Decentralized AI · protocol · open devnet
The architecture, what is implemented and tested today, the honest security posture, and what is still unproven. Every claim below points at running code in the public repository.
Every decentralized-AI network keeps its incentive layer on-chain and its model in someone's storage bucket. Sestrian inverts that: the model's weights are the chain state. A block is one optimizer step; a transaction is a signed gradient update; the block header commits a Merkle root over the weights; replaying the chain reconstructs the model bit-for-bit. Compute joining the network either trains the weights or serves them, and inference fees pay both: a network that funds its own intelligence.
The unclaimed prize
No network on earth currently pays training rewards out of inference revenue; the field's largest runs a 20–40× emissions subsidy. Reaching that crossover does not require the world's best model, only one whose users pay more than its training costs. That is the entire strategic target.
Five layers, bottom to top. Each is implemented and tested; the rightmost column names the module: .py is the Python reference (the spec), .rs the production Rust node, pinned to each other by golden vectors.
The rig attacks its own claims. The founding discipline is stop citing, start seeing. Status is what the code demonstrates, not what it aspires to.
| Capability | Evidence | Status |
|---|---|---|
| Model-as-chain-state, bit-exact replay | chain, blockchain | proven |
| Full flywheel: train → score → apply → serve → pay | e2e.py | runs (0.13→1.0) |
| Real transformer + MoE, through the chain | model2, moe_transformer | grad-checked 1e-8 |
| Sparse serving, O(k) not O(experts), attested | moe_transformer | partial-recompute verifier |
| Async miners with real staleness | async_node.py | converges |
| Coordinator-free gossip consensus | p2p, gossip_net | cross-machine |
| Unbiasable beacon (threshold BLS + DKG) | beacon, dkg | proven |
| Erasure-coded DA + sampling | da.py | withholding caught 100% (rig) |
| Write-price homeostat + stake/slash | economics.py | holds target |
| Everything wired into one live loop | integrated.py | runs + live viewer |
| Revenue loop closing at scale | market outcome | Phase 3 goal |
The hard cryptographic and networking pieces are not hand-waved. Each maps to an established design and runs in the rig.
| Prior art | Sestrian | Module |
|---|---|---|
| Bitcoin signed transactions | Ed25519-signed delta commitments | crypto, ed25519 |
| Bitcoin headers + longest chain | Hash-linked headers, heaviest-valid-chain fork choice | blockchain |
| Bitcoin P2P gossip | Async socket gossip, partition-heals, no coordinator | gossip_net |
| Bitcoin difficulty retarget | Write-price homeostat (damped for a sharper plant) | economics |
| drand threshold randomness | Threshold-BLS beacon with Feldman-VSS DKG | beacon, dkg |
| Celestia data availability | Reed-Solomon erasure coding + Merkle sampling | da |
Three attack surfaces, three locks. The one correction below is the most important thing in this document, because it is where our own red-team changed our claims.
The correction our red-team forced
The original intuition was that a 51% honest majority prevents poisoning.
Our red-team (redteam.py) disproved that: a stealthy backdoor
keyed to a secret trigger is invisible to blind detection, and a slow-drip
coalition can implant one from deltas each less conspicuous than honest
work, no matter how honest the majority. What actually defends is
staked data-admission (cost to get poison in) and replay-excision (removing
a backdoor once discovered, driven to zero effect in the rig). So
the claim is corrected from "poisoning is prevented" to "poisoning is made
costly and reversible." We found this before it could mislead anyone.
Everything is runnable and seeded. pytest tests/ runs the 204-test
Python reference suite and cargo test the 68-test production node;
28 golden-vector families pin the two to each other, and both are blocking in
CI alongside a live two-node convergence run and a kill/restart soak. The
strongest reproducibility claim is the running network itself: five machines
on two continents independently rebuilt the genesis from its published seed to the identical
root, and four of them are in block-for-block lockstep right now. Where a
node runs never changes the state.
The rig has retired the architectural and distributed-systems risks. What the next phases have to prove are three market-and-scale questions: does DiLoCo-class training hold at 7B+ across untrusted machines; does a vertical exist whose users pay more than its training costs; does the poisoning residual stay manageable on a real model.
A limits section written by us before a reviewer writes it for us. Live status is tracked continuously in production-readiness.md and the threat model.