A reason behind
every decision.

Sign-in identifies your workspace. Practice saves confirmed rules, simulated funds and receipts. Wallet observation reads public evidence without granting authority. Live spending is not enabled.

Overview accepts an EVM browser wallet or a watch-only public address. The reader verifies mainnet 4663 and matches stock tokens by their official contract addresses. Balances share one block; ETH, DeFi and other tokens are excluded from the stock subtotal. Failed reads never imply zero holdings.

Indicative valuation uses the midpoint of a matched official USD bid/ask, multiplied by the official shares-per-token multiplier and exact raw token quantity. Halted, mismatched, pending-multiplier or quotes older than two minutes are excluded. A stock subtotal is not the full wallet value or an executable swap quote. At most 20 held tokens are priced per read.

Autonomy onboarding offers an explicit picker for detected browser wallets or a watch-only address. The picker uses EIP-6963 discovery with a browser-default fallback. Extension-supplied wallet labels are not independently verified. Ownership signing uses the wallet you selected, checking its exposed account and Robinhood Chain network before and after signing. Connection shares an address; the separate ownership signature grants no spending permission. Wallet creation inside Stock Steward is planned, not implemented. You may create a wallet in your own wallet app, then connect it. Account or network changes clear the selected onboarding address. Readiness receipts can be downloaded as JSON with their recorded checks, route evidence, and intent digest when present. Exports contain public wallet addresses and recorded financial evidence; review before sharing. The remaining-check checklist is historical and must be refreshed after changes. A separate switch button asks your wallet to add or select Robinhood Chain; it does not send a transaction. Ownership messages show an expiry countdown and cannot be signed after expiry. Stock Steward has no private-key or recovery-phrase input.

Route inspection also records existing USDG allowance to Permit2 and Permit2 allowance to the documented router at the same canonical block. It binds the recipient, exact input, minimum output, pool, deadline and mandate version into an inspectable intent digest. Unknown allowance evidence stays pending. A passing allowance check grants no agent authority. The router’s poolManager getter is checked against the canonical manager at the same block. Unsupported getters remain pending, while mismatches fail. The internal execution guard requires simulation and any exact approval to match the same complete intent digest; changing the amount, output, pool, deadline or mandate invalidates earlier evidence. Router bytecode is fingerprinted, but its deployed interface and enforcement still require verification before executable calldata or full wallet simulation is enabled. USDG token units cannot substitute for verified dollar-limit accounting.

Observe & save stores the evidence under your site login. Wallet ownership remains unverified. Load saved observations to compare quantities, multipliers, available prices and mandate versions. Purchase previews check saved symbol and single-buy limits; daily exposure, full-wallet concentration, funding and execution eligibility remain pending. No preview approves an order.

Automatic spending remains disabled. Alchemy documents Robinhood wallet APIs and scoped session keys, but read-only Alchemy connectivity is verified but total setup cost is not measured. Gas sponsorship does not establish free gas. Before activation, permissions, revocation, execution routes and a user-selected setup budget must be verified. Supported networks · Official data semantics

The workspace can check Robinhood mainnet identity and bytecode at the documented Uniswap Universal Router 2.1.2, Permit2 and Alchemy SMA-7702 delegate addresses. Checks use one observed block. This establishes infrastructure presence, not available liquidity, audited behavior, investor eligibility or a usable stock-token swap.

Each manually requested check stores a historical readiness receipt under your site identity. It identifies your saved mandate version, pending ownership and delegation checks, missing route and fee evidence, and remaining prerequisites. A public address and an automatic preference grant no authority. Optional read-only schedules store observations after runner activation. Pause discards in-flight results, and three consecutive failed observations pause the schedule. Wake-ups may be delayed; actual run times are shown. Transaction watches report chain evidence, not investment completion. No session signer is running.

Spending permissions

Activation requires an owner-approved wallet delegation, a bounded session, approved settlement and output tokens, constrained recipients and calldata, expiry, and proven revocation. A router allowlist alone can allow unwanted commands. Steward must test the complete permission path before requesting live authority. Root permissions are not acceptable.

Accounting before execution

The reservation core is implemented and tested, but is not wired to an executor. It atomically reserves purchase amounts, rejects duplicate intents, and counts unresolved reservations across midnight. Unknown transaction outcomes retain their budget until reconciled. Confirmed purchases count toward their execution-day cap. Reconciliation must establish a terminal outcome before releasing a reservation.

Fees before funding

The fee guard requires fresh estimates for delegation, permission installation and revocation, including execution, data and provider fees. It adds 50% headroom and rounds upwards against a selected cap no higher than $20. It cannot return a complete quote from gas price alone. Funding or bridge fees and investment principal remain separate. Real setup estimates are still pending.

Infrastructure references: Uniswap deployments and Alchemy permissions. Robinhood stock-token restrictions still apply; blockchain accessibility does not establish eligibility.

The route inspector uses canonical USDG and a stock token matched from the official registry. It verifies mainnet identity, contract presence and the quoter/state-view manager reference, then pins every call to one block. Four zero-hook pool keys are checked: fees 100, 500, 3000 and 10000 with tick spacing 1, 10, 60 and 200.

Pool initialization, active liquidity and exact-input quoter output are separate evidence. An unavailable RPC result is not proof of an empty pool. A failed direct search does not rule out other fee/spacing keys, hooked pools, multihop paths or RFQ venues. The best output means best among those four inspected keys only.

