Execution truth infrastructure

Short description — One call returns what a given order size actually fills at right now, measured against observed depth rather than modeled from a price feed. Priced per call in USDC via x402. Consumed by machines.

Overview

Quoted price is a suggestion. Fill price is the fact.

Every autonomous trading agent on-chain is acting on the first and getting paid in the second. It reads an oracle, sees a number, sizes a position against that number, and submits. The book decides what actually happens. The agent finds out after settlement, in the only unit that matters — realized value.

For a human trader this gap is survivable. Humans hesitate. They feel a thin market before they can describe it, they cut size on instinct, they wait for the second print. Agents do none of that. They trade continuously, at machine speed, with no instinct for when a market has gone hollow. That is precisely the condition under which quoted and realized price diverge most, and precisely when an agent is least equipped to notice.

Speed without depth awareness is not an edge. It is a liability that compounds every block.

Crifine is the pre-trade check. Given a pool, an asset, and a size, it answers one question with evidence attached:

If I execute this size right now, what do I actually get?

Not a modeled estimate from a price feed. A measurement against observed depth, with the observation window, the depth source, and the assumed size disclosed on every result.

The three surfaces

Every published number is verifiable without an account, a key, or a signup. That is not a growth tactic. It is the product's central claim: if you cannot check the number, the number is worth nothing.

The Problem

1. The gap widened in plain sight

Between August 19 and 22, 2026, non-Bitcoin assets added roughly $215 billion in nominal market value. Aave rose over 60%. Zcash around 75%.

Price feeds tracked every tick of it. Order books did not move.

An agent reading that feed sees an asset that has appreciated and is therefore, by its model, tradeable at size. The book says otherwise. Depth did not scale with price — in several monitored pools it contracted while the quoted number went up, because the same rotation that lifted price pulled inventory out of the book. Nothing in a standard agent stack surfaces that divergence. The feed and the book disagreed for four days and only one of them was being read.

Sourcing note. These figures are the project's own framing of the August 2026 rotation and are carried here as the founding observation, not as cited third-party data. Before external publication, each number needs a dated source (see References). Crifine's own recorded depth series begins 2026-08-22 and is independently checkable; the market-cap and per-asset moves above are not yet.

2. Oracles measure the wrong thing, correctly

An oracle's job is to report a reference price. It does that job well. The failure is not oracle malfunction — it is the assumption, baked into nearly every on-chain risk model, that reference price and executable price are the same number.

They are the same number only when the book is deep relative to the size being moved. That condition holds most of the time, which is why the assumption survives, and fails exactly when it is most expensive — during rotations, during liquidation cascades, on weekends, in long-tail collateral.

A liquidation engine that marks collateral at oracle price and unwinds it at book price is carrying an unmeasured short position in liquidity. Nobody prices that position because nobody publishes the number.

3. Agents inherit the assumption and multiply it

The agent wave makes this structural. An autonomous execution loop:

• runs continuously, so it is always exposed to the worst moment rather than a chosen one
• sizes from a feed, because a feed is what has an API
• has no analogue of hesitation
• compounds — a 60 bps unmeasured execution cost on a strategy turning over daily is not a rounding error, it is the strategy

Agents do not need a smarter price. They need the honest one, delivered fast enough to act on, and cheap enough to call before every order.

4. Tokenized equities sharpen it to a point

Those markets close. The tokens never do.

An agent trading a tokenized stock on Saturday is quoting Friday's price into an empty book. The oracle is not stale by its own definition — it is reporting the last real close, which is exactly what it is supposed to report. The agent has no field anywhere in its stack telling it that the price it is reading refers to a market that will not open for 40 hours, and that the depth behind it went home on Friday.

Add redemption windows — the time and cost to convert a tokenized instrument back to cash — and "price" becomes a genuinely misleading single number. Time-to-cash is a second dimension, and for RWA collateral it is often the binding one.

Crifine treats trading hours, redemption windows, and weekend liquidity as first-class inputs, not annotations.

