For an autonomous agent to act with real money, capability is not enough — someone has to be able to say what it was allowed to do, prove what it actually did, and stop it. COSMO builds that as seven separable primitives: delegated authority, mandate, policy, ceremony, record, receipt, verification. All seven have run together, for real, in two micro-live execution cases across two different economic domains — a SupraFX trade and a marketplace work delivery. Both cases are published below.
What "institutional" means here — and what it does not
Institutional means governance primitives: bounded authority, rules fixed in advance, records that cannot be quietly rewritten, receipts that can be checked. It does not mean custody of funds, supervision of third parties, regulatory status, or an investment product. None of those are offered here.
Let an autonomous agent execute one real trade on SupraFX — one pair, one micro-sized order, real settlement. Not a demo and not a testnet: supervised agent execution with explicit human authorization at the irreversible boundary.
A key the agent could hold without holding the account. Limits the agent could not exceed even if compromised. Rules decided before the action, not after. A human arming the irreversible step. A record whose later modification becomes detectable. A signed statement of what happened — including when what happened was failure.
None of those requirements are about trading. Sizes and price bounds are trading-shaped; authority, mandate, policy, ceremony, record, receipt and verification are not. The trade was the occasion. The primitives are the product.
Each one is separable, and each one was exercised in Case 001. The first two are deliberately not the same thing:
Capability is copyable. Authority is not.
A key can be copied; whoever holds it can act. Authority is what bounds the acting: scope, caps, expiry, revocation — and, per individual case, a single-use mandate. COSMO never treats possession of a key as permission.
A standing, bounded permission to act: a delegate key with an explicit scope, per-trade and total caps, an expiry — and an on-chain revoke.
Case 001: delegate restricted to taker-only SUPRA/USDC, capped at 1 SUPRA per trade / 2 SUPRA total, created on-chain, fully consumed, then revoked on-chain by the principal.
A signed authorization for one concrete case: single-use nonce, time-to-live, and a hash binding to the exact policy in force.
Case 001: one mandate, one nonce, consumed exactly once; the mandate hash is carried into the execution envelope itself.
Rules fixed and hash-pinned before the action: allowed modes, sizes, price deviation bounds. Anything not explicitly allowed is rejected.
Case 001: policy pinned by hash; every check either passed or the case would have closed as POLICY_REJECTED.
A human arms the irreversible step. The run stops at AWAITING_ARM; the operator writes a one-shot, mandate-bound ARM with a 15-minute freshness window.
Case 001: armed manually by the operator; the ARM was consumed exactly once.
A hash-chained journal of every state transition, plus write-once evidence files sealed by a manifest.
Case 001: twelve journal entries from case_opened to case_closed, each chained to the previous; twelve evidence files sealed under one evidence root.
A signed closing statement with an honest outcome taxonomy — failure classes are first-class outcomes, not silence.
Case 001: outcome EXECUTED at exactly the mandated rate. An earlier drill closed as EXECUTION_FAILED — and its receipt says so.
A separate offline verification of internal consistency: key pin, signatures, time bounds, policy pin, mandate binding, manifest, journal chain, envelope, statement re-derivation, outcome consistency. It is run apart from execution — not by an independent third party.
Case 001: ACCEPT on all ten criteria, exit code 0 — using the COSMO verifier, whose implementation remains private.
Delegated authority is not a property of the mandate — it is the standing, bounded permission the case runs under. The two lifecycles are managed, and shown, separately.
Amber marks the step that requires a human. A micro-live case stops at AWAITING_ARM and stays stopped until the operator arms it — the agent cannot arm itself.
Every case closes with exactly one of eight outcomes, and the receipt is signed either way. The first live drill exposed a mismatch between the external settlement and COSMO's observation: the fault was in the observer, not the trade. The receipt preserved the system's actual recorded state (EXECUTION_FAILED), the verifier confirmed its internal consistency — which is not world truth — and the system halted instead of silently relabelling the outcome. The second drill validated the corrected settlement observer. An institution that cannot name its failures cannot be audited.
Submitted, filled and observed settling. Only this outcome claims success.
Dry run completed. A shadow case can never carry EXECUTED.
The request itself was malformed. Rejected before any mandate existed.
A pinned policy rule said no. The default is rejection, not permission.
Executed into the market, but nobody took the other side in time.
The mandate ran out of time before the action could complete.
A halt file or kill switch stopped the case. Stopping is always available.
The action was attempted and did not complete as observed. Recorded, signed, kept.
One verification entry point, shared integrity guarantees, two domain-specific execution profiles.
The same verifier entry point accepts both receipts below — a SupraFX trade and a marketplace work delivery. What is shared are the integrity invariants (signatures, mandate binding, policy pins, journal chain, evidence manifest, receipt integrity, fail-closed behavior); the economic meaning of each action stays domain-specific.
