RAMPAGE

Your machines. One governed compute organism.

Recursive Autonomous Mesh for Policy-Aware Acceleration, Governance, and Evolution

Rampage turns the hardware you already own into a private, evidence-bearing compute fabric—then adds an autonomous intelligence layer that can improve how work is planned without ever inheriting the authority to run wild.

Launch the showcase · Architecture · Security · Release evidence · Owner-relay evidence · Resumable-storage evidence · Native distribution

This is what personal compute should feel like

Install Rampage on an owner PC. Install it on another machine. Paste one short-lived signed invite. Rampage discovers usable CPU, GPU/VRAM, RAM, storage, power, thermals, runtimes, and local Ollama models automatically—then moves bounded work to the machine that can actually perform it.

No Tailscale account. No fictional “global RAM.” No mystery daemon with unlimited authority. No AI agent holding the keys to its own guardrails.

The old constraint	The Rampage move
A powerful desktop sits idle while another machine struggles	Place the whole job on the best available node
Small machines cannot host the full workload	Give them restart-tolerant shards, preprocessing, evaluation, cache, or relay work
Donated disks become brittle network mounts	Turn them into encrypted, resumable, content-addressed artifact capacity with independently signed repair evidence
“Autonomy” quietly becomes administrator access	Let intelligence propose; let deterministic Rust policy decide
Distributed systems fail opaquely	Sign leases and receipts, fence stale work, and write every transition to a hash chain
A kill switch depends on the system it is stopping	Keep STOP local, non-agentic, and independent of the controller and network

The result: more useful compute, less wasted hardware, and an autonomous system whose ambition is separated from its authority by construction.

Built—not imagined

Rampage 0.2 established the working Windows x64 release candidate. Current source adds later qualified milestones; the evidence links below distinguish source proofs from packaged 0.2 claims.

Proof surface	Validated result
Trust kernel	Scoped Ed25519 leases; durable one-shot nonces; restart-safe monotonic epochs; crash-reconciled native STOP fencing; fail-closed admission and sidecar auth isolation
OnePool	Three independent evaluation shards placed across bounded offers, completed with signed results, and recovered after restart
Private mesh	Authenticated direct QUIC plus a forced-relay proof through the bundled owner-operated relay; no Tailscale account or silent public relay
Storage fabric	Encrypted chunked CAS, flushed restart-resumable QUIC frames, full-content possession proofs, corruption quarantine, budgeted independent repair, staging, and retrieval
Real AI workload	OpenAI, Anthropic Messages, and OpenRouter-style text requests crossed authenticated QUIC to a worker's loopback Ollama, streamed back, and ended in a transcript-matched signed receipt
Universal capability contract	Signed offers advertise exact workload domain, adapter, operation, execution pattern, isolation, runtime digest, and qualification status; candidate profiles grant no authority
Autonomous self-scan	Stable evidence digests cover routes, links, failures, denials, thermal/battery pressure, capability gaps, idle capacity, and protected-artifact replication
Compute Strategy	Read-only Maximum Model, Speed Boost, Throughput, Efficiency, and Autonomous placement previews with exact capacity and qualification blockers
Packaged product	Native Tauri shell, role-aware system tray, close-to-tray, start-at-login, governed sidecars, clean explicit shutdown, installer, and automatic desktop launcher
Verification	Rust, desktop, TypeScript SDK, Python intelligence, Python SDK, deterministic universal-gateway, forced-relay mesh, packaging, and lifecycle gates

The packaged 0.2 qualification record—including artifact hashes and the unsigned-release boundary—is in the release evidence. The newer API, workload-contract, self-scan, and signed-canary campaign is recorded separately in universal-compute evidence. The self-hosted hard-NAT fallback and its forced-relay transport proof are recorded in owner-relay evidence. Restart-safe two-node protected storage, signed possession challenges, and autonomous repair are recorded in resumable-storage evidence.

The design graph

flowchart LR
    H["Human owner"] --> X["Fabric Arena · Ops Grid · CLI · SDK"]
    X --> C["Controller\nintent · scheduling · recovery"]
    I["Intelligence plane\nDBOS · Pydantic AI · scientific memory"] -. "typed proposals only" .-> C
    C --> G["Governor\ndeterministic Rust policy"]
    G --> L["Signed capability leases\nexpiry · scope · fencing"]
    L --> W1["Command rig\nCPU · GPU · Ollama"]
    L --> W2["Spare PC\nshards · cache · storage"]
    L --> W3["Edge class\nforeground-safe work"]
    W1 <--> M["Authenticated QUIC mesh"]
    W2 <--> M
    W3 <--> M
    M -. "hard-NAT fallback only" .-> R["Owner relay\nsigned admission · rate caps"]
    M <--> A["Encrypted artifact fabric\nresumable · content-addressed · self-repairing"]
    C --> E["Hash-chained evidence ledger"]
    G --> E
    W1 --> E
    W2 --> E
    W3 --> E
    S["Independent local STOP"] -. "revokes authority" .-> G

