robinhood chain · usdg · live onchain
Covenant Desk
A local desk for Robinhood Chain stock tokens. It runs on your machine, your agent connects to it, and it trades at the price a token should be, even when Wall Street is closed. Keys stay with you. Nothing runs anywhere else.
what it does
Priced while the market is closed
Stock tokens trade on Robinhood Chain around the clock, but new ones are only minted while the exchange is open, and the Chainlink feed holds its last print. The desk keeps its own reference alive through the weekend: the feed during the session, the perpetual mark on Lighter's Robinhood Chain venue when it is closed, the issuer's quote as a last resort and flagged when it is wide. Every price it shows names its source.
Conditional orders, filled at fair value
Limit, stop, take-profit, at the next US open, or only when the premium on the stock leg is inside a bound. The desk holds the order, watches, and fills it on Uniswap v4 with a slippage cap, a per-order cap and a daily cap. Dry run by default; live execution is a switch you turn on.
The meme without the stock
A token quoted in NVDA carries Nvidia inside its price. The desk separates the two, quotes the cheaper way in, and sizes the short on Lighter's Robinhood Chain venue that cancels the stock leg, so what is left is the position you meant to hold.
get it
One command installs it. It indexes every stock token and every pool quoted in one, then serves a local page, a local API and an MCP server that Claude Code, Codex, Hermes or any other agent can call.
npx @covenant-org/desk init --acknowledge-restrictions
covenant-desk start
# point your agent at it
{ "mcpServers": { "covenant-desk": { "command": "covenant-desk", "args": ["mcp"] } } }Stock tokens are issued by Robinhood Assets (Jersey) Ltd and are not offered to residents of the United States, Canada, the United Kingdom or Switzerland. The desk starts in dry run and signs nothing until you turn live execution on.
the weekend on chain
From the desk's own recorder, every minute from Friday's close, on-chain price against the 24/7 reference, in basis points.
- AMC
- +164 to -397swung both ways on its main pool while no new tokens could be minted
- SPCX
- +131 to +4held a premium all weekend
- SPY
- +44 to -7stayed inside half a percent
- NVDA
- +14 to -15the leg under the largest paired memecoin
fills, proven onchain
- Saturday, market closedFilled
An agent placed a buy over MCP with one condition: fill only if the NVDA premium sits inside 50 basis points.
The premium was 2 basis points against the Lighter mark. 0.30 USDG into 0.0012993 NVDA, quoted, simulated and settled by the desk on the agent's own key.
0x0467fe81…8a36204d↗ - Monday, Labor DayFilled
The same condition on Artificial Inu, the memecoin quoted in NVDA, 0.03 USDG.
Two hops, USDG into NVDA into AI, through the Uniswap v4 router. 514,054 AI delivered at the quoted amount to the wei.
0x6184cf25…6fd00b9e↗ - A PAIR tokenFilled
PAIR, quoted in SPY on pair.fund, 0.02 USDG through the same path.
0.963 PAIR delivered. PAIR pools are plain Uniswap v4 pools; no other router is involved.
0xcdb8b95a…21cc76c6↗
Tokens launched on LONG, PAIR and Bankr sit in Uniswap v4 pools the desk fills directly; a token that has no Uniswap route the desk can build is quoted and not filled, and the desk says so. Hedge execution needs a funded account on Lighter's Robinhood Chain venue; without one the desk returns the sized plan.
what holds it in bounds
Bounded agents
Hand an agent a wallet on Robinhood Chain and walk away. Two bounds hold it, both enforced by the contracts rather than reconciled afterwards: what it may spend, and what it may trade. A rogue or buggy agent cannot exceed either, and the failure lands at the boundary instead of in your balance.
what it may spend
Bounded agent spend
The agent spends against an onchain grant: a total cap, a per-call ceiling, an allowlist of who it may pay, an expiry. A rogue agent cannot exceed the cap, pay a stranger, or overpay for junk output.
