Most “hook” tokens you can buy today aren't really hooked. The rules — who can buy, who can sell, when, how much — live on someone's server. The server checks your trade, keeps the receipts in its own database, and if the server goes down, the rules pause and the coin just trades. That's not a hook. That's a promise wearing the word.
This platform works the other way. Every rule is enforced by a Solana Token-2022 transfer hook, on-chain, inside the transfer itself: no server sits in the trade path, and no keeper decides whether your swap counts. If a transfer violates the token's rule stack, the hook vetoes it and the transfer never happens. The chain is the referee, and it doesn't sleep. One dependency sits outside the trade path, stated plainly: the latch rules read a price feed that an operator-run crank keeps fresh — and a stale feed vetoes exits rather than mispricing them, so the failure mode is a pause, not a theft.
Six programs, deployed once, shared by every token: the Engine (the transfer hook itself), the Registry (the identity substrate rules can read), the Distributor (holder fee accounting), the Crown (the contestable beneficiary seat the settlement splits read), the FeeSchedule (the Decay Tax rate schedule), and HouseSwap (the house venue). Token-2022 calls the Engine inside every transfer — buy, sell, or wallet-to-wallet send — and the Engine runs that token's rules in order. Any veto fails the whole transaction, atomically. There is no off-chain step to skip, delay, or switch off.
Fees follow the same principle. Curve fees route to the token's Distributor, which settles them pro-rata to holders through a cumulative index. Folding new fees into that index is a permissionless crank: anyone can call it, and the caller keeps a cut. The step before the fold is not permissionless today: claiming a token's accrued curve fees into its Distributor vault is signed by the token's fee claimer — for AGTR, that claimer is the platform, and its one executed cycle is written up on the AGTR page. Once claimed, the settlement is open to anyone: AGTR's fold moved ~1.2 million AGTR of routed fees into the index through the permissionless crank, with the caller keeping its cut.
Honesty about the instrument itself: a transfer hook is a veto, not a hand. It can read and write its own state and refuse a transfer; it cannot move tokens, skim a fee, or redirect value. Every behavior on this platform is built inside that limit — if a rule can't be enforced by the hook alone, it doesn't ship. And one disclosure we keep on every page: the programs are upgradeable by the launcher wallet today, deliberately not burned yet, because the catalog is young. A token whose config is Locked can never have its rules changed — but the engine's upgrade authority is real, and we'd rather say so than hide it.
There is exactly one engine program: EPdYVfsX7Lk9gtLp8CVouiFrNwtxP5g11NR6DDgs6akT. A token's rules are not a new contract — they're data: a per-mint configuration holding an ordered stack of up to eight rules, each a rule id plus a 64-byte parameter block. Stacks compose: a token can be agent-gated and max-walleted and latch-locked, enforced by one program on one surface, instead of a fresh contract per token that you'd have to trust one at a time.
All seventeen rules in the catalog are implemented today — the transfer-hook rules in the engine, the fee-stream rules in the settlement layer, and Escrow Split in the house venue. Four have been exercised on live tokens so far: Basis Latch (1), Escrow Split (2), Agent-Only (3), and Max Wallet (9); the rest are implemented and trial-proven, and each rule's panel in the docs states how far it has been verified. One distinction the names alone blur: Agent-Only (3) gates on a registry record that any wallet can create for itself with one signature — the attested variant is Ecosystem Gate (17), which admits only wallets attested through a named ecosystem's own flow (a tag lands only when both the wallet and that ecosystem's attester sign). The launcher rejects a rule it cannot deliver by name rather than silently dropping it. The full catalog, with each rule's status, is in the docs.
A hook that only trades through its maker's own website is a walled garden. Engine v3 — live on mainnet since October 16, 2026 — removed the last wall, and the wall turned out to be ours.
The problem was one entry in each token's hook meta list. In v2, a holder's record address was derived from the contents of their token account. The standard resolver every router and trading bot uses computes those addresses before building a swap — and for a first-time buyer, whose token account doesn't exist yet, there are no contents to read. Resolution threw TokenTransferHookAccountDataNotFound, and generic first buys failed. Existing holders resolved fine; our own skill worked because it creates the account first. The fix: v3 keys holder records by the token account's address — for an associated token account, a pure function of owner + mint that anyone can compute before the account exists.
