Reference

Architecture

One server for the site, the API and the orchestrator; workers anywhere; settlement on Robinhood Chain.

The parts

Part	Role	Code
Server	Static site, OpenAI-compatible API, worker WebSocket, one port	`network/server.mjs`
Orchestrator	Worker registry, queue, matching, streaming, failover, hidden checks, settlement	`network/orchestrator.mjs`
Ledger	Accounts, keys, workers, jobs, treasury, deposits, payouts, snapshots, runs (SQLite, amounts in nano-dollar integers)	`network/db.mjs`
Money	ETH deposits, payouts, staking snapshots, Pons fee claims, buyback and burn	`network/robinhood.mjs`
Browser worker	WebLLM on WebGPU	`site/assets/worker.js`
Full node	Ollama	`network/node-worker.mjs`

Worker protocol

Workers keep one outbound WebSocket to /ws/worker. Messages are JSON:

worker -> hello      { wallet, runtime: "webgpu" | "ollama", gpu, machine, models: [...] }
orch   -> welcome    { worker_id, share, balance_n, paused_until }
orch   -> job        { job_id, model, messages, max_tokens, temperature, top_p, stop }
worker -> token      { job_id, text }                 (repeated)
worker -> done       { job_id, completion_tokens }
worker -> error      { job_id, message }
orch   -> cancel     { job_id }                       (client left, or max_tokens reached)
orch   -> settle     { job_id, credited_n, balance_n, tokens }
orch   -> check      { ok, reason }                   (result of a hidden check)
orch   -> paused     { until, reason }
worker -> models     { models: [...] }                (when the loaded models change)

Amounts ending in _n are nano-dollars: $1 = 1,000,000,000.

Settlement

Every job settles in one database transaction. Once a day the server claims the coin's Pons creator fees into the treasury (when the treasury is the fee recipient), takes the staking snapshot, runs the treasury split (buy and burn, staker shares), then pays every worker and staker owed $1 or more, in ETH at the on-chain price. Each payout is taken off the ledger before it is sent and put back if the transfer fails, so a crash can never pay twice.

Trust assumptions

The orchestrator is a coordinator run by an operator: it sees which worker served which job and holds the ledger until the daily payout. It does not store prompt content. The treasury is a hot wallet controlled by the operator, who can pause the server and withdraw its funds (network/withdraw.mjs). The coin was launched from the team wallet, which receives its Pons creator fees; the server uses that wallet only to claim the fees that arrive after it starts, keeps half there and moves the other half to the treasury. It never touches the team's other ETH or tokens. Workers run the model on hardware they control, so correctness is enforced statistically by hidden checks, not by cryptographic proof of inference.