gridkernel — permissionless GPU compute market, settled in USDG against renter-signed receipts
registry.register(class, units, price, endpoint, bond) → kernelId market.open(kernelId, term, spec) → leaseId market.accept(leaseId) operator, within 1 h market.redeem(leaseId, served, signature) anyone, pays operator market.close(leaseId, result) operator market.settle(leaseId) anyone, after term + 6 h market.cancel(leaseId) renter, while OPEN
GridKernel is a two-sided market for GPU time. An operator lists a kernel: a node described by a hardware class (32 bytes, free text), a GPU count, a price in USDG per GPU-second, a public endpoint, and a bond. A renter opens a lease on a kernel for a term, escrowing price × units × term up front and writing the hash of a job manifest it sends to the endpoint off chain.
The chain does not verify the compute. It verifies receipts: EIP-712 messages signed by the renter stating the cumulative GPU-seconds it has received on a lease. The operator redeems the newest receipt on chain and is paid for the increase since the last one, less the fee. Money the renter never receipted never leaves escrow; it refunds at close.
Every parameter of the market is a constant. There is no owner, no pause, no setter, no upgrade path.
OPEN renter escrowed; operator has ACCEPT_WINDOW to accept.
renter may cancel at any time before acceptance.
RUNNING accepted; term runs from startedAt. receipts redeem.
CLOSED operator closed; balance refunded; result hash written.
SETTLED term + GRACE elapsed with no close; anyone settled it.
served == 0 → operator abandoned; SLASH_BPS of bond → renter.
CANCELLED renter withdrew before acceptance. full refund.A receipt is typed data under the domain below and is valid on exactly one market and one chain.
domain { name: "GridKernel", version: "1", chainId: 4663, verifyingContract: market }
type Receipt(uint256 leaseId, uint64 served)
rules served > lease.served (a receipt never re-pays)
served ≤ lease.term (a receipt never overpays)
signer == lease.renter (nobody else's word counts)
payout (served − lease.served) × price × units, less FEE_BPSReceipts are cumulative, not incremental, so a lost receipt costs nothing: the next one covers it. A receipt is a message until it is redeemed; signing costs no gas. Anyone may submit a redemption. The payout always goes to the operator.
renter stops signing operator stops at the first late receipt, redeems, closes.
exposure: one receipt interval, chosen by the operator.
operator stops serving renter never signed for it. balance refunds at close,
or at settle. renter loses time, not money.
operator accepts, idles settle() after term + GRACE with served == 0 cuts
SLASH_BPS of the bond to the renter and delists the
kernel until bond ≥ MIN_BOND. close() avoids it, always.MIN_BOND 50 USDG UNBOND_DELAY 7 days SLASH_BPS 2000 (20 %) FEE_BPS 100 (1 %) ACCEPT_WINDOW 1 hour GRACE 6 hours MIN_TERM 60 s MAX_TERM 30 days
The endpoint is not part of the protocol; it is the operator's door. A node that wants to be usable by this site's renters should accept the following, over HTTPS, and nothing else is assumed:
POST {endpoint}/lease/{leaseId}
body: the manifest whose keccak256 equals lease.spec
auth: EIP-191 signature by lease.renter over "gridkernel:{leaseId}"
→ 202 once the node has accepted on chain
GET {endpoint}/lease/{leaseId}
→ { served: <gpu-seconds delivered so far>, logs: <url>, outputs: <url> }
the renter signs a receipt for "served" when it agrees.
A node's loop: watch Opened(kernelId) → accept → run → ask for a receipt
every interval → redeem the newest → on a late receipt: stop, redeem, close.market 0x7111ee4d9e407bb249e66f7e6ccd24d134c9c0ab registry 0xa1a627cc1193d75b95bc6a587c5c11287e195e57 lens 0x06019f7c50c67aa41547c8e3835fb3b7ba0ccbf0 usdg 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168
A wrong answer the renter is willing to sign for is not caught, and cannot be. The ledger under a kernel — seconds served, leases closed against leases abandoned — is what a renter reads before trusting it, and an operator can inflate that ledger from a second address at the price of the fee. That is a cost, not a cure.
The bond is flat. A kernel of one 4090 and a kernel of sixty-four H100s post the same 50 USDG, because the bond is not insurance for the lease; it is the price of silence. A renter who needs more than that should open shorter terms.
The first receipt interval is unpaid work the operator chooses to front. An operator who fronts nothing asks for a receipt at second one.