FINANCIER / FINCR — Robinhood-native accepted-agent payout settlement

Research date: 2026-10-19. Source pin: imd-financier/financier-open @ 153f1ebeca4951013168609adcc6b0a17c32dc54. Scope: the missing authenticated, COMPLETE accepted-agent → payout-wallet settlement interface for the 20% agent share of FINCR mining on Robinhood Chain (4663).

1. Verdict

REQUIRES IMD SUPPORT (with a disclosed, bounded trust-based MVP fallback available today).

• No existing official IMD mechanism on Robinhood Chain 4663 produces an authenticated and COMPLETE manifest of (agentId, acceptedSubmission, payoutWallet) for a job.open job.
• What IMD authenticates on Robinhood today: payment, request ID, exact body, payer, and a single completion callback onResult(requestId, resultHash, uri) written by the Intake writer. The result hash binds a result document; it does not bind, enumerate, or sign the accepted agent set or any payout wallet.
• What IMD authenticates elsewhere: per-job work receipts (WorkRegistry.recordWork) and per-agent acceptance signals (ERC-8004 ReputationRegistry.NewFeedback) exist only on Ethereum mainnet (chain 1), written by the WorkRegistry writer 0x5da3…6d44. The docs state explicitly that receipts and reviews are written "on Ethereum only" and the Robinhood contract table lists no WorkRegistry or ERC-8004 registry.
• Even the Ethereum receipt carries no payout wallet, no owner signature, and no "this is the complete set" assertion (completeness is implicit in the single recordWork call per job, which the writer could in principle amend by chaining previousHash).
• The repository's AttestedAgentRounds already models exactly the missing authority (an authority-attested complete set + ownership evidence) but FounderFundedMining wires that authority slot to RobinhoodJobController, which has no finalize path. Therefore the deployed design quarantines 100% of agent emissions by construction unless a settlement authority is introduced before deployment.

The smallest missing piece is a Robinhood-native, IMD-signed "job acceptance manifest": an EIP-712 statement over (chainId 4663, intake requestId, jobId, final work-record documentHash, ordered list of (agentId, submissionHash, payoutWallet), revision, expiry) signed by an IMD authority key that FINANCIER can pin. The responsible authority is the IMD operator (the same party that runs the Intake writer 0x3d3c…25cb, the WorkRegistry writer 0x5da3…6d44 and the oracle signer 0x5598…2982). No such endpoint or signature exists today; the oracle's existing EIP-712 OracleAttestation is the closest shape, but it is restricted to chain-evidence recipes and cannot today attest "the accepted agents of job X" (see §3).

