Add onchain_executor: on-chain actions through the Aomi Pipeline (stage → simulate → commit)

[CeciliaZ030]

Operator outcome

Adds an optional onchain_executor for Aomi Pipeline execution, verified Aave V3 lending, and shared Solana instruction execution. Jupiter Lend, Kamino Earn and PumpSwap preparation uses protocol-specific recipes in Aomi without adding a Hummingbot connector for each venue. An operator can preview a bounded supply, explicitly execute it, see actual confirmation evidence, and later withdraw through Condor. Completed lending transactions remain in a durable contribution ledger instead of disappearing from exposure history.

Companion UI: hummingbot/condor#232. Gas estimation support: aomi-labs/product-mono#1070. Ready for maintainer review; operational boundaries and evidence are below.

Implementation

• Connectorless execution: stage/build → simulate → risk check → commit → confirmation. Raw EVM calls and catalog operations remain available; commit: false runs without signing.

• Lending mode constructs exact Aave V3 approve/supply or withdraw calldata and verifies chain, wallet, target, amount, approval, recipient and call order before commit.

• Commit retries reuse the original build digest as the idempotency key. Temporary account contention retries the same phase; changed/stale builds do not silently rebuild a reviewed transaction.

• Estimated execution gas is valued in USDT independently of the display pair. A configured ceiling fails closed when the estimate or price is unavailable. The estimate excludes rollup data fees and provider surcharges; it is not a final signing fee cap.

• Creation is persisted before execution starts. Completion-save failures retain the live result for retry. /executors/lending/positions combines full durable history with current Base USDC receipt-token balances, deduplicates receipt replays, preserves unknown submissions, and returns errors when history or balances are unavailable.

• Controller net contributions and wallet-wide receipt balances are separate. Deposits/withdrawals are position changes, not trading profit. An optional operator-owned Base USDC policy now validates exact wallet/market/controller grants and contribution limits under a PostgreSQL transaction lock before inserting the durable reservation. Pending supplies consume capacity; only confirmed withdrawals release it. require_lending_policy prevents fallback if a grant is removed. This bounds recorded contributions, not all portfolio market exposure; Condor checks the grant, values USDC independently and includes durable contributions in its portfolio risk state.

• Docker clients initialize lazily so an Aomi-only API can start without Docker. Existing bot discovery still reports unavailable Docker.

• Client dependency is pinned to public aomi-labs/aomi-python commit caa72d5225dd60e482835e0341a91293d7549dd3 (v0.1.3). README documents configuration and lifecycle limits.

• Solana preparation binds the registered Aomi app identity and connected wallet. It returns unsigned instructions without staging or committing. The shared executor verifies the reviewed plan hash, complete network-fee evidence, and optional wallet/market/program/debit limits before handoff.

• Solana debit limits cover per-account net wallet debits in a single simulation. They do not constrain intermediate flows, CPI program access, farm exposure, later chain state or unattended execution. Missing or unsupported balance evidence refuses submission.

Validation

• Latest full local API suite: 1,010 passed, eight integration cases deselected. Eleven warnings include dependency deprecations and an unawaited fake-client coroutine warning; no failures.

• Previous Aave revision: upstream main 7e86651b69b13b39e0cb3e1afbf080eedd461e8d merged. then-current full local suite: 928 passed, 8 integration cases deselected.

• 43 lifecycle/gas tests passed after the final correction. Duplicate durable creation is rejected before start; upstream completion upserts and performance snapshots are preserved.

• Real PostgreSQL race/restart tests pass under READ COMMITTED and REPEATABLE READ defaults, including required-policy removal. Temporary-contention regressions preserve build digests and idempotency keys.

• Public client v0.1.3: 147 passed, one live skip, wheel and source distribution built and inspected.

• New Solana preparation/configuration/policy/lifecycle checks: 156 passed. Additional registration/lending/accounting checks: 62 passed, two database-dependent skips. Existing dependency warnings remain.

Solana runtime evidence

All six Condor UI confirmations were independently reconciled with receipts and final positions on a local Solana mirror: Jupiter Lend supply/redeem, Kamino Earn vault supply/withdraw, and PumpSwap direct liquidity add/remove. Reviewed executor hashes, complete fee/balance guards, and final zero positions were checked. Every transaction paid 5,000 lamports in network fees. These used a substituted local test wallet and a locally registered Aomi application fixture; hosted app activation and production Para signing are not demonstrated. The completed V2 recording is linked below.

