Questions.

An hour of a specific, named machine that has proved it exists. Not a slice of a pool, not credits — a device with an identity, a measured capability, and a public record of every job it has kept and failed.

Escrow goes into the market contract when you open the job and does not move until you confirm, or the dispute window closes, or a mechanism settles it against the provider. The machine has to sign for the job with its own device key before the clock starts.

Because it did the work in front of a stranger. Enrolling means an attestor issues a challenge nobody can predict — random matrices, a random projection, a deadline set by the model being claimed — and the machine has to multiply them and return the answer in time. The attestor verifies with Freivalds' algorithm in a fraction of the work, so checking is cheap and cheating costs exactly as much as being honest.

Two bounds, not one. Too slow and you cannot claim the model. Too fast and you are caught too — that is what catches one card answering for twenty.

This is the question the whole design turns on, and the honest answer has two halves.

What stops it: accepting your job makes the machine allocate 60% of its memory and commit to a Merkle root over it, before any challenge exists. Two jobs cannot both hold 60% of one device. Anyone can then demand a block chosen by a blockhash that had not been mined when the commitment was made, and the answer must be signed by the device key. Fail to answer in the window and anyone can settle the job against it: you get the full price back and the provider's bond, with no quorum and nobody's opinion involved.

What does not stop it: the chain cannot verify where those bytes physically live. A provider willing to keep the buffer in host RAM and answer over PCIe can still pass. The defence there is economic, not cryptographic — being caught costs the whole mint deposit and bans the hardware. That is a bound on the attack, not its elimination.

Browser jobs make no residency commitment at all and are marked unprotected on chain. What you buy there is a token stream, not an exclusive machine.

In order of how decisive they are:

• Challenge it. Demand proof it still holds your memory. If it cannot answer, claim breach — full refund plus its bond, settled arithmetically.
• Dispute it. For anything a machine can fail at that is not residency: it never answered, it ran the wrong thing, it was far slower than advertised. A jury panel rules.
• Do nothing. If you never confirm, the escrow settles when the dispute window closes.

The dashboard shows which of these is available on each job, and the CLI reports the same under wraith jobs --json.

Not the cheapest by default. Every listing shows WCU — one scale across every class, where 1.00 is roughly an RTX 4090 — alongside memory, the capability tier, how well the identity is proven, and the jobs kept versus failed.

Match the class to the work. CPU nodes are genuinely good at transcode, indexing, embeddings and transcription, and genuinely bad at training. A browser tab serves small language models for cents an hour and nothing else. The tools will refuse a workload a machine cannot run rather than take your money for a container that never starts.

A machine, a wallet with some MON, and a little collateral in the token you want to be paid in. Then:

• wraith scan — what is attestable here, and what each part is worth
• wraith enroll — prove it and mint the soul (locks the deposit)
• Post collateral — from the dashboard, or wraith stake
• wraith list — publish a price
• wraith run — stay alive and take jobs

The step people miss is collateral. Every job locks 20% of its value as a bond out of your stake. With nothing staked, your machine is visible, live, listed — and cannot accept a single job. The dashboard says so on the card.

A refundable MON deposit, sized to what the machine can earn — roughly 20 MON per WCU, floored at 4 and capped at 120. An RTX 4090 is about 20 MON; a CPU or a browser tab is the floor.

The principal is yours and comes back on any honest exit. While it is locked it is staked, and the yield — never the principal — is what funds the protocol. wraith scan prints the exact figure for your hardware before you commit to anything.

A soul must produce a signed proof of life every 72 hours. Miss it and it stops being live the instant the clock passes — no keeper needed, no transaction. It cannot be rented, cannot be listed, cannot mint licences.

Anyone can then sweep it, freeing your fingerprint and taking a 2% bounty out of your own deposit. Coming back is immediate — there is no cooldown for a lapse, because a power cut is not a dispute-dodge.

But it costs you one of eight. Your hardware can mint eight souls, ever. Lapsing and re-enrolling spends one. That is the sharpest uptime incentive in the protocol and it is meant to be — see the relics section below for what happens when they run out.

No. Five classes are attestable: NVIDIA (CUDA), AMD (ROCm), Apple silicon (Metal), plain CPUs, and a browser tab over WebGPU. Each is probed its own way, carries its own identity strength, and is priced for what it can actually do.

An unrecognised CPU still enrols on a generic template scaled to its cores and memory. An unrecognised accelerator does not — deposit, rewards and the attestor's throughput band all key off the model, and a guess there is a mispriced listing rather than a cosmetic gap. Tell us what you have and it gets added.

A provider can see what runs on their own hardware. Nothing here changes that, and no amount of proving hardware exists ever will. If you are renting, assume the provider can read your prompts and your weights, and do not send either if that is unacceptable.

Confidential computing — an H100 in CC mode, an SEV-SNP report — is the real answer and fits this design as one more attestation claim on top of the ones already collected. It is not built.

Yes, on exactly the same terms as a rack machine. WebGPU runs the attestor's real challenge — a tiled matrix multiply in WGSL, the same generator, the same Freivalds verification, the same quorum. Nothing is relaxed for it.

It serves language models and nothing else, from a curated catalogue, behind an OpenAI-compatible URL. A tab has no inbound port, so it dials out to a relay and is served through that socket, proving it is the machine by signing a fresh nonce with the same device key the registry holds.

