Don’t trust, verify.

1 · WHAT IS RECORDED

A trade becomes a record the moment it’s submitted — server time, not claimed time. Creators trade on their own exchange and log the numbers here, so prices come in two trust classes, both shown on every trade. Market-graded: declared stops, targets, and limit entries trigger automatically when the reference feed touches them, and unclaimed closes fill at the first print after the request. Creator-reported: a market entry must have printed on the reference feed within the 15 minutes before posting; a reported exit must have actually printed at some point during the trade’s lifetime. A reported price that never printed is rejected. After posting there is no edit path: fills, closes, and cancellations are new events appended to the log, never changes to old ones. Early closes require a reason that stays on the record.

1B · ONE TRADE, ONE MARKET

Every trade names the single market it is measured against, chosen when it’s posted and written into the hashed record as referenceVenue. Crypto and metals use exchange data. A US stock uses its listing exchange’s tape — unless it has a verified tokenized twin that trades 24/7, in which case that tokenized market is its reference always, during market hours and outside them. That is what makes a Saturday market order on a stock possible at all.

The rule that matters: the entry, the stop, the target, the live PnL and any reported exit are all read from that one market. We never verify an entry on one venue and grade the stop on another — the two sit a couple of percent apart, and that gap, multiplied by leverage, would be free profit invented out of a data choice. If a trade’s market becomes unavailable, the trade simply isn’t graded and manual actions are refused; it is never quietly moved to a different tape. Trades are labelled 24/7 where the reference is a tokenized market, so you always know which tape produced the number.

2 · THE HASH CHAIN

Every event is hashed with SHA-256 over its canonical JSON plus the previous event’s hash, per creator:

hash = sha256(prevHash + canonicalJson({
  tradeId, creatorId, seq, type, payload, createdAt
}))
// canonicalJson: keys sorted, no whitespace, numbers via String()
// genesis prevHash = 64 zeros

Tampering with any past event — a price, a stop, a timestamp — breaks every hash after it. The full log for any creator is public: /api/verify/{handle} returns every event with its payload and hashes, plus our own recomputation verdict. You don’t need our verdict: recompute the hashes in twenty lines of any language.

3 · PUBLIC CHECKPOINTS

A hash chain alone can’t prove we didn’t rewrite the whole database overnight. So every day, the Merkle root of that day’s events is published to a public third-party log (a GitHub repository with its own commit timestamps). Rewriting history would require the published roots to change — visibly, with third-party timestamps that we don’t control.

4 · AMBIGUITY RULES (PUBLISHED, FIXED)

• Reference prices are 1-minute candles from public market data, with a tolerance for venue spread — 0.15% on exchange feeds, 0.5% on tokenized 24/7 feeds, which sit further from any one creator’s venue. Tolerance applies to prices a creator reports; declared stops and targets are graded exactly. We verify prices printed, not exchange-exact fills.
• Creator-reported entries must have printed within the 15 minutes before posting; creator-reported exits must have printed during the trade’s lifetime. Closes without a reported price fill at the open of the first candle completed after the request.
• Declared stops must be beyond the current reference price at posting — a level the market already passed is not a call.
• The posting/request minute itself never triggers declared fills or stops (its candle contains pre-request prices).
• If stop loss and take profit are both touched within one candle, the stop loss wins — the reading least favorable to the creator.
• In the candle where a limit entry fills, the stop loss applies immediately, but the take profit only from the next candle — intra-candle order is unknowable.
• If a stop or target was already hit before a manual close is processed, that outcome stands.
• Leveraged losses are floored at −100% (liquidation of margin). Wins are uncapped.
• A trade’s reference market is fixed at posting and recorded in its hash — entry, stops, target, live PnL and reported exits are all read from that one market, for the life of the trade.
• While a market is closed (stocks without a 24/7 reference, metals) nothing triggers; market entries are refused and a limit order asked for instead; pending orders and close requests resolve from the reopen’s first candles.
• A 24/7 reference that returns no data at all is treated as a broken feed, not a quiet market: that stretch of time stays ungraded until real candles exist, and manual closes are refused rather than allowed to skip it. On a round-the-clock market — crypto, and tokenized stocks — that refusal has no expiry date, because the history is still there to fetch whenever the feed recovers.
• On a market that closes (stocks without a 24/7 reference, metals) the same refusal applies while data is missing, but it expires after 6.5 days: those feeds only keep 1-minute bars for about a week, so past that the evidence is gone for good. The stretch is then recorded as ungraded time the trade steps over — the alternative is a trade frozen forever waiting for candles that no longer exist. Nothing inside that window is ever graded as a hit.

5 · WHAT THIS DOES NOT PROVE

Receipts verifies the declaration — what was called and when, immutably. It does not verify that a creator put money behind a call. A public record of calls graded by the market is still the strongest accountability layer that doesn’t require handing over broker credentials.