Product concepts
How a judgement works
Follow a customer request from payment through independent model answers to final settlement.1. Commit the complete input
The canonical RequestInput schema includes the settlement-domain ID, prompt, output type, unique model list, budget, time limit, display agreement threshold, visibility, and private-output salt. CanonicalBytes serializes those fields in a fixed JSON-array order and SHA-256 produces inputHash. Before admission or credit reservation, the API publishes this complete request preimage to the configured content-addressed replica quorum. Native Chain commits the resulting requestArchiveId and refuses admission or finalization without it, including when every provider attempt fails. The domain remains immutable through authorization, reservation, assignment, receipt, settlement, and finalization.
| Field | Rule |
|---|---|
| prompt | 10–20,000 characters after trimming |
| settlementDomain | Nonzero 32-byte governed domain ID; fixed before authorization |
| models | 1–7 unique, active governed identifiers |
| spendLimitMicros | 10,000–100,000,000 (0.01–100 USDC) |
| timeLimitSeconds | 5–600 and must fit the governed authorization window |
| visibility | public or private |
| executionQuorum | 1..model count; display-only agreement observation |
2. Reserve prepaid credits
The requester signs a request-specific EIP-712 AuthorizeRequest message binding request ID hash, input hash, settlement domain, requester, maximum budget, and a governed Native Chain block-height expiry. The Native Chain rejects expired or overlong authorizations and reserves only already-safe deposited credits in that domain; provisional deposits cannot fund requests. EOA signatures are state-independent. ERC-1271 signatures are evaluated at one identified safe block on the selected domain, bind that block number and hash into the quorum observation, and remain under canonicality monitoring. The signature does not move USDC and cannot authorize a different input or custody domain.
3. Assign every selected model
Native Chain derives assignments from finalized state and the previous finalized block, selects an eligible bonded servicer, fixes the attempt deadline and equal model budget, computes the maximum provider reimbursement from that allocation and the snapshotted fees, and produces a stake-quorum certificate. Batches use a Merkle root so one BDN signature can cover up to 128 independently reconstructed assignments.
Queued
Authorized request is retained durably and awaits committed admission.
Executing
Each model has a deterministic assignment and bounded attempt.
Retry
Timeout observation can reassign up to the governed retry limit and queue evidence-backed slashing.
Terminal
Every model returns valid work or exhausts retries; agreement never short-circuits the protocol.
4. Execute and verify
- The assigned servicer authenticates to retrieve the private request preimage.
- The enclave reconstructs the complete request and rejects any inputHash, model, provider, schema, or consensus-assigned provider-cost limit mismatch. Native Chain independently determines whether the signed execution was authorized, assigned, timely, unique, and payable.
- The provider call runs with a deterministic per-model budget; the response is normalized into the requested schema.
- The complete provider exchange is content-addressed and replicated before the receipt is accepted. If replication fails after a provider response, the enclave retains that authenticated response and retries only archival/signing, never the charged provider call; the independently archived request preimage remains available even if no provider responds.
- The enclave signs the canonical receipt with its attested Ed25519 key, including the exact assignment-bound provider-cost ceiling; observers validate the receipt, attestation, cost/status relationship, identity, and deadline.
- Native Chain commits the execution or a defined failure state.
5. Settle and release
Native end-block deterministically forms a bounded settlement candidate from committed request, execution, reservation, and typed-result state. Validators attach auxiliary BDN votes to ordinary consensus votes; strict greater-than-two-thirds frozen weight produces a finalized, publicly queryable certificate. The coordinator only relays that certificate to the matching escrow. Validator watchers later observe the finalized EVM receipt autonomously and certify the domain-bound finalization back into Native state. TakusenEscrow prevents replay, transfers servicer and foundation amounts, publishes terminal model results, and finalizes a request only when terminalModels equals expectedModels. Every escrow hard-caps a batch at 64 executions; current Native certificates intentionally authorize one request per cohort for deterministic bounded work.