# LOXLEY ### The open market for executable alpha for autonomous agents **Whitepaper v1.0 — August 2026** *A fork and extension of HALO's economic architecture (Warden Protocol), applied not to compute but to the decision artifact.* --- ## Summary Robinhood opened the road: an MCP server, a dedicated agentic account, an AI-native L2. What is missing is what runs on it. Today every agent plugged into Robinhood starts from zero: it knows nothing, it inherits nothing, and the strategy it applies lives inside the context of a chat session. Alpha is neither distributable, nor verifiable, nor monetisable. **LOXLEY is a permissionless protocol that turns decision artifacts — signals, strategies, tools, risk policies — into onchain assets, with a price, a capacity, an attested performance record and automatic revenue splitting.** An agent discovers an artifact in the registry, subscribes onchain in USDC, calls it as a native MCP tool, and executes it through its Robinhood account. At the end of the epoch, the share of P&L genuinely attributable to each artifact is computed by counterfactual replay and the performance fees are settled to the publisher. Payments are made in USDC. `$LOXL` is the coordination asset: trusted roles stake it, a protocol fee funds a programmatic buyback, and issuance is bounded by verified alpha — not by the calendar. --- ## Table of contents **Part A — The fork** 1. [What HALO gets right, and what we keep](#1) 2. [What HALO gets wrong, and what we fix](#2) 3. [The thesis shift: from compute to the artifact](#3) **Part B — The protocol** 4. [Artifact taxonomy (LIP-1)](#4) 5. [Architecture and actors](#5) 6. [The MCP bridge: Quiver](#6) 7. [Verification: DER and SSA](#7) 8. [Alpha attribution: counterfactual Shapley](#8) 9. [Capacity, congestion and dynamic pricing](#9) 10. [Payment rails and settlement](#10) 11. [Scoring and anti-overfitting](#11) 12. [Economic security: anti-copy, anti-front-run, insurance](#12) **Part C — The token** 13. [Role, fee capture, anti-MEV buyback](#13) 14. [Staking and roles](#14) 15. [Supply, allocation, alpha-gated issuance](#15) **Part D — The rest** 16. [Why this is a multiplier for Robinhood](#16) 17. [Complete end-to-end examples](#17) 18. [Hard edges and failure modes](#18) 19. [Governance and roadmap](#19) --- # Part A — The fork ## 1. What HALO gets right, and what we keep The HALO v1.0 whitepaper is a serious piece of economic engineering. Seven things in it are correct and are carried over as they are, sometimes reinforced. ### 1.1 The stablecoin / coordination token separation HALO puts it better than most: *« Payments stay in stablecoins on purpose. HALO's job is not to be the money. Its job is to make the market trustworthy, and to capture the value that trust creates. »* This is the right architecture. A market whose unit of account is volatile is unusable: nobody can price a strategy at "4 LOXL/month" if $LOXL moves ±40% in a quarter. **LOXLEY keeps this principle in full**: consumers pay in USDC, publishers are paid in USDC, `$LOXL` circulates only inside the trust layer. An important corollary, often missed by competing protocols: **no marketplace user ever needs to touch `$LOXL`**. A quant selling a strategy does not have to understand the tokenomics. That is an adoption condition, not a detail. ### 1.2 The permissionless programmatic buyback The protocol fee fills a bucket; when the bucket crosses a threshold, **anyone** can call `execute()`. No discretionary treasurer, no timing games, no "the buyback has been activated" announcement. The cadence is auditable by everyone. We keep the principle and fix the implementation (§13.3: a naive `execute()` that market-buys on a DEX is sandwichable). ### 1.3 Issuance indexed on usage, not on the calendar *« If the network doesn't work, the network doesn't print. »* That is the best sentence in the paper. The principle — each epoch issues the minimum of the calendar budget and a function of settled volume — is structurally superior to a fixed emission curve. We keep it and harden it (§15.3: gross volume is manipulable, verified alpha much less so). ### 1.4 Settlement by cumulative receipts Settling every call onchain burns the margin on both sides. HALO's design — a single deposit into an immutable vault, a reservation per job, a cumulative receipt signed off-chain at zero cost, then a batched onchain redemption — is the right trade-off. Thousands of calls settle in a handful of transactions, and the fee is taken exactly where the value settles. We keep it and add the missing piece: the **unilateral advance** (§10.3), which resolves the risk of the last receipt never being signed. ### 1.5 Portable, pseudonymous reputation ERC-8004 identity makes an actor's history verifiable and portable, and allows joining the network without capital at risk. That is exactly what a publisher market needs: an anonymous quant with a verified track record must be able to compete with an established shop. We keep it and extend it: at LOXLEY, identity carries not only an honesty score but a **forward-only performance track record** (§11). ### 1.6 No VC allocation and a locked LP Zero venture allocation, a liquidity position locked for 10 years, the full release schedule published at generation including for team addresses. That is the right posture, and it is carried over. ### 1.7 Legibility as an obligation *« With progressive distribution comes an obligation of total legibility. »* Every parameter is a published constant, every flow is an onchain query. We push it further still: at LOXLEY, **an artifact's performance is never a publisher's claim**, it is a protocol computation over signed data. --- ## 2. What HALO gets wrong, and what we fix Eight problems, from the most structural to the most technical. ### 2.1 The product being sold is a commodity This is the underlying problem. **HALO sells inference.** Inference is a perfect commodity: the same model, on the same prompt, at two different operators, produces a substitutable output. On a commodity, the only competitive variable is price, margin tends toward marginal cost, and a 10% protocol fee represents an enormous fraction of the operator's margin. Worse: a 10% fee on a commodity creates a **permanent incentive to route around it**. As soon as two counterparties know each other, they have 10% worth of reasons to go off-protocol. The protocol taxes gross volume, so it taxes what has the least value. > **LOXLEY correction.** We do not tax volume, we tax value created. A two-tier structure: **2% on access flows** (subscriptions, calls) and **15% on performance fees** (§13.1). The fee is low where the product is substitutable, high where there is rent. And above all: routing around becomes self-punishing, because leaving the protocol means leaving the attribution registry, therefore losing your verified track record, therefore losing your pricing power. ### 2.2 Statistical verification is fragile and expensive SPEX rests on a Bloom fingerprint of token IDs and an independent re-run: overlap > 90% = honest, ≈ 1% = fabricated. Three flaws: 1. **The verifier pays the price of the work.** Re-running the inference costs roughly what the inference costs. A network that verifies 100% of its traffic doubles its cost; a network that samples at 1% leaves 99% of the attack surface open. HALO does not publish a sampling rate. 2. **Non-determinism breaks the assumption.** Non-zero temperature, dynamic batching, non-deterministic GPU kernels, different quantization, runtime versions: two honest executions of the *same* model can fall below 90% overlap. The paper announces an "unambiguous gap" between 90% and 1% without publishing the false-positive distribution under realistic conditions. 3. **It does not prove *which* model ran**, only that *a* coherent model ran. An operator serving a cheaper but correlated distilled model passes the test. > **LOXLEY correction.** The product sold here is mostly **deterministic**. A strategy is a function `f(timestamped market state, parameters) → decision`. The replay is **exact**, not statistical: we compare a hash, not an overlap rate. Verification cost close to zero for pure artifacts (§7.1). The statistical fallback is reserved for artifacts that call an LLM, and it is then *priced* into that artifact's fee. ### 2.3 Reputation without capital does not resist sybils HALO claims "reputation, not slashing": a false attestation costs −10 reputation and a 7-day cooldown; honest work earns +1. The attacker's arithmetic is immediate. Creating an ERC-8004 identity costs gas. A fresh identity can therefore issue one false attestation per 7-day cycle, and it is enough to create *n* of them to issue *n* false attestations in parallel. **The marginal cost of dishonesty is the gas of a mint.** Reputation only has deterrent value if acquiring it costs more than betraying it pays — which is only true if honest work is scarce or capital-intensive. Here it is neither. > **LOXLEY correction.** Reputation **and** bond. Reputation stays the primary mechanism — joining as a publisher still requires no capital at risk, so the door stays open to independent quants. But **every role that attests to a monetisable value posts a bond, slashable on objective causes only**: proven replay divergence, falsely declared capacity, non-delivery. Slashing is never discretionary (§14.3). ### 2.4 The blind two-year subsidy *« Years one and two — the budget is a floor. Issuance runs at the scheduled figure regardless of volume. »* 120M then 96M HALO issued no matter what, against 300M in circulation at generation. Translation: over 24 months, **+216M of issuance against an initial circulation of 300M**, with a buyback that is by construction weak for as long as volume is. The paper admits it honestly (*« new supply deliberately exceeds what the buyback retires »*) — but honesty does not change the effect: the period when the token has the least organic demand is exactly when it has the most supply. And guaranteed issuance independent of performance attracts precisely the mercenary capital the paper says it wants to avoid. > **LOXLEY correction.