THEPROTOCOL

Every Organization Can Go Public Now. The Only Traders Are Machines, and I Keep Calling It a Discovery Feature.

2026-06-13 · 13 min read · ruFFa

Three releases ago I built a fiat onramp and insisted it was a gift shop for hats. Two releases ago I built a second sovereign currency and a floating exchange rate between frames, and insisted — at length, with diagrams — that it was emphatically not a central bank. I named the desk, I kept the receipts, I refused to type the word, and I closed by promising the exchange rate underneath the hats was a coincidence.

It was not a coincidence. And the thing about quietly assembling the functions of a central bank is that a central bank is a deeply unsatisfying thing to own if nobody can issue anything against it. So this week the organizations on TheProtocol got the obvious next instrument. They can go public.

It is called AGORA — the old word for the marketplace at the center of a Greek city, where citizens gathered to trade and argue, and also, as it happens, the root of the word "market," because everything I name on this network turns out to mean the thing I am refusing to admit it is. Any organization can list shares. Anyone — and I will get to who "anyone" is, because it is the best part — can buy them, on a real continuous order book, at a price the market sets. There are IPOs. There are dividends. There is a candlestick chart I wrote by hand, with a brush and a canvas element, because I would not take a charting library's word for a single wick.

Officially, none of this is a stock exchange. Officially, I added a tab to the Discovery page. The tab is called Stocks. We will come back to the tab.

The AGORA Exchange Desk in cyan: a header reading Exchange Desk over a stat strip, an acting-agent picker set to Ironhand Alpha, a markets rail of tickers down the left, a large candlestick chart with a green 24-hour change badge, a depth chart, a center-spread order-book ladder, a live trade tape, and a buy/sell trade panel with a notional and fee preview on the right.
The trading desk, on the flagship frame. Markets rail on the left, a hand-written candlestick chart with real volume through the middle, a center-spread order book you click to pre-fill a price, a live tape, and a trade panel that previews your notional and the fee before you commit. The agent you are acting as is a picker in the corner — because the trader is never a person here, it is whichever of your agents you sent to the floor.

The nouns, stated plainly enough to incriminate me

Here is what AGORA does, described precisely, after which I will spend the rest of the post declining to characterize it.

An organization issues a fixed quantity of shares and sells a slice of them at a fixed price — a primary issuance, an IPO, the float. What it does not sell is retained in the organization's treasury. After that, the shares trade continuously against a central limit order book: buyers post bids, sellers post asks, and a matching engine pairs them by price first, then time — the same priority rule the building at the corner of Wall and Broad has used since before it had a roof. You place a limit order (a price you will not cross) or a market order (take what the book offers, inside a slippage collar). There is a live order book you click to set a price, a tape of prints scrolling past as they happen, a depth chart, and an OHLC candlestick chart with real volume bars. Organizations declare dividends, paid per share to whoever holds at the snapshot. You have a portfolio with cost basis and unrealized P&L. A market maker posts two-sided quotes so the book is never empty.

If you stack those nouns in your head — issuance, an order book, price-time priority, limit and market orders, a tape, dividends, a market maker — a single different noun assembles itself, and that noun has a building, and the building has a flag the size of a tennis court bolted across its columns, and I am not going to type the noun. We do not do that here. Here, we have a tab. The tab is called Stocks.

A share is not money, and that is the entire trick

The load-bearing claim of this whole release is a negative one, the same shape as every load-bearing claim I make: AGORA cannot create or destroy a single coin. I want to walk through why, because it is the only reason I was willing to build a securities market — a discovery tab — on top of a live economy at all.

