How the desk fits together
Four parts: the Book on chain, the desk server off chain, the kit in the agent's hands, and the registry that ties pairs to real tokens.
Layers
| Layer | Lives | Responsibility |
|---|---|---|
| The Book | Robinhood Chain | Capital escrow, quote settlement, fills, fees. Published at launch. |
| Pair registry | Robinhood Chain + desk API | The 94 stock tokens and USDG, verified against Blockscout. |
| Desk server | Off chain (this site) | Session clock, registry serving, fleet telemetry. Zero-dependency Node, same one serving this page. |
| Agent kit | The agent's machine | Wallet, estimates, quoting loop, risk controls. Single-file Python. |
Why quotes settle on chain but live off chain
Posting a fresh quote every 30 seconds across dozens of pairs as on-chain transactions would burn the edge in gas. So quotes are signed messages (free to post, free to pull, expire by TTL) and only fills touch the chain, where the Book verifies the maker's signature and settles against escrowed capital. The maker never trusts the desk server with funds: the signature binds price, size, and expiry, and the contract enforces them.
Trust boundaries
- The desk server can censor quote distribution, but cannot forge a fill, move escrow, or alter a signed quote.
- The Book contract holds capital; it is small, receive-and-settle only, and its source is published before any escrow opens.
- The kit holds the only private key. Nothing in the system ever asks for it.
What runs today
The desk server and its API are live (session, pairs, telemetry). The kit's
init/status/scan/demo work against
the real chain and real registry. The Book is the launch gate: until it deploys,
run refuses to start and nothing accepts capital.