The live proof, on both tokens that were already trading: before the upgrade, the standard resolver threw for a fresh, never-holding wallet on AGTR and on Latch; after the upgrade and the meta-list flips, it resolves on both — first buys are buildable by the generic route, for any rule stack. All seven pre-existing holder records were carried across by a permissionless migration instruction, byte-identical at their new addresses, rent-neutral, with the legacy accounts closed. The upgrade itself is public: 3wt6DhFi…, and the engine has been upgraded once since: the currently deployed binary (318,144 bytes, sha256 87d31f83…) is the one whose hash the docs publish for verification against the source.
One trade, disclosed rather than buried: holder state is now per token account, not per owner. For the canonical associated token account — the account every wallet and router uses — the two are exactly equivalent. State held across an owner's extra token accounts fragments until it's combined, and v3 ships the combine: an owner-signed merge that blends basis, takes the higher peak, and closes the source record. Nothing about the change makes a holder less locked; fragments fail closed. The docs carry the full semantics.
The first v3 deployment window, earlier that same day, failed and was rolled back — and the record of it is published, because the candor is part of the product. The upgrade landed, but the meta-list flip panicked in simulation against both tokens' launch-era lists: the refresh shrank the account before updating it, leaving a stale length marker the resolver library rejects. The test suites had missed the path because every fixture started from a correctly-sized modern list; the live lists were written at launch, in the older, larger layout. Simulation-first discipline meant no broken transaction ever reached the chain; transfers failed closed throughout, no funds moved, and the rollback restored the exact prior binary with every config, list, and holder record verified byte-identical afterward.
The fix reordered the refresh (update first, then resize, rent settled neutrally) and was rehearsed against the preserved real list bytes from both live tokens — a new 83-assertion suite covering exactly the shrink path that failed — before the second window opened. That window landed end to end: upgrade, both flips on the first try, all seven migrations, and the client surfaces flipped to match. We tell this story on the same page as the launch announcement because a platform that asks you to trust its rules should show you how it behaves when it's wrong.
| Option | What happens | Status |
|---|---|---|
| release the default | At the curve's threshold, the token migrates to a DAMM v2 pool and the hook is revoked inside the completing swap. Rules retire; trading continues free, anywhere. The Distributor keeps paying holders — it never depended on the hook. | Live — AGTR and Latch both launched this way. |
| never | The migration threshold is set to the maximum the venue accepts (≈18.45 billion SOL), so the curve never completes: the token lives on its curve with its rules enforced forever. The cost is stated up front: the 20% migration share stays locked in the pool, and there is never a post-curve pool. Since v3, standard resolvers still build its trades — permanence no longer costs routability. | Live — a launch-time spec choice, verified accepted by the venue program. |
| house | Graduating onto our own venue with config, holder records, and price feed carrying over intact — the rules surviving graduation. DBC migration can't be re-aimed, so House is a venue activation on a never launch: past the threshold, the HouseSwap program takes over trading, the hook is not revoked, and the engine keeps judging every transfer. Escrow Split (rule 2) lives in this venue's swaps. | Live — HPROOF activated onto the house venue on mainnet on 2026-10-20, and its Escrow Split settlements reconciled to the lamport (receipts on its preflight report). |
This engine is not a moat. The full source tree — the six programs (engine, registry, distributor, crown, fee schedule, and house swap), the launcher CLIs, and the design specs — is public at github.com/anondevv69/hook-launcher (see the docs for exactly what's in the tree and how to verify the deployed program against it). The launcher itself is already public in the only form that matters today: the agent skill and the hook.mjs / launch.mjs CLIs are served from this site, and any agent with a Solana wallet and ~0.07 SOL can launch a ruled token or trade one, right now, without asking anyone.
The invitation is specific. Builders: read the specs, launch tokens with stacks we haven't tried, write the doors and tools on top — a hook token that trades everywhere is an invitation to build everywhere. Agents: you are first-class users here, not a marketing segment; the skill is your front door, and the registry is your guest list. Rule authors: a new rule is an engine change, and the path is the one every live rule took — a written spec, an implementation in the engine's rule dispatch, and a trial suite against the real venue binaries. Bring us a rule worth having, proven to that bar, and it ships in the catalog with your name on it.
Hooks are better as an ecosystem than as a moat. The door is open — and unlike the rules, that's the only part of this that runs on trust. Everything else runs on Solana.