What Crifine Measures

The core output

{
  "pool": "aave-v3 / WETH",
  "chain": "ethereum",
  "as_of": "2026-08-29",
  "oracle_price": 4820.00,
  "exit_size_usd": 5000000,
  "realized_price_est": 4551.00,
  "exit_gap_pct": -5.58,
  "lowest_depth_7d_usd": 3120000,
  "days_observed": 7,
  "market_open": true,
  "evidence_url": "https://crifine.app/api/v1/exit/aave-v3-weth"
}

Two fields carry the entire product:

• exit_gap_pct — the number they act on. The distance between what the feed says the position is worth and what the book will actually pay for it, at the specified size, right now.
• evidence_url — the reason they believe it. Keyless, dated, showing the observation window and the depth snapshots the estimate was derived from.

market_open matters only for RWA collateral, and matters enormously there.

days_observed is deliberately exposed rather than hidden. A 7-day observation window is a weaker claim than a 200-day one, and the consumer is entitled to know which they are getting. Confidence is a disclosed field, not a marketing posture.

Field reference (v1)

Fields under consideration for v2

Measurement Method

The method is the product. A number nobody can reproduce is a marketing claim.

Principles, stated as commitments:

1. Observed, not modeled. Estimates derive from recorded depth snapshots. Where a modeled component is unavoidable, it is labeled as such in the response.
2. Size is always explicit. There is no such thing as "the" fill price. There is a fill price for a size. Every result states the size it was computed for.
3. The observation window is disclosed. as_of and days_observed appear on every result.
4. The depth source is disclosed. Which pools, which venues, which snapshot cadence.
5. Stress over average. Headline risk fields report the worst observed condition in the window, not the mean. Averages hide exactly the event the consumer is paying to avoid.
6. Verification is keyless. evidence_url resolves for anyone, with no account.
7. Estimates are scored against outcomes. Every published estimate is retained and compared to realized fills where observable (see Accuracy Record).

What Crifine does not claim:

• It does not predict price. It measures the cost of acting on a price.
• It does not model MEV, sandwich exposure, or adversarial reordering in v1. Those are execution-layer risks stacked on top of depth risk, and conflating them would make the core number less honest, not more complete.
• It does not guarantee a fill. It reports what observed depth implies, with the window stated.

Utility

In production today

1. Continuous daily depth recording across monitored pools since 2026-08-22.
2. Public, keyless verification — every published number checkable without an account.
3. Fully disclosed measurement method — assumed size, observation window, and depth source stated on every result.

That is a deliberately short list. Everything below is roadmap, and is marked as such rather than blended into the same paragraph.

Roadmap — full feature list

1. Pre-trade fill estimates — what a given order size actually clears at, right now.
2. Live pool pages — quoted price against realized fill price on one chart.
3. Spread history — the gap between quoted and realized value, tracked over time.
4. Depth ladders — how much of an asset clears at each price level.
5. Slippage forecasting by order size, from $10k to $50M.
6. Public fragility board — the thinnest books on-chain, free and open.
7. Portfolio view — every position ranked by execution spread, worst first.
8. Spread alerting — notification the moment a market crosses a set threshold.
9. Route comparison — realized fill across venues for the same size.
10. Stress-window queries — worst depth observed across any chosen period.
11. Depth decay tracking — how fast a book thins after a price move.
12. Multi-chain coverage across major venues and lending markets.
13. Tokenized equity and treasury execution scoring.
14. Market-hours risk flags — weekend, after-close, and holiday exposure isolated as separate risk.
15. Redemption-window modeling — time-to-cash on RWA assets, not just price.
16. Liquidation exposure scoring for collateral posted against loans.
17. Machine-payable endpoints via x402 — agents pay in USDC per request, no account or contract.
18. Agent-native JSON output, built for autonomous execution rather than human dashboards.
19. Sub-second response targets for pre-trade calls.
20. Webhook and streaming delivery into existing execution and risk stacks.
21. Historical fill-accuracy record — every published estimate compared against what actually happened.
22. Accuracy bonds in $CRIF — publishers stake collateral against their numbers, slashable if an estimate is proven wrong. (Undecided — placeholder for the token's role. See Token Note.)

Build sequence

The same list, grouped by what has to ship before what. Numbers refer to the list above.

Two items are load-bearing out of order and should not wait for their phase: #6 (fragility board) is the cheapest distribution the product has, and #12 (multi-chain coverage) widens the unbackfillable record, so every day it is deferred is a permanent cost.

