SestrianTechnical brief

Decentralized AI · protocol · open devnet

A blockchain whose state is a model.

The architecture, what is implemented and tested today, the honest security posture, and what is still unproven. Every claim below points at running code in the public repository.

85.4M params, live49 node tests 23 golden-vector families Rust node ≡ Python reference, bit-exact verified cross-vendor GPU

1 · Thesis

Every decentralized-AI network keeps its incentive layer on-chain and its model in someone's storage bucket. Sestrian inverts that: the model's weights are the chain state. A block is one optimizer step; a transaction is a signed gradient update; the block header commits a Merkle root over the weights; replaying the chain reconstructs the model bit-for-bit. Compute joining the network either trains the weights or serves them, and inference fees pay both — a network that funds its own intelligence.

The unclaimed prize

No network on earth currently pays training rewards out of inference revenue; the field's largest runs a 20–40× emissions subsidy. Reaching that crossover does not require the world's best model — only one whose users pay more than its training costs. That is the entire strategic target.

2 · Architecture

Five layers, bottom to top. Each is implemented and tested; the rightmost column names the module.

StateWeights as chain state. Paged, Merkle-committed; deterministic fixed-point aggregation; replay reconstructs the model. chain.py, blockchain.py
ConsensusScored mempool + Nakamoto fork choice. A delta is included only if a committee measures it improves the model; heaviest valid chain wins. blockchain.py, p2p.py
RandomnessThreshold-BLS beacon (drand-style), DKG-generated. Unbiasable, unpredictable, verifiable; drives shard assignment and leader election. beacon.py, dkg.py
DataErasure-coded data availability. Reed-Solomon (any k-of-n reconstruct) + Merkle availability sampling; withheld bodies are unrecoverable and detected. da.py
EconomicsDifficulty-style write-price homeostat + stake/slash. Holds admission at target, prices out spam, slashes provable faults. economics.py

3 · What is implemented

The rig attacks its own claims — the founding discipline is stop citing, start seeing. Status is what the code demonstrates, not what it aspires to.

CapabilityEvidenceStatus
Model-as-chain-state, bit-exact replaychain, blockchainproven
Full flywheel: train → score → apply → serve → paye2e.pyruns (0.13→1.0)
Real transformer + MoE, through the chainmodel2, moe_transformergrad-checked 1e-8
Sparse serving, O(k) not O(experts), attestedmoe_transformerpartial-recompute verifier
Async miners with real stalenessasync_node.pyconverges
Coordinator-free gossip consensusp2p, gossip_netcross-machine
Unbiasable beacon (threshold BLS + DKG)beacon, dkgproven
Erasure-coded DA + samplingda.pywithholding caught 100%
Write-price homeostat + stake/slasheconomics.pyholds target
Everything wired into one live loopintegrated.pyruns + live viewer
Revenue loop closing at scalemarket outcomePhase 3 goal
117
automated tests, all passing
2
machines: coordinator-free consensus over Tailscale
O(k)
per-token serving cost, independent of model size
100%
withholding attacks caught by DA sampling

4 · The distributed-systems stack is real

The hard cryptographic and networking pieces are not hand-waved. Each maps to an established design and runs in the rig.

Prior artSestrianModule
Bitcoin signed transactionsEd25519-signed delta commitmentscrypto, ed25519
Bitcoin headers + longest chainHash-linked headers, heaviest-valid-chain fork choiceblockchain
Bitcoin P2P gossipAsync socket gossip, partition-heals, no coordinatorgossip_net
Bitcoin difficulty retargetWrite-price homeostat (damped for a sharper plant)economics
drand threshold randomnessThreshold-BLS beacon with Feldman-VSS DKGbeacon, dkg
Celestia data availabilityReed-Solomon erasure coding + Merkle samplingda

5 · Security posture — stated honestly

Three attack surfaces, three locks. The one correction below is the most important thing in this document, because it is where our own red-team changed our claims.

The correction our red-team forced

The original intuition was that a 51% honest majority prevents poisoning. Our red-team (redteam.py) disproved that: a stealthy backdoor keyed to a secret trigger is invisible to blind detection, and a slow-drip coalition can implant one from deltas each less conspicuous than honest work — no matter how honest the majority. What actually defends is staked data-admission (cost to get poison in) and replay-excision (removing a backdoor once discovered — driven to zero effect in the rig). So the claim is corrected from "poisoning is prevented" to "poisoning is made costly and reversible." We found this before it could mislead anyone — which is what a rig is for.

6 · Reproducibility

Everything is runnable and seeded. scripts/run test executes 117 tests; scripts/run e2e shows the flywheel; scripts/run integrated runs beacon + DA + leader election in one loop; scripts/run live opens a browser dashboard that streams the chain block-by-block. The gossip network and the beacon have both been run coordinator-free across two physical machines, producing a byte-identical chain — where a node runs never changes the state.

7 · Roadmap & the crossover

The rig has retired the architectural and distributed-systems risks. What the raise buys down is three market-and-scale questions: does DiLoCo-class training hold at 7B+ across untrusted machines; does a vertical exist whose users pay more than its training costs; does the poisoning residual stay manageable on a real model.

8 · What could kill this

A limits section written by us before a reviewer writes it for us. Live status is tracked continuously in production-readiness.md and the threat model.