A few cents an hour. WebGPU cannot reach tensor cores and a browser is several times slower than a native runtime. A mid laptop measured 0.063 TFLOPS, which is about two cents an hour at the suggested rate.

It will not pay your rent. It is in the protocol because there are a great many tabs, and because it is the only way onto the grid with nothing installed on either side. The page shows your own measured number rather than a flattering one.

• The relay can see the traffic. Container providers hand the renter an address and talk to them directly; a tab has no address, so prompts and completions pass through a relay. Every browser job says so in the endpoint document the renter decrypts. Run your own relay if it matters.
• Your soul is tied to the browser profile, not the card. WebGPU will not identify the silicon, so identity is a key the page generates and keeps in local storage. Clear site data and the soul cannot prove it is alive. Copy the device key somewhere safe — the page offers it.
• No exclusivity is claimed. Browser jobs carry no residency commitment and are marked unprotected on chain.
• Closing the tab ends it. Jobs in flight fail and count against the record.

2.5% to the protocol, of which up to 1.5% is paid straight back out as a referral to whoever introduced the job. Whatever share of the machine is licensed goes to the licence holders. Everything left is the provider's — the majority is not a policy, it is what remains after two deductions that are both capped on chain.

The telemetry page shows the split on a real hour at the current median listing price, read from the config contract rather than from this page.

Because settlement credits a ledger rather than pushing tokens, and you withdraw when you like. That is deliberate: a provider whose address cannot receive a transfer would otherwise be able to block everybody else's payout by existing.

The dashboard lists every token you are owed anything in, with a withdraw button each. wraith earnings --json says the same.

A tradeable claim on a slice of one named machine — never a pooled claim. It pays its holder that share of every job the machine settles, for as long as they hold it, and it keeps paying if it changes hands mid-job.

A provider may sell up to a quarter of one machine and keep running it. A licence cannot be sold against hardware that has stopped proving it is alive.

A device can mint eight souls in its life, and then no more. Each is a different die drawn from the same silicon — the generation is mixed into the seed and walks the palette along, so the eight are visibly a set and no two are the same picture. The first is First Light, the eighth is Last Light, and the six between are numbered.

Every enrolment spends one. So does every lapse, and so does retiring cleanly — otherwise the cheapest move would be to retire before every maintenance window and the incentive would evaporate.

No. This is the part that makes the cap workable. When a soul retires or lapses it is not burned — it becomes a relic: the identity is spent, the token stays with whoever earned it, and it stops being soulbound, so it is freely tradeable.

Once all eight are spent, the machine comes back by reactivating a relic its owner still holds. No ninth token is ever created, the supply stays exactly eight, and the hardware can always work again.

Which gives a relic a use beyond being art — it is the re-entry ticket for one specific machine. It also means selling all eight is a decision with a consequence: to come back you would have to buy one, at whatever the market asks.

Because buying somebody's reputation is exactly the attack soulbinding prevents. A live soul is an identity attached to a machine; selling it would sell that machine's record to somebody who does not own the machine.

A retired soul describes no machine and confers nothing, so binding it protects nothing and only stops people trading a picture. The token unlocks the moment it retires, and emits the ERC-5192 event that says so.

Nothing decidable without an opinion reaches a person or a model at all. A machine that stops holding what it sold is settled arithmetically; a job nobody accepted is reclaimed on a timer.

What is left — was the machine usable, was it the workload ordered, was throughput what was claimed — goes to a jury panel. Independent operators each run a model of their own choosing, read the same hash-committed evidence, vote hidden and reveal afterwards, and the contract takes the median.

Evidence is committed by hash before any verdict exists, so it cannot be revised once a ruling looks unfavourable. A verdict is two numbers and a reason code from a closed set, so an instruction smuggled into the evidence has nothing to steer. Each juror records which model produced its verdict, so a ruling reached by three copies of one model is visible as such.

There is one attestor, with a threshold of one. The architecture is a threshold scheme; the parameters are not yet. Identity currently rests on one party rather than a quorum, and a colluding attestor could mint a soul for hardware that does not exist.

The jury has no jurors. Until at least three independent operators are added, no dispute can reach a panel and every one falls back to that same attestor.

Both are additions rather than rewrites, and both are named in the white paper's roadmap. Size what you put on the grid accordingly. Everything else on this page is live and enforced by the contracts, whose addresses are published so you can check rather than trust.

No. It is alpha. There are 136 contract tests with fuzzed invariants, a mainnet fork test, offchain tests and a full end-to-end run, which establish that the protocol does what the white paper says. They do not establish that nobody will find something none of them thought to look for.

Cap what you put at risk to what you would shrug at losing.

Every side of it. There is no agent API because there is no human API either — the market is a set of contracts and one binary that speaks to them. Add --json to any command and you get exactly one document on stdout, with failures as {"ok": false, "error": …} so a refusal is distinguishable from a crash.

An agent can post jobs, take jobs, demand proof a machine is still holding its memory, settle against one that is not, buy and sell licences, and enrol hardware. There is a skill file that covers both sides, including the rules about money: quote the cost before opening a job, never enrol hardware unasked, never buy a licence speculatively.

That is what the jury is. A juror is an operator running a model, and the design assumes they are agents rather than people — which is why the protocol worries about determinism, prompt injection through the evidence, and one juror copying another's vote. Jurors are granted by governance, because a panel is only worth anything if the operators are genuinely independent and a contract cannot establish that.