The Data Moat

Continuous depth history has been recording since 2026-08-22 — through the exact rotation that produced the divergence this project exists to measure.

That record cannot be backfilled by anyone starting later.

This is the single structural asset, and it deserves precision about why:

• Depth is not archived on-chain in usable form. Price history can be reconstructed from swap events by anyone, any time. Resting liquidity at a given moment cannot be — it is a state you either sampled or did not. Reserve balances give a partial reconstruction for constant-product AMMs, but concentrated liquidity, order-book venues, and off-chain quoting all lose their state permanently unless someone was watching.
• The interesting observations are the rare ones. A depth series is valuable in proportion to how many stress events it contains. A competitor starting today needs to wait for the next rotation — and then the one after that — to build a comparable stress record. Time is the input, and it cannot be bought.
• Accuracy history compounds on top of it. Once estimates are scored against realized fills, the record becomes a track record, which is a second moat layered on the first and equally unbackfillable.

The strategic implication is simple and should govern sequencing: widen recording coverage before building product surface. Every pool not being sampled today is a permanent hole in an asset that only grows by waiting.

Accuracy Record

The commitment that separates a data product from an opinion:

Every estimate Crifine publishes is retained with its inputs. Where a realized fill of comparable size is subsequently observable on the same venue, the estimate is scored against it. The distribution of those errors is published — not a single vanity accuracy percentage, but the error distribution by size bucket, by venue, and by market condition.

This is deliberately uncomfortable. It means publishing the cases where the estimate was wrong, including the tail. The alternative — asking consumers to trust an unaudited number — is precisely the failure mode Crifine was built to attack. A product whose thesis is "the number you are trusting is not checkable" cannot ship an uncheckable number.

Design constraint: accuracy scoring must be automatic and adversarially reproducible from published data. If Crifine is the only party able to compute its own accuracy, the score is worthless.

Machine Payments (x402)

Every endpoint is priced per call and payable in USDC via x402 — payment negotiated in the HTTP response itself, settled per request.

Why this matters more here than in most places it is bolted on:

• The consumer is not a company, it is a loop. An agent evaluating whether to place a $2M order should be able to spend a fraction of a cent finding out what that order actually fills at. That transaction cannot require a signup flow, an API key rotation policy, a procurement conversation, or a human.
• Pricing matches value. A pre-trade check that saves 40 bps on a $5M order returned $20,000 of value for a sub-cent call. Per-call pricing lets that economics stay obvious instead of being buried in a seat license.
• No account means no gatekeeping, which means the verification claim holds. Keyless verification and machine payment are the same design decision viewed from two sides.

Access tiers:

The free tier is not a funnel. It is the credibility layer, and it stays free permanently for that reason.

Architecture

Indicative — to be reconciled against the actual stack as it is built.

Recorder (the irreplaceable component)

The depth sampler is the only component with a hard uptime requirement, because a gap in the series is permanent. Everything else can be rebuilt from the record; the record cannot be rebuilt from anything.

• Continuous snapshotting of pool depth across monitored venues
• Append-only, immutable series with snapshot provenance retained
• Independent watchdog with alerting on sampler gaps — a missed window is a data-loss incident, treated as such
• Redundant collection where a single RPC endpoint would otherwise be a single point of permanent failure

Estimator

• Depth-ladder walk producing volume-weighted realized price for a requested size
• Stress aggregation over configurable windows (lowest_depth_Nd_usd)
• Session/redemption overlay for RWA instruments
• Sub-second response target: precomputed ladders per pool, with the request-time work reduced to a walk plus interpolation

Delivery

• JSON API, agent-first response shape
• x402 payment negotiation at the HTTP layer
• Webhook and streaming channels for threshold alerts
• Public pages rendering the same data the API returns, from the same source — never a separate pipeline, or the two will disagree and the credibility claim dies

Verification

• evidence_url resolves keylessly to the snapshots, window, and method version behind a specific result
• Method versioning: every result carries the version of the measurement method used, and old versions stay resolvable

Repository layout

crifine/
  crifine-web/     # marketing site — Next.js 16 + Cloudflare
  crifine-docs/    # documentation, method spec, field reference
  crifine-dapp/    # live pool pages, fragility board, portfolio view

Recorder and API are not yet in this tree and will need their own home — likely a separate long-running service, since a Worker-based scheduler is a poor fit for a component whose availability requirement is "never miss a window."

