papers/morpheus/adoption/adopt-15-open-source-path.tex

\documentclass[11pt,a4paper]{article}
\usepackage{../shared/luxcover}
\usepackage{../shared/proposal}
\usepackage[utf8]{inputenc}\usepackage[T1]{fontenc}
\usepackage{amsmath,amssymb}
\usepackage{listings}\usepackage{xcolor}
\input{../shared/lstlang}
\setcounter{secnumdepth}{0}
\newcommand{\code}[1]{\texttt{\small #1}}
\newcommand{\lift}[1]{{\color{muted}\footnotesize\sffamily #1}}
\newcommand{\gh}[1]{\href{https://github.com/#1}{\texttt{\small github.com/#1}}}
\newcommand{\req}{{\color{muted}\footnotesize\sffamily source on request \textbullet\ being opened}}
\newcommand{\repo}[3]{\vspace{0.9ex}\noindent\textbf{#1}\quad{\footnotesize #2}\par\nopagebreak\vspace{0.2ex}\noindent #3\par}
\newcommand{\height}[2]{\vspace{0.9ex}\noindent\textbf{#1}\quad\lift{#2}\par\nopagebreak\vspace{0.2ex}}
\setlength{\emergencystretch}{3em}
\title{From Chainless to Sovereign}
\author{Zach Kelling\\\textit{Lux Industries, Inc.}\\\texttt{[email protected]}}
\date{2026}
\begin{document}
\luxcoverpage
\sloppy

\noindent{\color{muted}\footnotesize\sffamily ADOPT-15 \quad\textbullet\quad Hanzo AI, Lux Industries \& Zoo Labs \quad\textbullet\quad 2026}\par
\vspace{0.8ex}
\noindent{\LARGE\bfseries From Chainless to Sovereign}\par
\vspace{0.7ex}
\noindent{\color{rule}\rule{\linewidth}{1.1pt}}\par
\vspace{1.0ex}
\noindent{\itshape The open-source path for Morpheus: every repository, what it is worth, how it is
adopted, and where it sits on the climb from a token with no chain to a sovereign L1 that runs a
decentralized, quantum-safe public-goods stack for AI.}\par
\vspace{1.2ex}

\section{The climb, in one page}

Morpheus today is a token and a marketplace with no chain of its own. That is not a criticism; it is
the starting height. This document describes four heights above it and the open-source software that
gets a team from one to the next. Each height is worth reaching on its own. None requires the one above.

\height{Chainless}{today}
MOR is an ERC-20 OFT on Ethereum, Arbitrum and Base. The compute market is a single EIP-2535 diamond on
Base, owned by a five-of-nine multisig. Settlement pays for elapsed time. Nothing here needs to change to
begin.

\height{Adopt}{no chain change $\cdot$ ours, mostly}
Take pieces of the stack one at a time: a provider, a market, a bridge, a credit line, a meter that reads
the receipt it already signs. MOR earns from usage. The five-of-nine signs nothing.

\height{L2 on Lux}{rent finality $\cdot$ Morpheus governance}
Onboard as a Lux L2 from the same template Hanzo and Zoo were born from. Anchor to Lux as a
post-quantum root and inherit Quasar finality and validator management instead of building either.

\height{Sovereign L1}{own the network $\cdot$ Morpheus governance}
Convert to a sovereign primary network: one network ID equal to the chain ID, a validator set of your
own managed by an on-chain staking contract, the post-quantum primitives carried by the chain itself.

\height{A public-goods stack for AI}{the whole estate}
Governance, explorer and indexer, exchange, custody, keys, identity, routing, attested inference,
research process --- one declared stack, run by three organizations as tenants, all of it open.

\vspace{0.6ex}
\noindent Quantum safety is the thread. At every height, the stack carries more of it: a session layer at
the first, a post-quantum root at the second, the primitives themselves at the third. An inference
marketplace is a durable store of other people's prompts, and that is exactly the kind of data an
adversary records now to decrypt later. The climb is worth making because each rung closes more of that.

\section{Where Morpheus stands}

The facts below are verified against source and chain as of late August 2026, and nothing structural
moved in the following week (the only changes on \code{dev} were a dependency pin that fixes the
v1.47.0 boot failure and a CORS fix).

\begin{itemize}
\item \textbf{Chainless.} MOR is an OFT; the market is one diamond on Base at
      \code{0x6aBE1d28\ldots3030a}, owned by a five-of-nine Safe with no timelock.
\item \textbf{Settlement pays for time.} \code{pricePerSecond} times duration. The settlement does not
      commit to the model, the token counts, or that the consumer was a different party than the provider.
      The signed receipt already carries the two token-count words; the meter does not read them.
\item \textbf{Revenue is decoupled from usage.} Real revenue is stETH and Aave yield, about \$476K over the
      trailing year and falling. Emission runs roughly ten to one over it.
\item \textbf{Liquidity is thin and protocol-owned.} About \$1.3M tradeable, most of it in one Safe. A
      \$100K sell is eleven days of volume.
\item \textbf{Prompts cross the provider port in cleartext.} \code{SessionPromptRequest} accepts a
      \code{providerPubKey} that the current implementation does not use to encrypt the request. Responses
      are encrypted; prompts are not.
\end{itemize}

\noindent Each of these is a gap in what has been built, not in the idea. Each has a corresponding piece of
open software below.