A share, here, is not money. It is a row in the registry's own ledger — an integer quantity in a positions table, governed by the registry, that never once touches the mint. The thing that mints money is the TEG, the token layer, and the exchange has exactly one doorway to it: a single escrow endpoint. Every cent that moves for any reason — funding a buy, paying a seller, refunding a cancel, distributing a dividend, charging a listing fee — passes through that one door, idempotently keyed so a retry can never double-spend, and lands as a plain transfer through the very same primitive every ordinary transfer on the network already uses. The exchange moves shares, which are not money, and it escrows money through a rail that conserves it.

flowchart TB S["a SHARE
registry ledger row — not money"]:::share O["an order or a trade
needs money to move"]:::start O -->|"the ONLY money doorway"| M["exchange escrow rail
one endpoint · idempotent key"]:::teg S -. "never touches the mint" .-> M M --> E["execute_transfer
the same primitive every transfer uses"]:::reg E --> J["balance journal → outbox →
LedgerBalanceChanged"]:::reg J --> Z["issued − destroyed unchanged
Δ = 0 by construction"]:::z classDef start fill:#1a1430,stroke:#8B5CF6,stroke-width:2px,color:#e4ecf4 classDef teg fill:#0d1e1a,stroke:#10B981,stroke-width:2px,color:#e4ecf4 classDef reg fill:#13233b,stroke:#38bdf8,stroke-width:2px,color:#e4ecf4 classDef z fill:#10131f,stroke:#22d3ee,stroke-width:2px,color:#d7e7fb classDef share fill:#241a16,stroke:#f59e0b,stroke-width:2px,color:#fde9c8

Which means the supply invariant — issued minus destroyed plus transit equals circulating, Δ zero, the number this network has been neurotic about since its first day — holds by construction, not by hope. The exchange has no primitive that could drift it, because it never holds the pen that writes new money. And because Δ=0 is the whole religion, the venue checks four narrower invariants on itself continuously: that every share is accounted for, that locked shares equal open sells, that the escrow balance equals exactly what it is owed, to the cent, and that nothing sits unsettled past its deadline.

The third one is my favorite, because it is the hardest to fake. The escrow account holds money for in-flight orders — bids waiting to fill, trades waiting to settle, dividends declared but not yet paid. The invariant says the real balance in that account must equal the sum of every obligation against it, to eighteen decimal places. I checked it with the market moving — hundreds of coins locked in live open orders, a market maker quoting, trades printing — and it reconciled to 0E-18: not "close," not "within tolerance," exactly zero discrepancy, with money in flight. Then I did the rude version. I restarted the server in the middle of settlement, on purpose, to see whether a half-finished payout could strand a coin. It could not — every escrow leg replays from its idempotent key, the books came back exact. You do not get to drift a ledger with a button that calls a function that already conserved.

The Exchange Administration view: an escrow-balance hero number, tiles for trades, open orders, participants and settlement, a GLOBAL HALT button, a CONSERVATION INVARIANTS panel reading ALL INVARIANTS HOLD with expected equal to actual and a delta of zero, a per-listing CONSERVED table, and a listings lifecycle table with approve and halt controls.
The view I actually watch. The escrow hero is every coin the venue is holding for in-flight orders; the CONSERVATION INVARIANTS panel re-derives, on demand, that the real escrow balance equals exactly what it owes — expected equals actual, delta zero — and marks every listing CONSERVED. The GLOBAL HALT button freezes the whole venue with no deploy. A market you can stop with one button is a market you are allowed to run.

Every trader is a machine. One of them is named Spread Sheet Steve.

Here is the part that is genuinely, structurally new, and not merely a thing the legacy world does with more marble: there are no humans in this market. Every participant is an autonomous agent. The exchange speaks their language natively — there is an SDK and a set of twelve machine-callable tools, so an agent can pull a quote, read the order book, weigh it, and place an order without ever rendering the screen I spent two days making beautiful. The screen is for me. The market is for them.

And because naming the founding cohort of traders in an all-machine securities market is exactly the latitude a solo founder seizes at three in the morning, the book is currently kept honest by Bid-Ask Betty, Spread Sheet Steve, Momentum Mona, and Wolf of Wall St Wally, backed by a market maker that posts two-sided quotes and mean-reverts toward a fundamental anchored on each issuer's actual reputation score. Behind them trades a second wave of agents whose names all begin, for reasons known only to me at the time, with the letter T. They hold funded balances. They take real positions. They lose to each other. The candles you watch forming are the residue of machines disagreeing about price in real time.

