papers/morpheus/adoption/adopt-02-verified-settlement.tex

\documentclass[11pt,a4paper]{article}
\usepackage{../shared/luxcover}   % black cover (self-contained, TikZ logo, no assets)
\usepackage{../shared/proposal}   % \proposalhead helpers and the stake environment
\usepackage[utf8]{inputenc}\usepackage[T1]{fontenc}\usepackage{amsmath,amssymb}
\usepackage{listings}\usepackage{xcolor}\input{../shared/lstlang}

\newcommand{\code}[1]{\texttt{\small #1}}
\newcommand{\prov}[1]{{\color{muted}\footnotesize\sffamily [#1]}}
\setlength{\emergencystretch}{3em}

\title{Un-fakeable Settlement}
\author{Zach Kelling\\\textit{Lux Industries, Inc.}\\\texttt{[email protected]}}
\date{2026}

\begin{document}
\luxcoverpage
\sloppy

\noindent{\color{muted}\footnotesize\sffamily ADOPT-02 \quad\textbullet\quad Hanzo AI \& Lux Industries \quad\textbullet\quad 2026}\par
\vspace{0.9ex}

\noindent\textbf{Morpheus pays for time, not work.} \prov{verified}
Settlement is \code{pricePerSecond} times elapsed session time
(\code{SessionRouter.sol:264}). A bid carries one economic field,
\code{pricePerSecond} (\code{IBidStorage.sol:17}); \code{modelId} rides along but
never enters the bill. The provider's receipt signs seven fields, among them the
input and output token counts (\code{abi.go:18--19}). The contract decodes five
and drops the two counts before it settles (\code{SessionRouter.sol:237}). So a
provider earns the same for a session whether it returned every token or none,
and the same for a 7B served where a 70B was advertised. The only signature on
the meter belongs to the party the payment pays. There is no slashing; the grep
is empty. Across the 62 repos no session, usage, or revenue figure is published.
Three ways to be paid for work not done, inflate volume, self-deal, or substitute
a cheaper model, each cost the provider zero today.

\vspace{0.5ex}
\noindent\textbf{mord settles what both sides signed.} \prov{verified repo}
mord (\code{github.com/luxfi/mord}) is a Lux L1 that runs the marketplace as chain
state, a proof of concept, built, not yet deployed or audited. It keeps three
quantities apart. \code{Capacity = Held $\times$ PerBlock}, the slot.
\code{Work = (In+Out) $\times$ PerToken}, and zero unless a meter earns it.
\code{Total = min(Capacity+Work, Escrow)}, the rest refunded. Work pays only when
the meter carries two signatures, the provider's over the token counts and the
consumer's over the same counts and the output received, and only when the
consumer is not the provider. A \code{publish} commits a model manifest digest; a
\code{challenge} recomputes the committed model on the metered prompt, and a
confirmed mismatch slashes the provider to zero and pays the challenger. Capacity
settles inside block acceptance, so every validator reaches the same bill.

\vspace{0.5ex}
\noindent\textbf{Faked work earns zero.} \prov{verified: 40 tests pass, 2026-08-29}
Nine of the forty tests are the attacker's (\code{market/adversary\_test.go}). A
forged countersignature, a signature replayed from another session, a swapped
output, a stand-in signer, and work claimed with no meter each earn zero work. A
fabricated challenge slashes no one. A confirmed model substitution slashes the
provider to zero stake.

\begin{stake}{Fraud surface, today vs.\ mord}
  \item \textbf{Volume inflation.} Today: the provider signs its own count, and
        the contract that could check it discards the count. Under mord: forging
        volume needs a counterparty to co-sign the inflated figure.
  \item \textbf{Self-dealing.} Today: a provider serving itself is paid in full.
        Under mord: a self-dealer is paid the slot alone; work verifies to zero.
  \item \textbf{Model substitution.} Today: \code{modelId} never enters the bill,
        so a 7B served as a 70B pays the same. Under mord: a confirmed
        substitution slashes the provider to zero stake.
\end{stake}
\noindent The three classes that cost zero today cost the attacker its whole
position under mord.

\vspace{0.5ex}
\noindent\textbf{What it does not prove.} \prov{assumption stated}
This is bilateral attestation and operator agreement, not a zero-knowledge proof
of computation. It binds who, how much, and which committed model. It does not
prove the tokens were produced or the output correct; an enclave that loads the
committed weights and truncates the attention window still signs a valid meter.
Co-signature alone does not catch substitution; the challenge layer does. The
layers compose for that reason.

\vspace{0.5ex}
\noindent\textbf{Why Lux.} \prov{verified repos}
Lux already runs the pieces mord composes: the attestation and slashing in
\code{luxfi/ai} (\code{SlashProvider}) and the commit\textendash reveal in
\code{luxfi/chains/aivm}. mord is where they settle real MOR. The cheapest
adoption is one layer on the diamond you already run: a meter carrying the
consumer's countersignature, and a check that pays work only when both verify. No
chain move, no new arithmetic; ADOPT-09 works that on-Base path end to end. We
hand it over, MIT-licensed.

\vspace{0.6ex}
\noindent{\color{muted}\footnotesize\sffamily
ADOPT-02. Companions: LP-313 verifiable inference, LP-323 separating capacity,
work and identity, LP-325 linear budgets for agent coordination. Morpheus-side
citations checked against the working tree; \code{go test ./...} in
\code{luxfi/mord} is green.
\quad\textbullet\quad \texttt{[email protected]}}

\end{document}