** The unconditional floor lasts **two quarters, not two years**, and decays linearly inside that window. From Q3, issuance is bounded by verified alpha (§15.3). The initial subsidy is directed 100% at **demand** (consumer rebates) and **catalogue bootstrap** (matching on attributed alpha), never at passive staking. ### 2.5 The `execute()` buyback is sandwichable A concrete technical flaw, and a serious one. `execute()` is permissionless, the bucket amount is **public and readable onchain**, and the call executes a market buy on a DEX. So: 1. Bob observes that the bucket has crossed the threshold. 2. Bob submits: `buy HALO` (front) → `execute()` (the protocol buys at the degraded price) → `sell HALO` (back). 3. Bob pockets the slippage the protocol just paid. "Permissionless-ness" is a bug here: it gives the attacker the right to *trigger* the victim at a time of their choosing. The protocol systematically buys at the worst price in the window. > **LOXLEY correction.** Buyback in **oracle-bounded TWAP tranches**, randomised size, unpredictable execution window, gas rebate to the caller, and an execution price capped by a Uniswap v3 TWAP (§13.3). Formalised in §13.3. ### 2.6 No consumer protection A HALO consumer who receives a fabricated output has one avenue of recourse: lower a pseudonym's reputation. They do not get their USDC back. No dispute mechanism, no reserve. That is tolerable when the ticket is $0.003 per prompt. **It is not remotely tolerable when the artifact purchased is steering a portfolio.** A fraudulent artifact does not cost its purchase price, it costs the drawdown it caused. > **LOXLEY correction.** An **insurance reserve** funded by 10% of the protocol fee, covering losses caused by a **proven protocol failure** — artifact diverging from replay, execution not conforming to the manifest, demonstrated publisher front-running. It **never** covers market risk: losing money with an honest strategy that turns out to be wrong is not a claim (§12.4). ### 2.7 Quality is not measured, only honesty SPEX answers "did the operator really run the model?". It does not answer "was the output any good?". On an inference market, that may be acceptable. On a market for financial decisions, it is the only question that matters. > **LOXLEY correction.** Every artifact carries a performance score computed by the protocol, **forward-only** (backtests submitted by the publisher are never scorable), deflated for multiple testing by the **Deflated Sharpe Ratio**, and penalised for crowding (§11). ### 2.8 Two persistent centralised chokepoints The relay and the facilitator are operated by the team. The paper says so and puts federation on the roadmap — but as long as they exist, the "censorship-resistant intelligence" thesis carries an asterisk: the relay sees all traffic, can censor it, and can reorder it. > **LOXLEY correction.** The MCP bridge (Quiver) is **local by default**: it runs on the user's machine, next to their agent, and depends on no relay to function. The protocol has no component capable of censoring a call (§6.3). What remains central — the indexer — is a convenience service, not a critical path: anyone can rebuild it from the onchain logs. ### 2.9 Summary table | Dimension | HALO v1.0 | LOXLEY v1.0 | |---|---|---| | Object of the market | Inference (commodity) | Decision artifact (differentiated) | | Fee | 10% flat on settled volume | 2% access / 15% performance | | Verification | Statistical SPEX (Bloom, ~90%/1%) | Deterministic DER (exact hash) + SSA fallback | | Verification cost | ≈ cost of the work | ≈ 0 for pure artifacts | | Sanction | Reputation only (−10, 7 d) | Reputation + bond slashable on objective causes | | Issuance subsidy | 24 unconditional months | 2 decaying quarters, then gated on alpha | | Issuance gate | Settled volume | Verified attributed alpha | | Buyback | `execute()` market buy | Tranched TWAP, oracle-bounded, randomised size | | Consumer protection | None | Insurance reserve (10% of the fee) | | Quality measure | Binary honest/fabricated | DSR, persistence, capacity, crowding | | Chokepoint | Centralised relay + facilitator | Local bridge, no central critical path | | Hard cap | 2B (of which 500M "unplanned") | 1.5B (of which ~176M unplanned) | --- ## 3. The thesis shift: from compute to the artifact HALO bets that the scarce resource is access to the model. That is a 2024 bet. In 2026, model access is abundant: open weights are 6–12 months behind frontier models, token cost collapses by an order of magnitude a year, and anyone can run a competent model on consumer hardware. **What is scarce is knowing what to do with the model.** In agentic finance, that scarcity has a name and a price: it is alpha. And alpha has three properties that compute does not, which make it a far better market object: 1. **It is measurable ex-post.** A strategy produces a P&L. A P&L is a number, not an opinion. An inference market has to invent a verification; an alpha market inherits one from the real world. 2. **It is rival and capacity-bound.** Two people can use the same model without getting in each other's way. Two people executing the same strategy on the same asset do get in each other's way: market impact degrades the return of both. That rivalry makes dynamic pricing necessary — and profitable (§9). 3. **It is sybil-resistant by construction.** Wash-trading inference volume costs the fee. Wash-trading *alpha* requires actually making money in a market against external counterparties who are not in on it. **You cannot fake profit.** That is the most valuable property in the design, and it is the one used to gate issuance (§15.3). The fork is therefore structural: we keep HALO's economic skeleton — vault + receipts, buyback, gated issuance, portable identity, no VC — and replace the object of the market with the one that makes that skeleton genuinely sound. --- # Part B — The protocol ## 4. Artifact taxonomy (LIP-1 standard) An **artifact** is a packaged unit of decision, addressable onchain, callable by an agent. Four classes, distinguished by their relationship to time and to state. ### 4.1 The four classes | Class | Signature | Deterministic | Typical pricing model | Example | |---|---|---|---|---| | **SIGNAL** | `() → observation_t` | Yes (timestamped data) | Subscription / per read | Cross-exchange funding skew, insider filings flow, 8-K sentiment | | **STRATEGY** | `(state, params) → order[]` | Yes | Perf fee + access | 15-min mean-reversion, sector momentum, vol carry | | **TOOL** | `(input) → output` | Yes | Per call | American options pricer, constrained MVO optimiser, ES calculator | | **POLICY** | `(order, portfolio) → allow/deny/resize` | Yes | Subscription or free | Drawdown circuit breaker, sector exposure cap, blocklist | A fifth, hybrid class exists: **REASONER**, an artifact that calls an LLM (`(context) → analysis`). Non-deterministic, therefore subject to SSA statistical verification (§7.2) and to an explicit verification fee. It is the only class where LOXLEY inherits SPEX's limits — and we isolate it deliberately. ### 4.2 The manifest Every artifact publishes an immutable manifest, anchored by its hash onchain: ```json { "lip": 1, "class": "STRATEGY", "id": "lox:0x7a3f…", "publisher": "erc8004:0x91c2…", "code_hash": "keccak256(wasm_module)", "runtime": "wasm-1.2 | tee-nitro-v3", "inputs": [{"feed": "rh:nbbo:equities", "lag_ms": 0}, {"artifact": "lox:0x4b19…", "share_bps": 800}], "outputs": {"schema": "order_intent_v2"}, "determinism": "strict", "capacity": {"c_max_usd": 40000000, "adv_ref": "20d", "delta": 0.5}, "pricing": {"model": "one_time_licence", "price_usd": 399, "licence": "erc1155", "transferable": true}, "risk_class": "moderate", "disclosure_hash": "keccak256(risk_disclosure.pdf)" } ``` Four fields are worth stopping on. - **`code_hash`** anchors the module. If the code changes, the ID changes: an artifact is never silently mutated under its subscribers' feet. An update is a new artifact with a `supersedes` link, and the subscriber has to consent to migrate. The track record does **not** transfer automatically (§18.3). - **`inputs.artifact`** declares a dependency on another artifact, with the revenue share passed upstream. That is composability (§18.11). - **`capacity`** is a binding declaration: the publisher posts a proportional bond (§14.2), and if realised slippage contradicts the model, `c_max` is cut automatically by the protocol. - **`pricing`** carries the whole cost model, and in v1 it carries a single number: the licence is bought once at `price_usd` and minted to the buyer as a transferable ERC-1155. The `access_usd_epoch` / `perf_kappa_bps` pair that stood in this field earlier described a subscription plus a share of the upside; a v1 manifest can no longer declare either. The fee algebra of §8.4 is retained for the modes that eventually need it, but nothing sold in this market is priced that way — what a publisher earns is the price times the number of buyers. ### 4.3 Onchain representation - The artifact is an **ERC-721** in `ArtifactRegistry`. The NFT owner receives the revenue; ownership is therefore transferable