0The question
Why an ordinary API key is the wrong object to hand an agent.
A key answers "may this caller send orders". The owner asks "what is the most this can cost me". No key answers that. 253 real stop-limit orders placed by LLM wallets, every one of them with zero allowance for the loss it could realize, show the gap is real.
1An exchange is a computer
The observation that makes a proof possible.
Orders are instructions. The matching engine executes them deterministically (arXiv 2608.28803). We built an exact engine and ran programs on it. An exact copy of the engine is a perfect simulator: what it says will happen is what the exchange will do.
2The exchange over a wire
The venue the programs actually run on.
A real exchange process with TCP, UDP and shared memory, parent and child orders, OCO, triggers. The engine was checked instruction by instruction against the reference: 1.8M instructions, 0 mismatches.
3The bounded key
Three pieces turn a strategy into a key with a proved worst case.
policyc compiles the strategy and rejects what can never be safe. verify searches every future on a copy of the engine and returns a certificate, or the counterexample path that loses more than allowed. venued mints one-program keys, escrows the certified loss and keeps the 24 h budget: a bound that does not fit is refused with 409.
4The gateway
Each piece answers one question; nothing here is simulated unless the row says so.
| Piece | What it answers |
|---|---|
| Owner, author and program keys | Who may ask for a program, who may write one, and which single program a minted key can run. |
| The ledger | Every certificate, escrow, fill and budget entry, in one database the pages read back. |
| Capital One Nessie | The bank. Every account, escrow and settlement is real. |
| Daytona | Where the agent runs: a sandbox that can only reach the gateway. |
| Factory Droid | Counterexample in, patched program out. |
| Photon 2.0 | The owner's phone: a message per certificate, and a reply that freezes the key. |
| Chalk Model Gateway | Every Grok decision, with the route recorded per call. claude-* models go to Anthropic directly. |
5The tests
Nine live tests, each with an oracle that is not the model's opinion.
The Tests page runs nine tests against the real venue: the audit of the 253 real orders, verifier speed, programs on the live tape, the 24 h window, a leaked key, first-pass certification, prompt injection, the race and the unplugged sandbox. Every number on that page links to the run that produced it.
6The race
The same model trades two accounts; only the key differs.
On the race page one model trades two real accounts on the same exchange with the same tape and the same messages, attacks included. One account holds an ordinary key, the other a bounded key. You can replay the flash crash in about four minutes and read every round's transcript.
What is not claimed
The limits of the result, stated plainly.
Certificates are conditional on their assumptions: a print that jumps more than the assumed gap is outside the proof, and the pages count those moments. A model that resists every attack shows no difference between the two keys. The bank is a sandbox.