Discount-rate workflow

The pendle_discount_rate_oracle workflow compares the PT price implied by the smoothed Pendle rate with the price produced by Aave's active PT price-cap adapter. When the difference is material and every guard passes, it publishes one bounded PendleDiscountRateUpdate.

The workflow never calls the adapter itself. The router, AgentHub, and configured discount-rate agent form the execution boundary.

What one run does

1. Read the PT registry entry and stop if it is disabled.
2. Ask the Aave oracle for the PT's current source adapter.
3. Read the adapter's active annual discount rate, immutable maximum rate, and maturity; stop if the PT has matured.
4. Read the latest accepted EmaImpliedRateUpdate.
5. Reject the EMA if either its observation time or source block is stale.
6. Read the AgentHub agent state, last injection time, and active directional range for PendleDiscountRateUpdate.
7. Calculate the target rate and bound the move.
8. Simulate the signed router report and its expected adapter post-state.
9. Submit the report only if the preflight permits it.

All reads use finalized confidence. The adapter must be non-zero, and a missing EMA is an error rather than a bootstrap condition. EMA bootstrapping belongs exclusively to the market-state workflow.

Freshness checks

The same registry value, emaFreshnessSeconds, protects two different clocks:

• Observation age: computedAt - EMA computedAt
• Source-state age: latest finalized source timestamp - EMA source-block timestamp

The workflow skips if either age is greater than the limit. Checking both prevents a recently republished record from disguising old source data.

Decision and movement bounds

Let t be time to maturity in 365-day years, r_ema the smoothed logarithmic implied rate, and d_current the adapter's annual discount rate. The workflow compares:

P_adapter = max(1 - d_current × t, price floor)
P_market  = exp(-r_ema × t)
deviation = (P_adapter - P_market) / P_adapter

d_target  = (1 - exp(-r_ema × t)) / t

It then applies the following gates and bounds:

1. AgentHub delay: skip if the last successful injection for this PT is newer than the agent's minimum delay.
2. Deviation threshold: skip unless abs(deviation) reaches the registry's thresholdBps.
3. Directional step: move from the current rate toward the target by no more than the active RangeValidationModule increase or decrease allowance. An allowance can be absolute or relative to the current rate.
4. Adapter maximum: cap the result at MAX_DISCOUNT_RATE_PER_YEAR.
5. Domain checks: require a positive uint64 rate and a positive pre-maturity linear adapter price.

If the bounded rate equals the current rate, the workflow does not publish. The workflow uses AgentHub's last injected update for its timing gate; it does not infer timing from the latest RiskOracle recommendation.

Guard state

Before calculating a publishable move, the workflow requires:

• a non-zero AgentHub address;
• a registered agent and range-validation module;
• an enabled agent; and
• a non-zero range configuration for PendleDiscountRateUpdate.

Missing or disabled guard wiring produces a no-write result. The on-chain router independently enforces the registered workflow route, report replay protections, throttle configuration, RiskOracle destination, and AgentHub path when the report is simulated and delivered.

Published record and execution

The recommendation is keyed by the PT address.

The report body is wrapped with the consensus timestamp before DON signing. This lets the router reject expired or out-of-order delivery. A successful route publishes the recommendation to RiskOracle and can cause the configured Aave discount-rate agent to call the adapter's setter.

The preflight checks the exact receiver calldata before submission. Where the simulation backend supports state inspection, it also expects the adapter's discountRatePerYear() to equal the recommendation after execution. A rejected simulation produces no write; an unavailable optional simulation stage is surfaced as degraded telemetry.