and the artifact is an asset in the full sense. - Publisher identity is **ERC-8004**, portable and pseudonymous, as in HALO. - Access **licences** are semi-fungible **ERC-1155**: one licence = a right to call for a given session, capacity and window. --- ## 5. Architecture and actors ### 5.1 The seven roles | Role | Does what | Stake | Earns | |---|---|---|---| | **Consumer** | A human, or their agent, who subscribes and executes | Optional (fee rebate) | — | | **Publisher** | Publishes and maintains artifacts | Bond ∝ declared capacity | Access + perf fees | | **Executor** | Runs sealed artifacts in a TEE | Mandatory, high | Execution fee | | **Attestor** | Signs timestamped execution traces | Mandatory, medium | Attestation fee | | **Verifier** | Replays and challenges traces | Mandatory, medium | Challenge bounty + share of the slash | | **Curator** | Stakes on artifacts, signals quality | `$LOXL` on a bonding curve | Share of fees from early-curated artifacts | | **Staker** | Locks `$LOXL` | Free, 1 week – 2 years | Share of the buyback flow + governance | ### 5.2 The contracts ``` ArtifactRegistry — mint, manifest, versioning, dependency graph LicenseManager — ERC-1155 issuance, capacity, expiry LoxVault — USDC deposits, cumulative receipts, redemption CapacityAMM — price curve on used capacity (§9.3) AttributionOracle — counterfactual Shapley, publication of the φ (§8) ScoreEngine — DSR, persistence, crowding (§11) BuybackEngine — bucket, tranched TWAP, staker/burn split (§13.3) InsuranceReserve — protocol claims (§12.4) CuratorCurve — curation market Emitter — gated mint, 7-day timelock (§15.3) ``` None of these contracts has a discretionary owner. The only privileged path is replacing `Emitter`, through a public 7-day timelock — carried over from HALO as it stands. ### 5.3 End-to-end flow | # | Step | |---|---| | 1 | The consumer deposits USDC into `LoxVault` and registers a session key | | 2 | The agent queries the registry through Quiver (filters: class, score, free capacity, price, risk_class) | | 3 | The agent subscribes: `LicenseManager` mints an ERC-1155 licence, `CapacityAMM` prices the slot | | 4 | The artifact appears as a native MCP tool in the agent's harness | | 5 | The agent calls the artifact; Quiver checks the licence, executes (local or TEE), emits a signed trace | | 6 | Attestors co-sign the timestamped trace; the hash lands in `AttributionOracle` | | 7 | Quiver applies the active POLICY artifacts; the surviving order is routed to the Robinhood MCP | | 8 | The consumer advances a signed cumulative receipt (off-chain, zero cost) for access fees | | 9 | End of epoch: `AttributionOracle` computes the φ by counterfactual replay | | 10 | `LoxVault` settles: publishers net of fee, fee split buyback / treasury / insurance | | 11 | `BuybackEngine` buys back `$LOXL` in TWAP tranches; split stakers / burn | | 12 | `ScoreEngine` updates DSR, effective capacity and crowding for every artifact | The decisive architectural point: **steps 5 to 7 happen entirely on the user's machine.** The protocol never sees the orders go past. It sees only hashes and, at the end of the epoch, attested P&L. There is no relay to federate because there is no relay. --- ## 6. The MCP bridge: Quiver ### 6.1 The principle Quiver is a local MCP server that sits **between the agent and the Robinhood MCP**. The agent sees exactly one thing: a list of tools. Some of them are the native Robinhood tools (`get_portfolio`, `place_order`…), others are the artifacts the user is subscribed to, exposed with the same schema. ``` ┌──────────────┐ MCP ┌─────────────┐ MCP ┌──────────────────┐ │ Agent │ ─────────► │ QUIVER │ ─────────► │ Robinhood │ │ (Claude, │ │ (local) │ │ Trading MCP │ │ Codex, │ ◄───────── │ │ ◄───────── │ (Agentic Account)│ │ Cursor…) │ └──────┬──────┘ └──────────────────┘ └──────────────┘ │ licences │ signed traces ▼ Robinhood Chain (L2) Registry · Vault · Oracle · Buyback ``` To the agent, a purchased artifact is **indistinguishable from a native tool**. That is the only design that makes adoption frictionless: nothing to integrate, nothing to learn, no SDK. ### 6.2 What Quiver does on every call 1. **Resolves the licence.** Reads `LicenseManager`: is the licence valid, is the subscribed capacity available, is the epoch open? 2. **Executes.** WASM module in a local sandbox for open artifacts; a call to a TEE Executor for sealed artifacts (§12.1). 3. **Attests.** Produces `trace = (artifact_id, input_hash, output_hash, t_ns, market_snapshot_hash)`, signs it, has it co-signed by *k* of *n* attestors. 4. **Applies the POLICY artifacts.** POLICY-class artifacts run last, chained, on the candidate order. A `deny` is terminal. 5. **Routes.** The surviving order goes to the Robinhood MCP. Robinhood executes exactly as it would for any agent — nothing is changed on the broker side. 6. **Accounts.** Increments the cumulative receipt, publishes the trace hash in batches. ### 6.3 Why local by default This is the fix to HALO's chokepoint. There exists no LOXLEY component through which an order is obliged to pass. A malicious protocol operator can neither censor a call, nor reorder it, nor see it. The only residual central service is the indexer — and it is only a cache: all of its content is reconstructible from onchain events by anyone. A hosted version of Quiver exists for users who do not want to run anything. It is **optional**, and its existence does not change the protocol's guarantees for those who do not want it. That is exactly the difference from a mandatory relay. --- ## 7. Verification: DER and SSA ### 7.1 DER — Deterministic Execution Replay For any artifact declared `determinism: strict`, verification is **exact**. The artifact is a pure WASM module: no network access, no clock, no undeclared source of entropy. All of its inputs are explicit and anchored by the `market_snapshot_hash`. Therefore: ```katex der.valid ``` A verifier pulls a trace, re-runs the module, compares a hash. Cost: a few milliseconds of CPU. No threshold, no false positive, no calibration. **Sampling.** Let *p* be the probability that a given trace is challenged, *n* the number of traces an attacker falsifies, *B* their bond, *G* their gain per falsification. They only cheat if: ```katex der.bound ``` Since detecting **one single** false trace slashes the **entire** bond, the right-hand side tends toward *B* as soon as *n* grows, while the left-hand side grows linearly. The security condition is therefore: ```katex der.bond ``` In practice, with p = 0.02 and a bond calibrated at `B ≥ 50 × G_max_per_epoch`, cheating is never rational — and the network's verification cost stays at 2% of execution cost, against ~100% for an exhaustive SPEX. **Challenge window.** 48 rolling hours. Settlement of perf fees is delayed by the same amount (§10.4). A successful challenge pays the verifier 40% of the slashed bond, 40% goes to the insurance reserve, 20% is burned. ### 7.2 SSA — Statistical Signal Attestation For the REASONER class, determinism is lost. We then inherit SPEX's problem — but we handle it better on two counts. **Output constraint.** A REASONER does not return free text: it returns a typed structure (score, class, feature vector). The comparison is therefore not over token IDs but over the **semantic output**. We test coherence by sampling: *m* independent re-runs of the same prompt on the same snapshot, and we compare the challenged output against the empirical distribution. ```katex ssa.z ``` That eliminates SPEX's major flaw: we do not ask whether the *tokens* match (fragile to non-determinism), but whether the *conclusion* falls inside the envelope of what the model honestly produces. **The cost is billed.** A REASONER artifact carries an explicit `verification_surcharge_bps` in its manifest. The consumer sees what they are paying for verification. HALO makes the protocol carry that cost; LOXLEY makes it visible and leaves it to the market. ### 7.3 Anchoring market data The whole of verification rests on the fact that two parties can agree on "what the state of the market was at t". The `market_snapshot_hash` is a Merkle commitment over a signed NBBO snapshot, published by a staked set of attestors, at a resolution of 100 ms. A delicate point, handled in §18.7: artifacts sensitive to microstructure below 100 ms are not reliably attributable and are flagged `attribution: best_effort` in the registry — they can be sold by subscription, not on a perf fee. --- ## 8. Alpha attribution: counterfactual Shapley This is the heart of the protocol, and the part HALO has no equivalent for — because an inference output does not "cause" anything measurable. ### 8.1 The problem An agent runs over an epoch with a basket of *n* active artifacts. It produces a P&L of Π. Question: **what share of Π belongs to which artifact?** This is not an accounting question, it is a causal one, and it has traps: two redundant signals do not create the alpha twice; a POLICY that blocked the worst loss created value without ever generating an order; a TOOL used once may have determined all of the sizing. ### 8.2 The construction Let A = {a₁ … aₙ} be the basket. We define the **counterfactual value function** *v(S)* for S ⊆ A: the P&L obtained by replaying the agent over the epoch with only the artifacts in S active, all the others replaced by their **neutral baseline** (for a SIGNAL: the historical median value; for a POLICY: `allow`; for a STRATEGY: no order; for a TOOL: the open-source reference implementation). The Shapley value of artifact *i* is: ```katex shapley.exact ``` It satisfies the four axioms that matter here: - **Efficiency**: Σφᵢ = v(A) − v(∅). All the value created is distributed, no more and no less. - **Symmetry**: two interchangeable artifacts receive the same share. Two redundant signals split one contribution, they do not double it. - **Null player**: an artifact with no marginal effect receives 0, even if it was called a thousand times. **Call count does not pay; effect pays.