TagioFi Docs

The one-liner

On TagioFi, your payment tag carries your preferences. Tell your tag once, “I take 60% SPY, 30% USDG, 10% gold”, and every payment that hits it arrives converted: the tip, the invoice, the salary, the split. Senders send anything; your tag makes sure what lands is what you’d actually keep. Stop receiving money you immediately have to convert. Start receiving the portfolio.

Institutions just proved people want this: the first RWA payroll pilot (Plume × Toku × WisdomTree) let staff take salary in a tokenized money-market fund, but it’s a closed program: one employer, one fund, verified wallets, a payroll vendor in the middle. Wallets solved the buy side (MetaMask × Ondo: swap into 200+ tokenized assets). The receive side, payments that arrive as the asset you want, doesn’t exist anywhere, for anyone.

Robinhood Chain is the only venue where this is trivial to make real: tokenized stocks are native tokens with live Chainlink pricing, and the chain carries an on-chain tag registry, NFT-registered payment tags whose resolver exposes a destination, programmable splits, and a preferred-settlement-asset field that today sits unused. TagioFi is the machine that makes that preference field mean something.

How it works

1. Point your tag. Own or register a tag in the chain’s tag registry; set your receive-mix, any blend of registry-verified assets (tokenized equities/ETFs, USDG, tokenized metals), percentages totaling 100.
2. Share it everywhere. Bio, invoice footer, stream overlay, storefront QR. Anyone pays the tag in any token they hold.
3. It lands converted. The TagioFi settlement contract resolves the tag, honors the mix, swaps within strict slippage and Chainlink price-sanity bounds, and delivers to your wallet, one atomic flow, nothing custodied, ever.
4. Teams too. A tag with splits pays each member their share in their own mix, one client payment, four people, four different portfolios. A payroll vault runs the roster on schedule.

The field, and where they stop short

“Your paycheck shouldn’t need a second transaction to become your portfolio.”

Everyone has a seat

$TGIO

Bounded settlement fee on converted volume + payroll tiers → open-market $TGIO buyback + staker distribution (80/10/5/5). Same-asset payments are permanently free, the rail grows first, the conversion monetizes.

Stakers back the registry and its parameters and earn a share of settlement fees. The fast path, sent asset equals mixed asset, is a direct transfer with zero fee, hardcoded, forever.

Straight talk

• Receive-mixes draw only from the verified registry (canonical, liquid); RHC Stock Tokens are debt securities, region-gated, unavailable to US persons, disclosed at mix-setup.
• A leg that can’t fill within bounds arrives as USDG with an on-chain notice. Payments complete; they never fill ugly or strand.
• No balances held, no custody, no payroll/tax function, employers plug in at their own compliance layer.

Shipping order

Kill/persist: Phase 1 is the claim and a complete product. If conversion volume lags at day 30, lead with the payroll-vault B2B lane and keep the rail as infrastructure.

Design laws

1. The receive-mix is law. Every settlement resolves the tag, honors the recipient’s mix exactly, delivers to their wallet. Atomic; zero custody.
2. Verified assets only. Canonical-registry authenticity + liquidity floor, fail-closed: spoofed/illiquid assets can’t enter a mix or a delivery.
3. Complete, never ugly. Per-leg slippage caps + Chainlink latestRoundData() × uiMultiplier() sanity (staleness / oraclePaused guarded). A breaching leg safe-settles in USDG with an on-chain notice.
4. Read the tag standard; never fork it. Tags live in the chain’s existing tag registry (ERC-721; resolver returns owner, destination, splits Σ=10000 bps, activity/expiry). TagioFi consumes it read-only via a pinned interface and builds settlement above it.
5. Free fast path. Sent asset == mixed asset → direct transfer, zero fee, forever.