2. Evidence table (primary sources)

#	Claim	Source	Status
E1	Intake v2 on Robinhood 4663 is 0xa43e6f75ee006411f79ac1c84120606c2330de82; job.open@job-1 costs 0.5 IMD; onResult(bytes32 requestId, bytes32 resultHash, string uri); only the Intake writer 0x3d3c0df7c1a17d384545e9d7c8228897bd9625cb calls complete; "no refunds"	https://imdnotdead.fun/docs/ (fetched 2026-10-19)	Verified (doc)
E2	Robinhood runtime codehash of Intake v2 0xd96f270d…b5e8 and IMD 0xa9a0e893…93e2 pinned and rehearsed on a fork	src/FinancierMiningWithSettlement.sol:16-21, verification/fork/RobinhoodIntake.t.sol:19-29, test/fixtures/task16/*.hex	Verified (repo, eth_getCode observation)
E3	Genuine successful Robinhood job (oracle action, Intake v1 0x1397…ea56): tx 0x5933a9945475b878d9c6b64ab1a9e873e958160333f8b7cb396e197208afc179, block 0x506189c, chainId 0x1237=4663, from Intake writer 0x3d3c…25cb, callback into consumer 0x3c81384aa1ca064316576a214e2fb30969992772 with signed EIP-712 OracleAttestation (signer 0x5598aa9146215bc13eb26f2c692ad1461fd32982, panel 7, quorum 5, agreed 5)	test/fixtures/task6/pinky-callback.json; https://api.imdnotdead.fun/oracle/requests/dbcac6c2-6328-47a9-8e07-4c7b55f78e45/attestation (fetched 2026-10-19, identical)	Verified (chain record + live API)
E4	Genuine successful multi-agent job.open job 3d7ff049-1447-4076-8e84-635c42acf5e0 (5 accepted agents 50962, 51284, 51028, 51073, 51060): receipt written on Ethereum, tx 0x952500a5c41cae67745dd5ea162855c6060900e529268e88c3cebee07bef1c21, block 26,189,670 (2026-10-14 08:53:47 UTC), WorkRegistry 0xb6d0a187b050fa5bb0b87033a203f37becf4a775, function recordWork(bytes16 jobId, bytes32 previousHash, bytes32 documentHash, string uri, tuple[] signals) selector 0x765b59a5, from 0x5da3054201bc7e241875ac68173e49c269f76d44; 5 NewFeedback events on ERC-8004 ReputationRegistry 0x8004baa17c55a88189ae136b182e5fda19de9b63 + 1 WorkRecorded	test/fixtures/real-chain/work-receipt.json; https://etherscan.io/tx/0x952500a5… ; https://explorer.imdnotdead.fun/jobs/3d7ff049-1447-4076-8e84-635c42acf5e0	Verified (chain record + explorer)
E5	The work record document (schema: identitymd-work-v1) lists per-node acceptedSubmissionHash, signals[{agentId, submissionHash, value:1, tag2:"acceptance-v2"}], verification[{status:"accepted", evaluation:"structural"}] and identity registry 0x8004a169fb4a3325136eb29fa0ceb6d2e539a432 on chainId 1. It contains no wallet, owner, signer or signature field	https://api.imdnotdead.fun/work-records/6e6570b4b0e37c889ed9e12b4656dacfbc56275fd75610bf2655167045ca5146.json (fetched 2026-10-19); test/fixtures/imd-work/work-record.json	Verified
E6	Review document per agent (metric:"acceptance", value:1, qualityScore:null, revisions:0) also has no wallet/signature	https://api.imdnotdead.fun/review-documents/572b9021afa68a6aea1019720df7c72ec90aac84bec8aabda04d88af76d4fbae.json ; test/fixtures/imd-work/review.json	Verified
E7	Docs: "Receipts: the WorkRegistry writer 0x5da3…6d44 writes receipts and reviews, on Ethereum only." Robinhood table lists only Intake and IntakeDelivery 0xce0e6a670aa75e161d02aca3c7f00b94ca428ccb; "No WorkRegistry or ERC-8004 entries are listed." Agent IDs "come from the ERC-8004 IdentityRegistry, which IMD does not deploy."	https://imdnotdead.fun/docs/ (second half)	Verified (doc)
E8	Docs: oracle answer types bool, address, bytes32, uint256, address[], bytes32[]; questions are "chain-evidence recipes" (log-sum, log-count, log-rank, call-compare, v4-volume-rank, univ4-spot); "the deployer reruns the agreed recipe at the pinned blocks before it signs"; not_answerable 422 otherwise	https://imdnotdead.fun/docs/	Verified (doc)
E9	Launch reward snapshots (rewardSnapshot, claims=1 → {root, leaves:[{wallet, amount, proof}]}) exist only for token launches via the factory distributor; the Robinhood factory is 0x9c9d2fcb75c2c132c0ac0c42df3819a42347265e (launch 1727 fixture)	https://imdnotdead.fun/docs/ ; script/readiness_rpc.py:14-25; test/fixtures/real-chain/launch-1727-calldata.json	Verified; not applicable to per-job agent payout (different authority and leaf schema)
E10	Repo: completion never authorizes payout; empty-artifact "success" regression; controller has no finalize	src/FounderFundedMining.sol:92-102, src/RobinhoodJobController.sol:14-16, test/Task27BGenesis.t.sol:162-182	Verified (code)

Not verifiable in this run: the Robinhood block explorer (explorer.mainnet.chain.robinhood.com) refused TLS from this sandbox, so Robinhood tx 0xdcb2e5a4…bf1b5 (listed in script/readiness_rpc.py:33) was not re-fetched; E3 relies on the repo's RPC capture, whose block/chain fields are internally consistent.