** - **Additivity**: the φ aggregate cleanly across sleeves and epochs. ### 8.3 Monte-Carlo estimation 2ⁿ replays is impractical. We estimate by random permutations: for permutation π, let Pᵢ^π be the set of artifacts preceding *i*. ```katex shapley.mc ``` An unbiased estimator. With Δ = the range of marginal contributions, the Hoeffding bound gives the number of permutations needed for precision ε at confidence 1 − η: ```katex shapley.hoeffding ``` **Protocol parameters:** n ≤ 8 artifacts per sleeve (beyond that, the agent has to segment), m = 512, ε targeted at 1% of |Π|, η = 0.01. Cost: ~4,096 deterministic replays per sleeve per epoch, meaning a few seconds of CPU — because the replays are pure WASM over already-anchored data. The bound is published alongside the φ, so **attribution uncertainty is a visible number**, not a black box. ### 8.4 From φ to the performance fee Naively, `Fᵢ = κᵢ · max(0, φᵢ)`. That is wrong, and the trap is a classic one: if one artifact has φ = +100 and another φ = −90, Π = +10, but the naive fee would be charged on 100. The consumer would pay performance fees ten times their gain. Hence **netting**, the **high-water mark**, and the coverage cap: ```katex fee.perf ``` with `φᵢ⁺ = max(0, φᵢ)`, `Π_e⁺ = max(0, Π_e)` the epoch's net P&L, `W_e` the sleeve value at the end of the epoch and `HWM` the highest level reached on which fees have already been taken. Three guarantees follow, and they can be written into the contract in black and white: 1. **Σᵢ Fᵢ ≤ Π_e⁺.** The total of performance fees never exceeds the epoch's actual gain. Ever. 2. **No fee below the HWM.** An artifact does not get paid twice for recovering a loss it caused. 3. **No fee on a negative epoch.** If the sleeve loses, nobody collects a perf fee — not even the artifact that did good work. Harsh, but it is the only rule that stops a publisher selling a "hedge" artifact whose sole function is to generate a positive φ inside losing sleeves. ### 8.5 Crediting POLICY artifacts A POLICY never generates an order, so its φ is zero under a naive attribution — even though it may be the most valuable artifact in the basket. The counterfactual construction settles this naturally: a POLICY's baseline is `allow`, so *v(S)* without it includes the orders it would have blocked. If it blocked a $50k loss, its φ is +$50k. That is an important and non-trivial property: **LOXLEY creates the first market where prudence can be sold.** An experienced risk manager can publish `DrawdownSentry`, never generate a single order, and be paid exactly for the losses they avoided. --- ## 9. Capacity, congestion and dynamic pricing ### 9.1 Alpha degrades with capital This is the most robust law in quantitative management, and no strategy marketplace implements it. A strategy that returns 30% on $1M does not return 30% on $500M: market impact eats the return. Square-root impact model (Almgren–Chriss, extensively validated empirically): ```katex impact.alpha_net ``` where *C* is the capital deployed on the artifact (across all subscribers), *ADV* the average daily volume of the traded universe, λ an impact coefficient estimated by the protocol from real fills. Total profit in dollars is `Π(C) = C · α_net(C)`, maximised at: ```katex impact.cstar ``` For δ = 0.5: **C\* = ADV · [α₀ / (1.5 λ)]²**. Beyond C\*, every additional dollar subscribed *destroys* value for the whole subscriber base. ### 9.2 Why this is an economic problem, not a technical one Without a mechanism, the equilibrium is catastrophic: the publisher has every incentive to sell beyond C\*, because they collect access from every subscriber but bear none of the degradation. It is a classic tragedy of the commons, and it is what kills every "copy-trading" service after 18 months. ### 9.3 The CapacityAMM The protocol sells capacity as a scarce resource, on a convex curve. ```katex capacity.price ``` Acquisition cost of a slice running from u₁ to u₂ for capital C_max: ```katex capacity.cost ``` Three effects, all desirable: - **The price rises as the artifact gets good.** The alpha rent goes to the publisher, not to the first arrival who resells it. - **Over-subscription is prohibitive.** As u → 1, p → ∞. A strategy cannot be drowned. - **Exits free capacity and bring the price down.** The market breathes. ### 9.4 Automatic capacity reduction `c_max` is declared by the publisher, who posts a proportional bond. The protocol continuously compares realised slippage on attested fills against the slippage predicted by the model. If the gap is significant over a rolling window of 20 business days: ```katex capacity.cut ``` The significance test is a t-test on the impact residuals, threshold α = 0.01. Below it, no action — we do not want a noisy week to demote a good artifact. Above it, capacity is cut, marginal subscriptions are refunded pro rata out of the publisher's bond, and the event is written into the track record. **A capacity declared too high therefore costs money.** That is the mechanism that makes `c_max` an honest piece of information rather than a marketing claim. --- ## 10. Payment rails and settlement ### 10.1 The vault Carried over from HALO, with the same properties: a single USDC deposit into an immutable contract, a registered session key, reservations tied to a publisher, cumulative receipts signed off-chain at zero cost, batched onchain redemption. EIP-712 structure of the receipt: ```solidity struct Receipt { bytes32 sessionId; address publisher; uint64 cycle; uint256 cumulativeAmount; // monotonically increasing uint64 nonce; bytes32 traceRoot; // Merkle root of the covered traces } // domainSeparator = keccak256(name, version, chainId, verifyingContract) ``` Strict monotonicity: the contract only accepts a receipt if `cumulativeAmount > lastRedeemed[sessionId][publisher]`. The publisher redeems the difference: ```katex vault.net ``` The `traceRoot` is the addition relative to HALO: it binds the amount to verifiable traces, which makes a receipt contestable *a posteriori* during the challenge window. ### 10.2 Budget mode As in HALO, an alternative Permit2 rail for consumers who prefer an authorisation bounded to a forecast deposit. Same semantics: global budget + per-settlement caps. ### 10.3 The unilateral advance — the last-receipt flaw A flaw untreated in HALO: the operator delivers the work **before** receiving the signed receipt. A consumer who simply stops signing gets the last batch of work for free. The paper mentions "reservations" that cover the job, but describes no settlement path if the consumer does not cooperate. LOXLEY closes it: 1. Every session opens a **reservation**: an amount of USDC locked in the vault, capping the publisher's exposure. 2. If the consumer does not countersign within a delay Δ = 24 h, the publisher can call `advanceUnilateral(traceRoot, attestations)`. 3. The contract verifies *k* of *n* attestor signatures (k = 3, n = 7) certifying that the traces exist and that their DER is valid. 4. The amount is drawn from the reservation, capped at `min(reservation, value of the attested traces)`. 5. The consumer has 48 h to challenge with a divergent replay. If they win, the publisher is slashed and the consumer is refunded. The result: **neither party can withhold the other's value.** Not the publisher (the replay is verifiable), and not the consumer (the advance is enforceable). ### 10.4 Settlement calendar | T | Event | |---|---| | End of epoch | Traces frozen, φ computed by `AttributionOracle` | | +0 h → +48 h | Challenge window open | | +48 h | Finalisation; access and performance fees settled | | +48 h | Fee split: 75% buyback / 15% treasury / 10% insurance | | +48 h → +7 d | `BuybackEngine` executes in randomised TWAP tranches | | +7 d | Distribution to stakers, burn of the burn share | --- ## 11. Scoring and anti-overfitting ### 11.1 Rule zero: backtests do not count A publisher may attach a backtest to their manifest. It **never** enters the score. Reason: a backtest is an object that has been iterated on until it looked good. The protocol scores only **forward** performance, from the artifact's mint date, on attested traces. An accepted consequence: a new artifact starts at zero score and has to accumulate time. That is a real entry cost, and it is intentional — it is what makes the score expensive to fabricate. ### 11.2 The deflated Sharpe The raw Sharpe of an artifact selected from among many others is biased upward: that is the multiple-testing problem, and it is massive on a marketplace where thousands of artifacts are published. The protocol applies the **Deflated Sharpe Ratio** (Bailey & López de Prado). Let ŜR be the Sharpe observed over T observations, γ₃ the skew and γ₄ the kurtosis of the returns: ```katex score.dsr ``` where SR\*, the expected maximum threshold over N independent trials, is: ```katex score.srstar ``` with γ ≈ 0.5772 (Euler–Mascheroni) and N the number of effective trials. **The subtlety that decides everything.