PUNCH DOCS: ARCHITECTURE

ONE ENGINE. MULTIPLE COUNTERPARTIES. NO SHARED SOLVENCY.

Robinhood Punch uses a shared position engine with class-local settlement. The Core Pool, dKLP, and KLP are different economic domains: each has its own custody, counterparty capital, risk policy, fees, reward budget, and lifecycle. Shared arithmetic never means a shared balance sheet.

THIS PAGE IS ROBINHOOD PUNCH

The Core Pool / dKLP / KLP model below is the Robinhood architecture formalized in the design paper. A separate basket-backed KLP remains live on Flow EVM and is outside this modular model.

COUNTERPARTY CLASS IS AN ECONOMIC CHOICE

A class determines custody, payout timing, risk capacity, fees, rewards, and lifecycle. Shared position arithmetic never permits one class to rescue or drain another.

THE COUNTERPARTY-CLASS MAP

CORE POOL · ENDOGENOUS CLASS

Permanent class with no LP shares and no public pool deposit
Realized losses capitalize its isolated settlement pool
Surviving margin returns first; profit can settle immediately or enter senior FIFO
Its own risk limits, fee accounting, and outcome-reward budget

dKLP · MODULAR LP CLASS

Optional stable-asset LP vault for qualified emerging markets
Immediate profit settlement; no payout queue
Epoch NAV, asynchronous LP exits, and class-local payout headroom
Admission remains bounded by capital, market quality, and governance

KLP · MODULAR LP CLASS

Optional stable-asset LP vault for major markets
Immediate profit settlement; no payout queue
Independent vault, margin custody, risk limits, fees, and lifecycle
Economically conditional on trader demand and risk-adjusted LP capital

A MENU, NOT AN UPGRADE LADDER

KLP is not automatically “better” than Core Pool, and dKLP is not a migration stage. Traders choose among available settlement, fee, market, and reward frontiers. An LP class is economically viable only when trader demand and risk-adjusted LP capital supply support it.

WHAT IS SHARED — AND WHAT NEVER IS

The engine shares position identity, adverse-price execution, GMX-derived PnL arithmetic, leverage validation, liquidation semantics, and signed order handling. The class ID is part of every position key and signed intent.

Settlement modules do not share trader margin, counterparty cash, queued debt, LP assets, open-interest accounting, fee liabilities, or reward sub-budgets. Components are reserved to one class and remain reserved after retirement so history cannot be reinterpreted.

THE ISOLATION INVARIANT

An action in class c must produce zero custody and accounting change in every class d ≠ c. A loss in dKLP cannot service Core Pool FIFO; Core Pool cash cannot pay a KLP trader; one class's reward allocation cannot silently become another's.

CORE POOL: ENDOGENOUS CAPITAL

Core Pool has no LP shares. It may begin with zero cash or separately accounted donated seed capital. Realized trader losses and liquidation residuals add settlement cash; trader profits consume it. Protocol revenue remains separately accounted and junior to senior profit debt, and donations do not count as trader-loss basis.

Margin first. Surviving trader margin is returned before the profit path runs.
Finite profit promise. Every admitted position reserves a consumable lifetime profit budget in addition to OI capacity.
Capacity, not funding. There is no recurring Core Pool funding or borrow transfer. Gross, net, aggregate directional, and reserved-profit limits constrain imbalance.
Senior FIFO. Profit that cannot settle immediately becomes an ordered claim. Junior fee routing waits behind it.
Claim conservation. A valid net win remains directly paid, funded for the current claim owner, or outstanding as FIFO principal. A receiver-specific transfer failure changes delivery state, not amount, priority, or ownership.
Legible pressure. Pool cash, queued profit debt, funded claim escrow, net equity, claim age, and active profit reservations are distinct public quantities.
Bounded recovery. Queue pressure and total promised profit utilization are evaluated separately. Joint stress closes new exposure while repayment, liability release, reductions, and settlement remain available.
Permanent, not convertible. The class can pause new exposure but cannot be retired into, drained into, or transformed into a KLP.

DEFERRED PROFIT IS A REAL CLASS RISK

A Core Pool win can become a senior claim rather than immediate cash. The interface must disclose that settlement mode before a trader chooses the class. PUNCH rewards are not repayment collateral and do not make a queued winner whole.

MODULAR KLPs: EXTERNAL CAPITAL

dKLP and KLP reuse one LP settlement design through separate class instances. Mechanism reuse does not merge economics. Each instance has a unique stable-asset vault, margin escrow, risk manager, market set, fee waterfall, NAV reporter set, and lifecycle.

