Robinhood Chain

Retoque uses two contracts on Robinhood Chain, an EVM network. One records which exact patch versions exist. The other sells version-specific licenses and holds payments in escrow. Model weights, datasets and evaluation runs stay offchain.

Networks

On any chain other than mainnet, the deploy script deploys a test token named "Retoque Test USD (NOT USDG, no value)" with the symbol rtUSD-TEST and 6 decimals, unless a payment token is given. On mainnet it refuses to deploy without a verified payment token and refuses to use the deployer as admin.

The status page shows "not deployed" for the chain component when no license contract is configured.

RetoquePatchRegistry

The registry records the digests of each patch version: who published it, the patch ID, the semver, and the sha256 of the manifest, the adapter and the license terms.

• A version key is keccak256(chainId, publisher, patchId, keccak256(semver), artifactDigest), so the same version can't be registered twice by the same publisher.
• Only addresses with PUBLISHER_ROLE can register. All four digests must be non-zero. Digests can never change after registration.
• Status starts at Active and can move to Deprecated or Withdrawn, and from Deprecated to Withdrawn. Withdrawn is final. The version's publisher or a REVIEWER_ROLE address can change status, with a reason digest.
• A registration attests what was registered and when. It doesn't attest model quality, legal ownership or benchmark results.

Retoque registers a published version with an operator script that records the registration only from the mined receipt's decoded event.

RetoqueLicenseMarket

The market sells wallet-bound, non-transferable, version-specific licenses in allowlisted ERC-20 tokens.

Offers

The version's publisher sets an offer per version and license type: currency, price, payout address and whether it is active. The offer's terms digest is copied from the registry, so an offer can't point at different terms than the registered version. The version must be Active. A zero price creates a free onchain receipt with no token transfer.

Purchase

purchaseLicense(versionKey, licenseType, maxPrice, expectedTermsDigest):

• reverts if the offer is inactive, the version isn't Active, the terms digest differs from what the buyer expected, the price is above maxPrice, the buyer already holds that license, or the market is paused,
• pulls exactly the price from the buyer and rejects tokens that deliver less than the amount sent, such as fee-on-transfer tokens,
• fixes the platform fee at purchase time from feeBps, capped at 15% (MAX_FEE_BPS = 1500),
• emits LicensePurchased with the purchase ID, buyer, version key, license type, currency, gross, creator payout, platform fee and terms digest. The Retoque server reads this event to grant the entitlement.

Paid purchases start in escrow. Free purchases are settled immediately.

Escrow and settlement

Paid funds stay in the contract for a settlement window, settlementDelay, which is 7 days by default and can't exceed 30 days. After the window, anyone can call settle(purchaseId). Settlement credits the creator's payout address and the treasury, and each withdraws its balance with withdraw(currency). Nothing is pushed to anyone automatically.

Refunds

An address with OPERATOR_ROLE can refund a purchase while it is still in escrow, with a reason digest. The full gross amount goes back to the buyer and the license is deleted from the contract. A settled purchase can't be refunded. Downloaded copies can't be recalled.

Admin controls

The admin can change the fee (up to 15%), the treasury, the settlement delay (up to 30 days) and the currency allowlist. The operator can pause and unpause purchases. Settling, refunding and withdrawing still work while paused.

What the chain proves

• A registration proves a publisher recorded these digests at a point in time.
• A purchase event proves a wallet paid a price under a terms digest.
• Neither proves that a patch works, that the publisher owns the rights, or that a downloaded file will only be used as licensed. The evaluation report and the license terms cover those.

You can compare the registry's manifest and adapter digests with your installed copy: retoque status prints the adapter sha256, and the manifest sha256 is in retoque.lock.