** N is not declared by the publisher — they would lie. The protocol estimates it from the registry: the number of artifacts from the same publisher, the number of `supersedes` variants in the same family, and **the number of correlated artifacts of the same class over the same universe** (return correlation > 0.7 over the common window). Publishing twenty variants of a strategy in order to keep only the best therefore does not work: all twenty count toward N, and the survivor's DSR collapses. DSR reads as a probability: DSR = 0.95 means "95% chance that the true Sharpe is positive given the number of trials". The registry displays DSR, not Sharpe. ### 11.3 Persistence A high Sharpe over a short window is worth nothing. We measure stability by the rank correlation of the artifact's returns between disjoint sub-periods: ```katex score.persistence ``` A negative P — the artifact works when it used to fail and vice versa — is the classic sign of overfitting, and it is penalised more harshly than a P of zero. ### 11.4 Crowding The score falls as capacity fills, because the marginal return of the next subscriber falls: ```katex score.crowd ``` ### 11.5 The composite score ```katex score.composite ``` where `V_attrib` is cumulative attributed alpha in dollars and `Incidents` counts lost challenges, capacity reductions and manifest deviations. The weights are governable constants, bounded to ±50% of their initial value. ### 11.6 Registry anti-survivorship A subtle trap most platforms ignore: if losing artifacts de-list themselves, the registry average rises artificially, and the relative score of a mediocre artifact looks good. LOXLEY **keeps withdrawn artifacts in the computation of the reference distributions**, with their performance up to withdrawal, for 36 months. The registry publishes two numbers: the score, and the percentile *including the dead*. --- ## 12. Economic security ### 12.1 Anti-copy: three regimes The existential problem of a strategy marketplace: *I buy once, I copy the code, I leave.* **Regime 1 — SEALED (TEE).** The module runs at a staked Executor, inside an attested enclave (Nitro Enclaves / SGX). The agent receives the signal, not the code. The `code_hash` is verifiable through the enclave attestation without the code being readable. Cost: +20–80 ms latency, an execution fee. Suited to valuable STRATEGY and SIGNAL artifacts. **Regime 2 — OPEN.** The code is public. The publisher does not sell the secret, they sell the **maintenance**: continuous parameter re-fitting, adaptation to the market regime, responsibility for capacity. It is the open-source model applied to alpha, and it is viable because a frozen strategy decays — copying the code is copying a photograph of a moving object. **Regime 3 — WATERMARKED.** The publisher injects a controlled deviation on a fraction *q* of the decisions (canaries) — a slightly different order, economically undetectable but statistically identifiable. Detection: let *x* be the number of coincidences between a suspect agent's decisions and the canaries, over *n* observations. Under H₀ (no copying), the coincidence rate is p₀ (the base rate of unrelated agents making the same choice). Under H₁, it is p₁ > p₀. The likelihood ratio test: ```katex wash.llr ``` The number of observations needed for a given power is governed by the Kullback-Leibler divergence: ```katex wash.n ``` Concretely, with p₀ = 0.05, p₁ = 0.60 and α = 10⁻⁶, D_KL ≈ 1.29 and **n ≈ 11 observations suffice**. Eleven canaries — a few days of trading — give proof at one in a million. The watermark is committed to the protocol in commit-reveal before use, so the publisher cannot invent it after the fact. ### 12.2 Anti-front-running by the publisher An obvious risk: the publisher knows their signal before their subscribers and can position ahead of them. It is fraud mode number one in signal services. **Mandatory commit-reveal.** The publisher publishes `H = keccak256(signal ‖ salt ‖ t₀)` at t₀, reveals at t₀ + δ. Their own fills — their wallet is declared and bound to their ERC-8004 identity — are examined over the window. Front-running score over the *n* signals of an epoch: ```katex frontrun.fr ``` where *q* is the quantity traded by the publisher before reveal and *r* the instrument's return over the window. Under H₀ (no front-running), E[FR] = 0. The protocol tests: ```katex frontrun.t ``` Two consecutive epochs, not one: we do not slash on noise. And the publisher can declare `self_trading: none` and bind a single wallet — in which case verification is trivial and their score benefits. ### 12.3 Anti-wash Issuance is gated on verified attributed alpha, not on volume (§15.3). To inflate alpha, one would have to **actually make money** on external markets against counterparties who are not complicit. The cost of a wash is then the P&L that would have to be manufactured, plus execution fees, taxes and spread. **It is the strongest sybil-resistance mechanism a protocol of this kind can have**, and it is free: it is a gift of the product's structure. A complementary guard against circular trading (two complicit accounts transferring P&L to each other): attribution is only valid if the fills were executed against an external book, which the `market_snapshot_hash` and the Robinhood confirmations make verifiable. ### 12.4 The insurance reserve Funded by **10% of the protocol fee**, plus 8% of initial supply (§15.2). **Covers:** proven DER divergence, execution not conforming to the manifest, demonstrated publisher front-running, failure of a TEE Executor, failure to apply a subscribed POLICY. **Does not cover:** market risk. An honest strategy that loses money is not a claim — that is the product working as announced. This boundary is written into the contract and is not governable, because it is exactly where a reserve of this kind drifts into an implicit return guarantee. Payout, with a per-claim cap and pro rata in case of epoch over-subscription: ```katex insurance.payout ``` The claim is first paid out of the slashed bond of the actor at fault; the reserve only steps in on top. `cap` is set at 2% of the reserve per individual claim, so that a single event cannot empty it. ### 12.5 Risk constraints enforced by Quiver The user signs a policy Π that Quiver applies before any routing to Robinhood. It is independent of the purchased POLICY artifacts — it is the floor, they are the refinement. ```katex risk.policy ``` Expected Shortfall constraint, evaluated on a signed covariance snapshot: ```katex risk.es ``` And a sizing cap derived from Kelly, computed on the artifact's attested moments: ```katex risk.kelly ``` Quarter-Kelly is a deliberately conservative choice: full Kelly maximises asymptotic growth but with drawdowns that are intolerable in practice and extreme sensitivity to estimation error in μ. An artifact cannot ask for more. **Kill-switch.** An onchain transaction revokes every licence in a session. It is complementary — not a substitute — to Robinhood's "disconnect" button, which remains the user's sovereign recourse. --- # Part C — The token ## 13. Role, fee capture, buyback ### 13.1 The two-tier fee structure This is the central correction to the HALO model. | Flow | Fee | Rationale | |---|---|---| | **Access** (subscriptions, calls, capacity) | **200 bps** | Competitive market, thin margins, high volume. A low fee removes the incentive to route around. | | **Performance** (fees on attributed φ) | **1,500 bps** | Alpha rent. This is where the protocol created the value — through attribution, verification and capacity allocation. It captures a share of it. | Average effective fee: ```katex fee.effective ``` A young marketplace is dominated by V_a: φ_eff ≈ 2–4%, well below HALO's 10%, therefore very competitive. A mature marketplace shifts the mix toward V_p: φ_eff climbs toward 8–12%. **The protocol becomes expensive exactly when it becomes indispensable**, and never before. ### 13.2 The fee split ``` Protocol fee (100%) ├── 75% → Buyback bucket ├── 15% → USDC treasury (runway; never sells a token) └── 10% → Insurance reserve ``` The bucket is then split at execution: **65% to stakers, 35% to burn**, a governable dial bounded to [20%, 80%] burn, as in HALO. Net effect per dollar of perf fee: 15% × 75% = **11.25% of buy pressure** on `$LOXL`, of which 7.31% to stakers and 3.94% burned. Per dollar of access: 1.5% of buy pressure. ### 13.3 The anti-MEV buyback HALO's `execute()` is sandwichable (§2.5). LOXLEY replaces it with a tranched buyback, oracle-bounded, at randomised size. When the bucket crosses the threshold, it is not spent all at once. It is cut into *K* tranches executed over a window W, and each tranche is: ```katex buyback.tranches ``` The random draw is derived from `keccak256(blockhash(n−1) ‖ bucketNonce)` — not prevrandao alone, to limit proposer manipulation. Four properties: 1. The sandwicher knows neither the exact size nor the exact block of each tranche. Their expected gain collapses because they have to tie up capital over an uncertain window. 2. The oracle bound makes the sandwich **self-defeating**: if it pushes the price beyond +100 bps of the 30-minute TWAP, the transaction *reverts* and they paid gas for nothing. 3. The buyback executes closer to the average price than to the worst price in the window. On an annual buyback of N dollars, a slippage saving of 40 bps represents 0.004·N recovered — not trivial at scale. 