Immediate profit only. LP classes have no payout queue. Admission rejects exposure that exceeds class-local liability backing and payout headroom.
Epoch NAV. Share conversion uses a checkpointed view of cash and open trader PnL. A realized outcome closes priced share actions until a fresh current-reporter-generation quorum reconciles the vault.
Threshold reporting. Governance appoints the permissioned reporter set and threshold. A configuration change invalidates unfinished prior-generation votes; disagreement or non-quorum closes share actions rather than accepting one reporter's mark.
Asynchronous LP exits. A withdrawal request cannot jump ahead of valid trader-profit reserves or accrued protocol fees. Its delay responds to payout utilization.
Donation-neutral shares. Direct balance changes are reconciled before pricing. Pre-genesis assets receive permanently locked shares so the first depositor cannot capture them; an unexplained deficit closes share actions.
Independent lifecycle. dKLP can exist without KLP; a KLP class can remain absent when demand does not justify it; neither is required by the Core Pool.

THE MARKET-QUALITY PIPELINE

Listing is an evidence predicate, not a popularity vote. A permanent engine-market binding connects one market ID to one asset identity. Live source health, trust tier, and class risk capacity are checked before new exposure.

1. FORM

A token establishes a public spot market and a durable onchain identity. Venue identity alone does not guarantee perp eligibility.

2. OBSERVE

The market accumulates price history and live facts: depth, observation coverage, liquidity permanence, range coverage, and source health.

3. ASSESS

The asset registry assigns a trust tier to the asset itself. A venue's trust is only a ceiling; the asset's current facts decide within it.

4. PROVE

A probationary asset may build telemetry in the Core Pool under tight class-local limits. This does not expose LP principal.

5. QUALIFY

Only assets whose live facts satisfy an LP class's immutable policy can be considered for dKLP or KLP admission.

6. ADMIT

A modular LP class or market admits exposure only when governance, capital, risk, oracle, and NAV predicates agree.

froth.meme graduates can have a structural advantage because durable spot liquidity is observable from formation, but no brand receives automatic trust. External markets qualify under the same asset-level facts.

WHY dKLP CAN LIST WHAT UNDIFFERENTIATED POOLS CANNOT

dKLP does not obtain safety from a label. It can admit a qualified emerging asset because the asset's counterparty capital, settlement promise, market limits, oracle path, and lifecycle are isolated from every other class. A failure remains local to the dKLP that accepted it.

Admission evidence combines sufficient TWAP observation coverage, bounded spot–TWAP divergence, active in-range depth, wide-range or otherwise durable locked liquidity, and healthy venue identity and source routing. froth.meme graduates whose FrothSwap liquidity is verifiably persistent may present stronger permanence evidence than otherwise similar markets with withdrawable liquidity. That is an evidentiary advantage, not automatic trust, and external venues are evaluated under the same asset-level predicates.

QUALIFICATION CAN ONLY DEGRADE WITHOUT GOVERNANCE

Permissionless updates may preserve or reduce an asset's trust tier. Promotion into dKLP requires fresh evidence and delayed governance. Losing qualification stops new exposure while the reviewed decrease and liquidation path remains available.

The formal predicate and its containment assumptions are in Section 7 of the Punch Design Paper.

THE PRICE-SOURCE BOUNDARY

MAJOR MARKETS

One explicitly selected reviewed signed provider per market: Chainlink Data Streams or paid Pyth Pro. Freshness, publisher/confidence or spread, identity, and same-transaction execution constraints fail closed. Pyth Pro execution uses the conservative endpoint of its accepted median-confidence band. Provider changes are deliberate governance operations, not silent automatic fallback.

ONCHAIN MARKETS

Venue-specific V2 or V3 TWAP adapters report price plus live facts: observation coverage, spot–TWAP divergence, active in-range depth, permanence, and range coverage. Locked liquidity that is out of range or otherwise irrelevant does not qualify as protection.

RISK OFF DOES NOT MEAN EXITS OFF

A failed open-admission check blocks new exposure. Reductions and liquidations remain routable through the class's reviewed conservative price path. No source silently reuses a stale “last good” major price after its allowed window.

LIFECYCLE & GOVERNANCE

Guardians can reduce risk quickly by pausing new class or market exposure. Only delayed governance can resume exposure, promote an asset, relax a risk limit, activate a class, or schedule new economic terms. Existing positions retain their admitted leverage, profit-cap, fee, and reward-boost cohort.

Non-permanent LP classes progress through proposal, staging, activation, close-only, and retirement. Retirement cannot complete while registry positions, active margin, risk exposure, reserved profit, or a final reconciled NAV remain open. Independent ledgers must agree. The Core Pool moves only between active and opens-paused.

For the formal model, equations, and public invariant catalogue, read the Punch design paper.