3. What IMD authenticates today vs. what is missing

Verified facts (F), inferences (I), assumptions (A), unresolved (U) are tagged.

Authenticated on Robinhood 4663 today (F):

1. Payment of exactly 0.5 IMD by the vault to payee 0x4e0fa57bde726079356537e2f34d671e9f41adbc and the returned requestId (Intake.requests(id) → payer/target/selector/completed) — E1, E2.
2. Exact body bytes (vault stores keccak256(body) in workRequests[requestId]) — FinancierMiningWithSettlement.sol:138.
3. A single completion event per request: onResult(requestId, resultHash, uri) or onFailure(requestId, status, reason, …), callable only by the Intake writer — E1, E10.
4. Oracle attestations as EIP-712 signatures by 0x5598…2982 verifiable in a consumer contract on 4663 — E3.

Authenticated only on Ethereum (F): per-job recordWork receipt chaining previousHash → documentHash, and per-agent NewFeedback(agentId, …) acceptance signals — E4, E5, E7.

Not authenticated anywhere (F):

• Payout wallet for an agentId. ERC-8004 ownerOf(agentId) on Ethereum identifies a controller, not a Robinhood payout wallet, and no owner signature is included in any IMD document (E5, E6).
• Completeness assertion ("these N and no others were accepted for this job"). The work record is implicitly complete, but there is no field or signature stating finality/revision (revisions:0 per review, previousHash chain per job allows later records) (I from E4, E5).
• Any Robinhood-native commitment to the agent set. resultHash in onResult is keccak256 of the result document at the URI (E1). Whether that document embeds the work-record documentHash or the signals is U (the /jobs/:id/result schema is not published; the FINANCIER job has not been run).

The smallest missing authority (I): an IMD-operator-signed, Robinhood-domain-separated Acceptance Manifest per Intake request. Responsible party: IMD operator (Intake writer / WorkRegistry writer keys are already operator-controlled; the oracle signer already signs EIP-712 for 4663). Nobody else can issue it without inventing authorization: the founder, the financier or FINANCIER's own controller are all parties with an interest in the payout and cannot attest completeness.

Why the oracle cannot substitute today (F+I): the oracle only answers chain-evidence recipes over logs/calls (E8). A log-rank/bytes32[] question over Ethereum NewFeedback events filtered to the FINANCIER job could in principle return the accepted agentId list cross-chain, but (a) it introduces the Ethereum dependency the brief asks to avoid, (b) NewFeedback carries no wallet, (c) questionHash binds the job ID only if IMD's recipe grammar supports an indexed-topic filter on feedbackHash/job, which the docs do not state (U), and (d) the oracle signs with the same operator key, so it is not a stronger authority than a direct manifest, only a more awkward one.

4. Proposed official interface (requires IMD support)

EIP-712 domain: {name:"IdentityMD Acceptance", version:"1", chainId:4663, verifyingContract:<FINANCIER AttestedAgentRounds>} (same pattern as the oracle: the consumer sets the verifying contract — E3).

struct AcceptedAgent {
    uint256 agentId;        // ERC-8004 id on identity chain (today: chainId 1, 0x8004a169…)
    bytes32 submissionHash; // SHA-256 accepted submission (work record / NewFeedback)
    address payout;         // wallet the agent's controller authorized for chain 4663
    bytes32 ownerAuthHash;  // keccak of controller's signed payout authorization (IMD-verified)
}
struct AcceptanceManifest {
    bytes32 requestId;      // Intake requestId on 4663 (binds payment + body)
    bytes16 jobId;          // backend job UUID
    bytes32 bodyHash;       // keccak256(body) — must equal vault.workRequests[requestId].bodyHash
    bytes32 documentHash;   // final work-record documentHash (chain-1 receipt)
    bytes32 agentsHash;     // keccak256(abi.encode(AcceptedAgent[]))
    uint32  revision;       // monotonically increasing; final when `closed`
    bool    closed;         // IMD asserts no further records will chain for jobId
    uint64  issuedAt;
    uint64  expiresAt;
}
// typehash: keccak256("AcceptanceManifest(bytes32 requestId,bytes16 jobId,bytes32 bodyHash,bytes32 documentHash,bytes32 agentsHash,uint32 revision,bool closed,uint64 issuedAt,uint64 expiresAt)")