    classDef mint fill:#102a28,stroke:#67f5c5,color:#f4fff9,stroke-width:2px;
    classDef trust fill:#211b2d,stroke:#c7a7ff,color:#fbf8ff,stroke-width:2px;
    classDef node fill:#101722,stroke:#728199,color:#f6f9ff;
    class G,L,S trust;
    class X,C,I,M,A,E mint;
    class H,W1,W2,W3 node;

Loading

The narrow waist is the capability lease. Interfaces above it can become dramatically smarter; devices and engines below it can become dramatically more diverse. Neither change bypasses policy.

That waist is durable, not merely signed. A normal controller restart preserves the current authority generation and recoverable work. Owner STOP advances the hash-chained generation; controllers reject old claims and receipts, while workers and artifact gateways persist consumed nonces and the highest epoch they have observed so replay remains denied after restart.

OnePool: pool the work, not the address space

Remote memory and VRAM do not become magically coherent across commodity networks. Rampage instead pools the parts that are useful in the real world:

1. Place a complete workload on one capable device.
2. Split independent map, evaluation, rendering, preprocessing, or search tasks into a bounded shard set.
3. Add replicas where throughput or evidence benefits.
4. Prefer data-local execution and encrypted artifact movement.
5. Admit multi-GPU or cross-host model sharding only after a specific engine/topology adapter proves it wins.

Phones and tablets are not pretend GPU servers. Their best future contribution is thermally bounded, foreground, restart-tolerant work: data preparation, scoring, validation, sensor processing, relay, cache, and small-model inference. Console support remains constrained by platform-holder policy.

Model Fabric: biggest model and fastest chat are different lanes

The desktop now defaults to Maximum Model and exposes five explicit ways to use added compute:

Toggle	What Rampage optimizes
Maximum Model	Largest compatible aggregate model-memory placement
Speed Boost	Fastest evidence-supported single chat; slow distributed links are rejected
Throughput	Independent replicas for many concurrent users or agents
Efficiency	Smallest qualified placement that fits
Autonomous	Proposal-only strategy adaptation behind Governor gates

The planner reports visible versus compatible memory, requested weights plus KV cache, selected ranks, parallelism, predicted speedup, and the exact missing qualification. Planning remains read-only. Separately, the shipped whole-model lane can select an exact installed Ollama model on one contributor, mint a one-shot model-session lease, stream it over authenticated QUIC, and expose the result through bounded OpenAI, Anthropic Messages, and OpenRouter-style text APIs. Cross-host tensor and pipeline launch remain gated until a backend proves runtime, topology, isolation, recovery, and measured benefit.

rampage model-plan local/70b-quantized --weights-gib 40 --kv-cache-gib 4 --strategy maximum-model-size
rampage model-plan local/fast-chat --weights-gib 20 --kv-cache-gib 2 --strategy speed-boost

See Model Fabric for planner rules and topology thresholds, and Universal compute for the operation-exact workload contract, API surfaces, self-scan, and honest device roles.

One fabric, many kinds of useful work

“Universal” does not mean pretending that every program can consume remote RAM or VRAM. It means one signed capability language, one trust kernel, one evidence spine, and a growing set of qualified adapters that can move the right unit of work to the right class of machine.

Lane	Useful today	Expansion path and honest boundary
Local AI	Discover installed Ollama models, select one qualified worker, stream a bounded chat through OpenAI, Anthropic Messages, or OpenRouter-style APIs, and return a transcript-matched receipt	Maximum Model can plan compatible aggregate memory, but cross-host tensor/pipeline execution stays blocked until an engine-specific adapter proves topology, recovery, and speed
Agent swarms	Run independent searches, evaluations, transforms, and tool-safe shards concurrently; require a signed result and an explicit success threshold	New adapters inherit the same lease, nonce, epoch, STOP, and receipt contract rather than gaining ambient machine access
Production	Place independent builds, renders, transcodes, simulations, preprocessing, and batch transforms where a shipped adapter advertises the exact operation	Interactive application memory does not become a network DIMM; large workflows must expose schedulable stages or engine-native distributed execution
Gaming	Preserve the foreground gaming PC by routing eligible background AI, compilation, capture processing, media conversion, server simulation, and cache work elsewhere	Rampage does not claim that an arbitrary game can borrow another device's VRAM or increase FPS without game/engine support
Phones and tablets	Contribute foreground-safe validation, scoring, preprocessing, cache, relay, sensor, and small-model tasks under thermal, battery, network, and restart-tolerance limits	Mobile packaging and platform qualification remain separate release gates; consoles additionally require platform-holder permission
Donated storage	Encrypt, resume, verify, retrieve, and repair protected whole-artifact replicas across owner-controlled nodes	Current source caps an artifact at 64 MiB and uses full replicas; erasure coding and physical-loss campaigns are future qualification work

This separation is deliberate. Rampage can become broadly useful without selling users a fake shared-memory story, and every new backend must earn admission with deterministic tests and signed runtime evidence before the Governor can lease it.

