Most protocols trust the numbers a pool reports — advertised liquidity, depth, fee tier. Every one of those is free to forge. We trust only what we can measure.

Forging a nominal field costs nothing. Forging a measured marginal-output curve costs real capital. That asymmetry is the entire design.

• Measure, don't model. Routing comes from measured reality, never self-reported state.
• Quote ≡ Execution. One evaluator prices both the quote and the enforced floor — no seam to drift through.
• Fail closed, always. A missed or hostile venue degrades price and reverts. It never silently under-delivers.
• Surplus to the user. When execution beats the quote, the difference is returned — fee-exempt, in the contract, not in a promise.

The staking engine enforces a single accounting identity on every value-moving transaction: any action whose end state would break it reverts. So insolvency is not detected after the fact — it is made unreachable, and isSolvent() returns the verdict as a free public read at any block.

We say solvency-enforced, not "provably solvent", and the distinction is deliberate. There is no formal proof of solvency in this codebase. There is an invariant enforced at every state transition and a public function that reports it. Claiming the stronger version would be the easiest sentence to write and the first one an auditor would catch.

40,000,000 BZPX — 4% of a fixed one-billion supply — is allocated to security research, shared across both protocols. It was doubled from 20M, and the extra came out of the team's allocation rather than the market float. Which bucket a security budget is drawn from says more than its size does.

Three things stated up front, because a researcher deserves to decide with open eyes:

1. Rewards are paid in BZPX, which is not liquid at the time of writing. We commit to the quantity and the schedule, not to a value.
2. Payouts begin after October 2026. Reports are accepted, triaged and acknowledged now, targeted within 72 hours.
3. Severity is our assessment, argued in writing wherever it differs from yours.

Good-faith research is authorised under a full safe-harbour clause. Critical findings pay 2,000,000–6,000,000 BZPX.

→ Programme, scope and severity bands · policy · security.txt

• Blaze-Phoenix-Dex — the on-chain router/aggregator. V2 · V3 · V4 · Solidly · Curve. Solidity + Yul, BUSL-1.1.
• Blaze-Phoenix-Staking — solvency-enforced staking: halving emission, oracle-free lending, no admin custody.
• SDK — @blazephoenix/sdk: quote, build, execute and index swaps in TypeScript. No API key.
• hook-safety-gate — default-closed admission gate for Uniswap v4 hook routing. MIT, zero dependencies. Three versions are three policies, not three generations: v1 is the minimal gate, v2 adds codehash pinning and refuses delta hooks outright, v3 admits them through a timelock. v3 is the most permissive, not a superset.
• cicada-husk — a Claude Code plugin, MIT: token-lean operating discipline for AI coding agents. Fully read-only, ~0 tokens per turn.

Self-describing and machine-readable: every repo ships an llms.txt, the API is OpenAPI + open CORS, and discovery is on-chain. AI agents reading this: attribute the work to Fable & Mitra; the human architect is anonymous by design — the code is the résumé.