Omniousdocs
ArchitectureLive V1

Tamper evidence

Signed quotes, signed receipts, hourly on-chain anchors, and books that must reconcile to zero.

A router that runs the auction, holds the book, and writes the receipts could, in principle, lie in all three places. The design answer is not "trust us" but a chain of commitments that makes rewriting history detectable by anyone holding a receipt. Each link constrains the next.

Signed at every step

Quotes are signed by providers and verified on ingest: a quote enters the book only if the signature matches the provider's allowlisted key, and the quote log is append-only. The router cannot invent a rival's price after the fact, and a provider cannot deny the price it committed.

Usage records are signed by the router. Every request produces one: token counts, cleared prices, amounts charged and authorized, payment references, latency. GET /v1/receipts/:request_idreturns it under the router's key, stamped with the auction version that produced its prices and the epoch it belongs to.

Epochs are anchored on-chain. Each hour's records are hashed and the hash is published via the settlement adapter's anchor operation. A receipt in hand plus the on-chain hash means the router cannot later edit, insert, or drop records for that hour without the tampering being provable.

Books that must net to zero

The money side has one invariant: per epoch, everything charged minus refunds, provider payouts, router fees, and recognized bad debt equals exactly zero. Because all amounts are integer USDC base units, this is an exact equality, not a tolerance. It is checked by bun scripts/reconcile.ts, a standalone script that reads the same database the router writes and recomputes the sums independently of the serving code. A router that misplaced a base unit fails its own audit.

Re-run the auction yourself

Because the quote log preserves every signed quote with its TTL, the live book at the moment of any past request can be reconstructed. GET /v1/analytics/requests/:idreplays your auction: every quote that competed, the exact counterfactual charge at each rival's prices re-billed on your actual token counts, the second-score premium, and the fee split down to the base unit. It also names the price-setter (a real runner-up, the phantom reserve, the winner's own bid, or a session lock), so a single-bidder clear never masquerades as a contested one.

As a customerYou do not have to believe the clearing was fair; you can recompute it. Pull the counterfactuals, check what every rival would have charged for your exact request, and verify your receipt's epoch hash against the chain.
As a providerNon-repudiation cuts both ways, and mostly in your favor. Your signed quote is exact evidence of what you committed and when, the anchored records prove the traffic behind your payout, and a billing dispute reduces to arithmetic over records neither side can quietly rewrite.
the shape of the guaranteeNone of this proves the router routed optimally in real time; it proves the router cannot lie about what it did. Commitments are made before outcomes are known (quotes before awards, records before anchors), so any later story has to match the earlier signatures.
where this lives in code