Architecture
Data Flow
Trace a single order from production event to advance or pause — and which layer owns each hop.
Happy path
- ERP / vision / logistics emit events for
orderId. - Normalizer writes a validated production event.
- Scorer emits
scoreBps+dataRoot. - Oracle nodes sign EIP-712 attestation (optionally k-of-n).
- Score published on Arbitrum; consumer verifies signer + freshness.
- Agency evaluates proposed SPOOL call against allowlist + argument bounds.
- Agent simulates on an Arbitrum fork; on success, submits calldata.
- SPOOL updates order NFT / spool accounting; repayment waterfall later settles.
Cross-layer interfaces
| Interface | Direction | Contractual check |
|---|---|---|
| Score delivery | Oracle → SPOOL | Freshness window + authorized signer |
| Gated execution | Agency → SPOOL | Target, selector, value, decoded args |
| Simulation state | SPOOL ← Agency fork | State diff within expected bounds |
Failure coupling
- Oracle pause — no new advances; repayments can continue.
- Agency pause — no new agent actions; open positions remain.
- Sequencer stall — stop new advances; force-include critical pauses via delayed inbox if needed.
Design rule
Each degraded mode reduces capability without cascading into silent fund movement.