# Proof in production: the live earner governs itself through `/review`

**The strongest signal a governance product can give: our own live capital pays for its own oversight,
before it acts — and the gate is not a rubber stamp.**

invinoveritas runs a live autonomous trading sleeve on Hyperliquid (the **whale-consensus mirror** — it
mirrors the positioning of ~40 proven directional whales). Before it opens positions, the sleeve calls the
platform's own `POST /review` endpoint — `artifact_type=plan`, with live `trading_state` injected — and **pays
sats for the verdict**, exactly like any external caller. Every verdict is appended to a governed-decision tape
(`data/proofs/whale_mirror_review_gate.jsonl`). This is the same capital-scale-aware gate we sell.

This matters because of a structural truth that only gets sharper as models get more capable: **a more capable
trading model reasons better, but it still doesn't carry a capital-scale risk budget or leave a portable,
independent audit trail.** That oversight has to live *outside* the model. `/review` is that layer.

## A real governed-decision record (not a mock)

The platform's `/review` independently flagged the live book's actual risk **before we acted** — the same risk
our own risk controls were built around:

```json
{
  "ts_iso": "2026-06-05T04:54:06+00:00",
  "sleeve": "whale_mirror",
  "verdict": "approve_with_concerns",
  "confidence": 0.75,
  "summary": "The proposed trades mirror a consensus among proven directional whales, but the
              correlated short positions across major cryptocurrencies pose a significant risk of a
              short squeeze.",
  "issues": 2,
  "high_blockers": 1,
  "entries": { "BTC": "short", "ETH": "short", "SOL": "short" },
  "paid": true,
  "via": "POST /review (Bearer, internal earner account)"
}
```

Note the verdict is **not** "approve." On a different cycle the same gate returned **`reject`** (2 high
blockers) on a more aggressive book. The earner takes the breaker-authoritative action regardless (advisory
by design — circuit breakers remain the hard gate), but **every decision now carries an independent,
capital-scale-aware verdict it paid for.** That tape is the artifact an auditor or risk owner asks for: *what
verified this before it moved?*

## Why this is the honest version

- **Advisory, not theater:** `/review` never blocks the trade; the 30%-drawdown breaker, kill flags, and the
  per-position stop are authoritative. The value is the *independent recorded verdict*, not a veto.
- **Paid, not free:** the earner spends sats per review from an internal account — the economic proof that the
  oversight is real, not a self-serving log line.
- **Model-agnostic:** the verdict is produced outside the trading model and survives a model or vendor change.

The same endpoint is open to any agent or human-supervised system whose agents touch money or production
systems: `POST /review` on api.babyblueviper.com.