A native application, not a terminal ritual

Rampage owns the complete desktop lifecycle: sidecars, policy state, local discovery, the system tray, start-at-login, emergency STOP, explicit shutdown, and the desktop launcher. The owner should be able to install the app, create a fabric, paste one signed invite on each contributing machine, and let capability discovery do the rest.

Platform lane	Native deliverables	Current qualification boundary
Windows x64	MSI and NSIS installers; automatic desktop shortcut; Start-menu entry; role-aware tray; bundled sidecars	Packaged 0.2 was qualified on Windows 11 x64 but remains unsigned; fresh Windows Server 2022 candidate builds do not substitute for Windows 10 evidence
Linux x64	Debian package and AppImage with the same Tauri shell and native sidecars	Fresh Ubuntu 24.04 candidate gate; stable repository/AppImage signing remains channel-specific
macOS Apple Silicon	Native app bundle and DMG	Fresh macOS 15/M1 candidate gate; stable publication requires Developer ID signing, Gatekeeper acceptance, notarization, and a stapled ticket
Windows 10 x64	MSI/NSIS lifecycle, desktop shortcut, tray, sidecars, restart, STOP, and uninstall campaign	Deliberately unqualified until a real self-hosted Windows 10 runner completes the fail-closed workflow
Phones and tablets	Foreground-safe contributor contract	Native enrollment, transport, packaging, and physical-device qualification remain a later gate—not a shipped claim

Every staged candidate carries SHA-256 checksums plus a source-bound distribution manifest. Non-pull-request artifacts can receive GitHub OIDC provenance attestations, but provenance is not a substitute for platform identity. Stable Windows and macOS workflows therefore refuse to publish when their real signing credentials or native verification steps are missing.

See Native distribution and the live platform matrix for exact build environments, verification commands, credential contracts, and the difference between a candidate, a signed stable release, and a physically qualified operating system.

Recursively improving—without recursively expanding authority

The intelligence plane runs a durable improvement loop:

Record → Analyze → Mutate → Prove → Audit → Gate → Enshrine

DBOS workflows make the process recoverable. Pydantic AI adapters produce typed proposals. Scientific memory keeps experiments content-addressed. Deterministic replay, holdouts, adversarial review, replication, shadow, and canary gates determine whether an idea earns promotion.

The sidecar API fails closed when its authentication token is absent. The desktop gives it a fresh independent token rather than the controller credential, so proposal-plane compromise does not inherit controller admission, enrollment, STOP, storage, or lease authority.

There is no per-change approval prompt inside an owner-defined autonomy envelope. Candidates that pass every deterministic threshold may request a signed, traffic-capped, epoch-fenced canary lease from the Rust Governor and automatic rollback. Authority-critical changes, path escapes, and any attempt to widen that envelope are automatically denied—not queued for an AI to approve itself.

The model cannot mint leases, enroll peers, edit the Governor, access signing keys or secrets, promote itself, authorize destructive tools, change financial policy, or bypass STOP. Missing or ambiguous evidence fails closed.

Optional DumbMoney cell

Rampage can operate universally or attach as an infrastructure cell for DumbMoney. That bridge is a deliberately narrow external trust boundary: read-only telemetry enters Rampage; signed proposals return. Trading, capital, credentials, live databases, promotion, and policy authority never cross it.

Start the fabric

1. Download the Windows installer from Releases.
2. Open the Rampage shortcut created on the Windows desktop.
3. Choose Create my fabric on the main machine.
4. Choose Add machine, then paste the complete signed invitation into Rampage on the other PC.
5. Leave contribution limits on automatic or tune them. Press STOP whenever you want the node back.

Closing the window keeps the governed fabric alive in the Windows system tray. Left-click the tray icon to restore it, or right-click for role status, Start with Windows, emergency stop, and an explicit Quit that releases the desktop-owned sidecars. Auto-start launches quietly into the tray.

The current binaries are unsigned release candidates. Verify the published SHA-256 checksums and expect Windows reputation warnings until ObtuseAI publishes an Authenticode-signed build.

