How a research trace gets a Robinhood trade proof

A trade is the conclusion. The trace is the work behind it.

The candidate integration can attach a narrow, marketplace-verified Robinhood property to one scrubbed, licensed research release without publishing the contributor’s order history. A buyer can review the bounded claim, pay in THOT, and receive the committed research. Before payment, an ordinary buyer sees no excerpt from the research. This joined path has passed local acceptance with signed synthetic brokerage fixtures and Anvil; a fresh hosted Robinhood-to-purchase run is still required.

What the proof says

One current proof looks like this:

{
  "claim": "traded:F:within_30d",
  "symbol": "F",
  "window_days": 30,
  "value": true,
  "scope": "observed_records",
  "reference_time_basis": "trace-observed-start",
  "account_continuity": "not-established",
  "research_causality": "not-established"
}

Its precise meaning is:

Witnessed Robinhood records contained a filled buy or sell of F within an absolute ±30-day window around the trace timestamp.

The proof does not say that the research caused the trade, that the research came first, or that the trade was profitable. It does not establish a balance, return, Sharpe ratio, complete account history, or continuing control of the same account.

That narrowness is useful. A buyer can ask for an observable property without receiving an account statement or trusting a profile claim.

Add a trade proof in a configured test workspace

1. Open Market, choose one of your traces, and select Add trade proof.

2. Enter a ticker and a window from 1 to 365 days.

3. Open the test workspace for its one-time helper setup, then run the scoped command shown by thot market on the computer where you already use Robinhood. Use the native app origin shown in your workspace, not the public landing-page domain. It follows this form:

   wake-link robinhood \
     --wake-url https://YOUR-NATIVE-PHALA-APP-ORIGIN \
     --trade-trace TRACE_ID \
     --symbol F \
     --window-days 30

4. Open the helper’s one-use link in the Chrome profile where Robinhood is already signed in.

5. Return to thot market and choose Check trade proof.

6. The app accepts the result only after checking the signed credential, its hardware evidence, the owner-bound ticket, and the ticker and time window you requested.

7. Choose the saved proof when you authorize that exact scrubbed release for sale.

The contributor authorizes sale terms once. A later matching purchase can release the licensed trace automatically; the contributor does not return to accept each sale.

What happens inside the private path

The capture job receives a short-lived ticket tied to one contributor, trace, ticker, and time window.

The local helper uses the contributor’s existing Robinhood session to request the relevant order and instrument records. Login material remains on the contributor’s computer. It is not sent to thot market and is never included in the buyer-facing proof.

A Witness records the authenticated provider sessions. The captured records are sealed to an Appraiser running inside a TDX enclave. The Appraiser:

1. verifies the witnessed sessions;
2. resolves Robinhood instrument identifiers to tickers;
3. looks for a filled buy or sell of the requested symbol;
4. compares its transaction time with the trace timestamp; and
5. emits only the bounded result.

The marketplace verifier checks the Appraiser’s Ed25519 signature and hardware evidence, including the DCAP quote, RTMR replay, report_data, application composition, and operating-system image identity.

The marketplace binds the accepted property to the committed content hash and licensed release. It checks the full release against the onchain commitment before delivery. The ordinary buyer receives the research content without the private proof package, so the current buyer response does not itself allow independent recomputation of the full release hash or verification of the Appraiser signature.

What remains private

The marketplace credential does not disclose:

• account number;
• access token or browser cookie;
• position size;
• execution price or average cost;
• unrelated orders or tickers;
• portfolio holdings or balance; or
• the research trace itself.

The private Appraiser inspects the scoped order response and referenced instrument records used to compute the result. Ordinary buyers receive the bounded statement and the marketplace's release commitment, not those source records or the signed proof package. The private package also carries stable thot market owner and job identifiers, expired ticket/session commitments, and attestation metadata so the marketplace verifier can bind the result to its request. Those are thot market identifiers, not a Robinhood account number.

This is an attested property credential. It is not a general zero-knowledge portfolio proof.

How a buyer uses it

An ordinary buyer reviews a listing’s public metadata and supported properties. For example:

workflow = investment research
requested model = recorded
verified property = traded:F:within_30d
property value = true
maximum price = 20,000 THOT

The result can show a title, asking price, licence, model and provenance metadata, and the verified property. It reveals no random excerpt or other conversation content.

The buyer can then:

1. inspect the bounded claim and the marketplace's release commitment;
2. pay the asking price in THOT into escrow;
3. receive the full licensed research text; and
4. see the onchain delivery commitment that the marketplace checked against the full release.

The current ordinary-buyer flow does not deliver the raw signed brokerage proof or a portable verification package. The buyer relies on the marketplace's verification of the credential and release binding; independent verification of that package is a separate capability to build and test.

Governance-reserve sampling is a separate, contributor-controlled program. Its permissions do not give ordinary buyers access to trace content.

Current limits

The first predicate is intentionally narrow.

• It proves a positive observed fill only.
• It uses an absolute before-or-after window around the trace timestamp.
• It does not prove trade direction relative to the research.
• It does not prove P&L, investment skill, causality, balances, Sharpe ratio, or complete account history.
• The helper rejects paginated order histories rather than presenting partial coverage as complete.
• One capture currently supports at most 32 distinct instrument identifiers.
• A trace permits at most three capture attempts.
• The local capture has a 120-second timeout.
• The owner-bound job ticket expires after ten minutes.
• An accepted proof remains fresh for new listings for 24 hours.

Unsupported or incomplete captures fail closed. They do not produce a positive property.

What has been demonstrated

The integrated local acceptance path has produced and verified an Appraiser-signed:

traded:F:within_30d = true

The test exercises the production credential verifier, ticket binding, exact-release commitment, bounded disclosure, THOT escrow purchase and licensed delivery. Its brokerage records and approved Appraiser/Witness identities are synthetic fixtures, and settlement runs on local Anvil. No order quantity, execution price, brokerage account number or identifier, or unrelated ticker enters the buyer-facing claim. The private signed package carries stable thot market owner/job identifiers and verification metadata, but the ordinary buyer does not receive that package.

The remaining acceptance milestone is one joined hosted run using fresh Robinhood evidence, approved deployed enclave identities, a THOT purchase, exact delivery, restart recovery, and settlement in the same release environment. Until then, the demonstrated contribution is the integrated evidence primitive and market binding: witnessed account records can be reduced to a marketplace-verified, buyer-visible claim attached to one exact scrubbed, licensed release, and that research can travel through the purchase path without exposing the source records.

Read the launch story for why the research behind a trade should become a market, or the whitepaper for the settlement and reserve design.