> For the complete documentation index, see [llms.txt](https://docs.useicaria.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.useicaria.xyz/architecture/overview.md).

# System overview

The system end to end, on the chain and beside it, and how trust is split between the halves.

A small set of immutable contracts on Robinhood Chain, surrounded by stateless services that exist purely for convenience, is what Icaria amounts to. A single rule gives the design its shape: **the chain enforces, services only assist.** Take away any service and every guarantee survives; what disappears is convenience, never funds and never fairness.

## The pieces

```
          Traders, LPs, Makers, Integrators
                        │
        ┌───────────────┼────────────────────┐
        │               │                    │
   Platform UI     Quote service        Maker gateways
   (Next.js)       (stateless)          (RFQ streaming)
        │               │                    │
        └───────────────┼────────────────────┘
                        │  signed transactions only
   ┌────────────────────▼─────────────────────────┐
   │              Robinhood Chain                  │
   │                                               │
   │  SwapRouter ── AnchorVaults ── RfqSettlement  │
   │       │              │               │        │
   │  EligibilityRegistry │        FeeCollector    │
   │       │         OracleRouter                  │
   │  ParamController (timelock)                   │
   └───────────────────────────────────────────────┘
                        │
        Indexer (Ponder / Envio) ── Trade explorer,
        execution-quality dashboards, keeper service
```

## On-chain

Every contract and its single responsibility are catalogued in [Smart contracts](/architecture/smart-contracts.md). These properties hold across all of them:

* **Immutable logic, timelocked parameters.** Vault and settlement logic never upgrades. Behaviour changes only through `ParamController` values behind the timelock, each with a published rationale.
* **One oracle door.** `OracleRouter` and its guards are the sole route a price takes into a contract; nothing reads a price by any other path.
* **One eligibility door.** Whether an address may act is answered by the `EligibilityRegistry` and by nothing else; no contract decides for itself.
* **Pause can only stop.** The guardian can halt quoting and settlement. Withdrawals cannot be blocked, and nobody can move funds.

## Off-chain

Three services, and none of them holds anything that touches funds:

* **Quote service**: simulates router pricing and assembles maker quotes for the UI and the API. It cannot alter a fill, because the router re-derives or re-verifies everything itself. See [Off-chain services](/architecture/off-chain-services.md).
* **Keeper service**: fires regime transitions and halt conditions. Those functions are permissionless, the reference implementation is open, and running a keeper is open to anyone.
* **Indexer**: converts chain events into the trade explorer and the execution-quality datasets. A broken indexer can display the wrong thing; settling the wrong thing is beyond it.

## Trust map

| Party                     | Must be trusted for                                          | Cannot do                                                       |
| ------------------------- | ------------------------------------------------------------ | --------------------------------------------------------------- |
| Chainlink                 | Prices and market status that are correct, inside the guards | Move funds; a bad price is bounded by the band and the halts    |
| Robinhood (sequencer)     | Ordering and liveness                                        | Take funds; forced inclusion caps censorship                    |
| Robinhood Assets (issuer) | Stock Token terms and backing                                | Reach the venue's contracts; see [Issuer risk](/risk/issuer.md) |
| Attestation issuer        | Getting eligibility decisions right                          | Price anything, settle anything or hold anything                |
| Icaria Labs (services)    | Uptime and convenience                                       | Misprice a fill, take custody or stop a withdrawal              |
| Timelock multisig         | Parameter changes, publicly, after the delay                 | Move funds, block withdrawals or skip the delay                 |

## Failure stance

Failure has a planned answer in every component: oracles halt, the sequencer has its grace path, services fall back to direct contract calls, and the band keeps parameters bounded regardless. All of them are enumerated in the [Risk framework](/risk/framework.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.useicaria.xyz/architecture/overview.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.