Every trading bot has to keep its receipts.
AI agents now trade real money in milliseconds. RouteClerk makes an agent write down what a trade will cost before it makes it, then checks the real result afterward. If the bot's numbers don't add up, it is paused until someone explains why.
Your money stays in your own account the whole time. RouteClerk can't hold or move funds — it can only stop a bot from opening its next position.
Clean = the trade lands near the promise. Stressed = the book runs 6 bps against the bot. Both are the
prototype's own output — run python main.py demo to reproduce them.
One trade, from promise to verdict.
Trade receipt
Buy $25,000 of HYPE
a bot buys a crypto asset on HyperCore — one full cycle, agent 0xDemoAgent…0001
Before trading, the bot shops the same order across venues, picks the cheapest, and commits to the most the trade should cost. The promise is signed, so it can't be changed later.
HyperCore 2.30 bps expected (impact 1.30 + fee 1.00) · rejected ElysiumAMM at 72.45 bps — over the 8.0 bps budget
It re-prices the route assuming the market moves 3 bps against the bot. The cost rises but stays inside budget, so the route is approved.
stress re-price @ 3 bps adverse → 5.31 bps · verdict APPROVE
The chosen route and cost are hashed and stored with a deadline to fill — so the bot can't quietly change its story after the trade.
digest 940e7843…bd5139 · deadline 5,000 ms
It runs through Elysium's fast order path on the user's own account — custody never leaves the user.
avg 42.1641 vs mid 42.1565 · all-in 2.80 bps (impact 1.80 + fee 1.00) · latency 140 ms
The signed receipt is written: what was promised against what actually happened, itemised.
committed 2.30 vs realized 2.80 bps → deviation +0.50 bps (allowed ±2.0) · entry-vs-mid 1.80 · fees 1.00 · funding 0.00
The small gap is fine. The bot is cleared and may open its next trade.
The white line marks the biggest gap the bot was allowed between its promise and the real result. Stay left of it and the bot trades on; cross it and the bot is paused.
The eight words that matter.
You don't need any trading knowledge. Here is every piece of jargon on this page, translated.
- Basis point (bps)
- One hundredth of a percent (0.01%). So 2.3 bps is about 0.023% — a tiny slice of the trade's value.
- Mid price
- The midpoint between the best buy and best sell price. The fair "reference" price the bot is judged against.
- Budget
- The most a trade is allowed to cost, set before it runs — here 8.0 bps. A route that can't fit the budget is thrown out.
- Deviation
- The gap between the promised cost and the real cost. Most a clean trade may drift is ±2.0 bps; more than that and the bot is paused.
- Commitment
- The bot's signed promise — its chosen route and the most a trade should cost. It is locked in before the trade, so it can't be faked after.
- Autopsy
- The signed cost report written after the trade, comparing the promise with the real result — the "receipt".
- The gate
- The rule that pauses a bot whose costs were too far off, until the gap is explained or covered. The only power RouteClerk has.
- Custody
- Who holds the money. It always stays with you — RouteClerk never holds or withdraws funds.
Four steps, every trade.
Promise the trade
The bot locks in which exchange it will use and the most the trade should cost, with a deadline. The signed promise can't be altered afterward.
Make the trade
The order runs through Elysium's fast order path on your own exchange account. Your money never leaves your control.
Check the receipt
RouteClerk compares the real cost with the promised cost — the fill price against the fair mid price, plus fees and funding.
Continue or pause
Small gaps pass and the bot trades on. Too big a gap pauses the bot until the mismatch is explained or covered with a bond.
Built for the venue, not bolted on.
The real order book
Promises are priced against Elysium's live market data — the full book, not a rough feed — so the promised cost is the cost the venue will actually charge.
No extra delay
The check sits on Elysium's 100–200 ms order path. It's a single quick question before the order fires — a condition, never a detour.
One scorecard
Because promises and receipts are stored on-chain, trades on the Elysium AMM and HyperCore are graded the same way, by anyone.
Four functions do the whole job.
For developers: the on-chain gate is deliberately tiny. An order path asks one question before it fires, and the answer lives on-chain.
// 1. the bot promises a route and a cost
submitCommitment(id, routeHash, expectedCostBps, sizeUsd, deadline)
// 2. the order path asks one question before it acts
canAct(agent) // true unless a failed autopsy is open
// 3. the clerk files the receipt after the trade
submitAutopsy(id, commitmentId, realizedCostBps, fundingDriftBps, thresholdBps)
// 4. unblock: explain, or cover the gap
acknowledgeAutopsy(id) / coverDeviation(id) payable
Solidity 0.8.24 · contracts/RouteClerkGate.sol ·
testnet deploy on Elysium chain id 99801 (address to follow). Compiles clean; see scripts/deploy.md.
Where it stands.
Agent loop with promise-and-receipt logic; mandate checks and basic testnet payment between agents; integration points mapped to the Elysium RPC, the market-data precompile, and the CoreWriter order flow; non-custodial design.
Contracts that pause a bot's next trade based on its receipt; order-callback handling; deviation bonding and a market where specialists can challenge a number; operator dashboard.
Security review of the pausing and bonding contracts; testnet on simulated HyperCore data, then the real feed; one design-partner trading bot; an SDK for other builders.
Testnet MVP, late October–November 2026; mainnet-ready alongside the ElysiumCoreWriter upgrade; no token required for the core product.