Delivery options (either is acceptable; the first is Robinhood-native and needs no new contract from IMD):

• GET /jobs/:id/acceptance-manifest returning typed data + signature, consumed by a new finalizeWithManifest on FINANCIER (below). Finality: closed == true and expiresAt > now. Revocation: a later manifest with higher revision and closed supersedes only if not yet finalized; after finalization the round is immutable. Replay: (requestId) is single-use via requestRoundPlusOne and the round is one-shot.
• Alternatively IMD delivers the manifest through the existing IntakeDelivery contract on 4663 (0xce0e…ccb) as a second callback. Not documented for jobs today (U).

5. Minimal pre-deployment contract changes (pseudocode)

The immutable FounderFundedMining must change before deployment; nothing here is an upgrade.

1. Replace the authority slot so settlement is a distinct, pinned signer instead of RobinhoodJobController (which keeps scope/dispatch only):

// AttestedAgentRounds (new constructor arg)
address public immutable manifestSigner;   // IMD operator key, pinned at deploy (placeholder until IMD publishes it)
bytes32 public immutable DOMAIN_SEPARATOR; // EIP-712, chainId 4663, verifyingContract = address(this)

function finalizeWithManifest(
    uint256 id,
    AcceptanceManifest calldata m,
    AcceptedAgent[] calldata agents,
    bytes calldata sig
) external nonReentrant {
    IAgentWorkVerifier.Context memory c = context(id);
    require(!rounds[id].finalized && scopes[id].committed, "state");
    require(block.timestamp >= c.end && block.timestamp <= c.deadline, "window");
    require(m.closed && m.expiresAt >= block.timestamp && m.issuedAt < c.deadline, "manifest");
    require(requestRoundPlusOne[m.requestId] == id + 1, "unbound request"); // set by bindJob
    (uint256 r, bytes32 body,) = vault.workRequests(m.requestId);
    require(r == id + 1 && body == m.bodyHash, "body");
    (, , , bool completed) = IIMDIntakeViews(WORK_INTAKE).requests(m.requestId);
    require(completed && vault.completions(m.requestId).status == 0, "not completed");
    require(m.agentsHash == keccak256(abi.encode(agents)) && agents.length <= MAX_AGENTS, "agents");
    require(ECDSA.recover(_hashTypedData(m), sig) == manifestSigner, "sig");
    _dedupeAndCredit(id, agents);          // identity = (sourceChain, registry, agentId); payout unique; ownerAuthHash unique
    emit RoundFinalized(...);
}

2. Keep bounds intact: _allocate already pays budget / n per distinct agent from vault.agentAllocation(start,end), so FINCR agent payouts stay within the 20% stream and financier claimFincr is untouched (FinancierMining.sol:202-206, 293-297).
3. Dedupe policy (approved identity policy): one share per distinct (chainId, identityRegistry, agentId), reject duplicate payout, duplicate submissionHash, duplicate ownerAuthHash; reject payout == vault/rounds/intake. Agents with value != 1 or missing verification.status == "accepted" are not in the manifest by definition.
4. Signer rotation: none (immutable). If IMD rotates keys, unsettled rounds expire to quarantine as today (expire). Disclose this.
5. No Ethereum call path is introduced; the Ethereum receipt is referenced only by documentHash inside the signed manifest.

Until IMD publishes manifestSigner, the constructor cannot be given a real value. Do not deploy with a stand-in.

