When you send a prompt to a hosted model API, you are taking two things on faith. That they ran the model you paid for, and that they did not keep your prompt afterwards. Usually both are true. But usually is not something you can put in an audit, and it is not something you can hand to an agent that spends money on your behalf.
We are building an inference network where both of those become checkable facts instead of promises.
A receipt for every request
Each completion returns a signed receipt. It names the model identity that served the request, and carries hashes of the input and the output, the node that ran it, and a timestamp. The receipt hash is the SHA-256 of the canonical JSON of that payload, so two parties comparing notes either agree exactly or do not.
Model identity is the part that does the work. It is not a label like llama-3-70b, which anyone can print on anything. It is the hash of the actual weights file, plus the quantization, the runtime, the runtime version, and the sampling parameters. Serve a smaller quantization than the one that was requested and the identity in the receipt is a different string. The substitution is not something you have to detect by watching quality drift. It is a mismatch.
That matters because silent downgrades are the cheapest way to make money in this business, and the hardest thing for a customer to catch. Nobody can tell, from one answer, whether they got the model they paid for.
The prompt is never stored
A receipt carries the hash of the input, never the input. Same for the output. The gateway stores hashes, the node, the model, the amount and the timestamp, and nothing else. Raw prompts and completions are never written to disk and never logged.
This is enforced rather than promised: the test suite greps the receipt log for the prompt text after a run and fails if it finds any of it. A regression that started retaining prompts would break the build rather than quietly ship.
Trust classes, derived and not claimed
Nodes are not equal, so every offer, request and receipt carries a trust class. The class is derived by the network from evidence it can check, never asserted by the node serving the request, and a request can require a minimum instead of hoping.
The top class is the one where a node proves what it is running inside hardware its operator cannot inspect. That verification path already works: we bind a subject to an Intel TDX enclave, fetch the quote, and check it through DCAP against MagicBlock's mainnet TEE on Solana. The enclave comes back bound, with current TCB, on mainnet, today.
What that proves right now is the confidential execution environment, not the GPU doing inference. Wiring the attestation to the inference itself is the next piece of work, and we would rather say that plainly than let a mainnet screenshot imply more than it shows. The network clamps every served class to what it can actually substantiate, so nothing is advertised above what is checked.
What runs today
The network is end to end on our own nodes. A node serves an OpenAI-compatible surface, reaches the gateway through an outbound mTLS tunnel so it needs no inbound ports, and the gateway routes by model and minimum trust class. Pointing an OpenAI client at the gateway base URL works.
Payment is per request over x402. An unpaid request gets a 402 naming the price, asset and network; a paid one gets served and returns its receipt. We ran a 30 request soak across the full stack: 30 of 30 served, 30 receipts with unique payment references and no replay accepted, the payment gate holding on unpaid requests, an average of one second per request, and no trace of the prompts in the receipt log.
The soak also found a real bug, which is the point of running one. The node's reconnect backoff treated any short tunnel session as a failure, including the successful sub-second relays, so under burst it drained its own connection pool and started refusing requests. A successful relay now resets the backoff immediately, and three regression tests hold that line.
A result that changed the design
The original plan was to spot-check nodes by re-running a request elsewhere and comparing outputs token for token. We tested whether that assumption survives contact with real hardware before building on it.
Single-stream greedy decoding is reproducible, with zero divergence. But turn on the continuous batching that every serving stack uses for throughput, and three of eight prompts stopped matching exactly, on the same model, same machine, same seed. Batch composition changes the arithmetic. So exact-match checking would have flagged honest nodes as cheats under load, which is worse than not checking at all.
Spot-checking has to compare distributions rather than demand identical tokens. Better to learn that from a spike than from a slashed operator.
Who this is for
Not the race to cheaper tokens. There are networks already running that race, and they will win it. This is for the prompts that cannot leave the building today: patient notes, case files, unreleased code, anything where we deleted it, promise is not an answer anybody will sign off on. If that describes your workload, the receipt is the artifact you have been missing.
Supply is not open yet. The network runs on our own nodes while the attested tier gets wired to the inference itself and the payment rail moves to real settlement. We are looking for design partners on the demand side first, because the shape of the receipt should be decided by the people who will have to file it.