Architecture

[Payer wallet] → pay(tag | linkId, tokenIn, amountIn)
        ▼
TagRouter.sol
1. resolve(tag) via ITagResolver {owner, destination, splits[], active, expiry}
2. load ReceiveMix(recipientWallet), fallback 100% USDG
3. splits × mix-legs → conversion plan
4. validated swaps (0x/Uniswap) → deliver → Receipt event

Contracts: TagRouter.sol · MixRegistry.sol · PayLinks.sol · RosterVault.sol · TGIO.sol · FeeVault.sol
External: ITagResolver (chain tag standard, read-only)
Off-chain: Bun + Hono + tRPC v11 · Drizzle/Postgres + Timescale · Redis + BullMQ · viem · 0x/Uniswap · Chainlink · canonical RWA registry · 60s tag-resolution cache · Dwellir RPC

Contracts (Foundry)

// ITagResolver, external standard: getInfo(string tag) → (owner, destination,
//   Split[]{wallet,bps}, registeredAt, expiresAt, active)
// MixRegistry.sol, setMix(Leg[]{asset,bps}) Σ=10000, ≤8 legs; every asset checked against
//   VerifiedRegistry root; keyed to RECIPIENT WALLET (portable across tags); default 100% USDG;
//   asset turning unverified → that leg auto-falls to USDG + Notice.
// TagRouter.sol, pay(tagOrLink, tokenIn, amountIn, minOuts[]): resolve → active/expiry check
//   (expired tag reverts, no lapsed-tag hijack) → splits → per-recipient mix legs →
//   allowlisted-venue swaps with per-leg slippage caps + Chainlink sanity → transfers →
//   Receipt{payer, tagHash, legs, fee}. Atomic or safe-settle; router never retains funds.
// PayLinks.sol, createLink(tag, amount?, memoHash, expiry) → linkId; pay(linkId) binds invoice.
// RosterVault.sol, funder budget + roster{wallet, amountPerCycle}; run() permissionless;
//   every payout settles through each member's own mix; pages 200 payouts/tx.
// FeeVault.sol, bounded fee bps (fast path 0) → $TGIO buyback + stakers.

Settlement engine

Quote service composes the plan (0x quotes; one swap per distinct output asset across all splits); TagRouter enforces on-chain: venue allowlist, calldata target/selector checks, slippage caps, Chainlink sanity with staleness / oraclePaused guards (violations → USDG safe-settle for that leg). ≤8 mix legs; direct transfers for delivery (payments are 1–5 recipients; roster runs page). Stock Token deliveries record {raw, uiMultiplier} in receipts so balances display correctly across corporate actions.

Data model (Drizzle)

mixes    /* wallet, legs jsonb[{asset,bps}], updatedAt */
receipts /* id, payer, tagHash, recipients jsonb, legs jsonb[{asset, raw, uiMult, px}], feeWei, txHash, ts */ // Timescale
links    /* linkId, tagHash, amount?, memoHash, expiry, status, receiptId? */
rosters  /* id, funder, members jsonb, budget, cycleLen, nextRunAt, status */
verified /* asset, symbol, authentic, depthUsd, eligible, sampledAt */
tagcache /* tagHash, resolved jsonb, cachedAt */  // 60s TTL

tRPC: payRouter.quote(tag, tokenIn, amount), mixRouter.set/get, linkRouter.create/status, rosterRouter, receiptRouter.history.
Workers: quote-service, roster-runner (+ permissionless trigger), verified-refresher, tag-cache, chain-indexer.

Security & integrity

• Zero-residue invariant: router balance is zero after every settlement (tested).
• On-chain swap validation (allowlist + selector + slippage + sanity), a compromised quote service can’t mis-route or dump.
• Tag expiry enforced at pay time; resolution pinned to the payment block.
• Mixes wallet-keyed + sig-gated; nobody redirects another’s mix. Fee bps bounded; fast path hardcoded free.
• Fresh deployer + multisig per studio OPSEC. Region/debt-security notices at mix-setup; suspended assets fall to USDG automatically, delivery never blocked.

Testing & acceptance

Foundry: atomic-or-safe-settle; zero-residue; splits×mixes matrix (3 recipients, 3 distinct mixes, exact); expired-tag revert; unverified-asset mix revert; slippage breach → USDG + Notice; oracle-paused leg → safe-settle; multiplier-event fixture keeps delivered balances correct.

Quote preview matches execution within tolerance; roster pages 200/tx honoring per-member mixes.

Build order

1. MixRegistry + TagRouter (single recipient) + verified gate + quote preview.
2. Splits + PayLinks.
3. RosterVault + $TGIO genesis + fee switch (fast path stays free).
4. Verified-social tag pay + cross-chain pay-in (support-confirmed first).

Dev caveats: pin ITagResolver against the deployed registry ABI (read-only; independent of its upgrade path); Chainlink staleness / oraclePaused guards per studio standard; set the initial verified-asset floor from live venue depth at launch.