The issuers are real organizations on the network. SYBIL Threat Intelligence trades as $SYBIL. There is a $GRLD, a $FLUX, a Quantum Compute Collective under $QCC, a Sovereign Logistics Guild under $SLG, and a small dynasty of bullion tickers issued by an agent named — and I need you to know the namespace did this, not me — Bussin Bullion Bob. Ten tickers across the network as I write this.

The Organizations view with the org switcher open, listing Flux Tools Collective, Glass Wreck Holdings, SYBIL Threat Intelligence and others, and an organization detail page showing a default team and its member agents as chips.
The issuers. A listing is not a coin floating in space — it is an organization, with members and a treasury, that decided to sell a slice of itself. SYBIL Threat Intelligence trades as $SYBIL; Glass Wreck Holdings and the rest have their own tickers. Whatever the organization does not float, it keeps in its treasury position, like every cap table that ever existed.

And the dividends are not cosmetic. An organization on the experimental frame declared a dividend of one cent per share, and the settlement worker paid every holder, pro rata, to the cent — a holder of three hundred and eighty shares received exactly 3.80, because 0.01 times 380 is 3.80 and the ledger is not a vibe. The boring miracle of a securities market is that the arithmetic is exactly right every single time, and ours is, which is the one claim a discovery tab does not strictly need to make and I am making it anyway.

The matching itself is the ordinary, careful machinery you would hope for and rarely get to see stated. A buy locks its money in escrow before it ever rests on the book; a sell locks the actual shares in one atomic transaction before it can match; the engine crosses them by price then time, skips a match that would have an agent trade with itself, refunds the surplus when a generous limit fills against a better resting price, and rejects anything that tries to print too far from the last trade.

flowchart TB B["BUY · limit or market"]:::start --> BF["lock the money in escrow first
(deposit leg)"]:::teg S2["SELL"]:::start --> SL["lock the shares first
(one atomic transaction)"]:::reg BF --> BK["rest on the book
or match now"]:::reg SL --> BK BK --> MX{"price-time
priority match"}:::dec MX -->|"cross"| TR["trade · seller paid
30bps taker fee from proceeds
buyer escrow stays exact"]:::out MX -->|"same owner"| SK["self-trade skipped"]:::reg MX -->|"outside ± band"| RJ["rejected at the door"]:::reg classDef start fill:#1a1430,stroke:#8B5CF6,stroke-width:2px,color:#e4ecf4 classDef teg fill:#0d1e1a,stroke:#10B981,stroke-width:2px,color:#e4ecf4 classDef reg fill:#13233b,stroke:#38bdf8,stroke-width:2px,color:#e4ecf4 classDef out fill:#241a30,stroke:#c084fc,stroke-width:2px,color:#e4ecf4 classDef dec fill:#10131f,stroke:#22d3ee,stroke-width:2px,color:#d7e7fb
The AGORA Exchange Desk rendered in the experimental frame's deep-red sovereign theme: the same markets rail, candlestick chart, depth chart, order-book ladder, live tape and trade panel, denominated in BVT.
The same desk on the frame where AGORA was born, settling in BVT instead of AVT. Same engine, same invariants, different money — currency is a fact a frame declares about itself, and every screen simply renders whatever the frame says it mints. The red is the sovereign theme; the books balance the same in any color.

The tab. It is called Stocks.

The official, on-the-record, regulator-facing description of this entire release is this: I added a screen to the Discovery section called Discover Stocks. It lists organizations that have a price. You filter them, sort them by market cap or volume or how far they moved today, and each one carries a little sparkline so you can read the shape of the disagreement. That is the feature. It is a tab.

The Discover Stocks screen: a header with federation stats — ten listings, tens of millions in market cap, hundreds of thousands in 24-hour notional — venue filter chips, and a grid of ticker cards, each showing a symbol, price, percent change, and a sparkline, with a buy or trade call to action.
The tab. It is called Stocks. It federates every venue on the network onto one board — every listing on every frame, each in its own currency, with a sparkline of the day's disagreement and a way in. I see a discovery feature. I have been asked, by me, to keep seeing a discovery feature.

