0%

Protocol

Four rails, one settlement layer. A machine proves who it is, meters what it draws, spends what it earns and acts only inside what it was granted.

The spec’s seal, pressed in vermilion
  • SPEC v0.4
  • DRAFT
  • NO HARDWARE SHIPPED
A rope-bound gate at night, woodblock
PLATE I

The gate is not the guard.It is the line the guard can point at.

00

One job, end to end

THE ORDER IT ACTUALLY RUNS
  1. 01

    Attest

    The machine signs a challenge with its hardware key.

  2. 02

    Authorise

    A scoped, time-boxed grant is issued for the task.

  3. 03

    Meter

    Power and airtime accrue against the grant, per watt-second.

  4. 04

    Settle

    The task closes and the meter clears in one micropayment.

MachineIdentity

One robot. One key. Nobody has to be trusted for it to be checked.

01 / RAIL

Every machine carries a key sealed in its secure element at manufacture. It never leaves the die. Identity is the public half plus a manufacturer attestation, so a counterparty can verify a machine is what it claims without asking anyone's permission.

did
did:katana:<curve>:<pubkey>
Resolvable without a registry.
attest
COSE_Sign1
Manufacturer chain, offline-verifiable.
rotate
epoch, prev_key
Rotation keeps history, never breaks lineage.

A machine that cannot sign is not a machine on this network. There is no fallback path, and that is the point.

MeteredCharging

Power, priced per watt-second, settled by the dock itself.

02 / RAIL

A dock is a meter with a key. It signs a start reading, streams deltas, and signs a close. No operator stands between the machine and the electricity, and no invoice is reconstructed after the fact — the meter is the invoice.

session
dock_did, machine_did, t0
Opened by mutual attestation.
tick
wh, ts, sig
Signed delta, at most 1s apart.
close
total_wh, price_hint
Settles against the open grant.

A tick more than a second late is dropped, never interpolated. An estimate has no signature, so it has no price.

MicropaymentRails

Pay per task, never per seat. Sub-cent clears without a round trip.

03 / RAIL

One-shot RaaS work does not survive a payment flow built for subscriptions. Grants open a channel that nets off-chain and closes on-chain, so a fifty-cent job costs a fraction of a cent to settle and never waits on a block.

channel
grant_id, cap
Opened with the grant, capped by it.
claim
amount, nonce, sig
Netted off-chain, monotonic.
close
final_claim
One transaction, whatever the job count.

A channel that cannot close on-chain still closed correctly off it. The last signed claim is the receipt, block or no block.

ScopedPermissions

Authority with an expiry. Granted in markup, enforced on-chain.

04 / RAIL

A grant names the actuators it covers, the ceiling it may spend, and the moment it dies. Revocation is immediate and public. Nothing on the machine has standing authority — every actuator call carries the grant that permits it.

scope
actuator[], region?
Explicit. No wildcards on motion.
ceiling
wh, currency
Hard cap; the meter stops at it.
expiry
unix, revoke_to
Time-boxed, revocable before it.

There is no wildcard for motion. `arm.*` does not compile, because nobody has ever meant it.

05

The trust boundary

WHAT IS ASSUMED · WHAT NEVER IS

A protocol is only as honest as the things it admits it cannot check. Ours are written down, on the same page as the claims.

Assumed

  • Secure elementThe key sealed at manufacture cannot leave the die without destroying it.
  • Manufacturer rootA maker publishes its signing root, and publishes its revocations.
  • ClockMachine and dock agree on the time to within thirty seconds.

Never assumed

  • The operatorNo grant widens because the fleet owner asked. Scope is set once, at issue.
  • The dockA meter reading is a claim, not a fact. Unsigned ticks settle at zero.
  • UsKatana holds no keys. Switch the network off and every grant still expires on time.
06

When it goes wrong

FAILURE MODES · AND WHAT HAPPENS ANYWAY
Dock overreportsTicks run past the ceilingThe meter stops at the ceiling. There is nothing left to settle the surplus against, so it is unclaimable rather than disputed.
Key clonedTwo machines sign as one identityBoth attestations stand until the maker publishes a revocation — but the fork shows in the log the instant the second one signs.
Chain congestedSettlement cannot landNothing blocks. Claims keep netting off-chain and the channel closes when it can. The work already happened; only the receipt is late.
Machine stolenHardware leaves the fleetRevoke the grant. Authority ends at the next actuator call, not at the next sync — there is no standing permission to inherit.
Operator vanishesNobody is left to close the channelExpiry closes it. The last signed claim settles and the unused ceiling returns. Absence is a supported state.
08

Design bounds

WHAT THE SPEC COMMITS TO · NOT WHAT ANYTHING HAS MEASURED

  • < 200 ms

    attestation budget

  • 1 s

    meter tick ceiling

  • 24 h

    longest grant

  • 0

    custody taken, ever

07

Spec history

SEMANTIC, SLOW, AND BORING ON PURPOSE
v0.42026-06Meter ticks became individually signed. Channel close collapsed to one transaction.
v0.32026-02Grants gained a hard currency ceiling alongside the energy one.
v0.22025-10Manufacturer attestation moved to COSE_Sign1, verifiable with no network at all.
v0.12025-05First public draft. Identity and metering only.
KAI, keeper of the ledgerKAI
KEEPER OF THE LEDGER

That is the whole of it. Four rails, and the places they refuse to bend... Read them twice before you build against them.