showcase: Fiducia deterministic rebalance planner

[fiduciaindex]

Summary

Adds showcase/fiducia-deterministic-rebalance/. Fiducia compiles an index mandate into a hash-committed rebalance plan, so the trades an executor is permitted to make are fixed before it reaches a router.

• slug fiducia-deterministic-rebalance (matches folder, unique across the 60 manifests)
• builder Fiducia, https://x.com/fiduciaindex
• source https://github.com/fiduciaindex/fiducia (MIT, public)
• primitives ["token"]
• topic agents

Proof

PROOF.md has the commands and the recorded output. The planner is pure computation: no RPC, no keys, no clock, no network. Same input, same hash, any machine.

git clone https://github.com/fiduciaindex/fiducia.git
cd fiducia/packages/mandate
pnpm install --ignore-workspace
node --experimental-strip-types --test test/*.test.ts        # 46 pass
node --experimental-strip-types examples/deterministic-plan.ts

Expected on any machine:

mandateHash	0xe3420dccd9f0f958d51e2b2e1ae6d3a6fac1baffe12dc23e9a7a213e2d5125dd
planHash	0x07061e2f22ea83cca89468e9eba86c26300e92896a0e1ce69a8d30187df3e30e
determinism	100 rebuilds produce an identical planHash
tamper	halving minAmountOut yields 0x76c1fff7…; swapping router calldata yields 0xfbccc8be…

If those hashes do not reproduce, the determinism claim is false and this should be rejected.

Why the hash is the point

An agent that plans its own trades can quietly widen its own limits. The plan is hashed before execution and checked at settlement, so discretion is bounded by arithmetic instead of trust. minAmountOut and the router calldata are inside the hash preimage, not passed alongside it, so neither can be altered without changing planHash. The preimage is an ABI encoding of (bool, bytes32, uint256, uint256, address, bytes)[] matching the Solidity side, and test/planner.test.ts asserts it against an independent restatement of that tuple rather than against the implementation's own helper.

A real bug the tests found

The weight solver carried a comment claiming its invariants were "property-tested". No tests existed. Writing them showed waterFill returned allocations summing to 13000 bps — 130% whenever a cap and a floor bound at once: cap 0.9 / floor 0.1 over five assets produced 0.9 + 4x0.1 instead of the feasible 0.6 + 4x0.1. It clamped in both directions in one pass and never revisited a pinned name, so a cap-pinned name could leave less mass than the remaining floors needed. Reformulated as floor-plus-excess and verified over 4000 randomised feasible cases with zero invariant violations. In production it would have misallocated capital.

Scope — stated so the proof is not read as more than it is

• Runs: the deterministic core — canonicalisation, hashing, weight solving, planning, plan hashing, guardrails. 46 tests.
• Live: the $FIDUCIA agent token on Virtuals (#139254) and https://fiduciaindex.com
• Written, not deployed: the Solidity contracts. No Foundry tests, no deployment, no audit.
• Not implemented: the ACP adapter. No ACP job has been created or settled, which is why primitives lists token only and no ACP claim appears anywhere in the manifest. The agent processes in the repo do not run without that adapter. No token utility is implemented — the planner denominates in USDG, not $FIDUCIA.

The repo README carries the same per-component status table.

Checklist

• Folder name equals slug; kebab-case; unique
• node scripts/validate-showcase.mjs → Validated 60 showcase project manifest(s).
• Exactly three feedbackPrompts; seven artifacts
• All 13 manifest URLs return 200; posterUrl serves image/png
• Poster is 1600x900 (16:9), generated from a real demo run, not mocked up
• No credentials, keys, or wallet material in the package
• Diff adds only files under showcase/fiducia-deterministic-rebalance/

visual.posterUrl and the PROOF.md artifact point at the post-merge upstream main path, so they 404 until this merges. Both files are reachable on the PR branch for review — happy to switch them to branch URLs if you prefer to see them resolve pre-merge.

No video. Poster renders as a static card image per the Card Image rules.

[github-actions]

The showcase guide has a short list of allowed topics (agents, skills, commerce, security) to keep the site's filtering consistent. security and commerce seem like the best fit for the great work you're showing here!

Suggested change

	"topics": ["rwa", "index", "determinism", "risk", "tokenised-equities"],
	"topics": ["security", "commerce", "agents"],

[github-actions]

This is a really sharp submission — the technical detail in PROOF.md and the upfront honesty about what is and isn't built yet are both great.

The core question for us is one of scope: the showcase is focused on agents doing actual commerce, and this is a component for an agent that isn't at the commerce stage yet. It's a bit of a gray area, so we'll need a maintainer to make the final call on whether it's a fit.

One small thing that is a clear fix: I left a suggestion inline to trim the topics list to the standard set from the contributor guide.

Suggested edits (couldn't be anchored inline — copy manually)

showcase/fiducia-deterministic-rebalance/showcase.json (around line 8)
Let's trim this to the topics in the contributor guide. agents and security are great fits, and commerce seems appropriate for the problem domain.

  "topics": ["agents", "security", "commerce"],

---

Refreshed after a new push. Any inline suggestions from the first pass may now be stale.

[fiduciaindex]

Thanks for the read. Pushed e114ae0 picking up the filtering intent:

"topics": ["agents", "security", "robinhood-chain", "tokenized-stocks", "rwa", "determinism", "risk"]

I kept the descriptive tags rather than narrowing to the four buckets, because the four-value list is the constraint on topic, not topics. Counting the manifests on main:

• 56 of 60 have topics values outside {agents, skills, commerce, security}
• the most-used tags are acp (19), agents (15), commerce (15), base (13), security (12), robinhood-chain (11)
• showcase/README.md describes topics as "the free-form tags used for search" and topic as "the one primary bucket"

So security and robinhood-chain are in now, and topic stays agents. Happy to trim further if you'd rather these cards carry fewer tags.

On links.share: fair point, and I'd rather not fake it. There is no announcement post for this work yet, so the profile is the honest destination. I'll swap it for the specific post once it exists — before merge if that's preferred.

One thing worth flagging since it affects how the proof reads: visual.posterUrl and the PROOF.md artifact deliberately point at the post-merge upstream main path, so both 404 until this merges. They resolve on the PR branch:

• poster.png
• PROOF.md

Re-verified just now on the current branch: validator passes across all 60 manifests, the suite is 46/46, and two consecutive demo runs are byte-identical at 2525 bytes, still producing planHash 0x07061e2f…3e30e.

[fiduciaindex]

The share nit is resolved in 35f7a93 — there's an announcement post now, so it points at that rather than the profile:

https://x.com/fiduciaindex/status/2096257736510160916

Both review points are addressed. Validator still passes across all 60 manifests.