USDG input is a token amount, not a guaranteed dollar valuation. Output is raw stock-token quantity before UI multiplier conversion. Minimum output is rounded down using the selected tolerance. Quote expiry cannot outlive thirty seconds from either its block timestamp or observation. Quoter gas excludes the full router/account transaction, approval, setup, data and provider fees.

Owner control and replay protection

You may request a five-minute ownership message, inspect it, then choose to sign through your wallet. Its origin, address, chain, nonce and expiry are checked against a server-held challenge under your signed-in identity. An EOA signature is recovered, or a deployed contract must return the ERC1271 magic value. A consumed, replaced or expired challenge cannot verify again. Counterfactual undeployed wallets are unsupported. Signatures are not persisted.

Verification proves control at a recorded time. It neither installs a delegation nor proves future control, current balances or eligibility. Forgetting the record removes this workspace evidence; it does not revoke any separate wallet permission.

Execution preflight

The internal guard requires a matching owner, current mandate, fresh quote and block, unpaused state, verified eligibility, complete onchain restrictions, reserved accounting, concentration evidence, account-level simulation and complete fees. Approval mode also requires exact, unexpired approval bound to that route and mandate. Automatic mode still requires verified scoped authority. These checks are tested foundations; no signer or submission adapter is connected.

Router arguments require narrow enforcement. The tested Roles/Safe policy restricts exact commands, output tokens, recipients, quotas and expiry. It has not been installed on your live wallet. A generic contract/function allowlist cannot replace it; Stock Steward requests no broad or root grant. Provider permission reference · Stock-token trading venues

1. Save boundaries.

   In Mandate, choose allowed symbols and limits. Save, reload, and check the version persists. Automatic is a saved preference and must remain inactive.

2. Inspect an address.

   In Overview, paste a public address and select Observe & save. Inspect coverage, unavailable prices and the recorded block. A failed read must show an error, not zero balances.

3. Use your own wallet.

   In Autonomy, choose a detected wallet and connect. Cancel once to check recovery, then reconnect. Switch to Robinhood Chain using the separate button. Account or network changes must clear the onboarding address.

4. Verify control.

   Request an ownership message. Review its address, origin and expiry, then sign only if they match. This signs a message, not a transaction or spending grant. Expired messages need replacement. Watch-only addresses cannot sign through this flow.

5. Inspect a route.

   Enter a stock symbol and USDG token amount, then inspect. Quotes may be unavailable; that is a valid result. When a quote exists, inspect the minimum output, pool, block hash, allowances and intent digest. Quoter gas is not a full transaction fee.

6. Check and export readiness.

   Run a fresh readiness check and download its JSON receipt. Ownership evidence may pass historically, while delegation and execution remain blocked. Reload and inspect saved history. The export includes public address and recorded evidence.

7. Try monitoring deliberately.

   If you want background read-only observations, start a monitor, refresh status, then pause it. A scheduled run can take longer than the chosen interval because GitHub can delay wakes. Pause must show monitoring paused; it does not revoke wallet permissions.

Permission enforcement, full account simulation and fill reconciliation are tested in the isolated contract lab. Mainnet activation still requires your installed policy, current eligibility, verified full-wallet price and activity evidence, measured provider costs, a reviewed signer deployment and a separately approved funded end-to-end test. Funding alone does not complete those gates.

Bundled user operations require a separate verified account envelope and event path. The narrow Roles/Safe adapter also checks the exact session/module envelope and installed policy at the transaction block. The isolated lab verifies full account simulation, fixture swap proof, durable attempt settlement and all six lifecycle fee components. Other bundled user operations remain unsupported. The standard session permissions do not establish restrictions inside router arguments; no broad/root grant is installed.

Fake balances, rules and recent receipts survive reloads in the signed-in workspace. The agent checks about every eight seconds while open. Cloudflare requests optional background checks every 15 minutes; actual wakes may be delayed; approval mode still waits for you. Pause stops checks. Revoke permission before resetting fake funds. The Practice portfolio view shows cash, holdings, allocations and total fake-value change since reset; it is an estimate, not a real fill.

The Live selector cannot activate execution. Real custody, permissions, economic data, fees, settlement and an authorized execution path remain separate work. Practice authority never transfers to a real wallet.

The workspace shows a live preview of the draft rule sentence, position ceiling, and action preference as fields change. Reset draft restores the last saved values without creating a new version. Saving increments the mandate version in the signed-in owner’s D1 ledger. The server validates the limits and rejects stale versions from another session. Practice execution choice is reviewed separately in Strategy. Live spending remains inactive. Changing a mandate invalidates practice permission and pending approvals.

Wallet tracking uses official Robinhood Chain stock-token contracts and same-block balances. Indicative prices are not execution quotes. Missing prices or failed reads remain unknown; the stock subtotal excludes ETH and other assets. Ownership verification is a separate message signature and does not authorize spending.

Checks cover the approved symbol, purchase size, available fake cash, daily budget, concentration, cash reserve, price freshness and strategy trigger. A failed check holds the proposal. Ask-before-buying mode requires approval of the exact practice purchase; automatic practice can act only when all checks pass.

Trail displays the latest saved practice receipts with the symbol, amount, timestamp, strategy and mandate versions, rule results and outcome. Simulated fills update fake balances. Holds and pending approvals do not spend funds. Receipts can be downloaded from Trail. Practice does not produce real transaction hashes.

Confirming rules does not authorize spending. Authorize Practice enables simulated activity only. Pause stops the practice agent; revoke removes its practice permission. Background practice is optional and operates on fake funds. Live execution needs a separate reviewed wallet policy, verified route, complete accounting and fees, and a tested executor before activation.

Funding alone does not finish this work. Practice remains available without a funded wallet.