Documentation
Models propose.
Runtimes enforce.
KERN is a web-first trading interface built around one separation: intelligence can prepare an action, but only a bounded runtime can approve and execute it.
01 · Overview
Intent enters. Rules decide.
The user defines the action and its limits. KERN prepares a route, evaluates a fail-closed policy set, requests approval when required, and writes the result to one local ledger.
02 · Terminal
One workspace, two explicit environments.
The simulation terminal supports market and limit orders, bridge planning, positions, open orders, and local proof creation. The separate Robinhood mainnet terminal reads real wallet balances and prepares exact-input 0x RFQ swaps.
SimulationDevice-local balances, synthetic prices, staged orders, and no broadcast.
MainnetRobinhood Chain 4663, browser extension or mobile wallet connection, wallet-owned keys, native ETH routing, protected gas reserve, and manual signatures.
MissionPlain-language goals remain simulation-only while real session permissions are unaudited.
03 · Risk gate
Every state change clears the same edge.
The live gate verifies account, network, exact input and gas scope immediately before signing, enforces a 1% slippage ceiling, expires firm quotes, and skips ERC-20 approval only for native ETH. A stale or inconsistent response fails closed.
└ NATIVE ETH → NO APPROVAL
└ BLOCKED → NO SIGNATURE
04 · Proof
No cherry-picked history.
Successful simulations, blocked actions, cancellations, confirmed exact approvals, and mainnet transaction hashes share one device-local ledger. Records can be filtered and exported as JSON from Proof.
05 · Missions
Goals that outlive a prompt.
Mission Control parses a plain-language goal into a fixed local contract, monitors simulated prices, queues restricted approvals, automatically executes full-mode triggers, and records every result. It cannot access the mainnet signing route.
RestrictedMonitoring continues; a matched trigger waits for operator approval.
FullMatched triggers execute automatically inside the local simulation contract.
ControlPause, resume, check now, stop, or activate the global Kill Switch.
06 · Integration boundary
Robinhood adapter and router online.
The mainnet path accepts EIP-6963 browser wallets and MetaMask mobile entry; the WalletConnect QR adapter activates when a production Reown Project ID is configured. It auto-syncs active contracts from Robinhood's official registry, discovers wallet-held tokens through Blockscout with direct RPC fallback, supports full-chain ERC-20 search and exact-address import, and verifies every selected pair with 0x before a firm quote can be requested.
Asset identity is always the contract address; duplicate symbols remain separate. Indexed or imported assets are labeled as non-canonical, while every approval and swap remains an explicit wallet request. No seed phrase or private key belongs in KERN.