Earlier Aave runtime evidence

Current upstream code was exercised through both the Condor UI and typed create_lending_executor tool, the authenticated API, durable PostgreSQL policy admission and actual Aomi Pipeline on a Base fork at block 51,161,414.

• Typed granted flow: supplied 5 USDC and withdrew 4.999999 USDC. A 10.000001 USDC request was refused under a 10 USDC per-action limit.
• Recorded UI: supplied 2 USDC and withdrew 1.999999 USDC. All six receipts across these two flows were independently re-read from the live fork with successful status and matching block hash. Remaining approval allowance is zero.
• A 1 USDC preview with a 0.000001 USDT execution-gas budget is refused before wallet submission. Contribution accounting survives completion and is shown separately from shared wallet balances.
• Final accounting correction: simulated gas stays in custom_info.estimated_gas_quote; it is never booked as incurred executor fees, including on non-submitting previews. Receipt-derived quote fees are currently unavailable. History navigation follows upstream's groupBy=ctrlType contract.

Exact versions, receipt and balance evidence, reproduction boundaries, and narration script. A 148-second walkthrough and individual before/supply/withdraw/refusal/ledger recordings are completed local deliverables; videos are not hosted in the repository. The supply/withdraw footage predates the accounting-only correction and is labeled with its actual source versions.

Operational boundaries

These are local fork transactions, using a bounded loopback Anvil test signer and a fresh public Kraken gas-conversion adapter. Automatic USDC valuation uses the real Hummingbot Binance endpoint. No model inference or production Para signing is claimed. Eight Para envelope regressions pass, covering empty calldata and explicit fee/nonce validation before HTTP; live signing-provider verification remains a deployment check.

Gas estimates exclude Base data fees and signing-provider surcharges. The allocation policy bounds recorded contributions, not external deposits, interest or the full portfolio. Unknown submissions retain reservations for reconciliation. No realized yield is claimed.

The earlier Aave integration revision merged the upstream baseline described above; current mergeability is reported by GitHub. Supporting backend CI run 34591678160 passed at 2439db38, including the fresh upstream merge. All three PRs are out of draft. Backend deployment and maintainer merge are separate from this contribution.

Finished 2:30 V2 video, final narration, fresh receipts and recording notes. Six local transactions were verified, all three positions exited, and a 2 USDC action exceeded its 1.9 USDC limit and was refused before commit. The video is silent with a separate voiceover script; it uses a local Solana mirror and substituted test wallet.

Market-policy review correction: every top-level instruction for the selected protocol must reference the selected market. Mixed-market bundles are rejected regardless of instruction order. 147 targeted policy/configuration/lifecycle tests pass; all six archived demo receipts satisfy the stricter rule. The previous 1,010-test full-suite result predates this correction.

Unsigned preparation handles only explicit HTTP409 operation_in_flight admission refusals with bounded retries; timeouts, 5xx responses and other conflicts are not retried. Exhausted contention returns a sanitized busy response. The correction passed 23 focused tests and a live concurrent-read check. It does not alter transaction submission.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with the previously reported mixed-market policy bypass fully fixed and no new actionable defects established.

Summary

• Retries only explicit Aomi preparation admission contention with bounded backoff.
• Sanitizes preparation failures while preserving a distinct busy response.
• Requires every selected-protocol instruction to reference the configured Solana market, resolving the previous mixed-market policy bypass.

Diagram

sequenceDiagram
    participant Operator
    participant API
    participant Policy
    participant Aomi
    participant Chain
    participant DB

    Operator->>API: Create or preview on-chain executor
    API->>DB: Persist pending executor
    API->>Aomi: Stage/build transaction
    Aomi-->>API: Reviewed build
    API->>Aomi: Simulate build
    Aomi-->>API: Simulation, balances, and fees
    API->>Policy: Verify plan, market, wallet, and limits
    alt Preview only
        API-->>Operator: Simulation and reviewed plan hash
    else Commit requested
        API->>Aomi: Commit original build digest
        Aomi->>Chain: Submit transaction
        Chain-->>Aomi: Confirmation evidence
        Aomi-->>API: Receipt or pending result
        API->>DB: Persist final or unresolved state
        API-->>Operator: Durable execution result
    end

Loading

_{Reviews (4) · Last reviewed commit: "Handle explicit Aomi preparation admissi..."}