Judge the off-hours gap on tokenized US stocks — and prove every call.
GapGuard is an AI abstention and risk engine for tokenized US stocks: it decides whether an off-hours gap is liquidity noise to trade or news-driven repricing to respect, then proves every decision with a signed audit trail.
The move is easy to see. Judging why it happened is the hard part.
Off-hours, a tokenized stock like AAPLUSDT dislocates from fair value. Some of that move is fadeable noise that reverts at the US open; some is justified repricing — an earnings beat, a keynote, a Fed surprise — that keeps going. Blindly fading every gap is how naive bots blow up. And separately: why would anyone approve an agent for capital here at all?
Noise vs news
A grid bot fades both and gets run over by the ones that were real.
Blow-up risk
No governor, no veto — one justified gap erases a month of small wins.
Zero trust
"Trust my LLM" is not an audit. Capital needs proof, not a narrative.
Nobody owns it
The off-hours-gap hypothesis on tokenized equities is visible, testable, and still unproductized.
Perceive, debate, govern, prove — four stages, all auditable.
Read-only RWA data
Read-only Bitget RWA perps (isRwa=YES), ticker, funding, spread, plus a deterministic off-hours dislocation from the US-session clock.
The Quorum desk
Five adversarial roles — Narrative, Positioning, Market-Intel, Bear, Risk — reach evidence-weighted consensus; a Bear or Risk veto forces flat.
Natural-language mandate
A plain-English risk mandate compiles into hard vetoes — max position, overnight drawdown cap, flat-before-open — enforced in code.
Signed audit trail
Every decision is hash-chained, then summarized by an Ed25519-signed Merkle root anyone can re-verify — tamper-evident by construction.
The naive baseline fails at scale. The judgment layer is the product.
On real public Bitget AAPLUSDT candles (2026-05-12 → 06-18), blindly fading every gap is ~flat. Across a broader 20-symbol RWA basket, it is negative. A locked walk-forward rule then tests the opposite regime: follow only when prior same-direction RWA gaps have earned it. GapGuard sells that gate, the risk governor, and the proof layer that decide when the agent is allowed to leave simulation.
Backtests npm run backtest:multi
| Strategy | Return | Trades | Win |
|---|---|---|---|
| AAPL always-fade | −0.397% | 15 | 40% |
| AAPL gate-driven (real news) | +1.418% | 13 | 38.5% |
| AAPL label-aware baseline | +1.797% | 13 | 46.2% |
| 20-symbol always-fade (governed) | −0.015% | 747 | 44.1% |
| Positive pilot OOS (16 trading days) | +2.648% | 116 | 54.3% |
Honest caveat: on real blinded Finnhub news the Qwen gate scores 12/15 and correctly stands aside on WWDC, so the gate-driven row is +1.418% — driven mainly by that one catalyst, small sample. The +1.797% row is a label-grounded baseline, not an AI edge. The 20-symbol always-fade row is near-flat (−0.015%) because it is sized by the risk governor (gross exposure ~0.19%, max DD 0.019%) — naive fading shows no edge, and the governor stops a no-edge strategy from compounding losses. The walk-forward pilot is on just 16 OOS trading days — a hypothesis, not proven profitable alpha; we don't headline a Sharpe at that sample.
The rigorous finding (20-symbol / 790-candidate holdout, significance-tested): accuracy is the wrong yardstick for an abstention engine — a fade-everything bot looks accurate only because most gaps revert, while it eats the catastrophic losses on news days. On worst-case (95th-percentile) regret — the disasters the gate exists to avoid — GapGuard cuts the tail loss from 7.47% to 5.81%, a reduction with 95% CI [1.23, 3.56] and p = 0.001. The proven edge is risk reduction, not direction-picking.
Blinded gate audit
| Session | Verdict |
|---|---|
| Prompt input | real Finnhub headlines (blinded) |
| Holdout labels | separate file |
| Accuracy | 12/15 (80%) |
| WWDC call | stood aside ✓ |
| Gate-driven | +1.418% vs −0.397% |
The audit no longer feeds Qwen the answer key. On real, blinded Finnhub headlines it scores every AAPL gap after the model returns, and writes a verdict cache that backtest:news replays honestly. On real news Qwen scores 12/15 and correctly stands aside on WWDC, turning the −0.397% always-fade baseline into +1.418%.
