Routing confidence

Routing computes an exact token/USD value and a confidence score from chain-local pool evidence. Confidence is a weakest-link score, not a probability or permission to trade.

Invariants

Graph operations are chain-local; asset identity is (chain_id, opaque asset_id).
Authoritative prices are positive reduced rationals. Zero, NaN, infinity, and binary floats are invalid.
A physical pool contributes capacity at most once.
Path depth and confidence use weakest-link values.
External coverage data may lower or cap confidence; it cannot create or delete an on-chain price.
Routes expire without events. Every score exposes its components and active caps.

Exact price composition

q(X→Y) = (a × 10^dX) / (b × 10^dY)

Q(S/X₀) = (∏aᵢ × 10^dX₀) / (∏bᵢ × 10^dS)

P_USD(X₀) = Q(S/X₀) × U_S

a/b is the oriented atomic execution ratio. Reverse orientation is the exact reciprocal of observed evidence, not a reverse executable quote. Token decimals must be verified. U_S is an exact guarded stable/USD ratio.

Arithmetic cross-cancels by greatest common divisor, supports 4,096 bits per side, persists decimal strings, and rounds only the final display value to 18 significant digits using ties-to-even.

Common 2% depth

D↑ = USD input required to raise oriented marginal price by 2%
D↓ = USD input required to lower oriented marginal price by 2%
L  = min(D↑, D↓)
L_eff = min(L_current, EWMA_30m(L))

Adapters simulate protocol-exact integer swaps and choose the greatest consumed gross input still within the boundary. Depth rounds down to microdollars. TVL, reserves, and active liquidity are diagnostics, not substitutes for the simulation. Incomplete state makes depth UNKNOWN.

Weighted median and outlier rejection

Sort prices before applying the weighted median:

weighted median: first k where 2 × Σ(i≤k) wᵢ ≥ Σwᵢ

dev_bps(p,q) = 10000 × (max(p/q, q/p) - 1)
MADw = weighted_median(dev_bps(pᵢ,m₀), Lᵢ_eff)
τ = clamp(ceil((22239/5000) × MADw), 200, 1000) bps

Outlier rejection is one-pass. Proposed outliers are removed only when survivors retain at least 67% of the weight and span at least two independent pools and deployments. Otherwise all observations remain, NO_INDEPENDENT_CONSENSUS applies, and confidence is capped at 2.

Shared edges are capacity-limited:

b_r = min edge capacity on route r
B_e = Σ b_r for routes using edge e
w_r = floor_microUSD(b_r × min_e(min(1, L_e/B_e)))

Invariant: Σ(r using e) w_r ≤ L_e

The published value is the selected weighted-median path’s exact rational. The support envelope spans accepted inlier prices; it is diagnostic, not a calibrated probability interval.

Confidence algebra

S_edge = min(S_depth, S_fresh, S_agreement, S_temporal,
             S_feed, S_state, S_stable?)
S_anchor = min(S_edge, S_coverage)
S_route = min(all edge scores, routing-asset score)
S_published = min(S_path_agreement, material route scores,
                  S_aggregate_state)

Component	Bands and rules
Coverage	0 depth → 0; <0.3% → 1; <0.6% → 2; <1% → 3; <2% → 4; <3% → 5; <6% → 6; <10% → 7; <17.5% → 8; <25% → 9; ≥25% → 10
Absolute depth	0 → 0; $0–500 → 1; then $500, $1k, $2.5k, $5k, $10k, $25k, $50k, $100k, and $250k boundaries through 10
Freshness	Worst normalized price/liquidity age ≤0.1 → 10; ≤0.2 → 9; ≤0.4 → 8; ≤0.6 → 7; ≤0.8 → 6; <1 → 5; expired → 0 and disqualified
Agreement	Minimum of source count, spread, and retained support; one pool is usable but capped; unresolved split caps at 2
Temporal	Deviation from five-minute duration-weighted median: ≤1% → 10; ≤2% → 8; ≤5% → 5; >5% → 2; insufficient history → 5
Feed/state	Unverified, `GAP`, or `UNAVAILABLE` → 0; `DEGRADED` → 3; canonical → 8; all causal state finalized → 10
Stable	Within cap → 10; moderate depeg applies a cap; beyond suspension → 0; stale or nominal fallback is capped and labeled

Score	Label	Consumer posture
0	Unusable	Retract or ignore.
1–3	Low	Candidate only; require deeper independent evidence and a dry run.
4–6	Medium	Require an independent source and a dry run.
7–8	High	May flag promptly; a dry run remains mandatory.
9–10	Very high	Consider as a primary source only after rolling promotion gates.

State and ordering

Recompute on price, liquidity, retraction, health, finality, timer, policy, and external-anchor changes.
PRICE_RETRACT recomputes from final post-reorganization state; it is not a blind tombstone.
Sequence causal pool records before one coalesced token record.
When no route survives, timer expiry retracts the price with ROUTE_EXPIRED.

No score authorizes liquidation. Independent flag-then-confirm policy remains mandatory, especially when one party controls most effective depth, the sole venue, the ingestion cursor, or the sole stable source.

Keyboard shortcuts