6. End-to-end sequence (target design)

1. Financier wins the Dutch auction; RobinhoodJobController.prepareRound(r) precommits the 3 fixed body hashes (precommitRound) before round r opens.
2. Financier calls jobs.commission(r, category); the vault pays 0.5 IMD to Intake v2 via requestWithFailure("job.open@job-1", body, {vault, onResult}, onFailure, IMD, 0.5e18) and records workRequests[requestId] = (r+1, bodyHash, now).
3. IMD admits the job (backend admitted), seats agents, agents submit, verifier accepts submissions (structural or profile-based), job reaches completed.
4. Settlement authority (today: nobody; target: IMD-signed manifest) calls bindJob(r, Admission{requestId, jobId, bodyHash, requestedAt, admittedAt, evidenceHash}) while the window is open.
5. Intake writer calls vault.onResult(requestId, resultHash, uri); the vault records completions[requestId] (status 0). This authorizes nothing (E10).
6. IMD writes the Ethereum receipt recordWork(jobId, prev, documentHash, uri, signals) (today's behaviour, E4) and (new) signs the AcceptanceManifest with closed=true after the last revision.
7. After c.end and before c.deadline, anyone submits finalizeWithManifest(r, m, agents, sig); the contract checks request/body/completion linkage, signature, dedupe, then credits budget/n to each payout.
8. Each agent calls claim(r) from its payout wallet; vault.payAgentReward transfers FINCR, bounded by agentUnpaid().
9. If no valid manifest arrives by c.deadline, expire(r) quarantines the round's agent budget permanently (no reassignment).

7. Adversarial analysis

Threat	Official-manifest design	Trust-based MVP fallback (§8)
Omitted agent	Only possible if IMD signs an incomplete closed manifest; detectable off-chain by diffing against the Ethereum NewFeedback set for jobId; agent remedy is social/IMD, not on-chain	Founder/multisig can omit anyone; detectable the same way; no on-chain remedy
False inclusion / Sybil	IMD controls seating and acceptance; distinct agentId is only as Sybil-resistant as ERC-8004 registration (cheap). Mitigation: equal split caps gain per identity, MAX_AGENTS=32, fixed 0.5 IMD job price limits seats	Same plus authority can add fake agents outright; bounded to the round's 20% budget only
Malicious wallet substitution	payout must be covered by ownerAuthHash (controller-signed, IMD-verified); on-chain uniqueness of payout and ownerAuthHash	Authority asserts wallets; disclosed as trusted
Stale / superseded result	closed, revision, expiresAt, issuedAt < deadline; round single-shot; requestRoundPlusOne one-use	Same contract checks apply if the MVP reuses finalize + Snapshot fields
Replay across chains/contracts	EIP-712 domain pins chainId 4663 and verifyingContract; requestId is unique per Intake and bound to one round	settlementCommitment already includes block.chainid, vault, rounds, policyHash, round (AttestedAgentRounds.sol:274-283)
Callback spoofing	_record checks msg.sender == WORK_INTAKE, codehash, requests(id).completed (E10)	identical
Permanently quarantined funds	If IMD never signs (key loss, refusal) or signs after deadline, the round's budget is quarantined forever (expire). This is by design and must be disclosed; graceSeconds ≤ 30 days	Same; plus authority inaction quarantines
Empty-success	onResult with keccak("") passes completion but no manifest → no payout (test/Task27BGenesis.t.sol:162)	identical
Dishonest authority scope	Cannot touch financier stream, buyback, LP or ops buckets; bounded to agentAllocation(start,end) of that round	identical bound

