Decentralized AI · protocol · open devnet
The architecture, what is implemented and tested today, the honest security posture, and what is still unproven. Every claim below points at running code in the public repository.
Every decentralized-AI network keeps its incentive layer on-chain and its model in someone's storage bucket. Sestrian inverts that: the model's weights are the chain state. A block is one optimizer step; a transaction is a signed gradient update; the block header commits a Merkle root over the weights; replaying the chain reconstructs the model bit-for-bit. Compute joining the network either trains the weights or serves them, and inference fees pay both — a network that funds its own intelligence.
The unclaimed prize
No network on earth currently pays training rewards out of inference revenue; the field's largest runs a 20–40× emissions subsidy. Reaching that crossover does not require the world's best model — only one whose users pay more than its training costs. That is the entire strategic target.
Five layers, bottom to top. Each is implemented and tested; the rightmost column names the module.
The rig attacks its own claims — the founding discipline is stop citing, start seeing. Status is what the code demonstrates, not what it aspires to.
| Capability | Evidence | Status |
|---|---|---|
| Model-as-chain-state, bit-exact replay | chain, blockchain | proven |
| Full flywheel: train → score → apply → serve → pay | e2e.py | runs (0.13→1.0) |
| Real transformer + MoE, through the chain | model2, moe_transformer | grad-checked 1e-8 |
| Sparse serving, O(k) not O(experts), attested | moe_transformer | partial-recompute verifier |
| Async miners with real staleness | async_node.py | converges |
| Coordinator-free gossip consensus | p2p, gossip_net | cross-machine |
| Unbiasable beacon (threshold BLS + DKG) | beacon, dkg | proven |
| Erasure-coded DA + sampling | da.py | withholding caught 100% |
| Write-price homeostat + stake/slash | economics.py | holds target |
| Everything wired into one live loop | integrated.py | runs + live viewer |
| Revenue loop closing at scale | market outcome | Phase 3 goal |
The hard cryptographic and networking pieces are not hand-waved. Each maps to an established design and runs in the rig.
| Prior art | Sestrian | Module |
|---|---|---|
| Bitcoin signed transactions | Ed25519-signed delta commitments | crypto, ed25519 |
| Bitcoin headers + longest chain | Hash-linked headers, heaviest-valid-chain fork choice | blockchain |
| Bitcoin P2P gossip | Async socket gossip, partition-heals, no coordinator | gossip_net |
| Bitcoin difficulty retarget | Write-price homeostat (damped for a sharper plant) | economics |
| drand threshold randomness | Threshold-BLS beacon with Feldman-VSS DKG | beacon, dkg |
| Celestia data availability | Reed-Solomon erasure coding + Merkle sampling | da |
Three attack surfaces, three locks. The one correction below is the most important thing in this document, because it is where our own red-team changed our claims.
The correction our red-team forced
The original intuition was that a 51% honest majority prevents poisoning.
Our red-team (redteam.py) disproved that: a stealthy backdoor
keyed to a secret trigger is invisible to blind detection, and a slow-drip
coalition can implant one from deltas each less conspicuous than honest
work — no matter how honest the majority. What actually defends is
staked data-admission (cost to get poison in) and replay-excision (removing
a backdoor once discovered — driven to zero effect in the rig). So
the claim is corrected from "poisoning is prevented" to "poisoning is made
costly and reversible." We found this before it could mislead anyone — which
is what a rig is for.
Everything is runnable and seeded. scripts/run test executes
117 tests; scripts/run e2e shows the flywheel; scripts/run
integrated runs beacon + DA + leader election in one loop;
scripts/run live opens a browser dashboard that streams the chain
block-by-block. The gossip network and the beacon have both been run
coordinator-free across two physical machines, producing a byte-identical
chain — where a node runs never changes the state.
The rig has retired the architectural and distributed-systems risks. What the raise buys down is three market-and-scale questions: does DiLoCo-class training hold at 7B+ across untrusted machines; does a vertical exist whose users pay more than its training costs; does the poisoning residual stay manageable on a real model.
A limits section written by us before a reviewer writes it for us. Live status is tracked continuously in production-readiness.md and the threat model.