ClockWorks, from first principles.

Overview

ClockWorks runs a token's creator fees on Robinhood Chain. A launch on pons v2 earns a fee on every trade, and the creator claims it by hand. ClockWorks claims it on a clock, splits it by percentages the founder set once, burns the burn share in slices, sends the treasury share to a wallet that only grows, and prints every transaction hash where anyone can read it.

The machine runs in the founder's own GitHub repository on a wallet the founder created. ClockWorks never holds a key. The code is published as a package with a signed record of the exact build, and the repository pins the version it runs. Nothing changes under a machine unless its owner changes the number.

It ran first on GMERALD, a token paired with tokenized GME, where the treasury became the eighth largest GME wallet on the chain and a fifth of the supply burned in its first week. Every one of those transactions is on gmerald.xyz.

Lifecycle

Every tick follows the same four steps. There is no path where the machine decides to do something different.

The split

Four shares that add up to one hundred. Burn buys the token and destroys it. Treasury goes to the founder's treasury wallet and ClockWorks never moves it again. Ops, when set, goes to a wallet the founder spends from. The ClockWorks share is ten percent of every claim, sent on chain by the machine, slice by slice. The chain is the invoice.

Any split that adds up works.

Quick setup

Three bundles on the settings page set the claim rule, the pace, the dip mode, the guardrails and the cards in one click; the split stays yours, and any knob can still be turned afterwards. Patient: a claim a day or at twice the default floor, spread over the day, no dip mode, slippage refused past 2%. Steady: claims at the default floor or every twelve hours, spread over six, 1.5x on a ten percent dip, 3% slippage. Aggressive: claims every four hours or at six tenths of the floor, four slices in the hour, 2x on a ten percent dip, 3% slippage; this is Gerald's setting. The default floor is the one init writes: 5 for a stock, 100 for a stable, 0.05 for ETH. A new machine starts on Steady.

The pace

One control. Gentle spreads a claim over a day. Steady, the default, spreads it over six hours. All at once burns it in one slice. Under "advanced": a fixed slice size, a dollar floor, buying harder on dips, slippage, quiet hours. Most machines never open it.

The treasury

The treasury share is sent to an address the founder named. ClockWorks has no key to it and no function that moves it. On the status page the treasury shows its balance, its rank among holders of the pairing asset, and the average price the fees were claimed at.

Fees to the machine

On pons, creator fees go to whoever is named as the fee recipient. Naming the machine wallet is what makes claiming automatic. Moving the recipient does not move what is already credited, so claim the old balance first; the fee page reads the chain, says how much is waiting, and prepares the transaction for your own wallet. A founder who prefers to keep claiming by hand can skip this: the machine runs on whatever it is sent.

The machine claims when at least the claim floor waits in the escrow, five of the pairing asset by default, and at least once a day whatever is there. A claim costs gas and posts a card, so it is a real event, not a tick. Both numbers are in clockwork.json.

ClockWorks reads the recipient every run. If fees stop pointing at the machine, or a change is pending in pons's timelock, the status page turns red and the Telegram group gets one card. The machine keeps burning what it holds and claims nothing new until fees point back.

Community takeovers

A takeover wallet is a fee recipient like any other. Once the multisig points fees at a machine wallet, ClockWorks runs the community's fees the same way it runs a creator's. Nothing else about the token changes.

Buybacks

A launch with pons buybacks on accumulates its own token in a vault that vests over five years. ClockWorks releases what has vested and burns it with the next slice. A founder can turn this off and hold instead.

Dividends

Some memestocks pay their holders in the stock itself. ClockWorks keeps the book: every payout a listed distributor made, read from the chain as Transfer events from its wallet, grouped into drops, priced with the Chainlink feed at the block the drop landed. A holder pastes a wallet and gets a statement, a card and a CSV. Nothing is signed or connected; the book is public files, read in the browser.

Most of the paying is pons itself: a launch can route its creator fees to a fee-sharing contract that pays holders in the pairing asset, and the top of that list is in the book, in USDG. What counts as a dividend: a batch payout, three or more wallets paid in one transaction, from a wallet on the list. A distributor moving its own money, one wallet at a time, stays out. The list lives in distributors.json next to the book; a memestock that pays its holders and is not there can be listed by sending the distributor wallet and the token. A holder leg for machines, a share of every claim paid to holders, is next; when it ships, a machine's payouts read like any other payer's.

The job is clockwork dividends: read-only, no key, runs anywhere. It keeps a block cursor per distributor and reads only what is new, so an hourly run is a few seconds. DIVIDENDS_DIR names where the book is written.

Setup, self-serve

No form, no human at ClockWorks in the loop. Five steps, about fifteen minutes, and only one of them asks for a terminal, which you can skip. A founder with an assistant hands it the ClockWorks skill and answers its questions.

1. A machine wallet. Create a fresh wallet on your own device and send it about 0.02 ETH on Robinhood Chain for gas. Never a main wallet. Nobody at ClockWorks ever sees its key.
2. The config, built in your browser. Paste your token address on the start page. The page reads the launch from the pons factory, fills every knob with the defaults, and asks for two things: the machine wallet and the treasury wallet. Then, from the same page: create the repository from the template, name it on the page, paste a fine-grained GitHub token for that one repository (Contents read and write), and the page writes clockwork.json into it as a commit. The file is public by design and never holds a key. (The terminal way still works: npx --yes clockwork-press@0.2.4 init <your token address> writes the same file.)
3. The key. Repository settings, Secrets and variables, Actions: add MACHINE_WALLET_KEY. For your own Telegram bot, add TELEGRAM_BOT_TOKEN too. GitHub keeps them; the machine reads them at run time; nothing else can. This is the one step no page can do for you, because the page would have to see the key.
4. Dry run, then fees to the machine. Actions tab, the "clockwork" workflow, Run workflow, job = dry: the log shows the launch, where fees go, what is unswept, and what a real tick would burn. It refuses to run if the key belongs to a wallet other than the one in your config. Then claim what is already owed to you in pons and use the fee page: from the wallet that receives fees today, it sends the one transaction that points them at the machine. The pons UI does not show this function; the contract has it, and it takes effect immediately.
5. Live. The workflow's schedule ticks on the quarter hour. Your status page is at gmerald.xyz/clockwork/m/?r=<owner>/<repo> the minute the first tick commits, and the machine index on the start page lists you from your first claim.

