Skip to main content

Architecture

The protocol is three contracts and one peer-to-peer transport. Everything else is a client.

Contracts (Base Sepolia, chain 84532)​

ContractAddress
WorkerRegistry v0.20xFbE9FF497dC24bD69d13E4201418938Df7435Ff6
JobEscrow v0.20x8175df796A659681009BeDa4609a3cFe9d281D82
MockUSDC (test only)0xEb33DFC0424810039337a38510ef522e9E7F9727

WorkerRegistry​

function register(bytes32 peerId, bytes32 policyHash) external;
function registerWithLocator(bytes32 peerId, bytes32 policyHash, string locator) external;
function advertise(string calldata locator) external;
function selfDeactivate() external;
function isActive(address wallet) external view returns (bool);
function count() external view returns (uint256);
  • One entry per wallet. Re-registering keeps the original registration time.
  • advertise() is log-cheap and length-bounded (MAX_LOCATOR_BYTES = 256).
  • Deactivation is self-service; operators can also deactivate with a reason.

JobEscrow​

function openSession(address worker, uint128 amount) external returns (uint256 id);
function settle(uint256 id, bytes32 receiptHash, uint128 spend, bytes calldata workerSig) external;
function refund(uint256 id) external;
function claim() external;
  • settle() verifies the worker's signature over the session receipt.
  • Split is 99 / 1 worker / treasury.
  • Unspent escrow returns to the user through refund().

Transport​

libp2p over TCP/QUIC with Noise and yamux. The peer ID in the registry is the identity the client expects; a mismatch aborts the handshake.

  • DCUtR handles most NAT traversal.
  • Relay is used only when a direct path cannot be established, and only for the handshake. The relay budget (128 KiB / 2 min) rules out streaming through it.
  • IPv6 is supported but opt-in.

Credit and reachability​

Workers carry a behaviour-derived credit score. It is not a token and cannot be bought. Two gates use it:

  • Reachability gate — a worker that repeatedly fails the handshake is deprioritised.
  • Credit gate — a worker with a poor record is not shown by default.

Both are client-side policy, not contract state, so a client can always choose to ignore them.

Commit-challenge​

To stop a worker from claiming a model it does not run, the client can ask for a commitment over a random challenge before the first token. A worker that cannot produce it is dropped.

What is deliberately absent​

  • No orchestrator, no job queue server, no database of prompts.
  • No token, no staking, no governance contract.
  • No mainnet deployment.
  • No telemetry in the desktop app.