feat: Add brokering section

Author: zguesmi

src/protocol/proof-of-contribution.md

@@ -109,3 +109,149 @@ the on-chain rules:
 - the worker gets paid
 - app & dataset owners get their revenue shares
 - any misbehavior results in stake-based penalties for the scheduler
+
+## Brokering
+
+On iExec, **brokering** is the mechanism that matches all parties involved in a computation:
+
+- the **application** (the logic to run)
+- the **dataset** (optional, confidential input data)
+- the **workerpool** (TEE-enabled workers)
+- the **requester** (the user paying for the execution)
+
+Each party publishes an **order** describing what they offer or request.
+When compatible orders are combined, a **deal** is created and PoCo enforces all economic, confidentiality, and governance rules.
+
+### Why off-chain brokering?
+
+iExec uses an **off-chain order book and off-chain matching** system because it provides major advantages:
+
+- orders can be created, shared, and canceled **without gas costs**
+- signatures make orders **trustless and verifiable**
+- brokering is fast and flexible
+- the blockchain is used only to **validate signatures** and **create the final deal**
+
+Although off-chain, the system is secure because each order is:
+
+- encoded as a structured object
+- hashed using **EIP-712**
+- **signed** by the resource owner
+
+This makes an order **as authoritative as if it were published on-chain**, without paying gas.
+The **PoCo** smart contract validates every signature and ensures correct matching.
+
+### What brokering enables?
+
+- **Access control / permissioning**
+  Different actors define who can use their resources (specific apps, requesters, or workerpools).
+
+- **Dynamic pricing & monetization**
+  Apps, datasets, and workerpools set prices; requesters set maximum prices.
+
+- **Asynchronous, trust-minimized execution**
+  After a successful `matchorders`, the PoCo ensures that all parties can operate
+  asynchronously and without direct trust:
+  - the deal is created on-chain and acts as the single source of truth
+  - the requester does not need to stay online during execution
+  - TEE-enabled workers independently fetch tasks when ready
+  - results, proofs, and outputs are submitted later when execution completes
+
+  PoCo guarantees that even though all actors act at different times, the workflow
+  remains secure, deterministic, and economically enforced.
+
+### Order structures
+
+Each actor expresses intent through a signed **order**.
+There are four order types, all using **EIP-712 signatures**:
+
+1. **AppOrder** — how the application can be used
+2. **DatasetOrder** — how the dataset can be accessed
+3. **WorkerpoolOrder** — what TEE workers are available
+4. **RequestOrder** — what the requester wants to run
+
+Every order includes:
+
+- the resource address (app/dataset/workerpool/requester)
+- price
+- volume (number of times the order can be matched)
+- optional matching restrictions
+- a `tag` describing features (e.g., TEE requirement)
+- a `salt` for uniqueness
+- a cryptographic **signature**
+
+#### AppOrder
+
+```
+struct AppOrder
+{
+  address app;
+  uint256 appprice;
+  uint256 volume;
+  uint256 tag;
+  address datasetrestrict;
+  address workerpoolrestrict;
+  address requesterrestrict;
+  bytes32 salt;
+  bytes   sign;
+}
+```
+
+#### DatasetOrder
+
+```text
+struct DatasetOrder
+{
+  address dataset;
+  uint256 datasetprice;
+  uint256 volume;
+  uint256 tag;
+  address apprestrict;
+  address workerpoolrestrict;
+  address requesterrestrict;
+  bytes32 salt;
+  bytes   sign;
+}
+```
+
+#### WorkerpoolOrder
+
+```text
+struct WorkerpoolOrder
+{
+  address workerpool;
+  uint256 workerpoolprice;
+  uint256 volume;
+  uint256 tag;
+  uint256 category;
+  uint256 trust;
+  address apprestrict;
+  address datasetrestrict;
+  address requesterrestrict;
+  bytes32 salt;
+  bytes   sign;
+}
+```
+
+#### RequesterOrder
+
+```text
+struct RequestOrder
+{
+  address app;
+  uint256 appmaxprice;
+  address dataset;
+  uint256 datasetmaxprice;
+  address workerpool;
+  uint256 workerpoolmaxprice;
+  address requester;
+  uint256 volume;
+  uint256 tag;
+  uint256 category;
+  uint256 trust;
+  address beneficiary;
+  address callback;
+  string  params;
+  bytes32 salt;
+  bytes   sign;
+}
+```