quorum

Pay for verified compute on Kaspa. A result is paid only when independent workers agree — and a worker that fabricates a result forfeits its bond.

→ Read what quorum is, in one page — the rule in four verdicts, the economics, and the honest boundary.

metered settles work a buyer can count — bytes, tokens. It cannot reach compute, because a buyer usually cannot cheaply recompute a result to check it. Renting a GPU to run a job you can't verify is renting on trust, which is why the compute marketplaces that exist all need a trusted operator in the middle holding the money.

quorum removes the operator. When you can't measure a result directly, agreement measures it for you: run the task on independent workers, and pay only when they agree. Disagreement doesn't just fail the task — it attributes blame, so the worker who lied can be slashed and the honest one paid, all settled on the same kaspa-x402 escrow rail that spigot and flume use.

The rule, in four outcomes

A verdict about a task is one of exactly four things, and each maps to one settlement — nothing else is allowed to move money:

Verdict	Means	Settlement
agree	the workers produced the same result	pay them for it
resolved	a referee caught one lying	pay the honest, slash the liar's bond
undecided	two disagree, no referee has ruled	hold — no money moves yet
inconclusive	all three differ (an environment fault)	refund the buyer; punish nobody

The last one is the point most systems get wrong: three different results is almost never two liars, it's non-determinism — a mismatched build, a different backend, a driver. Slashing there punishes honest workers for the market's failure to pin the environment down. quorum refunds instead.

A worker is paid for a result, not for effort, and its bond — posted up front, forfeit only when a referee catches it — is what makes "I did the work" cost something to fake.

What is here

The whole pipeline, as pure decisions -- provable before any money is at stake. Each step reads the step before it and moves nothing:

src/replication.ts	replicate? -- shouldReplicate(task, worker) decides whether a task is double-run at all. A newcomer or a caught worker always; a proven worker only at a periodic audit floor. replicationFactor quotes the honest cost (~1.05x earned, 2x not). Vendored from kaspa-depin.
src/adjudication.ts	agree? -- adjudicate(a, b, referee?) decides agree / resolved / undecided / inconclusive from content hashes, and names who lied. Vendored from kaspa-depin, generalised from rendering to any deterministic-output task.
src/settle.ts	verdict -> money -- settleVerified(verdict, terms) turns a verdict into pay / pay-and-slash / hold / refund.
src/parties.ts	the on-chain handles a settlement touches: the buyer's channel, each worker's payout address and posted bond.
src/plan.ts	money -> rail actions -- planActions(settlement, parties) emits the exact, ordered moves: the price split exhaustively across the paid, every bond released to the honest or slashed to the buyer, never both.

npm install
npm test          # 21 tests: replicate? -> agree? -> verdict -> rail actions, end to end

Status

The decision pipeline runs as pure decisions, pinned by 21 tests: from "should this task be double-run?" through "did the workers agree?" to "what moves on the rail, and to whom." None of that touches the chain -- on purpose, so every rule is provable before any money is at stake. The chain is reached only past the last decision, through one injected SlashSubmitter (see The bond, on chain); that wire is proven live once on testnet-10 (2026-09-21).

Honest limits. Two things the pure logic does not do on its own: (1) the default audit sample is deterministic and public — reproducible, but not unpredictable. A submitter free to choose task ids can see which go un-audited and shop for them unless the injected hash is secret-keyed (an HMAC a trusted scheduler holds until the task ids are fixed). (2) Worker agreement is evidence, not proof: it supports a correct result only when the workers are genuinely independent and the task is reproducible, and an inconclusive verdict does not identify its own cause — commonly environment non-determinism, but a coordinated fault is not excluded.

Next, in order: the one open design question is the bond. metered's escrow is a one-way buyer-to-seller channel; a bond a fraud verdict can slash is a different shape -- a worker locks funds that release back to it on honest completion or a timeout, and to the buyer on a resolved verdict. That wants real research on the kaspa-x402 covenant rather than a rushed escrow (metered's own lesson). After it: execute a RailAction list live on testnet; then a first real vertical -- a deterministic GPU job (a render, a seeded inference) -- end to end.

The bond, on chain

quorum's slash was pure logic — a number in a settlement, with no on-chain teeth — because the kaspa-x402 escrow is the wrong shape for a bond a third party's verdict can seize. Kaspa's Toccata upgrade (live on mainnet 2026-06-30) changes that: its introspection opcodes let a covenant enforce where its money goes, so a bond can have two doors — refund to the worker after a timeout, or slash to the buyer on a referee's guilt verdict. The covenant is proven live on testnet-10 -- contracts/quorum-bond.sil, both doors (refund/slash) with their refusals broadcast end to end (docs/covenant-bond.md). Built and proven live on the same rhythm since: a reputation deed (docs/reputation-deed.md), an atomic slash-and-ding composition (docs/read-verb-composition.md), and an identity-minting registry (docs/deed-registry.md).

The wiring (self-audit, 2026-09-16 -- the author's own pass, not a third party's; broadcaster added 2026-09-20): most of the above is proven covenant mechanics exercised only by hand-run live-* scripts. Two wires into the product now exist. src/execute.ts turns a pay-and-slash decision into an executable SlashSpend -- the worker's real quorum-bond redeem, the buyer's payout, and the exact guiltyDigest the compiled covenant recomputes on chain (byte-tied to the same digest the live bond proved). src/broadcast.ts is the wire's end: broadcastSettlementSlashes(chain, parties, settlement, fee) takes a settlement and, on pay-and-slash, lands one real covenant spend per caught worker -- fee = bond − payout, the referee's datasig over the guilt digest, the witness [sig, tag, redeem] -- so settle() ends in an on-chain slash, not a recipe. The chain call is an injected SlashSubmitter, so the whole path is unit-tested offline (8 tests) with quorum still SDK-free. And because a txid is not finality on a BlockDAG, src/confirmations.ts + src/settlementledger.ts (added 2026-09-21, after vprogs PR #146) hold each broadcast slash tagged with the block it landed in: a slash counts only once it is a confirmation floor behind the tip, and a reorg hands back the orphaned slashes so their deeds get un-dinged off chain -- keeping the fabric's record in step with the chain. runSettlementSlashes(chain, parties, settlement, fee, ledger) is the whole path in one call. Proven live on testnet-10 (2026-09-21): the product code -- not a hand-run script -- posted a bond, broadcast the slash (tx 81c3008f1fe5d79508105ada9b0760f4de52651de8b38a5039f549aeffaf172d: 1 KAS in from the P2SH bond, 0.99 KAS out to the buyer, 0.01 KAS fee, accepted at blue score 565268486), consensus paid the buyer, and the ledger tagged it at its real block DAA so a reorg would revert it (driver: ). The wire that self-audit found missing is closed end to end.

The proofs, kept. Every transaction this repository links to an explorer is also archived as docs/proofs/<txid>.json -- the transaction as api-tn10.kaspa.org served it, with when it was fetched. The public testnet-10 index serves only about the last six days (measured 2026-09-22), after which a link alone is the author's word. npm run harvest archives anything newly cited; npm test fails on any linked id without its file, and on any id that was cut short.

Licence

MIT.