Open-Ledger Intelligence (OLI)

The discipline of producing rigorous analysis from publicly verifiable on-chain data. What Pellet practices on Tempo.

Open-Ledger Intelligence (OLI) is the discipline of producing rigorous analysis from publicly verifiable on-chain data.

Pellet practices OLI on Tempo. That's not a marketing line — it's a statement about method and scope, and it constrains what every Pellet endpoint can and cannot claim.

The three tenets

1. Public-ledger primacy

Pellet's source of truth is the public Tempo ledger itself. We read the chain directly:

Peg comes from quoteSwapExactAmountIn against the enshrined DEX — the actual swap rate a transaction would receive, measured live.
Compliance comes from isAuthorized(policyId, user) queries against the TIP-403 precompile — the authoritative per-user, per-policy check every TIP-20 transfer is evaluated against. Pellet runs the same check before agents submit, so /api/v1/tip403/simulate predicts Unauthorized() reverts without spending gas.
Issuance, burns, transfers come from decoded TIP-20 events on the chain.
Fee-token elections come from the fee manager precompile directly.
Rewards come from the reward precompile events.

Scope-honesty note. Not every TIP-403 read is live yet. Policy-metadata reads (admin, type enumeration, full registry scan) currently revert on the deployed registry — only isAuthorized and policyIdCounter are callable today. Full metadata is coming via event-log reconstruction (PolicyCreated + PolicyAdminUpdated on mainnet). Until it lands, Pellet reports those fields as coverage: "unavailable" rather than defaults. That's scope honesty in practice.

Nothing is sourced from off-chain oracle aggregators, price feeds, or third-party indexers. When an aggregator is uncertain about a Tempo stable's peg, they mark it confidence: null. Pellet has an answer because Pellet read the pool.

2. Scope honesty

OLI is explicit about what it does and does not cover. The public ledger is the lens; everything else is acknowledged as outside it.

In scope: every event, balance, price, policy, and attestation that lands on the public Tempo mainnet.
In scope: the boundary between Tempo mainnet and Tempo Zones — fund locks into zone contracts, cross-zone settlements, committed proofs of zone state. These are mainnet-visible and therefore OLI-readable.
Out of scope: zone-internal activity. When Tempo Zones host private parallel ledgers for enterprise stablecoin use, the transfers inside those zones are by design private. Only the zone operator and individual users can see them. OLI does not claim to.
Out of scope: off-chain issuer operations, private counterparty agreements, anything that never touches the public ledger.

When a number is outside OLI's lens, Pellet says so. Scope honesty is not a caveat — it's a feature of the discipline.

3. Measurement over inference

Every metric Pellet publishes is a measurement, not an estimate.

spread_bps is the difference between the bid and ask side of an actual DEX quote call. Not a triangulation through USD.
composite_risk is a weighted combination of signals — peg deviation, peg-break history, supply headroom, and policy posture. Peg + supply components are direct reads; the policy component currently degrades to a scope-honest default until full TIP-403 metadata reads land (see scope-honesty note above). The composite doesn't hide which components are direct vs. degraded.
effective_apy_pct is computed from distributed reward amounts and opted-in supply, both read directly.
backing_usd is totalSupply × current_peg_price — two direct reads, composed.

If a value cannot be measured, it is returned as null with an explanatory coverage / coverage_note pair in the response. Pellet never invents a number to fill a gap.

OLI vs. the alternatives

Approach	Source	Scope claim	When it fails
Observation	"We watch the chain"	Implicit: everything	Silently wrong when something becomes private
Oracle aggregation	Off-chain price feeds	"The token is worth $X"	Stale, lagged, `confidence: null` when pools are new
Generic indexing	RPC logs, generic patterns	"Tokens, transfers"	Misses TIP-20 / TIP-403 / precompile semantics
OLI	Direct on-chain reads	"What's publicly verifiable on Tempo"	Only what's genuinely private

Worked example

On 2026-04-16 morning, a worked comparison:

Codex (off-chain oracle aggregator, multi-chain) priced USDC.e at $0.998044 with confidence: null. pathUSD at $1.00029, also confidence: null. Implied USDC.e/pathUSD spread: 22 basis points.
Pellet (direct enshrined-DEX read) measured USDC.e/pathUSD at 0.9997 — 3 basis points below peg.

An agent swapping $1,000 based on Codex's implied rate would have mispriced the trade by ~$19. On Tempo-local pricing, the Codex answer wasn't just less precise — it was wrong.

This is why the distinction matters. Pellet's peg number is not "another provider's price." It's the price that would actually settle on the enshrined DEX at that block. OLI is the discipline that holds you to that standard.

Why this matters now

In April 2026, Tempo announced Zones — private parallel ledgers designed to let enterprise stablecoin use (payroll, B2B invoicing, treasury) run without exposing internal transactions. Zones are currently testnet-only: the prover isn't live yet, no production zones exist, and the spec is labeled "expect breaking changes." Tempo mainnet launched on 2026-03-18 without zones; they're a roadmap item, not a shipped product.

When zones do ship at production scale, they'll narrow the observable surface of internal transfers. But zones are validiums with a public portal, not opaque sidechains — so the boundary surface becomes richer per unit than people initially assume. What lands on mainnet, even with encrypted zones running:

Issuance and burns remain mainnet events, same as today.
Every deposit and withdrawal hits a mainnet ZonePortal with plaintext token + amount fields. Encrypted deposits keep the recipient and memo private but the token and amount are still public.
Every batch commitment (BatchSubmitted event with state-transition hashes) is a mainnet artifact.
Every TIP-403 policy change (PolicyCreated, PolicyAdminUpdated, WhitelistUpdated, BlacklistUpdated) propagates into zones via the mirrored registry — and the events themselves live on mainnet, indexable.
Bounce-back events — withdrawals blocked at the exit by TIP-403 — are mainnet-observable proxies for in-zone policy friction.

OLI's scope expands along the boundary as zones grow: per-zone TVL by stablecoin, encrypted-deposit adoption ratio (unique per-zone KPI nobody else will compute), cross-zone flow matrix via chained portal callbacks, compliance-propagation latency between a mainnet policy write and each zone's next TempoAdvanced, and sequencer revenue per zone per token.

Honest status. Pellet indexes the mainnet stablecoin and TIP-403 surface today. The zone-portal event indexer is on deck — a standalone build that will ship as the first production zones come online. Until then, this section describes the OLI scope we'll cover, not a live capability.

Zones don't drain mainnet — they add a new boundary surface with its own events, proofs, and compliance propagation. Some internal transfer flow moves behind the boundary; what remains on public mainnet is disproportionately the institutional-risk and compliance signal that OLI is built for.

How OLI shows up in Pellet's product surfaces

REST API — every endpoint is OLI-sourced. The methodology doc specifies exactly how each value is read.
MCP Server — exposes OLI measurements to agents as typed tools. An agent calling Pellet's MCP is doing OLI on your behalf.
Methodology — the full formula reference. The OLI bible.
Explorer — OLI values rendered for human readers.