Managed run: a Bitget Playbook run (pbrun-e3fe0ec8c873) completed on AAPLUSDT.BITGET — 38 trades, honest flat/negative Sharpe, a completed managed backtest on a real tokenized US stock.
Don't trust the agent. Re-verify it.
Every decision, mandate ruling, breach, passport, and order is sealed into a sha256 hash chain, then signed. The cockpit recomputes the whole chain in your browser with SubtleCrypto — toggle "simulate tampering" and the exact broken row turns red.
Signed Merkle attestation
Ed25519 · browser verification available
A compact "verify, don't trust" fingerprint: signed tamper-evident audit trail inspired by regulated-market recordkeeping. Cryptographic integrity proof, not regulatory certification.
What you can run yourself
- npm test — full deterministic test suite
- npm run backtest — real AAPLUSDT gap backtest, no key
- npm run backtest:multi — 20-symbol RWA baseline
- npm run alpha:certify — locked walk-forward RWA pilot artifact
- npm run backtest:news — label baseline + gate cache replay
- npm run gate:audit — blinded Qwen verdict cache on real Finnhub news; WWDC correct
- npm run arena:cockpit — rebuild the signed chain
- Open arena.html → Verify chain, then Simulate tampering
The OSS desks have the debate. The trust layers have the audit. Only GapGuard has both — on tokenized stocks.
| GapGuard | TradingAgents / ai-hedge-fund | Recall / VeritasChain | |
|---|---|---|---|
| Adversarial multi-agent desk | Yes — evidence-weighted, veto | Yes | No |
| Tokenized US-stock off-hours gap | Core thesis | Generic equities | No |
| Execution rail under a risk governor | RWA dry-run + Demo fills + historical live round-trip; autonomous default OFF | Backtest / educational | No |
| Signed, re-verifiable audit trail | Ed25519 Merkle + in-browser | No | Audit only (post-hoc) |
| Measured evidence discipline | 790-trade baseline + blinded gate cache | Asserted | N/A |
Sources: TradingAgents (arXiv 2412.20138), ai-hedge-fund (virattt), Recall (recall.network), VeritasChain (veritaschain.org). The off-hours reversion edge is treated as a hypothesis here; the SSRN abstract is not enough to claim the full paper proves it. Per public sources, the tokenized-stock gap product remains unproductized — that's the white space.
Watch the AI read the news and call each gap.
Real Finnhub headlines from before each US open, fed blinded to the Qwen gate (no answer key). Scrub through every backtest gap and see the verdict, the evidence it read, and the outcome.
loading…
—
decision
if faded
vs holdout
Data: gate-verdicts.json — produced by npm run gate:audit on real Finnhub news. 12/15 correct; WWDC correctly stood aside. Current operational feed: News tab.
Write the rule in English. Watch it compile to hard limits.
The same compiler the agent uses (src/mandate.ts) turns plain English into enforced vetoes. Edit the mandate and recompile — these are hard gates, not suggestions.
Composer decides what to buy; GapGuard decides what the agent is forbidden to do — signed and re-verifiable.
A public read surface. A gated, server-side write path.
This site is read-only: it observes the gap, the gate, and the signed trail. It holds no exchange key and places no order. Execution lives behind the broker on the server — three modes, rising friction. The autonomous live mode is separate from this browser.
Builds the order plan and places nothing — this is what the cockpit renders. No keys, no fills.
Routes to Bitget Demo via --paper-trading. Real orders, demo funds — proven with three BTCUSDT fills (real orderIds).
Server-side only. Autonomous entry needs VPS arming, a LICENSED passport, fresh non-vetoed Quorum consensus, a sub-25bps book, no pending/open exposure, isolated 1× margin, and reconciled daily caps. It submits a fill-or-kill limit at the executable quote.
Judge the gap. Earn trust. Then trade.
The public artifact runs today — read-only RWA market evidence, deterministic Quorum, a default-off autonomous broker rail, one historical live RWA round-trip, a verifiable chain, and reproducible backtests. Open the cockpit and re-verify the boundaries yourself.