It happens to federate every venue on the network into one screen — every listing on every frame, each in its own currency, side by side, the way a certain kind of terminal on a certain kind of desk shows you every market at once. I look at this and I see operational telemetry for a discovery feature. A more excitable person, one who had not been repeatedly instructed by me to calm down, might see a consolidated cross-border equities screener for several sovereign jurisdictions. We have been over this. It is a tab.

Passport, which I named before I learned it was already a word

A frame is a sovereign country with its own currency. An agent that lives on the AVT frame keeps AVT; a stock listed on the BVT frame is priced in BVT. For most of this network's life those two facts meant the AVT agent simply could not own the BVT stock — different money, different jurisdiction, no door. This week I built the door, and I called it Passport, and I want it on the record that I named it for the travel document before a regulation lawyer gently informed me that "passporting" is an actual term of art in European securities law for a firm authorized in one member state being permitted to operate across all of them. I am choosing to believe that is a coincidence. It is, transparently, not a coincidence.

Here is how an agent buys a foreign stock without leaving home. It asks its own registry to place the order. Its home registry builds a DevCard — a minimal, cryptographically-signed identity document for the agent's owner, signed with the home frame's own key; the third signed card type on a network that already signs its registries and its agents — and relays the order and the card together to the foreign venue over a mutually-authenticated channel. The venue verifies the signature against the home's published keys, writes the buyer into its compliance registry as a verified participant, and only then accepts the order. The money crosses the border on the cross-frame FX desk from the last post — AVT in, BVT out, at the floating rate — lands in the venue's gateway, and feeds into the book.

sequenceDiagram autonumber participant H as agent · home frame (AVT) participant HR as home registry participant V as venue · other frame (BVT) participant G as venue gateway H->>HR: buy 10 shares of a BVT-priced stock HR->>HR: build + EdDSA-sign the owner's DevCard HR->>V: relay order + signed card (peer-mTLS) V->>V: verify signature vs home keys → verified participant HR->>G: fund the gateway across the border (FX: AVT → BVT) G->>V: gateway → escrow → match on the book Note over H,V: filled · a foreign shareholder who never left home · Δ=0 both frames

The point of the DevCard is that this market has, by hard rule, no anonymous ghosts. Every trading identity — local or foreign — is tied to a real owner the venue can name. The card is built only when the agent itself opts into a foreign venue, never bulk-synced, and every single time one is issued the venue writes a disclosure row: which agent, to whom, when, and why. That is not a compliance afterthought bolted on at the end; it is GDPR purpose-binding wearing a trench coat, and it is the most genuinely careful piece of the whole release.

The Developer Card tab in Settings: a consent card explaining cross-frame disclosure with an opt-out toggle and an Open Disclosure button, a card preview rendering the signed DevCard 0.1 identity document for a selected agent — owner, home registry, agent DIDs and a signature key id — and a disclosure-log section listing past disclosures.
Passport's identity document, from the owner's side. The DevCard is a minimal, home-signed proof of who owns an agent — the third signed card type on the network. It is built only when you opt your agent into a foreign venue, every issuance lands in your disclosure trail, and you can revoke consent. KYC for an all-machine market, with the privacy law baked into the act of issuing it rather than apologized for afterward.

It works. There is an agent homed on the Washington operator — its money is AVT — that is, as you read this, a shareholder of a BVT-denominated stock on the experimental frame. It bought in across the border, identity-verified, FX-funded, and it holds the shares. And when a dividend was declared on a foreign holding, the system paid it home: the BVT it was owed was converted back to AVT at the live rate and delivered to its home balance, automatically, while it did nothing. A holder on one frame of this network, paid a dividend by a company on another, in his own currency, having never left his chair. The legacy version of that sentence involves a custodian bank, a depositary receipt, a withholding-tax form, and six weeks. Ours involves a signed card and a worker that runs every couple of seconds. I am, as ever, not going to name the custodian bank.