Punctual ticks. GitHub's own schedule can run a few minutes late. For ticks on the minute, add a cron-job.org job that POSTs to your repository's workflow dispatch URL with a fine-grained GitHub token scoped to that one repository. The machine's own guard refuses a second tick inside the same quarter hour, so the two clocks never double-burn.

Telegram

The cards are part of the flywheel: every claim and every slice lands in your group within the minute, with your art. Two minutes to set up.

1. In Telegram, open @BotFather, send /newbot, give it a name and a username. It replies with a token. Add the token to your repository as the secret TELEGRAM_BOT_TOKEN, nowhere else.
2. Add the bot to your group as an admin so its posts survive anti-spam bots.
3. Run the workflow once with job = tgcheck. The log prints the group's chat id. Put it in clockwork.json under telegram.chatId, with telegram.mode set to own.
4. Your art: brand.art takes one image or short mp4 URL per card, claim, slice, percent, buy, newHolder. Without one, the card is text only. The words on the cards follow brand.treasuryWord, brand.burnWord and brand.claimWord, so a hamster can call them stash, snack and press.

Cards on by default: the claim, the slice, and every whole percent of supply burned. The buy card, with new-holder detection, is off by default and has a dollar floor. No links in the cards; hashes live on the status page. A shared ClockWorks bot that needs no token of your own is next.

clockwork.json

One file the founder owns. Addresses in it are the audit; the machine refuses to run when the split does not add up, when the wallet on disk is not the wallet in the file, or when a paying config runs on a build whose service wallet is not pinned. Edit it by hand, or on the settings page, which shows every knob, checks them the way the machine does, and saves one commit to your repository with a GitHub token that stays in your browser.

Commands

Every command runs from the folder that holds clockwork.json, with Node 20 or newer. Nothing here needs a key except press and handback, which read it from the environment the workflow provides.

In a repository made from the template, the same jobs run from the Actions tab: Run workflow, then pick the job.

Contracts, Robinhood Chain (4663)

What the machine refuses

The split does not add up. The key in the repository is not the machine wallet in the config. A service share above zero on a build with no service wallet. A pool quote further from the market than the sanity band. A second tick less than the cadence after the first. Each refusal is a line in the run log, and none of them moves money.

Security

One machine, one repository, one wallet, one key. Every line below was checked against Gerald's machine on September 6, 2026, and the checks are repeatable on any machine.

No custody

The key is a GitHub Actions secret in your repository. Secrets are scoped to one repository; another repository, another workflow, or ClockWorks cannot read them. The machine only ever signs as the wallet named in your config, and refuses to run when the key belongs to any other wallet.

Nothing shared between machines

Machines do not know about each other. There is no server between them, no shared database, no shared wallet. The ClockWorks wallet that receives the service share is a constant in the package, never in a config, so no file can redirect a share to a different address.

Pinned code

The workflow runs an exact version of the package, with a lockfile that pins every dependency, and installs with lifecycle scripts disabled. The two GitHub actions it uses are pinned by commit hash. The tarball on npm is byte-for-byte the build in the source repository. One setting a template cannot carry, so set it on your repository: Settings, Actions, General, allow GitHub-owned actions only. Gerald's repository has it.

Money moves in small steps

Burns happen in slices at the pace you chose. Each swap is quoted first and refused when the pool quote is further from the market than the sanity band, or when slippage would exceed the cap. A tick that fails after a transfer writes what landed, and the next tick finishes the row. A second tick inside the same quarter hour is refused.

Nothing moves the treasury

The treasury share is sent to an address you named. ClockWorks has no key to it, no function that touches it, and refuses a config where the treasury is the machine wallet or the zero address.

The recipient watch

Every tick reads who receives your fees and whether pons has a takeover pending. If fees stop pointing at the machine, the status page turns red, the group gets one card, and the machine claims nothing new until they point back.

What can go wrong, honestly

Nobody at ClockWorks can see your key, and neither can GitHub staff. A GitHub Actions secret is encrypted at rest, decrypted only inside the runner for the minutes a job runs, and masked in every log. The only code that touches it is the package we publish, pinned by exact version, dependencies locked, install scripts off, and the published bytes are checked against the source build at every release.

What can expose the key: your own GitHub account being taken over, or a malicious version of the package, which pinning prevents unless someone bumps the pin. So keep two-factor on GitHub. And the design keeps the blast radius small: the machine wallet holds only the float between a claim and its slices, never the treasury. The one thing a stolen machine key can still do today is redirect the fee stream, which is what the collector contract below removes.

Shipped, and this week

Two of three landed in 0.2.2 on September 6: a treasury-outflow watch that posts one card per transfer out of a treasury wallet and turns the status page red for a week, and a low-gas card once a day when the machine wallet runs low. The third is the collector contract owned by the founder's cold wallet, so that a leaked machine key can burn a float but never move a fee stream. Until it ships, the first machines run with that one risk, stated here rather than hidden.

Support

The package is public on npm and the repository a machine runs in is the template, under the ClockWorks License: source-available, run it yourself, keep the service share. Questions go to @gmeraldexe until ClockWorks has a group of its own.