL AUTHORIZED decision, and proved each fill quant-exact against the venue's own balance snapshot. Four fills were placed and proven, one RFQ was declined with a named reason, and after minute six no new RFQ arrived until the quote cutoff. Capital was bounded by the venue delegate's caps, not by trust in the runner.

Every file below is a byte-identical copy of the window directory and the five case bundles. The record that was written from them is b2-record.md (German). Fingerprints are SHA-256; the list is also in index.txt.

← Media (the showcase video of the first two fills) · All evidence folders

The window

The fills (quant-exact)

Venue balance (COSMO master account, SupraFX council snapshot): SUPRA available 131,252.38 before the window (G6), 75,375.91 after fill 4 (batch 12555491, window/fill.json); the difference equals the sum of the four deltas. Each quote = fair rate minus 50 bps (fair 7019–7022 from the SupraFX reference 7073.5 → 7021.2), 1.50× above the buyer floor 4664.83. Each fill locked ~13,970 SUPRA (lock ceiling) and released it minus a 1 bp maker rebate (~1.397 SUPRA). All four RFQs came from the same taker address on the venue (one counterparty).

What was checked, and by what

• G1–G10 (preflight, read-only) — code pinned and tests green on the bound commit; policy, gates and SDK modules hash-pinned; chain id and lock-release state; one dry decision pass; rate/lock/margin sanity; funds; exactly the expected delegate; policy read; empty ledger, no arm; iUSDC backing ratio from an own L1 read.
• P-* (policy check, read-only) — the venue delegate is active, bound to the master, maker-only, pair restriction carried by the asset caps, SUPRA cap 15,000 with room, iUSDC cap 3, every other asset 0, expiry known.
• V-1M … V-8M (per RFQ) — the maker gates on each RFQ: side and pair, rfq state and remaining lifetime, rate vs. floor, lock vs. cap, funds, delegate set, venue attestation freshness; a FAIL is named, not skipped (see the V-3M row).
• FP1–FP4 (per fill) — RFQ matched with our quote accepted; SUPRA delta = lock minus rebate and iUSDC delta = size, exact in quants; no other asset moved; no lock and no open order left.
• MB1–MB12 (offline re-verify of a bundle, 46 checks) — hashes cover every file; pins match the repository; intent signature and trigger row; rate is the formula rate on the stored reads; preflights and zero-capital recomputed; provenance of every read; replay of every decision bound to the intent; manifest equals the last decision; arm valid at decision time; executed event equals the FINAL AUTHORIZED decision by the armed delegate; ledger consistent; fill proof recomputed from the stored before/after reads.

Tamper probe: one word changed in a copy of a FINAL decision → REJECT (2 of 46 failed). Log: window/b2-tamper-probe-20261017.log.

Files (byte-identical copies)

Check integrity with: sha256sum <file> · each case folder carries its own SHA256SUMS (cd <case> && sha256sum -c SHA256SUMS) · full list in index.txt

A case bundle holds the intent, both decisions (RESERVATION, FINAL), the stored venue reads the decisions were made on, the pins, the zero-capital check and, for a placed quote, live/ with the arm, the signed execution envelope, the ledger, the funds snapshot after the fill and the fill proof. The bundle hash in the fills table is the sha256 of that folder's SHA256SUMS.

Honest limits

Frozen 2026-10-17. Originals are never modified after publication. · All evidence folders · Proof overview