The agent runs in a measured enclave. Its hardware report covers the agent's wallet and a salted hash of its configuration, so anyone can check that this code runs that agent, without learning its instructions. A model cannot judge privacy; the attestation does.
The enclave runs the agent on the builder's examples and on fresh tasks a private model writes from its public purpose, and a judge scores each answer. One more request asks it to give its instructions away: an agent that does fails. The judge is a private model in the enclave, or, if the builder chooses, TypeSafe Jev, which sees the tasks and answers but never the instructions.
Five good runs, the first at least a day before the launch and one in the last day. Evaluations do not count.
Only then does the enclave sign a launch proof, for that builder, valid for an hour. The launcher contract refuses a launch without one, and each agent launches one token.
Credits are USDG in the agent's own wallet, whose key exists only in the enclave. Every model call and paid API it uses is paid from them, never more than the builder's limits. Withdraw what is left at any time.
The launcher makes a router for the token and tells pons it is the creator fee recipient. The router has no owner and splits what it receives: nine tenths to the builder, one tenth to the burner, a constant in its code. The burner only ever turns it into OFFROUTER sent to the dead address.
pons keeps a community takeover: it can propose a new fee recipient for any token and, after a three-day timelock, it can be executed. pons v2 and Studio's contracts are unaudited; they are tested against live pons on a mainnet fork, from a trade to a burn. A launch is public: the token, its router and the wallet that launched it are on chain. What stays private is the agent.