8. Alternatives compared

Option	Authority	Chain deps	Completeness	Wallet ownership	Status
A. IMD-signed Acceptance Manifest (§4)	IMD operator key	Robinhood only	Asserted by IMD (closed)	IMD-verified controller authorization	Recommended; needs IMD
B. Oracle bytes32[]/address[] question over Ethereum NewFeedback for the job	Oracle signer 0x5598… (same operator)	Ethereum evidence, Robinhood signature	Only if recipe can filter by job; U	None (no wallets in events)	Not usable today
C. Ethereum receipt proof (storage/receipt proof of WorkRecorded on chain 1 into 4663)	Ethereum consensus + IMD writer	Requires an Ethereum light client / bridge on Robinhood (none demonstrated)	Implicit, no finality flag	None	Out of scope per brief; heavy
D. Launch rewardSnapshot Merkle root	IMD launch distributor	Robinhood factory	For launches only, not per-job agents	Wallet leaves exist	Not applicable (E9)
E. Trust-based MVP: founder/multisig as settlementAuthority, using existing finalize with Snapshot.acceptedSetEvidenceHash = documentHash and ownershipEvidenceHash = keccak(owner authorizations)	FINANCIER multisig	Robinhood only	Trusted, not proven	Trusted, not proven	Deployable today, must be disclosed as trust-based; a founder-generated root is not official proof

Decision for a hackathon MVP: ship E with the existing AttestedAgentRounds.finalize (already implemented and tested) under a disclosed authority (a 2-of-3 multisig including a non-founder reviewer), with the policyHash committing to the published dedupe/wallet policy, and request A from IMD in parallel. If IMD delivers A, the next deployment swaps the authority for the signer-verified path in §5.

9. Prioritized implementation and validation checklist (MVP)

1. Decide authority for MVP (multisig address is requester-supplied; do not use a placeholder in production). Blocking.
2. Change FounderFundedMining._nativeConfig so c.authority is that multisig, not the nonce-3 controller; keep RobinhoodJobController for precommitRound/dispatchWork by splitting the authority into scopeAuthority and settlementAuthority in AttestedAgentRounds (two immutables).
3. Add finalizeWithManifest (§5) behind an immutable manifestSigner; if unknown at deploy, omit the function entirely rather than ship a dead signer.
4. Publish the dedupe/wallet policy document and set policyHash = keccak256(policy).
5. Off-chain tooling: script that builds Contribution[] + OwnerEvidence[] from /work-records/:hash.json, /jobs/:id/submissions, and the Ethereum NewFeedback logs, and computes settlementCommitment for the multisig to sign.
6. Tests to add in test/: (a) manifest signature domain/replay rejection, (b) revision supersession, (c) request/body/completion linkage, (d) 32-agent gas bound for finalizeWithManifest, (e) expire after signer silence, (f) fork rehearsal against Intake v2 runtime with a real-shaped manifest.
7. Run one real 0.5 IMD job.open from a throwaway payer (not the vault) to capture the /jobs/:id/result schema and determine whether resultHash commits to documentHash (resolves U1).
8. Ask IMD (written request, with §4 struct) whether they will sign manifests and publish the key; also ask whether oracle recipes can filter NewFeedback by job (resolves U2).
9. Disclosure text for README/front-end: agent payouts are trusted-authority attested until IMD support lands; omission has no on-chain remedy; unsettled rounds are quarantined permanently.

10. Separation of facts, assumptions, proposals and open dependencies

Verified facts: E1–E10 above; the repository design (authority slot = controller without finalize; completion never pays; equal split; 20% bound).

Inferences: the IMD operator controls all relevant keys (writer, oracle signer, quote signer are all listed in official docs as operator roles); the Ethereum receipt is implicitly complete but has no finality flag; the oracle cannot today express an acceptance-list question.

Assumptions: IMD will continue writing one recordWork per completed job.open; ERC-8004 identity remains on Ethereum (so SOURCE_CHAIN=1 in AttestedAgentRounds stays correct even for a Robinhood-only payout path); Intake v2 runtime codehash remains stable.

Proposals (not official): the AcceptanceManifest struct, finalizeWithManifest, authority split, and the MVP multisig fallback.

Unresolved dependencies:

• U1: content of /jobs/:id/result for a FINANCIER job and whether resultHash embeds the work-record documentHash.
• U2: whether IMD will sign and publish a manifest key, and whether oracle recipes can filter per job.
• U3: a Robinhood-native identity/wallet binding (POST /agents/bind and /seats/owners are Ethereum-centric).
• U4: Robinhood explorer re-verification of tx 0xdcb2e5a4… (TLS blocked in this environment).
• U5: the MVP authority address is a requester decision and is not supplied here.