Run by Jev.

Just Jev is a token whose treasury has no human at the controls. A decision model picks four levers once a minute; the contract sizes every amount, executes, and keeps the record.

What this is

Every trade of the token pays a creator fee. On most tokens that fee goes to a wallet somebody controls. Here it goes to an Operator contract that has no owner and no withdraw function. The only key that exists is the signer the model's keeper uses, and the only thing a signature can do is choose among four levers, each capped and rate-limited in code.

The model is Jev, TypeSafe's System One model. It does not write text; it answers typed questions with a probability for every option. That makes it cheap enough to ask every minute and honest enough to publish: each decision carries the model's probabilities and a hash of the exact state it judged.

The four levers

Lever	Options	What NOW / YES does	Cap	Cooldown
buyback	wait · now	swaps treasury dollars into the token, on the launch curve before graduation and on the Uniswap v4 pool after	20% of treasury USDG per decision	3 minutes
dispose	hold · burn	burn sends every token the treasury holds to the dead address	all held tokens	none
accumulate	none · NVDA · TSLA · SPY	swaps treasury dollars into that Stock Token through its direct USDG pool	25% of treasury USDG; fill must be ≥97% of the Chainlink price	5 minutes
pay	no · yes	opens a payout round of one treasury asset to holders, pro rata to balance at the snapshot block	25% of that asset	60 minutes

Two floors apply to every swap: nothing under $5 moves, and a stock purchase reverts if the Chainlink feed is older than 24 hours. The caps and cooldowns are constants in the contract. Nobody can change them, including the signer.

One minute, step by step

Compact. The keeper reads the chain and the market and turns the last minute into words: flow, price moves, volume heat, treasury size, stock holdings and moves, time since each lever last fired. No free text is ever included.
Judge. One request to Jev with that state and the four Choice questions. Jev returns a pick and a probability per option for each question, in a few hundred milliseconds.
Sign. The keeper builds a Decision (minute, deadline, the four picks, the four probabilities packed into one number, the state hash, a floor for the buyback fill, and the payout root if paying) and signs it with EIP-712.
Decide. Anyone can submit the signed decision; the keeper does. The contract checks the signature, that the minute is newer than the last one, and the deadline.
Execute. Harvest the escrow first, then the levers in order: buyback, dispose, accumulate, pay. Each lever checks its own cooldown and cap and simply does nothing if either blocks it.
Record. The decision and what it moved are written to a 256-entry ring in the contract and emitted as an event. The keeper also appends the full state and the model's answer to a public log the site reads.

What the model sees

The state is a small JSON object of buckets. This is the complete list:

venue: launch curve or liquidity pool
price_vs_1h, price_vs_24h: down more than 15% · down 5 to 15% · flat · up 5 to 15% · up more than 15% · unknown
flow_last_5m, flow_last_1h: quiet · sellers dominate · balanced · buyers dominate
volume_heat: quiet · normal · hot
treasury_usdg: under $50 · $50 to $500 · $500 to $5,000 · $5,000 to $50,000 · over $50,000
token_held_by_treasury: none · some
stock_holdings and stock_moves_24h per stock, same buckets
since_last_buyback, since_last_stock_purchase, since_last_payout: never · under 5 minutes · 5 to 30 minutes · 30 minutes to 3 hours · over 3 hours

Why buckets and not numbers: Jev's own documentation says it cannot count, cannot compare raw numbers reliably, and reads injected text literally. Words it can judge; arithmetic stays in code. Why no free text: a token description or a chat message could otherwise steer the treasury.

The decision record

Every decide() stores a Record: the minute, the timestamp, the four picks, the packed probabilities (four 16-bit values, buyback high to pay low, in basis points), the state hash, and what moved: dollars in, tokens out, tokens burned, stock out, amount paid, payout round. Read the last 256 with recentDecision(i), oldest first is i = 255. The site's feed adds the off-chain half: the full state and the model's full probability distributions, keyed by the same state hash.

Contracts

Operator

Holds the treasury. No owner, no pause, no withdraw, no upgrade. Immutable wiring to the token, USDG, the Pons fee escrow and curve, three swap adapters, the stock list with feeds, and the Distributor it deploys. Public functions: decide, harvest, rotateSigner (callable only by the current signer) and views.

Distributor

Payout rounds. Only the Operator can open one. A round is a token, a total, a Merkle root and the decision minute. claim(round, account, amount, proof) pays the account, once. After 30 days anyone can sweep the remainder back to the Operator.

Adapters

Stateless, hold nothing, no privileges. CurveBuyAdapter buys on the launch curve. V4SwapAdapter buys on the graduated pool through the PoolManager with the pool key fixed at deploy. UniV3SwapAdapter swaps USDG into a stock along a path fixed at deploy. The Operator re-checks its own balance after every swap.