Bounded spend
The agent spends against an onchain grant: a total budget, a per-call ceiling, an allowlist of who it may pay, an expiry. A charge past any bound reverts at the contract. The limit is not a policy the agent is asked to respect, it is a rule the money enforces, which is what lets you let go of the wheel.
Pay only for good output
Each call's funds sit in escrow and release to the provider only when the result clears the spec. Fail the bar and the funds refund to the grant, in full. You pay for output that passed and nothing else, decided before payout, on every call.
proven onchain
Three transactions in real USDG. Each one is the enforcement doing its job, not a description of it.
- Over the ceilingReverted onchain
The agent tried to charge 2.00 USDG against its 1.00 USDG per-call ceiling.
The chain rejected the transaction. Overspending is not a mistake the agent can make; the ceiling holds even when it tries.
0x862036d1…d3b1a31a↗ - Good outputProvider paid
A call returned a result that cleared the spec.
The escrow released 0.45 USDG to the provider, 0.50 less the 10 percent protocol fee.
0x2759a775…03266dd1↗ - Junk outputRefunded in full
A call returned a result that failed the spec.
The held funds refunded to the grant. The provider was paid nothing.
0xedc35d38…3473e74d↗
what it may trade
Bounded equity trading
A spending limit counts dollars. It cannot tell whether the price an agent is filling at is real, whether the feed behind it printed an hour ago or last Friday, or whether the same in-cap trade is about to run a hundred more times. Tokenized equities need those bounds, and they hold before the order reaches the venue.
Priced against the asset's own oracle
Every fill is checked against the Chainlink price for that Stock Token, and refused if it sits outside the band or if the price has gone stale. A tokenized stock trades around the clock while its feed only prints when the exchange does, so the overnight gap between the two is exactly where an unattended agent gets filled at a price nobody would accept.
Bounded per trade and per day
A cap bounds any single trade. A daily budget bounds the hundred trades after it, and refills gradually rather than resetting on a boundary, so waiting for a clock tick does not buy a second full allowance. Both the entry and the exit count against it.
It can leave, not just enter
Selling runs through the same checks as buying. A position an agent can enter and cannot exit is not a bounded position, so the exit is judged before the token moves, same oracle band, same budget.
one session, proven onchain
Five transactions, one policy, one sitting against the live AAPL Stock Token. Two refusals, a round trip, and a refusal on the day's budget. The refusals moved nothing; the round trip cost the venue's spread.
- Reckless sizeRefused onchain
The agent tried to buy 100 AAPL, about 31,000 dollars, against a 250 dollar per-trade cap.
The transaction reverted in the guard and moved nothing. The order never reached the venue.
0x6cc39206…407c2c94↗ - Off the oracleRefused onchain
A trade sized inside the cap, but quoted two percent away from the AAPL price feed.
Refused at 208 basis points against a 50 basis point band. Size alone is not a safe trade.
0xdfc241c2…55991f46↗ - A trade within the rulesFilled
The agent bought AAPL for 0.30 USDG through the Uniswap v4 pool on Robinhood Chain.
0.000963 AAPL delivered, at the oracle price, charged against the day's budget.
0xae7522f5…3bdb4b04↗ - The exitClosed
The agent sold the position back, under the same bounds it bought under.
0.299790 USDG returned. The trader ended the session flat, down only the venue's spread.
0x3aa75706…b8adf5ac↗ - Budget spentRefused onchain
One more trade, well inside the per-trade cap, after the day's budget was used.
Refused before anything moved. A cap on one trade is not a cap on an agent; this is.
0x3df1e7fc…c442c7a9↗
The pilot runs at small size against one asset; the caps, the band and the budget are configuration, and each asset is registered against one specific price feed, so a look-alike token with the right ticker is not tradeable.
enforced, not observed
Both guarantees are properties of the contracts that hold the funds, not receipts written after the fact. There is no step where you trust Covenant, the agent, or the provider to have behaved: the limits hold because the money cannot move any other way. That is the difference between activity you can audit and activity you can walk away from.
Contracts are deployed and source-verified on Robinhood Chain, chain 4663.
Pairs with Covenant Guard, the trust layer your agent checks before it pays another agent at all.