Funding-carry strategy model

The funding-carry library models a useful application of verified foreign context: compare funding rates across venues, authorize bounded paired exposure, account for fills and costs, and reconcile the result against venue statements. Its strongest implemented capability is a deterministic decision and accounting model.

It is not currently a live strategy or a native executable program. The module and program ID exist, but no corresponding native registration, transaction processor, durable strategy-account codec, or executor dispatch was found. Venue signing and delivery services are not implemented by these functions. This is distinct from Bombil's VM-level financial boundary.

Read this as an explanation of the decision and accounting model. For the underlying evidence policy, follow HILSA verified reads; for the separate financial runtime boundary, use Bombil.

What the model tries to capture

The modeled position shorts the higher-funding venue and longs the lower-funding venue for the same underlying. It sizes equal base quantities, rather than equal entry dollars, to align exposure to common price movement.

Projected net is funding differential minus fees, slippage, and settlement cost. The model assigns no projected profit to price-basis convergence. Instead, adverse basis blocks entry. This avoids treating a hoped-for price change as an earned cash flow. Decision model, pair selection and sizing.

For example, two observations with an attractive funding spread still produce NoTrade when their trust is too weak, their quote is stale, available depth is insufficient, or modeled costs exceed policy. A refusal is an explicit return value with reasons; it is not yet an automatically persisted chain receipt.

Inputs, policy, and deterministic arithmetic

TrustedObservation combines venue data with verification and finality classes. decide checks shape, freshness, and both floors before evaluating candidates. It iterates policy assets and venues deterministically; the best projected net wins, with stable policy order resolving ties. Selection and admission.

The wrappers use signed integers, with wider intermediate arithmetic for several products. Fixed point avoids floating-point variation; it does not automatically prove every operation cannot overflow or that truncation is conservative for negative liabilities. Number model.

The default policy is a fixture/design contract, not a recommended investment allocation: capital 100 USD, 90 USD notional per leg, projected net floor 1.25 USD, cost cap 0.25 USD, and target 1 USD. It separates market-observation freshness/finality from closing-statement freshness/finality. Policy::validate checks internal consistency; a future caller must actually invoke it. Policy.

An order intent bounds authority

OrderIntent specifies venue, asset, side, quantity, worst acceptable price, expiry, nonce, and execution flags. Entry constructors set post-only and clear reduce-only; unwind constructors reverse the open side, clear post-only, and set reduce-only.

The exact codec is 42 bytes with SFCO magic, version 1, big-endian quantity/price/expiry/nonce fields, and strict boolean bytes. Decode rejects wrong length, version, enum tags, nonpositive quantity/price, and invalid flags. Intent contract.

This is a useful design boundary for a constrained signer: exact authorized intent can be distinguished from delivery. But the codec is not a signer service, spent-nonce store, venue-native transaction encoder, or proof that an order was delivered. An OutboundMessageDraft helper likewise does not establish emission or external settlement.

Lifecycle and risk are caller-driven

The model separates entry, open-position accounting, closing, and recovery decisions. partial_check can wait, cancel an unfilled expired entry, or request unwind of an excessive one-sided fill. Its current Complete branch checks only that both fill options are present; it does not prove cumulative quantities equal the planned pair. A real orchestrator needs fill IDs, cumulative quantities, cancel/fill race handling, and restart-safe state.

exit_check evaluates drawdown, available margin information, stale data, maximum hold, spread collapse, and target profit in that order. A simultaneous risk breach takes precedence over profit-taking. Missing margin information does not trigger the margin branch. These are observable library semantics, not an assurance that a live supervisor is monitoring them. Risk and partial-fill logic.

Funding accounting converts an eight-hour-equivalent rate back to the supplied settlement interval. It ignores timestamps at or before the last absorbed settlement on that leg. This prevents simple replay of the same timestamp; it is not a general venue-event identity or correction protocol. Risk watermarks change only when the caller invokes observe_risk. Accounting.

Close the books per venue

Reconciliation compares opening and closing equity against each venue's modeled net. It verifies account continuity, statement ordering, minimum trust/finality, closing freshness, and a flat closing position. It then compares the worst per-venue residual against tolerance. Equal and opposite venue errors cannot disappear in a matching aggregate total. Reconciliation.

A settled receipt reports both modeled and attested P&L. It grants success only when ledger criteria and reconciliation pass. An unreconciled receipt never claims success. Its arithmetic check recomputes net from funding, execution P&L, trading fees, settlement cost, and slippage, then relates net to final capital. Receipt.

What remains between this model and an integration

HILSA's current universal-read enum has no venue-observation query, and its reserved subtree query is unsupported. The model's comments about such feeds describe intended integration. Exact venue observations, fills, account statements, and their evidence need an accepted schema and ingestion path.

A usable system also needs authenticated strategy state, deterministic orchestration, correctly addressable outbox corridors, constrained venue signing, delivery/retry semantics, and external completion evidence. HILSA reads and writes explain the substrate and its gates.

Colocated tests cover decimal math, decision gates, intent codecs, funding intervals/replay, risk precedence, residual reconciliation, and receipt arithmetic. They were inspected, not executed in this run. They establish model behavior, not venue connectivity, custody, deployment, or profitability.