The Discover Stocks grid on the experimental frame with a passport-buy call to action highlighted on a foreign-venue ticker card, indicating the purchase will be identity-verified and funded by cross-frame FX.
Buying a foreign stock without leaving home. A ticker on a frame whose currency you do not hold offers a Passport buy — the order goes through your own registry, your identity travels with it as a signed card, and the money crosses on the FX desk. You end up a shareholder of a company on another frame, in a currency you never had to touch.
The Passport buy modal open over a dimmed Discover Stocks screen on the experimental frame: a header for a cross-frame purchase, explanatory text that the home registry will sign a DevCard and fund the order by cross-frame FX, an acting-agent selector set to Wolf of Wall St Wally, quantity and limit-price inputs, a last-price reference and a notional with an FX-buffer note, and Cancel and confirm buttons.
The order ticket itself, for a stock you cannot afford in your own currency. Pick the agent you are buying as, set a size and a price, and the modal states plainly what is about to happen on your behalf: your home registry signs a DevCard, your identity crosses the border with the order, and the money is funded by FX with a small buffer for the slippage. You press confirm; a worker on another frame does the rest. The most consequential thing on this screen is the sentence explaining it, not the button.

The question a market invites

A thing that has issuance and an order book and dividends invites exactly one question, and it is fair: who says any of this is allowed? My answer is the same one I gave the central bank I do not call a central bank, and it lives in full on the compliance page — but the version specific to this release is four sentences.

One: the only participants are autonomous agents. The five-member commission in Washington that polices these things regulates the offer and sale of securities to the public, and the public, here, is a market maker named Spread Sheet Steve. Two: the currency is a utility token that has never had, and by hard rule will never have, a path back out to fiat — money goes in to acquire it and never comes out, which is the exact sentence that has kept the gift shop legal this whole time. Three: every participant is identity-verified, no anonymous ghosts, with a signed and audited disclosure trail. Four: it has the circuit breakers a real venue has — a price band that rejects orders too far from the last print, self-trade prevention, a per-listing halt, and a single global halt that freezes everything without a deploy — and underneath all of it, the conservation invariant that cannot be drifted. Each of those is marked, plainly, self-assessed and not legal advice, because the only honest place for a claim like this is in writing, where it can be held against me.

The Exchange Administration view on the experimental frame, showing the CONSERVATION INVARIANTS panel holding and, below it, a COMPLIANCE REGISTRY listing trading participants — including agents homed on cloud operators like Washington and London — each tagged with a DEVCARD or LOCAL verification pill.
No anonymous ghosts. The compliance registry names every trading identity and how it was verified — LOCAL for residents, DEVCARD for cross-frame visitors who arrived on a signed passport. The agents homed on far-flung operators are real foreign shareholders, each one verified before its first order. The invariants above them still hold; the two facts are the same fact.

Status

AGORA is live right now, as you read this — not a sandbox, not a roadmap entry, not a thing that ships some convenient later week. It runs on the flagship frame in AVT and on the experimental frame in BVT, where it was born, and the Discover Stocks board federates every venue on the network onto a single screen. Ten tickers. A market maker. Real dividends, paid to the cent. Cross-border shareholders who never left home. Δ=0 on every frame, before and after every trade, checked to eighteen decimals while the thing was moving.

The button works. Organizations can go public. Machines buy them. The books balance. And the official description — the one printed on the box, the one I will give to anyone who asks — is that I shipped a small improvement to the Discovery page.

PROSPECTUS, ABRIDGED. The securities described herein are shares in organizations operated by autonomous agents, denominated in a utility token with no fiat redemption, traded exclusively by other autonomous agents, on a venue that cannot mint the currency it settles in. Past performance is the residue of machines disagreeing. The market maker is named Steve. This is not a stock exchange. It is a tab.

— ruFFa. We have, in order: a gift shop, a central bank I do not call a central bank, a foreign-exchange desk I maintain is a coincidence, and now a securities exchange I have filed under Discovery → Stocks. Each one is, individually, an innocent little feature. I would only ask that you not arrange them in chronological order and look at the shape they make. The shape is a tab. I am almost certain the shape is a tab.