Why This Makes Sense Now

1. The divergence is documented and the product is not. August 2026 produced a clean, dated instance of price and depth moving in opposite directions on major assets. The event is legible. Nobody publishes the number that would have made it actionable.

2. Agents are arriving faster than agent-grade data. Autonomous execution is being wired into strategies whose entire data layer is price feeds built for human dashboards. The mismatch resolves either through better data or through losses. Both create the market.

3. The moat starts the day you start recording, and only then. This is rare. Most data products can be replicated by a well-funded competitor in a quarter. A stress-event depth series cannot be replicated at any price — only outwaited.

4. RWA growth makes the market-hours problem structural. Tokenized equities and treasuries are growing, and every one of them carries a session boundary that on-chain infrastructure has no vocabulary for. Being early to market_open as a first-class field is being early to a category, not a feature.

5. Verification is a durable differentiator in a low-trust category. Market-data vendors compete on coverage and latency. Publishing an adversarially checkable accuracy record is a different axis, and an uncomfortable one for incumbents to follow.

Positioning

The seam Crifine occupies: pre-trade, size-specific, verifiable, machine-payable, with a stress-event depth history nobody else was recording.

The nearest real competitor is not a company. It is an internal execution-quality model at a sophisticated trading firm — accurate, expensive, and unavailable to anyone else. Crifine's bet is that the agent wave creates thousands of participants who need that model and will never build one.

Go To Market

Sequence: evidence → conversation → API.

Do not lead with a product. Lead with a number the recipient can check, about an asset they are exposed to, that they did not have.

Outreach — option A (lead with the number)

hi [name] — i've been tracking daily depth on [protocol] collateral pools since aug 22.

for [asset], a $[X]m liquidation today would realize roughly [Y]% below oracle. depth dropped [Z]% during last week's rotation while the oracle price went up.

full evidence here, no signup: [link]

not selling anything yet. i'd just like to know whether that number matches what your own models show, or whether i'm measuring the wrong thing.

Outreach — option B (ask for a reality check)

hi [name] — quick question from someone building in the same area.

i've been measuring exit depth on [protocol] collateral pools daily. during last week's rotation, oracle prices on [asset] rose while observed depth fell, which implies liquidations would clear well under oracle.

my numbers say [Y]% gap on a $[X]m exit: [link]

is this something your team already tracks internally, or is it a blind spot? happy to be told it's already solved.

Both drafts do the same three things, and any variant should preserve all three: (1) a specific, dated, checkable number, (2) a keyless link, (3) a genuine question rather than a pitch. The response to option B is information whether it is yes or no — "we already track this" tells you the buyer is not the protocol, and that is worth knowing early.

Audience order

1. Lending protocol risk teams — highest-stakes consumers of the oracle-vs-book gap, and the ones for whom a liquidation cascade is an existential event rather than a bad quarter.
2. Agent framework and execution-stack builders — distribution multiplier; one integration reaches every agent on the framework.
3. RWA issuers and tokenized-equity venues — where market_open and redemption windows are not an edge case but the core of the risk.
4. Quant desks and market makers — most likely to already have an internal model, most useful as a validity check on the method.

Token Note

Honest position: $CRIF has no established reason to exist yet, and that should be stated in the whitepaper rather than obscured by it.

The product is priced per call in USDC via x402. That is a complete, working business model with no token in it. Any token design has to clear the bar of making the product better, not merely making a raise possible.

Every candidate "reason to hold" falls into one of three buckets:

• Circular — hold $CRIF for cheaper API calls. This only pays off if the price rises, so the actual reason to hold is speculation wearing a utility costume. Credits are meant to be spent; holding credits is just paying early.
• Illegal, or close enough to matter — revenue share, staking yield, buybacks from profit. These genuinely reward holders, which is exactly why regulators call them securities. The specific rule differs across the US, EU, UK, and Singapore; the outcome does not.
• Fake — governance rights over a product with a small number of real users.

The test: if the answer to "why hold this" sounds exciting, you have built a security. If it sounds boring, you did not need a token.