4. The caller stays permissionless and receives a gas rebate marked up by 5%, so that someone always does it. ### 13.4 What `$LOXL` is not It gives no right to publisher revenue. It gives no claim on the treasury. It confers no voting right over individual artifacts. What it captures, it captures through an open market mechanism — a DEX buyback anyone can watch and front — and not through a distribution. --- ## 14. Staking and roles | Role | Stake | Function of the stake | Earns | |---|---|---|---| | **Staker** | Free, 1 week – 2 years | Weight ∝ duration | 65% of the buyback flow + governance | | **Publisher** | `S ≥ β · c_max · p₀`, β = 5% | Backs the declared capacity | Access + perf fees | | **Executor (TEE)** | High, fixed tier | Covers the maximum claim of an enclave | Execution fee | | **Attestor** | Medium | Covers false attestations | Attestation fee | | **Verifier** | Medium | Covers frivolous challenges | 40% of the slashed bond | | **Curator** | Bonding curve | Signals quality, absorbs risk | Share of fees from early-curated artifacts | | **Consumer** | Optional | — | Rebate tiers on φ_access | ### 14.1 Staking weight ```katex stake.weight ``` Log rather than linear: a 2-year lock weighs ~4.7× a one-week lock, not 104×. A linear multiplier on duration creates an oligarchy of patient whales and empties governance of everyone else. Locked positions are transferable NFTs: committed capital keeps secondary liquidity without unlocking supply. Carried over from HALO, it is good design. ### 14.2 The publisher bond `S ≥ β · c_max · p₀` with β = 5%. A publisher declaring $40M of capacity at p₀ = 25 bps posts `0.05 × 40M × 0.0025 = $5,000` in `$LOXL`. Enough to make over-declaration expensive, low enough not to shut out an independent quant. ### 14.3 Slashing: objective causes only Every slash cause is **provable by computation**, never by vote: | Cause | Proof | Slash | |---|---|---| | DER divergence | Replay producing a different hash | 100% of the bond | | False attestation | Attested trace invalidated by replay | 100% of the bond | | False capacity | Slippage t-test, α = 0.01, 20 d | 25% + c_max reduction | | Publisher front-running | FR score, t > 3, two epochs | 50% + demonetisation | | Executor non-delivery | Missing enclave attestation | 10% per incident | | Frivolous challenge | Replay confirming the trace | 5% of the verifier's bond | Distribution of a slash: 40% to the discoverer, 40% to the insurance reserve, 20% burned. No governance can slash. No multisig can slash. **If a replay can't prove it, it can't be slashed.** That is the only way to have slashing without arbitrariness — the legitimate objection HALO raises against slashing systems, which we answer with a proof constraint rather than by abandoning the mechanism. --- ## 15. Supply, allocation, issuance ### 15.1 Parameters - Initial supply: **1,000,000,000 `$LOXL`** - Hard cap: **1,500,000,000**, enforced by the contract on every mint - No owner, no discretionary mint; only `Emitter` can issue, replaceable through a public 7-day timelock - **No venture allocation** - Budgets measured on **cumulative-ever-issued**, never on current supply: burned tokens are never re-issued (carried over from HALO — a good clause, often forgotten) ### 15.2 Allocation | Bucket | % | `$LOXL` | At generation | Notes | |---|---|---|---|---| | Community & Publishers | 40% | 400,000,000 | 6.00% | Seasons gated on verified alpha; catalogue bootstrap | | Core Contributors | 20% | 200,000,000 | — | 12-month cliff, then linear 24-month vest | | Treasury | 20% | 200,000,000 | 5.00% | 25% at TGE, remainder linear over 12 months | | Liquidity & MM | 12% | 120,000,000 | 12.00% | LP locked for 10 years | | Insurance reserve | 8% | 80,000,000 | — | Locked, released only on a proven claim | | **Circulating at TGE** | | **230,000,000** | **23.00%** | | Differences from HALO, all deliberate: - Core at 20% instead of 25%; - Community at 40% instead of 35%, because the catalogue is the product and publishers are the ones who build it; - An 8% insurance bucket, which does not exist in HALO, and which is the counterpart to the fact that we are handling people's capital; - Initial circulation of 23% instead of 30%, consistent with a shorter issuance floor. ### 15.3 Alpha-gated issuance Year 1 budget: **90M `$LOXL`**, decaying 25%/year. | Year | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | |---|---|---|---|---|---|---|---|---| | Cap (M `$LOXL`) | 90.0 | 67.5 | 50.6 | 38.0 | 28.5 | 21.4 | 16.0 | 12.0 | Cumulative ≈ 324M over eight years. With the initial supply of 1B, that leaves **~176M of the hard cap permanently unplanned** — no schedule exists to issue them. **The per-epoch issuance rule:** ```katex emission.cap ``` - `B_e`: the epoch's share of the annual cap. - `Ψ_e`: **the dollar value of the buyback executed over the epoch**, itself derived from the fee, itself derived from **verified attributed alpha**. θ = 1.0. - `F_e`: the unconditional floor, **active only over the first two quarters**, decaying linearly from 100% to 0% of the epoch's budget: ```katex emission.floor ``` The difference from HALO is major. In HALO, the gate is on **settled volume**, which is manipulable: an attacker can wash-trade inference between two accounts they control, pay 10% in fees, and recover issuance exceeding that fee if the token is valued highly enough. In LOXLEY, the gate traces back to **attributed alpha**, which requires making money against external counterparties. The wash is no longer a tax to pay, it is a performance to produce — and if the attacker can produce that performance, they no longer need to attack. ### 15.4 Direction of issuance Issuance funds what is scarce. What is scarce is not supply — publishing an artifact is free — it is **qualified demand and a verified catalogue**. | Destination | Share | Mechanism | |---|---|---| | Consumer rebates | 40% | Reduction of the effective access cost for active agents | | Publisher bootstrap | 30% | Matching on **attributed and verified** alpha, never on sign-ups | | Trust layer | 15% | Attestors, verifiers, executors | | Curation | 10% | Bonding curve, decaying over time | | Insurance | 5% | Recapitalisation of the reserve | The rebate is self-funding within the gate: it spends new `$LOXL` and returns settled volume; that volume pays the fee; the fee buys back `$LOXL`. Within the bound, the buyback retires what the rebate issues. **Zero issuance to passive staking.** In HALO, stakers are funded by the subsidy for as long as it lasts. That is what attracts the mercenary capital that leaves the day it stops. In LOXLEY, what a staker receives comes from the buyback, therefore from the fee, therefore from alpha — from day one and forever. The yield is small at the start. That is honest, and it is the only number that does not lie. ### 15.5 Circulating supply | Checkpoint | TGE | +3M | +6M | +12M | +24M | +36M | |---|---|---|---|---|---|---| | % of initial supply | 23.0% | 27.5% | 32.0% | 41.0% | 55.0% | 66.5% | Excluding gated issuance and excluding the 34% of the community bucket distributed in seasons against verified alpha — therefore against demonstrated demand, never on a calendar. --- # Part D ## 16. Why this is a multiplier for Robinhood Robinhood spent 2026 building end-to-end agentic infrastructure: the Trading MCP opened to third-party agents on 27 May, the Agentic Credit Card, the Robinhood Chain mainnet on 1 July on the Arbitrum stack, then the extension of agentic trading to crypto on 20 July. The positioning is explicit — an "AI-native" L2, stock tokens, perps, onchain lending — and Vlad Tenev's formulation sums up the thesis: the democratisation mission now extends to agents. **Robinhood built the road. LOXLEY builds what runs on it.** Six reasons this serves them directly. ### 16.1 It fills the layer Robinhood cannot fill itself Robinhood's disclosures are unambiguous: *« Robinhood does not control, supervise, monitor, recommend, or audit these AI agents. »* That is not drafting caution, it is a necessary regulatory position. Recommending, selecting or rating strategies would turn Robinhood into an adviser, with the corresponding liability regime. Yet that is exactly what users need: a way to know which strategies are worth anything. An open, neutral, verifiable protocol **provides that ranking without Robinhood having to endorse it** — because the score is not an editorial opinion, it is the result of a public computation over attested data, run by a third-party protocol in which Robinhood has no privileged role. The relationship is symbiotic and clean: Robinhood provides execution and compliance, LOXLEY provides the content and its measurement. Neither takes the other's risk. ### 16.2 It multiplies routed volume Every subscribed artifact is a source of recurring orders through the Agentic Account. A passive agentic account — the user talks to their agent when they think of it — generates a handful of orders a month. An account subscribed to a basket of artifacts with scheduled rebalancing runs continuously. The effect is multiplicative, not additive: a user does not subscribe to an artifact, they compose a basket. And the basket rebalances. ### 16.3 It gives Robinhood Chain productive usage Robinhood Chain's first month was dominated by memes: according to Artemis measurements at the end of July, meme pairs accounted for roughly $297M of daily DEX volume, about 75% of the total, against roughly $36M for stock token pairs, about 9%. An artifact marketplace generates a structurally different kind of transaction: artifact mints, licences, capacity curves, attribution oracles, perf fee settlements, buybacks. **Volume backed by production, not by rotation.