This is not a mockup. It is running.
Live software, a real check pipeline and a real hash-chained ledger. Clean proposals settle without a human. Failed proofs stop and wait for one.
Eight checks, then the tunnel opens — or it does not.
All eight pass and the trade settles in milliseconds. One fails and it is quarantined with the evidence attached.
Identity
Agent credential resolves to a registered legal entity and an authorising human.
Transport
mTLS certificate thumbprint matches the pinned counterparty. No match, no tunnel.
Enclave
TEE attestation quote is fresh inside a 15 minute window and signed by the expected root.
Provenance
C2PA manifest chain over the input data verifies end to end.
Logic
Zero-knowledge proof that the decision satisfies the institution's rulebook.
Mandate
Asset, side and size sit inside the agent's registered envelope.
Limits
Per-trade cap and remaining daily headroom both hold after this trade.
Halt state
No platform, institution, agent or asset halt is currently in force.
The trade executes and the sealed artefacts are written to the chain. Median decision time under 200ms. No human involved, and none needed.
The channel never opens. The proposal lands on the Exception Desk with a reason code. A cryptographic failure needs two operators to override; a policy hold needs one.
Operators only ever see what failed.
A triage queue, not a report. Clean settlement collapses into a feed; anything held sits at the top with the failing check named.
Triage first
Held trades sit above everything else, tagged proof failure or policy hold.
Kill switch
Halt at platform, institution, agent or asset scope. Effective on the next check.
Headroom live
Remaining daily envelope per institution, so a limits hold is visible before it happens.
A ledger that cannot be quietly edited.
Each entry is hashed with the digest of the one before it. Change a byte anywhere and every digest after it stops matching.
Append only
The database rejects updates and deletes on the ledger. Records are written by a trigger.
Verifiable on demand
Integrity is recomputed across the whole history and reports the first sequence that fails.
Evidence bundles
Any settled trade exports with its terms, eight check results, signatures and chain anchor.
We will run a live proposal against your own risk policy.
Thirty minutes: inject a clean trade, inject a broken proof, and watch the difference land on the desk and on the chain.