The pay2seed hub: consent, escrowed offers, leases and the 1 percent - #211
Merged
Conversation
bittorrented.com is now the reference hub for the OpenSwarm payment family (logicsrc.com/openswarm). The specs were merged this morning; this is the implementation. A requester signs an attestation saying what they are putting on a swarm and why they may share it, with a README that becomes the swarm's page. Nothing is listed without one. A public claim waits out a window in the open first, so a notice can void it before anyone is paid to seed something the requester had no right to. A private swarm is ciphertext a seeder holds without ever reading. An offer escrows a budget for the swarm to be kept for N days by M seeders at a price per GiB-month. It stays unpaid until the money settles, because a budget that is not escrowed is not a promise anyone should seed against. Seeders take slots by signing the offer id, prove each period, and are paid per proven period; the receipt's unique (lease, period) is the whole of the idempotency, so a verifier that reports twice pays once. Two consecutive failures reopen the slot. Every party is a key, and a key is a human or a bit: an autonomous agent that holds its own key and earns its own money under the same consent rules. Because both sides can be either, the lane is stamped on every lease and receipt at the moment the money is agreed. h2h, h2b, b2h, b2b. We carry all four. The hub takes 1 percent of what crosses it, charged to whoever is paying and never taken out of a seeder's floor. Money is exact six-decimal strings over integer micros the whole way and only becomes a number at the Postgres boundary, so a hub and a seeder computing a period apart always agree. Ten tables, all RLS-enabled and service-role only, applied to the live database. The API is at /api/openswarm/pay2seed with the hub record at /.well-known/openswarm-hub.json, and the market is at /swarm, where a swarm's README is rendered through a subset renderer that emits no HTML from the source and is sanitised again after. The generated Supabase types were regenerating 129 unrelated breakages across the app, so only the ten new tables were added rather than the whole file. Bringing the rest current is its own piece of work. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SKAohrRkqLKVQL2cGCAkR5
ThreatCrush Security Scan99 finding(s) HIGH/CRITICAL: 11 | MEDIUM: 29 | LOW: 59
…and 49 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
bittorrented.com becomes the reference hub for the OpenSwarm payment family. The four specs merged this morning (profullstack/logicsrc#143, live at logicsrc.com/openswarm); this is the implementation of the seed half.
The two rules everything rests on
Nothing is listed without consent. A requester signs an attestation saying what they are putting on a swarm and why they may share it, carrying a README that becomes the swarm's page. A public claim waits out a window in the open first, so a notice can void it before anyone is paid to seed something the requester had no right to. A private swarm is
ipfileciphertext a seeder holds without ever reading.A promised floor is what the seeder is paid. The hub takes 1 percent of what crosses it, charged to whoever is paying, on top of what they quoted, and never taken out of a seeder's earnings.
Lanes
Every party is a key, and a key is a human or a bit: an autonomous agent holding its own key, earning its own money, under the same consent rules. Because either side of a payment can be either, the lane is stamped on every lease and receipt at the moment the money is agreed, so it survives a party later changing kind.
h2hh2bb2hb2bAn agent selling in public must name a responsible operator key, so a notice always reaches somebody.
Money
Exact six-decimal strings over integer micros the whole way, becoming a
numberonly at the Postgres boundary. A period earnsprice × size × time, rounded down, so a hub and a seeder computing it apart always agree; a budget is escrowed rounded up, so a proven period can never exceed what was set aside for it. A receipt's unique(lease, period)is the whole of the idempotency: a verifier that reports twice pays once.Surface
POST /api/openswarm/pay2seed/attestations·parties·offers·leases·proofs·noticesGET /api/openswarm/pay2seed/offers— the market, honoured attestations onlyGET /.well-known/openswarm-hub.json— the hub record, 1 percent and all four lanes/swarmand/swarm/[id]— the market, and a swarm's page built from its READMESchema
Ten tables, all RLS-enabled and service-role only, already applied to the live database and verified. The migration file matches what was applied and is safe to re-run.
A note on the generated types
Regenerating
src/lib/supabase/types.tswholesale surfaced 129 unrelated type errors across the app, because the checked-in types were well behind the live schema. So only the ten new tables were added rather than the whole file. Bringing the rest current is real work and its own PR.Checks
tsc --noEmit0 errors.vitest run2,770 passing, 206 files. ESLint clean on everything new. 23 new tests cover canonical bytes, signature verification (including that a signature cannot be replayed as another record type), the 1 percent, the four lanes, period arithmetic, and a README renderer that must never emit HTML somebody put in their own README.🤖 Generated with Claude Code
https://claude.ai/code/session_01SKAohrRkqLKVQL2cGCAkR5