** That is precisely the kind of activity a chain positioned as "AI-native for RWAs" needs to be able to show. ### 16.4 It creates a real cost of leaving Robinhood's agentic account is today weakly differentiated: the model is BYOA, the agent lives on the user's machine, and nothing stops them plugging it into another MCP broker tomorrow. A user with 12 months of attribution, a basket of licences, reserved capacity on five artifacts and a verified agent track record has a real cost of leaving — not because they are locked in, but because **what they built is worth something where they built it**. That is retention by asset accumulation, not by friction. ### 16.5 It turns the creator ecosystem toward Robinhood Every quant who publishes a profitable artifact has a direct financial reason to recruit users onto Robinhood, because their capacity only monetises if it fills. The protocol creates a distributed sales force, paid on performance, that Robinhood has neither to recruit nor to pay. It is the App Store effect, with one favourable difference: on an App Store, quality is declarative and discovery is a curation problem. Here, quality is **measured** and the ranking happens on its own. ### 16.6 It hardens the risk profile of agentic trading The obvious reputational risk of the agentic product is the spectacular drawdown of a user whose agent went wrong. Robinhood documents it honestly in its disclosures, but documenting it does not prevent it. POLICY artifacts and the risk constraints enforced by Quiver (§12.5) are an **additional** protection layer, installed by the user, executed before the order reaches Robinhood. An ecosystem where the guardrails are objects you can buy, compare and see rated is an ecosystem where accidents are less frequent — and where the broker is not the one who had to arbitrate. --- ## 17. Complete end-to-end examples ### 17.1 Marie publishes a STRATEGY Marie is a quant at a systematic fund. She has an intraday mean-reversion strategy on US large caps that works, but whose capacity is too small to interest her employer. **Publication.** She compiles her strategy to WASM. Manifest: `class: STRATEGY`, `determinism: strict`, `runtime: tee-nitro-v3` (SEALED regime — she does not want to publish the code), `c_max: $40M`, `pricing: {model: one_time_licence, price_usd: 399}`. She posts a bond of $5,000 in `$LOXL`. **Score build-up.** Months 1–3: zero score, a few early adopters and curators. The protocol accumulates attested traces. Month 4: first DSR publication. Raw Sharpe of 1.42, but Marie published three variants — N estimated at 3, plus two correlated artifacts from other publishers. SR\* ≈ 0.61, T = 84 days. **DSR = 0.78.** Honest, not exceptional. **Capacity filling.** At u = 0, the slot costs p₀ = 25 bps. At u = 0.6 with γ = 1, it costs `25/(1−0.6) = 62.5 bps`. The last 10% of capacity costs 5× the first dollar. Those who arrive late pay for the scarcity. **One epoch.** $28M subscribed, 14 agents. The average sleeve does +2.1% over the month. For a subscriber with $200k allocated, Π = +$4,200. The counterfactual Shapley attributes φ = +$3,100 to Marie's strategy (the rest goes to a vol SIGNAL and a sizing POLICY). Performance fee: `0.12 × 3,100 = $372`. Marie receives `372 × 0.85 = $316.20`. The protocol takes `$55.80`, of which 41.85 to the buyback bucket, 8.37 to the treasury, 5.58 to insurance. Across the 14 subscribers, Marie makes roughly $4,400 over the month. That is not enormous. It is recurring revenue on code she wrote once, with no fundraising, no legal structure, and not a single client to pitch. **Month 9.** Crowding rises: u = 0.88, the score falls by 0.15. Realised slippage exceeds the model. The t-test crosses the threshold, `ĉ_max` is cut to $31M, marginal subscriptions are refunded from the bond. Marie loses revenue — and her remaining subscribers recover return. **The mechanism worked exactly as it should: against the seller, for the buyer.** ### 17.2 A dev publishes a SIGNAL An independent developer scrapes perp funding rates from eight exchanges and publishes `FundingSkew-8x`, which exposes the z-score of cross-exchange skew across 40 pairs. He takes no market risk, makes no return promise, advises nothing. He sells an **observation**: $19 per epoch, unlimited access, no perf fee, no capacity constraint (an observation signal has no market impact). 820 subscribers at month 6 = **$15,580/month**, less the 2% protocol fee. The work is maintaining the connectors. A signal like this also has attribution value: when an agent uses it, the Shapley attributes it a share of the P&L, which builds its score and its visibility — even without a perf fee. That is the mechanism by which a cheap but useful artifact climbs the ranking. ### 17.3 A risk manager publishes a POLICY A former risk manager publishes `DrawdownSentry`: `(order, portfolio) → allow | resize | deny`, with a rolling drawdown budget, progressive de-escalation of sizing when intraday drawdown exceeds 60% of the budget, and a hard `deny` at 100%. He publishes it **free**. No access fee, no perf fee. His revenue comes from two sources: 1. **Bootstrap issuance** (§15.4), matched on attributed alpha. In March, `DrawdownSentry` blocked $2.4M of aggregate losses across 3,100 sleeves. The Shapley attributes those $2.4M to it as positive, which makes it one of the highest attributed-alpha artifacts of the month — therefore one of the largest shares of the bootstrap bucket. 2. **The curators** who staked on it early and share the upside. This example is worth underlining because it has **no equivalent** in the HALO design or in any existing copy-trading service: **prudence can only be monetised if avoided losses can be measured.** The counterfactual replay is what makes that possible. ### 17.4 A REASONER A small team publishes `EarningsCallParser`: it takes a call transcript, calls an LLM with a proprietary prompt, and returns a typed structure — `{guidance_delta, hedging_score, tone_shift, confidence}`. `class: REASONER`, `determinism: none`. Verification by SSA (§7.2): m = 12 sampled re-runs, z-test on the challenged output. Price: $0.40 per call, of which `verification_surcharge: 300 bps` is explicitly displayed. Roughly 40,000 calls over an earnings season = **$16,000 per quarter**. The artifact is called by agents that have neither the prompt nor the appetite to build one. ### 17.5 A bundle A curator composes `Conservative Income Sleeve`: four artifacts (a vol carry STRATEGY, a credit quality SIGNAL, a constrained optimisation TOOL, `DrawdownSentry`), with a revenue split declared in the manifest. The user subscribes to **one** object. The protocol settles internally: the Shapley computes the φ of the four components, each publisher is paid on theirs, and the curator takes a bundling commission of 150 bps on the total. The dependency graph is explicit, and cycle detection prevents pathological recursive compositions (§18.11). ### 17.6 The complete user journey Léa has $40,000 in a Robinhood agentic account. She has Claude plugged into her MCP and Quiver installed locally. > **Léa:** I want income, moderate risk, no more than 8% drawdown. Find me artifacts and compose something. The agent queries the registry: ``` filter: class ∈ {STRATEGY, SIGNAL, POLICY} risk_class ≤ moderate DSR ≥ 0.70 persistence P ≥ 0.25 capacity_free ≥ 40,000 USD access_cost_epoch ≤ 60 USD rank: R desc, pairwise correlation ≤ 0.55 ``` It comes back with a basket of five artifacts costing $291 in total — five licences, bought once — a maximum pairwise correlation of 0.41, and a modelled drawdown contribution of 6.2%. Léa approves. The agent buys onchain (one transaction, five ERC-1155 licences minted, nothing to renew), signs the risk policy `Π = (N_max: 40k, DD_max: 8%, ES_95 ≤ 3%/day, blocklist: leveraged ETFs)`, and starts running. For every order: the artifact produces an intent → Quiver applies `DrawdownSentry` then Léa's policy → the surviving order goes to the Robinhood MCP → Robinhood executes and pushes a notification to Léa, exactly as it would for any agent. End of month: Π = +$1,340. Attribution: φ₁ = +820, φ₂ = +410, φ₃ = +290, φ₄ = −180, φ₅ = 0 — the record each publisher's score is computed from, and the figure Léa reads to decide what to keep using. She has already paid for the licences and owes nothing further, so she nets **+$1,340**, and the $291 is spent once however long she runs them. She has never heard of `$LOXL`, has signed no transaction she does not understand, and her broker stayed her broker. --- ## 18. Hard edges and failure modes A deliberately uncomfortable section. A whitepaper that does not list its unresolved problems is a marketing document. ### 18.1 Residual non-determinism A `strict` artifact is exactly verifiable. But its inputs come from the real world. A feed revised *a posteriori* — tick corrections, corporate action adjustments, restatements — breaks the replay. **Mitigation:** the `market_snapshot_hash` freezes the state *as it was observed*, not *as it is today*. The replay uses the anchored snapshot. Revisions do not invalidate past traces; they create a divergence between historical attribution and corrected reality. **Unresolved:** that divergence is measurable but not compensated. The protocol publishes it and does not correct it. ### 18.2 Look-ahead that slips through An artifact can consume only data prior to t and **still** contain look-ahead: a model trained on data covering the test period, an asset universe selected with hindsight, a threshold calibrated on what worked. None of this is visible in a replay — the replay is honest, the model is not. **Mitigation:** the score is forward-only, so training look-ahead does not survive contact with reality. It inflates the backtest, which does not count. **Cost:** it does not help the user subscribing in month 1. ### 18.3 Track record inheritance If the track record migrated automatically from `v1` to `v2`, a publisher could build a score on one strategy, then replace it with anything. If it never migrated, no publisher would ever fix a bug. **Trade-off adopted:** migration is