Remote providers, stakes, slashing, bench oracle · 07_compute_marketplace/COMPUTE_MARKET_V2.md

Compute Market v2 — remote providers, stakes, slashing, reputation

Date: 2026-09-09/10 · Status: shipped & tested (30/30) · Supersedes: the v1 in-process design in P2P_COMPUTE_MARKET.md §1 · Run: python3 qmarket/qmarket.py + python3 qmarket/provider.py run · Prove: bash qmarket/test_market_v2.sh

What v2 added over v1

Capability	v1	v2
Provider execution	in-process adapters only	remote provider agents — standalone `provider.py` HTTP servers (:8850+) advertising `POST /execute`; the gateway routes jobs to them
Trust	reputation number only	stakes (providers post stake via their own loopd agent, min 500c)
Disputes	none	`POST /dispute` → two verification paths: (a) output-vs-anchor integrity (the anchored output hash vs what the provider claims), (b) deterministic recompute for reproducible jobs
Enforcement	none	slashing: proven fault → 50% of stake to the FloorVault bucket, 50% refund to the buyer, earnings clawback on the disputed job, reputation −25, delist below 40
Reputation	flat 100	dynamic: +1 per clean settle, −25 per proven dispute, delisting gate
Pricing signal	provider's word	bench.py price-floor oracle (sha256-iter/s CPU benchmark + optional Ollama tokens/s → suggested cents/unit by kind)

The v2 flow (as proven by the suite)

provider.py register --name local-media-studio --kind render --price 12 --stake 5000
        │ (registers via gateway; stake agent funded)
        ▼
buyer POST /jobs {buyer, provider_id, kind, spec, units}
        │ hold ~115% (loopd) ──► job routed to provider's /execute
        ▼
provider attests {frames|tokens, gpu_seconds, outputs}
        │ settle actual = metered × price (clamped to hold) — 0% platform take (founder policy 2026-09-12: the buy-spread is the margin)
        ▼
SETTLED ──► earnings accrue (redeemable AU$1:1) ──► output anchored on-chain
        │
        ├── DISPUTE (doctored output): anchor-hash mismatch proven
        │      → SLASH 50/50 (FloorVault / buyer) · clawback · rep −25
        │
        └── DISPUTE (cheat-mode provider): recompute mismatch proven
               → repeat offences → reputation < 40 → DELISTED (stake consumed)
clean jobs ──► reputation recovers (+1/settle)

Why this matters (the moat, restated)

The 2026 competitor scan (COMPUTE_MARKET_COMPETITORS_2026.md) found nobody ties stake→slash→delist to output correctness (Aethir verifies hardware, Golem recompute is CPU-only, Bittensor scores emissions) — and nobody pays sellers in a stable, redeemable unit. v2 is that moat in working code.

Honest limits (v2)

The gateway is still the dispute verifier — the last centralized trust point; next step is second-provider sampling (an independent node re-runs the recompute path).
Stakes are paper-phase (loopd cents), not on-chain escrow; on-chain qal_credit holds are the graduation path.
provider.py --cheat exists deliberately (it's how the suite proves slashing works) — never run it as a real provider.
Remote providers need reachability (Tailscale or public); the fleet provider on minirig is registered but offline-dependent.

v3 candidates (queued)

Second-provider dispute sampling · on-chain escrow via qal_credit holds · futures/capacity locks (ComputeFuture) · JobBundle batching for micro-jobs · RunPod adapter (goetica, see GOETICA_RUNPOD_INTEGRATION.md — runpod_train.py wrapped as kind lora-training, ~272c/GPU-hr).

← Tauri Wallet AppIOTA Tech Extraction →