Trust, in the open
Security
Once strangers can buy compute and devices can earn money, the failure modes change. Ayni publishes its threat model, an adversarial test harness that runs on every commit, cryptographic per-job authorization, and a fail-closed governance council — code first, claims second.
Threat model
What we design against
A compromised coordinator
Cannot read the provider hop (sealed per job with a fresh key). Cannot turn devices into a botnet: the node independently verifies what it is asked to run and enforces limits the coordinator cannot raise.
A malicious renter
No arbitrary code, no arbitrary network egress. Only allow-listed runtimes and models, and only the inference operation, with network_policy: NONE.
A malicious provider
Cannot create earnings without verified compute. One payable event per (job_id, device); the coordinator counts completion tokens itself and overwrites the provider’s self-report before billing.
Replays, races, retries
Single-use nonces; idempotent settlement and debits; a reference ledger that asserts credits are conserved and payouts never exceed accrued earnings, under concurrency.
Full delta: SECURITY_V0.1.md. External penetration test and audit precede general availability.
Adversarial CI
The cyber harness
An offline suite of hostile cases — tampered runtime and model hashes, widened network policy, shell operations, expired leases, unbounded resource limits, wrong-device binding, signed-payload replay, post-signature tamper, forged keys — every one of which must be rejected. It runs on every push in a dedicated job and sends no traffic anywhere.
cd security python -m pip install -r requirements.txt python -m unittest discover -s tests python -m ayni_security.harness # every hostile case: PASS
Per-job authorization
Signed Workload Manifest v1
Every dispatched job can carry an Ed25519-signed manifest that binds it to one device key, one runtime, one model, one resource envelope, and an expiry. The provider node verifies the signature against the coordinator’s published key and checks every resource limit against immutable local ceilings the coordinator cannot raise — refusing to run on any mismatch. A Go↔Rust known-answer test keeps the two implementations byte-identical.
Governance
The Ayni Council
Ten specialist seats, provider-diverse, fail-closed. Models reason and vote; a deterministic policy decides; every decision is hash-linked and publicly verifiable. It never moves money, deploys code, or commands nodes.