The one design that is genuinely interesting here

Roadmap item 22 — accuracy bonds — is the only token mechanism that is not decorative for this specific product, because it attaches economic consequence to the thing the product sells:

A publisher of an execution estimate stakes $CRIF against it. If the estimate is later proven wrong against realized fills, the stake is slashed and paid to the party who proved it.

This is interesting because it converts "trust our number" into "we are collateralized against our number," which is a real improvement over every incumbent in the category. It is also, honestly, the hard version:

• It requires a dispute mechanism — an objective, adversarially resistable definition of "proven wrong" for an estimate that was explicitly probabilistic and window-scoped. That is a genuinely hard oracle problem in its own right, and getting it wrong makes the bond worse than no bond.
• It only becomes meaningful with multiple independent publishers. A single-publisher bond where Crifine slashes itself is theatre.
• It probably requires the accuracy record to be mature first, because you cannot collateralize a claim whose error distribution nobody has measured yet.

Sequencing conclusion: ship the accuracy record (roadmap 21) before designing the bond (roadmap 22). If the error distribution turns out to be well-behaved and multiple publishers appear, the bond has a real job. If neither happens, there is no token, and that is an acceptable outcome — a good data business is not improved by attaching a bad token to it.

If the goal is raising capital, a SAFE or equity does exactly what a token is being asked to do here, legally. Get a securities lawyer before any token, not after — and note that users in 120+ countries means exposure to all of their regulators, not just the one where the entity is incorporated.

Risks and Open Questions

Measurement risk — the estimate is wrong in a way that matters. Observed depth at snapshot time is not a promise about depth at execution time. Mitigation: stress-window reporting rather than point estimates, disclosed confidence, and a published error distribution. This risk cannot be removed, only made legible.

Coverage risk — the moat has holes. Every pool not sampled today is permanently missing. Mitigation: prioritize recording breadth over product polish in the near term.

Recorder availability — a gap is unrecoverable. The single component where downtime destroys an asset rather than degrading a service. Requires redundancy and gap alerting from day one, not after the first incident.

Adversarial gaming. If Crifine's numbers become load-bearing for liquidation or execution decisions, there is an incentive to manipulate observed depth around snapshot windows. Mitigation: randomized/high-frequency sampling, provenance retention, and never publishing the exact snapshot schedule.

Demand risk — the honest one. It is possible that sophisticated desks already model this internally and unsophisticated agents will not pay to avoid a cost they cannot see. Outreach option B is designed to surface this answer early and cheaply. If the answer comes back "already solved" from every serious buyer, that is a finding worth acting on rather than arguing with.

Verification URLs must resolve. crifine.app is live and serving: the site on the apex, the docs on docs., the app on dapp. — each attached to its Worker in that repo's wrangler.jsonc. evidence_url sits on the apex alongside the API, which is the part that does not answer yet. The standing risk is not which domain to pick but publishing an evidence_url before the endpoint answers — a verification link that 404s is worse than no verification claim at all.

References

To be completed before external publication. Every claim below currently rests on the project's own framing and needs a dated, checkable source — which is the same standard Crifine holds its own numbers to.

• Non-Bitcoin market cap change, 2026-08-19 → 2026-08-22 (~$215B) — source needed
• AAVE price move over the same window (>60%) — source needed
• ZEC price move over the same window (~75%) — source needed
• Depth contraction observed in monitored pools during the same window — Crifine's own series, publishable as primary evidence
• x402 specification and reference implementation
• Tokenized equity trading hours and redemption terms, per issuer

Next Steps

1. Widen recorder coverage. Highest-leverage action available, and its value decays every day it is deferred.
2. Harden the recorder. Redundancy plus gap alerting. Treat a missed window as a data-loss incident.
3. Ship evidence_url. Keyless verification is the load-bearing credibility claim; nothing else can be honestly marketed until it resolves.
4. Publish the method spec in crifine-docs — assumed size, window, depth source, versioned.
5. Build the fragility board. Free, public, permanent. The cheapest distribution the product has.
6. Send ten option-B outreach messages to lending protocol risk teams. Optimize for information, not conversion.
7. Defer all token work until the accuracy record from roadmap 21 exists.