One mandated micro-trade, run through all seven primitives: −1 SUPRA / +169 micro-USDC — exactly the mandated rate, observed at batch 9,647,777. Offline consistency verification: ACCEPT, ten of ten criteria (COSMO verifier, implementation private). The delegated authority behind it was created on-chain with hard caps, fully consumed by two drills, and then revoked on-chain by the principal — the complete lifecycle, including the ending.
Note on the amount: the platform API returned a JavaScript floating-point balance delta. The normalized economic amount is 169 micro-USDC — "exactly the mandated rate" refers to this normalization. Future adapters should use integer micro-units end-to-end (this fix has since landed in the engine).
case case_msskp1gg956f8a
mandate_hash 0xb0d3911a…6bab11
policy_hash 0x59f7c39f…7dd75d
evidence_root 0x5799bf59…1b50c2
Delegated authority on record
created — SupraFX batch 9,559,624 (2026-08-12) · delegate c1add416…760fbc
scope & caps — taker-only SUPRA/USDC · 1 SUPRA per trade · 2 SUPRA total
caps consumed — drill 1 batch 9,563,222 · drill 2 batch 9,647,777 (2/2 SUPRA)
revoked — batch 9,649,339 (2026-08-14) · event 0xce7398f7…c69f61de
Council event feed (DelegatePolicyCreated … DelegatePolicyRevoked) ↗
Public evidence bundle. Offline verification currently requires the COSMO verifier, whose implementation remains private.
Case 002 — the generalization case, deliberately NOT a trade: a solver agent delivered work on the COSMO market under the same seven primitives. The deliverable's hash was pre-committed in the mandate BEFORE delivery, the policy checked six named criteria against live chain state, a human armed the irreversible step, and the agent committed the hash on-chain (deliver_result_v2, job 9, 5 wCOSMO escrow). The on-chain result hash matches the mandated hash exactly. Honest scope: the case ends at DELIVERED — buyer approval is a separate human step outside the case, so this is mandated delivery with on-chain commitment, not full settlement. That separate step has since happened: the buyer approved and job 9 settled atomically on-chain (escrow payout + deposit release) — as a direct human action, not yet as its own mandated case. That remaining gap has since been closed: see Case 002-G below, where the approval leg runs as its own mandated case.
The drill's failures are part of the record: a first attempt closed EXECUTION_FAILED (SDK defect before any network contact — receipt says exactly that), a second closed EXPIRED (the ARM ceremony missed the mandate window by one minute). The third closed EXECUTED on the first submit attempt.
case case_mst8l7i8d4391a
mandate_hash 0x3ad166f7…430b9d01
result_hash 0x5429d300…e34ce055 (pre-committed == on-chain)
evidence_root 0x318fa77b…3fd26d44
Public evidence bundle. Offline verification currently requires the COSMO verifier, whose implementation remains private.
Case 002-G — the double ceremony: the full economic arc of a marketplace job, with BOTH irreversible legs under mandate. On live job 10 (5 wCOSMO escrow), the solver agent (K1) committed a pre-mandated result hash on-chain under a provider mandate (deliver_result_v2), and the buyer acceptance — atomic escrow release via approve_delivery_v2 — was ALSO executed as its own case, under a one-shot mandate held by an agent-controlled buyer wallet. The approve policy re-verified before release: job delivered and unsettled, execution key equals the on-chain buyer, on-chain result hash equals the mandated hash, mandate window inside the review window, release within the escrow cap. Both cases verify offline through the same entry point: ACCEPT, ten of ten criteria each.
Honest scope: both ceremonies were armed by the same operator — the separation of buyer and provider authority is cryptographic (distinct keys, one-shot mandates, domain policies), not organizational. The buyer wallet is agent-held but was created and funded by the founder for this drill.
deliver case_msuc7iwa03bd86 · mandate 0x7996b572…17626652
approve case_msuc8s79e56cea · mandate 0x93ba83d6…0eaa712f
result_hash 0xd71c14ce…7104caf6 (pre-committed == on-chain)
outcome job 10 SETTLED · escrow released 5 wCOSMO buyer → solver
Public evidence bundle. Offline verification currently requires the COSMO verifier, whose implementation remains private.
The market already shares part of this discipline: frozen criteria, on-chain settlement and published evidence. The full Execution Case framework — delegated authority, mandate, ARM, receipt, offline verification — has been proven in Case 001 (a SupraFX trade), Case 002 (a marketplace work delivery, run over the market as one mandated case) and Case 002-G (delivery AND acceptance with escrow release, both legs mandated). Day-to-day market jobs do not yet run through the full framework. What settles on the market is listed on the Trust page, newest first.