How PROG programs
a token economy.
The technical reference for trading-tax intake, strategy composition, launch orchestration, receipt-backed discovery, authority, failure behavior, release gates, and APIs.
A programmable economic layer between trading and capital deployment.
PROG starts where a bonding-curve launch normally stops. It claims recurring trading tax from a certified carrier, then applies a deterministic policy across liquid reserves, weighted DeFi portfolios, custom tokenized-market baskets, treasury-owned or alliance liquidity, and token-support actions.
Pons is the first fork-certified intake rail, not the boundary of the architecture. New carriers and strategies enter through typed adapters only after their authority, runtime, pricing, custody, liquidity, and exit behavior are certified.
It is not a principal floor, guaranteed-yield product, managed stock fund, or automatic holder-distribution product. It is experimental tokenomics infrastructure with explicit risk budgets and fail-closed execution.
- Chain
- Robinhood Chain · 4663
- Carrier
- Pons V2 (curve → V4)
- Reserve asset
- USDG
- Authority
- Project Safe (EIP-1271) + bounded operators
Ten sections. Every failure has a destination.
01Contract rolesTyped modules · bounded authority
01bOnchain / offchain boundaryVerifiable custody · fast control plane
Onchain
- Project identity, Pons binding and deployment provenance.
- Policy, metadata and strategy commitments.
- Owners, operators, caps, deadlines, pauses and exit rules.
- Timelocked factory/version admission and event-rebuildable registration.
Offchain
- Wallet UX, simulation, quotes and keeper scheduling.
- Full metadata, artwork, search, rankings and charts.
- RPC indexing, alerts and cached Explore views.
- Analytics may be replaced; contracts still enforce fund-moving bounds.
Upgrade model: existing treasuries are not controlled by a universal proxy admin. New code ships through a new versioned package, while project configuration changes remain bounded or timelocked. A paused reserve-only project can migrate only after PROG governance attests the exact replacement graph and project governance independently waits 48 hours. The treasury preserves the same owner, asset, policy, 5% fee, fee recipient, branch split, ceilings and accounting continuity; alliance and buyback migrations remain disabled in v1.
Status: the V2 factory and registry boundary is fork-certified against the real Pons factory and escrow, but it is not publicly deployed or connected to the production launch switch.
01cCertification matrix11 fork-certified lifecycles · experimental + unaudited
The current aggregate suites contain 183 Forge and 46 TypeScript tests. None of this substitutes for an independent audit.
02Creator-tax claim + conversionPull-based · fail-closed
Claimability invariant
escrow.credit(treasury) == amount operator → treasury.claimExact(amount) treasury → escrow.withdraw() // msg.sender = treasury destinationDelta == amount escrow.credit(treasury) == 0
Execution bounds
- 3% maximum slippage against the oracle quote.
- 15-minute maximum deadline.
- Independent ETH/USD and USDG/USD minimum; feed freshness bounded (1h / 26h).
- Runtime drift or a weak fill reverts atomically; tax stays in escrow.
- Fallback to the project Safe is a separate allowlisted operator action, never automatic.
03Strategy composition + redemptionCustom weights · up to 8 feeders
Creators set the top-level liquid, DeFi, and tokenized-market weights. Inside the DeFi sleeve they can compose up to eight admitted feeders with independent weights and caps. Strategy additions and cap increases are timelocked; disabling risk is immediate. Failed deposits remain liquid USDG.
Cash redemption unwinds only realizable positions. Locked strategy shares transfer pro rata in-kind, so early redeemers cannot drain cash and leave locked risk behind.
04Tokenized markets + high-water accounting12 admitted routes · 33 verified feeds
Every admitted route binds token runtime, Chainlink feed and aggregator, direct USDG pool, maximum feed age and maximum weight. A policy can select 1–8 routes. A single-asset thesis may use 100% of the market sleeve with an explicit concentration flag; multi-asset baskets enforce route-specific diversification caps.
Only realized gain above the adjusted high-water mark may leave. At most 50% of new gain enters a buyback, with a 25 USDG canary per batch because the downstream ETH/USDG route exceeded the 3% bound at larger sizes on the fork. The 33-feed universe is verified market data, not 33 executable routes.
05Ownership + holder benefitRead before buying
Implemented today
- Creator tax follows a published, inspectable policy instead of an opaque wallet.
- Treasury positions, caps, routes, limits and receipts are inspectable.
- Realized gain above the high-water mark can fund a capped buyback and burn of the launch token, on the Pons curve and in the graduated V4 pool.
Not current rights
- Holders do not own, redeem or receive treasury USDG, Spark/Morpho shares or stock tokens.
- No dividends, distributions, principal floor, guaranteed yield or guaranteed buyback size.
- A holder-owned reserve and direct cash distributions are roadmap modes that require new contracts and qualified legal review.
Reserve shares and stock-token positions belong to the configured project beneficiary. Direct distributions or a holder-owned reserve require separate contracts and qualified legal review before any public claim.
06Failure matrixA destination for every failure
07Risk registerValue can decline
- Market: tokenized-market and DeFi positions can lose value; the treasury is risk-bearing.
- Liquidity: routes can be too thin to execute within bounds; buybacks may not occur.
- Strategy: withdrawals can lock; protocols can lose funds.
- Issuer: stock-token rights, transfer eligibility and corporate actions vary and are not established by runtime tests.
- Oracle: stale or divergent data stops operation and can delay action.
- Governance: Safe signers, operators and timelocks remain trust dependencies.
- Contract: internal tests and fork evidence do not replace an independent audit.
- Third parties: Pons, Robinhood Chain, Spark, Morpho, Uniswap and Chainlink are independent systems PROG does not operate.
08Release gatesExperimental launch + future work
Experimental launch gates
Future scale-up considerations
Audit and legal work are not blockers imposed on the initial decentralized experiment. They remain available as future risk-reduction work if PROG gains traction, supports larger balances or expands its operating model.
PROG shared infrastructure is live on Robinhood Chain. No PROG token/project has launched, no canary funds have been routed, and public execution remains disabled.
09Plan-only APIRead-only · no execution
POST /api/plan/previewGET /api/plan/schemaGET /api/plan/exampleGET /api/catalogGET /api/readinessPOST /api/launch# reproduce the pinned example digest from any machine curl -s https://prog.build/api/plan/example | jq .plan \ | curl -s -X POST https://prog.build/api/plan/preview -H 'content-type: application/json' -d @- | jq .digest
The digest is keccak256 of the sorted-key JSON manifest. The launch workspace computes it locally and cross-checks it with the server; identical inputs always produce the same digest. GET /api/plan/example returns the fixture the test-suite pins.
Words used precisely.
Public copy says creator tax or trading tax. Literal ABI names appear only in technical contexts like this page and the evidence files.
The Pons fee charged on each buy and sell. PROG receives 5% of creator fees actually claimed through its settlement controller; the remaining 95% follows the creator's committed routing policy.
The runtime-locked PonsFeeTreasury that claims tax, converts to USDG and allocates by policy. Project-owned.
A market route or strategy whose token, feed and pool identities are runtime-locked under concentration caps and selectable in a plan. Fork-certified routes have also completed a signed deposit/exit lifecycle; read-certified routes have not.
The sleeve's adjusted peak value; only gain above it counts as realized and may fund a buyback.
A deliberately small execution bound (25 USDG per buyback batch) that grows only with observed liquidity.
The workspace produces a deterministic manifest and digest before any wallet request. The canary-gated orchestrator then reveals transactions one at a time after simulation and receipt verification.