The signer

If the signer key leaked, the worst an attacker could do is pull the levers within the caps: buy back and burn too eagerly, rotate stocks, open payout rounds to holders. Nothing can be sent anywhere except the token's own market, the stock pools, the dead address and the holders. The signer can hand its role to a new key, and no one else can.

Token: —
Operator: —
Distributor: —
Curve: —
Signer: —

Fees

The token is launched on Pons V2, quoted in USDG. Each trade pays the pool fee plus a 3% creator tax. Pons keeps 30% of the pool fee as protocol share; the creator share and the tax accrue to the Operator in the Pons fee escrow. Before graduation the Operator sweeps the curve itself on every decision; after graduation the pool's hook fees are swept into the escrow by Pons and claimed on the next decision. In the first three seconds after launch Pons applies a snipe tax that starts at 99% and decays to zero; whatever snipers pay lands in the same escrow.

Payouts

When the model says yes, the keeper reads the amount the contract would allow (payQuote), takes a snapshot of every holder's balance at the current block, splits the amount pro rata, builds a Merkle tree over (account, amount) and puts the root into the signed decision. The contract moves the tokens to the Distributor and opens the round.

To verify a round, recompute the balances at the published snapshot block and rebuild the tree; the root must match the one in the RoundOpened event. The Operator itself and the dead address are excluded. Claims can be sent by anyone on behalf of an address; the tokens always go to that address.

The model grades wallets

Before a round, the keeper compacts every holder's recent behaviour into buckets, the same way it compacts the market: how long the wallet has held, buys and sells this week, whether it sold into weakness or bought it, its size against the typical holder. Nothing in the buckets is a number the model would have to count. Each wallet is one request with one score question on five ordered levels, flipper, trader, holder, patient, pillar, and the model returns a score from 0 to 4 with its probabilities.

The score sets a weight from 0.5× (flipper) to 2× (pillar), and a round's shares are pro rata to balance × weight instead of balance alone. The snapshot block, every weight and every amount are published with the round, the Merkle root is inside the signed decision, and the grading itself is at /api/grades with each wallet's buckets, so anyone can rebuild the tree. Grades refresh every 30 minutes and a round never uses grades older than three hours. On a fork the behaviour comes from the local trade log; live it comes from the explorer's transfer history, and a wallet whose history cannot be read is graded from "unknown" buckets rather than penalised.

The keeper

A small process that runs the loop and serves this site. It reads balances and the Pons escrow from the chain, market stats from GeckoTerminal once the pool exists, and Chainlink feeds for the three stocks. It never scans logs, which this chain's public RPCs cap. It signs with the operator's signer key and pays gas for one transaction a minute. If it dies, nothing moves and nothing is lost; the treasury simply waits. If no model key is configured it runs a fixed rulebook and labels every decision shadow-rulebook, so a rulebook decision can never be mistaken for the model's.

The model

Jev (jev-latest, currently 1.13) is served by TypeSafe directly and through OpenRouter, Vercel and Cloudflare gateways. Input is billed at $0.042 per million tokens and output is free; one decision here costs a fraction of a cent. The four questions and their criteria are printed verbatim on the live page under The model, with the state of the current minute, so the request that produced any decision can be reproduced.

Risks

The model can be wrong. Calibrated does not mean right. It can buy into a dump or sit out a bottom. The caps limit how much any one minute can cost.
Thin markets. A buyback on a thin pool moves the price; the keeper's floor guards against sandwiches, not against paying up.
Feeds and pools. A stale Chainlink feed blocks stock purchases. A missing direct pool would make a stock unbuyable; the three chosen stocks all have one.
The keeper. A dead keeper pauses the token's treasury until it is restarted. A compromised signer can misuse the levers within the caps, as described above.
Securities. The treasury buys tokenized stocks and pays them to holders. Whether that is available to you depends on where you are.

Questions

Why a decision model and not a chat model

A chat model writes a paragraph you then have to parse, takes seconds, and costs cents. Jev answers a typed question in a few hundred milliseconds with a probability. Asking it every minute costs less than a dollar a day, and the probability is a number the contract can carry.

Why every minute

Because it can be. The cooldowns mean the treasury still moves at most every few minutes; the minute cadence gives the record a steady rhythm and lets the model wait most of the time.

Who can call harvest

Anyone. It only pulls what the escrow already owes the Operator; every decision runs it first.

Can the levers change

No. The caps, cooldowns, stocks and adapters are immutable. A different set of levers would be a different contract.

What if graduation is late

Pons's executor creates the pool; until then buybacks keep going through the curve adapter. The contract switches to the pool adapter the moment the curve reports graduation.