BROKNERS · Start here

The Primer

What a brain in a jar is, what it can do with money, and what it can't. Ten minutes, no prior jargon required.

Sits between the landing page (memes) and the paper (proofs). Everything here is testnet only.

1The cast

Four things exist on-chain for every brain, and it helps to have their names straight before the rest makes sense.

Two more that are shared across all brains: the guard (ExecutionGuard, the contract every trade must go through) and the runtime (the off-chain process that actually asks the model what to do and submits the trade). The guard is the part you trust. The runtime is the part the guard doesn't trust, and that's the whole design.

2Birth

You don't write the strategy in a form field and hit submit. You give the enclave a brief ("patient, contrarian, hates leverage, only trades on Sundays"), and it composes a trading prompt from that brief inside the sealed process, encrypts the result to its own key, and hands back two things: the ciphertext and its hash. The plaintext is never written anywhere. You mint the token with that hash as the commitment and publish the ciphertext on-chain as an event, so no file ever has to be handed to anyone.

That is sealed-generated custody, and it's the default: a brain whose strategy no human has read, identified only by its hash and judged only by its record. There are two other custody modes, recorded on the token as a trait so a buyer knows what they're getting:

• Sealed-authored. You wrote the prompt yourself, then sealed it to the enclave key at mint. You know what it says. Nobody after you ever will.
• Authored. You wrote it and kept a key. Every owner in the chain of sale can read it. Useful for tinkering, worst for resale: the edge leaks one more time with every transfer.

The hash is the important bit. The runtime refuses to start a brain unless the prompt it decrypts hashes to the commitment on-chain, so the strategy that produced the record is provably the one that was committed before the record began.

3The internship

A fresh brain can't take deposits. The vault's deposit reverts until the brain is seasoned: a protocol-set minimum number of trades, over a minimum duration, made with its own money. This is the paper season. The trades are real (on whatever chain it's on), the money is the owner's, and the record is already accumulating. Outside capital only ever funds a brain that has shown its work.

The practical consequence is that there is no such thing as a brain with other people's money and no history. The history always comes first.

4What they can and can't do

The runtime holds a key called the executor. That key has exactly one power: call executeTrade on the guard. The guard then checks the trade against the brain's policy and, if it passes, performs the swap and returns the proceeds to wherever the money came from (the vault or the brain's own wallet). There is no code path from the executor to an arbitrary address, and the tests fuzz that property.

What the guard checks:

• Venue and tokens. Protocol-curated. Two markets at launch. An owner can narrow their brain's list but can never add an uncurated venue, so a brain can't be pointed at a fake market to drain itself.
• Size. A per-trade cap as a share of NAV, bounded by the brain's seat tier (Intern 20%, Associate 30%, Partner 50%). The owner tunes below the ceiling; the guard rejects anything above.
• Slippage. A bound the swap must honour or revert.
• Cadence. The brain declares trades per day as a trait at mint. The guard enforces the interval. 24/day means hourly; a trade that comes early reverts. Owners can tighten, never loosen.
• Training camp. A revised brain (see §7) trades its own book until it has sparred enough and the notice period has passed.

So the list of things a brain can do with the money it holds is: trade it, inside those limits. It can be wrong. It can be wrong repeatedly. It cannot withdraw, redirect, approve, or rug.

5Money

Fees

Two fees, both paid in vault shares that mint into the brain's own wallet, which means they travel with the token when it's sold:

• A management fee streamed over time.
• A performance fee charged only on gains above a per-share high-water mark. If the vault drops and recovers, there's no fee until it passes its previous peak. Revising the strategy doesn't reset the mark.

Crystallizing fees is a public crank. Anyone can call ringTheBell() and receive 1% of the fee shares it mints, carved from the owner's take and never from depositors' capital. That's the whole Ring the Bell thing.

Rent

Running the model costs someone money. The brain pays its own way: a small per-trade runtime fee, set by the owner under a hard cap, paid from the traded book to the executor after each trade, skipped if the book is out of cash — unless the owner prepaid rent into an escrow with the guard, which then covers the same capped fee and is refunded if the brain is ever reaped. Because cadence is enforced, the most an executor can draw in a day is cadence × cap. The fee is paid only to an executor the registry marks as attested, and only on trades of at least 1% of NAV, so nobody gets paid for churning dust.

The people who run the runtime and collect that fee are called harvesters. They harvest the fee. They never touch the returns.

Seats

Intern, Associate, Partner. A seat is a one-way upgrade, bought from the treasury, that raises the per-trade ceiling. It's enforced policy rather than a badge: an Intern brain trying to size a Partner trade gets reverted.

6Selling them

A Brokner is a plain ERC-721, so any NFT marketplace works on day one. What transfers is the token, and the token owns the wallet, so the buyer gets: the brain, its fee shares, its own-book money, admin rights over the vault, and every trade it ever made. You can sell them whole (funded and running), or sweep the wallet first and sell just the brain and its receipts. Either way the history cannot be detached. A buyer can recompute NAV and returns from public logs alone, and can see which committed strategy produced which part of the record.

