Inspect risk.
Keep the doubt.

A small evidence service.

Pool and pair lookup use a filtered registry seeded from the bounded high-fee pool study and verified DOAI swap evidence. Calldata checks recognize supported encodings. Transaction checks attempt read-only analysis; unsupported routes and incomplete evidence fail closed.

Transaction hashes describe historical execution, not a fresh proposal. Pool discovery is partial: absence does not establish safety or even absence of a pool.

No green by default.

DENY

A detected hazard, malformed request, or missing required execution evidence. Read the reason code.

WARN

A risk profile or partial inspection needing further checks. Not permission to trade.

UNPRICEABLE

Independent executable fair value or coverage is missing. Not permission to trade.

ALLOW

Reserved for complete, fresh transaction validation. The public deployment has no reviewed profile enabled and cannot issue ALLOW. An operator-reviewed, code-pinned single-hop profile is implemented separately.

Read only, by construction.

1. A browser or agent submits a pool, pair, calldata, unsigned transaction, or historical hash.
2. The API validates input and consults the compact registry.
3. Supported on-demand RPC reads retrieve execution evidence.
4. The engine returns explicit reasons, scope, and an evidence checksum.

No wallet connection, private keys, signing, broadcasting, or trading-bot integration.

Keep storage bounded.

Run the Node service behind a trusted reverse proxy. Use separately configured RPC endpoints, restrict bind address to loopback, and expose only the documented read-only API.

Maintain only selected PoolManager events with resumable checkpoints. The existing source collectors are reusable patterns; no 71 GB route cache or archive node is required. Enable bounded storage and log rotation; inspect runtime health rather than assuming the disk ceiling is an OS quota.

Narrow by design.

Implemented: legacy Universal Router, one mandatory V4_SWAP command, actions 0x060c0f, ERC-20 → ERC-20, exact input, static fee, no hook. A pinned parent block, eth_simulateV1 with transaction validation, before/after wallet balances, reconciled swap events and independently grouped executable pool references are required.

No reviewed deployment profile is enabled publicly. Operators must supply evidenced immutable runtime-code pins and pool-control provenance—not just two provider URLs. Limits include ≤1 second decision age and ≤10 blocks of drift. Enso multi-hop routes, hooks, dynamic fees, native assets and arbitrary router commands do not inherit this coverage.

What a digest means.

The envelope checksum detects a changed payload when recomputed. It is not a digital signature, authenticity proof, signer authorization, or guarantee of future execution.

The response expiration bounds this evidence envelope only. It does not make historical pool data current. Inspect each result's block, observation time, coverage and missing checks separately.