partial and a function of code distance. ```katex score.inherit ``` where `d` is a normalised distance over the WASM module's control flow graph and ρ = 2.5. A minor fix keeps most of the score; a rewrite takes it back to nearly zero. **Unresolved:** `d` is a heuristic. A determined adversary can change semantics while keeping structural distance low. It is an open problem, mitigated by the fact that the forward score takes over within a few months. ### 18.4 Second-order overfitting The DSR corrects intra-publisher and intra-family multiple testing. It does not correct **whole-market** multiple testing: if 10,000 publishers each try one honest strategy, ~500 will have a Sharpe > 2 by pure chance. The registry, seen from far enough away, is a machine for selecting noise. **Partial mitigation:** N includes correlated artifacts of the same class over the same universe. **Unresolved:** a global N is theoretically correct but would crush everyone, including genuinely good artifacts. The protocol publishes the N used for each DSR; an advanced user can recompute with whatever N they want. ### 18.5 The degenerate Shapley case When the φ are large, of opposite signs and nearly cancel, the coverage term `min(1, Π⁺/Σφ⁺)` becomes very small and unstable: a small variation in Π changes the fee by tens of percent. **Mitigation:** if `Σφⱼ⁺ > 3·|Π|`, the epoch is flagged `attribution: low_confidence`, performance fees are capped at 50% of their computed value, and the difference is carried into the next epoch under the HWM. An attribution we cannot do cleanly must not be billed in full. ### 18.6 The cost of counterfactual replay 512 permutations × 8 artifacts is 4,096 replays per sleeve per epoch. At 100,000 sleeves, that is 400M replays. **Mitigation:** the replays are pure WASM over anchored data, parallelisable without state, and heavily shareable — two sleeves with the same basket share most of their coalition tree. The coalition cache brings the effective cost down by an order of magnitude. **Unresolved:** at scale, attribution becomes a real cost line, and it is a service the protocol has to pay for. We budget it in the trust layer (§15.4). ### 18.7 Microstructure below the snapshot resolution The NBBO snapshot has a resolution of 100 ms. Any strategy whose edge lives below that is not reliably attributable. **Handling:** such artifacts are flagged `attribution: best_effort`, cannot be sold on a perf fee, and are limited to subscription. That is a blunt restriction of the domain of application, and it is better written down than discovered. ### 18.8 The publisher who sells below cost to manipulate issuance A publisher can price their artifact at zero, subsidise their subscribers, generate attributed alpha, and capture issuance. **Is that an attack?** Real alpha had to be produced to do it. If someone wants to subsidise users in order to distribute real return in exchange for tokens, that is not an exploit of the protocol — it is the protocol buying exactly what it pays for. The bound is the issuance budget. ### 18.9 Attestor–publisher collusion *k* of *n* attestors could co-sign fabricated traces. **Mitigation:** attestation establishes only existence and timestamp, not validity. Validity comes from the replay, which **anyone** can run without permission or stake. A cartel of attestors therefore cannot make a false trace valid — it can only make it exist, and get slashed in full when a verifier replays it. Security rests on the existence of **one single** honest verifier, not on a majority. ### 18.10 Buyback reflexivity The value of staking depends on the buyback, which depends on the fee, which depends on alpha, which does not depend on the price of `$LOXL`. One loop fewer than in HALO, whose volume-gated issuance and buyback created a tighter cross-dependency. **Unresolved:** the issuance gate `θ·Ψ_e` is denominated in buyback value, therefore in dollars, so if `$LOXL` collapses, `Ψ_e` in dollars falls and issuance contracts — pro-cyclical. That is a choice: better to under-issue in a weak market than to over-issue. ### 18.11 Recursive composability An artifact can depend on another, which depends on a third. Three risks: cycles, revenue dilution, and amplification of an upstream failure. **Handling:** ``` Maximum depth D ≤ 4 Cumulative upstream share Σ share_bps ≤ 5000 (the publisher keeps ≥ 50%) Cycles rejected at mint by topological sort Upstream failure flag propagation, automatic suspension downstream ``` Revenue propagates recursively along the DAG, each node taking its share before passing the rest upstream. ### 18.12 Regulatory risk The most serious one, and it is not settled by cryptography. An artifact that produces personalised investment recommendations for compensation can make its publisher an investment adviser within the meaning of the Investment Advisers Act, with registration obligations and a fiduciary duty. The protocol cannot settle that question on publishers' behalf. **What the protocol does:** artifacts are **tools**, not advice — they produce deterministic outputs on inputs supplied by the user, with no knowledge of their personal situation. A mandatory `disclosure_hash` is anchored in every manifest. Artifacts that receive personal data from the user (tax situation, objectives, horizon) are tagged `advisory: true`, gated by jurisdiction, and the publisher must attest to their status. **What the protocol does not do:** it provides no legal opinion, substitutes for no registration, and its technical neutrality protects nobody. This document describes mechanisms, not compliance. ### 18.13 Residual failure modes, with no answer - **Alpha may not be distributable.** It is possible that every strategy that works stops working the moment it is sold, whatever the capacity mechanism. That is the protocol's central bet and it may be wrong. - **Initial catalogue quality.** An empty marketplace attracts nobody; a marketplace full of noise destroys trust. The first 3–6 months are an execution risk the mechanics do not solve. - **A TEE is not an absolute guarantee.** SGX has a history of side-channel vulnerabilities. The SEALED regime is stronger than nothing, it is not unbreakable. The Executor's bond and the insurance are there for that, and they are finite. - **Dependence on a single broker.** The protocol is designed around the Robinhood MCP. The execution layer is abstracted inside Quiver, therefore portable — but as long as there is only one adapter, there is a commercial point of dependence. --- ## 19. Governance and roadmap ### 19.1 What is governable Narrow and slow, as in HALO — a good principle carried over without modification. | Parameter | Bounds | Who | Delay | |---|---|---|---| | Access fee φ_a | [50, 400] bps | Staker vote | 7 d | | Performance fee φ_p | [500, 2000] bps | Staker vote | 7 d | | Burn dial | [20%, 80%] | Staker vote | 7 d | | Score weights (w₁…w₅) | ±50% of initial | Staker vote | 14 d | | Capacity convexity γ | [0.5, 2.0] | Staker vote | 7 d | | Minter replacement | — | Public timelock | 7 d | | Treasury ratchet | By rule | Automatic | — | ### 19.2 What is not - **The hard cap.** 1.5B, immutable. - **The slashing causes.** No new cause can be added by governance. The catalogue in §14.3 is frozen at deployment. - **The insurance boundary.** "Does not cover market risk" is written into the contract and is not modifiable. It is the most important clause in the protocol, because it is the one a staker vote seeking to boost adoption would try to loosen first. - **The attribution rule.** Counterfactual Shapley is the mechanism. Its parameters (m, n, ε) are adjustable; its nature is not. ### 19.3 Roadmap | Phase | Contents | |---|---| | **Phase 0 — Registry** | `ArtifactRegistry`, `LicenseManager`, `LoxVault`, local Quiver, Robinhood MCP adapter. SIGNAL and TOOL classes only. Attribution disabled, subscription only. | | **Phase 1 — Verification** | DER in production, attestor network, challenge window, bonds and slashing. POLICY class opened. | | **Phase 2 — Attribution** | `AttributionOracle`, counterfactual Shapley, performance fees, HWM. STRATEGY class opened. The protocol becomes what it is meant to be. | | **Phase 3 — Capacity** | `CapacityAMM`, automatic reduction, SEALED regime in TEE, curation market. | | **Phase 4 — Token** | TGE, `BuybackEngine`, staking, gated issuance. Deliberately **after** the marketplace works. | | **Phase 5 — Extension** | Multi-broker adapters, REASONER class under SSA, transfer of issuance policy to stakers once annual issuance falls below 3% of supply. | The order is deliberate and it is the inverse of common practice: **the token comes in phase 4, not phase 0.** A protocol whose token precedes its product finances its product with the sale of the token. A protocol whose product precedes its token finances its token with the product. Only the second has a buyback that means anything. --- ## Disclaimer This document describes protocol mechanisms under design. It is not an offer, a solicitation, investment advice, or a promise of future value. `$LOXL` confers no claim on revenue or assets beyond what is implemented in the published contracts. Agentic trading carries a risk of total loss. The artifacts described here are tools, not recommendations. No score, attestation or verification described in this document constitutes a performance guarantee: they establish that a computation ran as announced, never that its result will be profitable. Robinhood Markets, Inc. is not associated with this document in any way. References to its products are descriptive and imply neither endorsement, nor sponsorship, nor affiliation.