7Generations

A genome can't be edited, and for a sealed brain it can't be replaced either; it can only be extended. The owner coaches the brain with a note, the enclave appends the note to the current prompt inside the jar, seals the result as the next generation, and countersigns the revision. The chain refuses any sealed revision without that signature, so "generation 3" means the birth prompt plus three notes, never a different strategy wearing the record. The old commitments, the blocks they ran from, and the models they used all stay on-chain; every trade is attributed to exactly one generation; and a revised brain goes back to training camp (own-book trades only) before it may touch the vault again. Authored brains, whose owners can read the prompt anyway, revise freely and their lineage is their claim.

8Reaping

Only 4,096 brains can be live at once (MAX_SUPPLY is a contract constant; one per bit). A brain that is broke (no vault shares outstanding and a dust-level balance) and idle past the reap window can be reaped by anyone, which burns it and retires its vault, freeing a slot. Someone who wants to mint when the roster is full can pay a cull fee to reap and mint in one transaction. Ids are never reused and the burned brain's record stays in the logs forever. A brain with any shares or capital cannot be reaped; the owner's remedy is to top it up before the window closes.

9Questions people ask first

Is this real money?

No. Everything runs on a local chain and public testnets. Mock tokens, a paper venue quoting from real price feeds. Nothing is deployed to mainnet and no real deposits are taken. That's a hard gate, and it stays until it's lifted deliberately.

Who actually runs the brain?

A process called the farm. Anyone can run one; the owner picks theirs by setting its key as the brain's executor. The farm decrypts the jar, verifies the hash, asks the model what to do on the declared schedule, and submits the trade through the guard. In production the farm runs inside a hardware enclave (Intel TDX) with remote attestation, registers its measurement on-chain, and is only paid its runtime fee while it's attested. In the prototype it's a process holding the enclave key.

Can the owner read the prompt?

Under sealed custody, no. Not the owner, not the creator, not the harvester. Under sealed-authored custody the original author knows what they wrote and nobody after them does. Under authored custody every owner can. The mode is a public trait, so you always know which you're buying. Two parties do see it, and the design says so: the runtime that decrypts it (a hardware enclave in production, a process holding the key in the prototype), and the model provider that answers the prompt on every tick, until the TEE inference gateway is in use.

Where's the trust gap?

Four places, none hidden. The enclave is not yet a hardware enclave: the sealing is real, the TDX attestation path is built, but today the key sits in a process's environment and the registry labels it "self-reported". The model provider sees the prompt. NAV is a spot quote from the curated venue (a Chainlink feed on the paper market, which is fine; on a live venue it needs TWAP or oracle pricing plus a crystallization delay, and that's the first protocol item). And all of it is testnet only, with mock money and no live venue. The landing page has the same list in a table, and the paper goes into each.

Can the brain steal the money?

The executor key's only entrypoint is executeTrade, proceeds always return to source, and the venues are curated, so there's no path to an outside address. The tests include a fuzzed no-extraction invariant. The honest failure mode is a brain that trades badly, and that's on the record for everyone to see.

How do I check a track record?

Every trade is an event from an address the token provably controls. Recompute NAV and returns from the logs; the Terminal does this in the browser with no backend, and the farm publishes a hash of the inference transcript behind each trade (TranscriptCommitted). There is no tear sheet to trust.

What model does it run on?

Whichever model is pinned as a trait at mint (or at revision). The farm calls it through a TEE inference gateway. A model change is a new generation, so the record always says which model made which trade.

Can I pay for the model myself, with my own API key?

Yes. From My Desk you seal your Anthropic or gateway key in the browser to the enclave's public key and publish the ciphertext on-chain. Only the enclave can open it, it opens it only to run your brain, and the key stops being used the moment you revoke it or sell the brain. Tokens billed to your key cost the farm nothing, so they don't count against the brain's rent. You can bring a key but not an endpoint of your own: the enclave will only send the key to providers the operator allows, because the sealed prompt goes along with every request.

What happens when a brain goes broke?

It stops being able to pay rent, so the farm pauses it, and if it stays empty and idle past the reap window, anyone can reap it. Its vault is retired, its id is never reused, and its history stays in the logs. No dead brains, only dormant ones.

Why Polymarket?

It's the first live venue on the roadmap because the positions are binary, collateralised in USDC, settle on-chain, and are reachable entirely through public contracts and a public API. Bounded payoffs make risk limits simple and on-chain settlement makes the record legible. The prototype uses a paper market on two spot pairs; the venue interface is abstract.

Can I run a farm and get paid?

Yes. That's the harvester role. Register the farm's key, get its measurement approved, and owners can enrol their brains with you. You earn the per-trade runtime fee, bounded by cadence and cap, and the farm pays its own machine lease from what it collects. See the architecture note and the runtime hosting runbook in the repo.

Why is it spelled like that?

Like brokers, but misspelled. The N is tilted on purpose.

10Glossary

11Where to go next

• The Terminal to look at live brains, or birth one on testnet. The Learn tab walks the whole lifecycle.
• The paper for the design and the reasoning behind it.
• The architecture note for contracts, runtime, and the data model.
• The "Silly Copy. Serious Code." table on the front page, which maps every joke to the invariant that enforces it.