▎
Proof-of-Model v3 — the matrix-state walk
The heart of H6. The possession proof moves from the hash-based walk to a matrix-state walk with a spot-check verifier, hardening Proof-of-Model against possession forgery.
- New prover + spot-check verifier with attack-case tests; wire layout and verification wired into check_pom_proof, gated at the H6 score.
- The proven tier is committed in the block header and read for reward and service-bond accounting.
- Difficulty-reset companion armed at the gate to absorb the new walk's hashrate profile; the difficulty window re-converges afterward.
- Witness handling — a bad possession witness invalidates the witness, never the block hash (no witness-poisoning).
Service-bond — enforced inference SLA
A new system that makes miners actually serve inference, not just hold the model.
- Escrow-key identity + mandatory delegation cert — a miner's service identity is its payout key; the wallet/CLI (delegate-escrow) signs the cert that authorises it.
- Per-request cohort audit — every accepted AiRequest audits the full eligible tier cohort; token-scaled service windows with a max_tokens cap.
- Escalation — rate-limited strikes, 24 h production suspension (burns the miner cut, does not reject the block), and escrow burn for a finality-deep miss.
- Sealed service state — a MuHash commitment of the service ledger in headers at the pruning point, downloaded and verified at IBD, so a fresh node re-derives the exact same standings.
- Signed V2 AiResponses and era-gated payloads.
Rewards & lineup
- H6 model lineup — tier 0 Qwen3.5-9B, tier 1 GLM-4-9B, tier 2 Gemma-4-12B (16 GB cards), tier 3 Qwen3.6-27B, tier 4 Kimi-48B.
- Tier-reward schedule re-spaced to 10-point steps across the five tiers.
- Fully-burned miner/escrow outputs are omitted rather than emitted as zero-value; merged red-block subsidies burn at H6.
Fixes & hardening
- UTXO commitment — fixes a state re-derivation divergence during reorgs that could wedge a re-syncing node; upgraded nodes recover normally.
- Recovery flag — KERYX_REVALIDATE_DISQUALIFIED=1 heals a wedged node in place (re-validates disqualified chain blocks) instead of a full resync.
- Block relay — recent orphan roots now require their possession proof at the H6 gate; retry applies the same proof policy as the first attempt.
- IBD — unverified carried PoM tiers are discarded.
- Escrow claims — burned-escrow rejections name the affected outpoints so miners drop them directly.
New RPCs
getServiceStrikes and a lifetime strike tally per identity · GetUtxoEntriesByOutpoints (153) · GetUtxoCountByAddress (152). Plus chunked utxoindex scans and outbound peer target raised 8 → 16.
Acknowledgements
- @ocminer — suggested the idea behind the Proof-of-Model v3 spot-check design and helped review its soundness.
- @jaja (neuropool.net) — review of the block-relay path; surfaced the orphan-root proof-policy gap fixed in this release.
- @ryancole03 — IBD PoM-tier authentication (PR #27) and the coin-age maturation reorg fix.
- @izzback — spotted the witness-poisoning issue (invalidate the witness, never the block).
- @gryph — spotted the merged red-block subsidy burn.
Thanks to every operator who reported issues and ran the testnet.