Direct QUIC is automatic. If hard NAT or CGNAT blocks a useful direct path, the bundled rampage-relay can be placed behind the owner's HTTPS endpoint. It admits only endpoint identities in a fresh Governor-signed manifest, rate-limits every connection, and is launched automatically by the desktop when rampage-relay.json exists in the runtime directory. See Owner relay for the exact one-time setup and unavoidable public-reachability boundary.

For a real local-model workload:

rampage generate llama3.2:latest "Reply with RAMPAGE_OK" --gpu-memory-gb 4

Or point an OpenAI, Anthropic, or OpenRouter-compatible client at the owner PC's loopback gateway. The API key is the local Rampage controller token; the desktop's Copy API setup button copies the compatible base URLs explicitly:

from openai import OpenAI

client = OpenAI(base_url="http://127.0.0.1:47831/v1", api_key="RAMPAGE_TOKEN")
reply = client.chat.completions.create(
    model="llama3.2:latest",
    messages=[{"role": "user", "content": "Reply with RAMPAGE_OK"}],
)
print(reply.choices[0].message.content)

GET /v1/models, non-streaming and SSE POST /v1/chat/completions, OpenRouter-style /api/v1 aliases, Anthropic POST /v1/messages, capability discovery, and explicit session cancel are implemented. Unknown fields, unsupported modalities/tools, inconsistent model aliases, replayed leases, stale epochs, oversized prompts, and unsigned terminal success all fail closed.

The desktop continuously displays the health score from GET /v1/diagnostics/self-scan. GET /v1/workload-capabilities exposes what each verified live offer can actually execute; the presence of a broad domain in the schema is not a claim that a backend is already shipped.

For useful pooled evaluation work:

rampage shard-plan "1,2,3" "4,5,6" "7,8,9"
rampage shard-run "1,2,3" "4,5,6" "7,8,9" --minimum-successes 3
rampage shard-status SET_ID

Each argument is independently retryable. Rampage previews placement without mutation, admits the entire set or none of it, and reports every selected node, signed receipt, result, and threshold.

Donated drives become explicit artifact capacity:

$artifact = rampage artifact-put .\dataset.bin | ConvertFrom-Json
rampage artifact-replicate $artifact.digest NODE_ID
rampage artifact-repair
rampage artifact-hash $artifact.digest

The system

Surface	What it owns
rampage-protocol	Versioned resource, job, shard-set, model-session, mesh, lease, receipt, artifact, and evidence contracts
rampage-policy	The deterministic Governor, signatures, admission, fencing, STOP, and promotion gates
rampage-controller	Scheduling, recovery, atomic shard admission, local API, and mesh gateway
rampage-agent	Hardware discovery and allowlisted CPU/GPU/Ollama worker adapters
rampage-mesh	Rampage-owned Iroh/QUIC identities and bounded remote control frames
rampage-relay	Owner-hosted hard-NAT fallback with signed endpoint admission and resource limits
rampage-storage	Encrypted, chunked CAS; durable resumable sessions; authenticated finalize; protected durability state
rampage-ledger	Recoverable, paginated, hash-chained SQLite evidence
apps/desktop	Tauri/React spatial Fabric Arena and accessible Ops Grid
services/intelligence	Durable proposal-only DBOS/Pydantic AI improvement workflows
packages/sdk-*	Token-aware TypeScript and Python integration surfaces
integrations/dumbmoney	Read-only telemetry in; signed proposals out

Build and prove it

Requirements: Rust 1.91+, Node.js with pnpm 11, Python 3.12+ with uv, and Windows build tooling for the packaged release.

pnpm install
uv sync --project services/intelligence --extra dev
cargo test --workspace
pnpm check
uv run --project services/intelligence pytest services/intelligence/tests
./scripts/Test-Rampage.ps1
./scripts/Build-Rampage.ps1 -Profile release
./scripts/Smoke-RampageInstaller.ps1

model-gateway-e2e.ps1 deterministically qualifies the gateway with a bounded fake loopback Ollama; ollama-e2e.ps1 can additionally exercise a real installed model. Generated outputs, installers, sidecar binaries, databases, keys, and logs are excluded from source control.

Read deeper

Architecture · Mesh and enrollment · Edge policy · Operations · Backend admission gates · Model Fabric · Owner relay · Native distribution · Platform matrix · Security policy · Release evidence

Publication and license boundary

Rampage 0.2 is designed for devices controlled by one owner or a deliberately trusted circle. It is not a public compute marketplace and does not permit anonymous stranger-to-stranger resource sharing.

The repository is publicly inspectable but proprietary—not open source. See LICENSE.

Stop wasting the machines you already own.

Make them act as one—and make every unit of authority prove where it came from.