\section{Three organizations, one stack}

Adopting ``Lux'' means adopting three organizations that run one stack. They are not a bundle sold
together; they are three tenants of the same software.

\begin{stake}{Lux Industries --- the chain, the consensus, the cryptography, the rails}
\item Quasar consensus and the post-quantum root an L2 anchors to.
\item Settlement and verified inference: the meter that cannot be faked, the quorum that slashes.
\item Governance, exchange, bridge, wallet, custody, keys.
\end{stake}

\begin{stake}{Hanzo AI --- the product, the demand, the routing}
\item An OpenAI-compatible control plane, a learned router, attested providers, a coding agent.
\item Identity and the trust boundary every request crosses.
\item The design system the whole estate wears.
\end{stake}

\begin{stake}{Zoo Labs Foundation --- the research, the process}
\item Decentralized AI and science research, a chat product, and the ZIP proposal process.
\item A governance tenant on the same DAO stack --- proof the stack white-labels.
\end{stake}

\noindent Hanzo and Zoo were each created from Lux's L2 template. They run the same governance
contracts, the same explorer and indexer, the same design tokens, declared the same way. That is the
point for Morpheus: the fourth tenant is a configuration, not a project.

\section{The open-source catalog}

Repositories linked below are public on GitHub today. Those marked \req\ exist and run in production,
and are available to Morpheus now; they are being published as public goods and the link will follow.
For each: what it is, what it is worth, how it is adopted, and which height it belongs to.

\subsection{Consensus and the post-quantum root}

\repo{luxfi/node}{\gh{luxfi/node}}{The Lux node: multi-consensus, post-quantum ready. The validator
Morpheus would run at the L2 and L1 heights. \emph{Worth:} a production node with the PQ profile already
in it, rather than a fork to harden. \emph{Adopt:} run it; at L1, run it as your own primary network.}

\repo{luxfi/consensus}{\gh{luxfi/consensus}}{Quasar: BLS Beam, ML-DSA and Pulsar Pulse composed into
classical-fast, post-quantum-durable finality (Horizon). \emph{Worth:} finality that a quantum adversary
cannot rewrite, without a consensus team. \emph{Adopt:} inherited at L2; owned at L1. Its PQ gate is one
function in one place, \code{contract.RefuseUnderStrictPQ}, so the policy is not braided into the
verification.}

\repo{luxfi/genesis}{\gh{luxfi/genesis}}{Genesis for mainnet, testnet, devnet and custom networks.
\emph{Worth:} the birth of a chain as a reviewed file, not a ceremony. \emph{Adopt:} the L2 and L1
heights start here.}

\repo{luxfi/sdk}{\gh{luxfi/sdk}}{The chain SDK for building high-performance chains on Lux.
\emph{Worth:} MOR's chain logic as a VM, not a fork. \emph{Adopt:} L2 and above.}

\repo{luxfi/vm}{\gh{luxfi/vm}}{VM types and interfaces. The contract every chain on Lux satisfies.}

\repo{luxfi/chains}{\gh{luxfi/chains}}{Independent VM plugin binaries, including the A-Chain that
settles verified inference. \emph{Adopt:} the settlement VM ships as a plugin, so it is a deploy, not a
rebuild.}

\repo{luxfi/precompile}{\gh{luxfi/precompile}}{EVM precompiles in the \code{0x0122xx} space: FHE and
ML-KEM (activated), ML-DSA and SLH-DSA (present, not yet activated), plus anchor, bridge, attestation,
compute and AI. \emph{Worth:} post-quantum key exchange and signatures, and fully homomorphic evaluation,
callable from a contract. \emph{Adopt:} available to any contract on the chain from the L2 height. Stated
plainly: the two PQ signature precompiles are shipped but not switched on at the profile today.}

\subsection{Settlement and verified inference}

\repo{lux/mord}{\req}{A settlement VM that prices capacity, work and identity as three quantities
instead of one \code{pricePerSecond}. Consumer and provider co-sign; a model commitment, a challenge and
a slash make substitution unprofitable; faked work earns zero. About 3{,}400 verified sessions per second
per core. \emph{Worth:} the structural end of fakeable receipts. \emph{Boundary:} the meter is bilateral
attestation, not a zero-knowledge proof of inference; it proves the two parties agreed on what ran, not
that the arithmetic was correct. \emph{Adopt:} gated on volume; the minimal change on Base today is to read
the two token fields the receipt already signs.}

\repo{luxfi/ai}{\gh{luxfi/ai}}{The AI compute network: \code{SettleQuorum}, \code{SlashProvider}, a
miner, and local attestation (nvtrust, SPDM, RIM --- no cloud call). \emph{Worth:} verified inference
with bonded operators, and a provider that earns MOR. \emph{Adopt:} the first rung --- Hanzo lists as a
provider on Base through this.}

\repo{lux/aivm}{\gh{luxfi/aivm}}{The A-Chain: attestation, AI provenance, audit anchors. \emph{Worth:} TEE
evidence a consensus can check, so a specific model on specific silicon is an on-chain fact rather than
an off-chain report. \emph{Adopt:} the node's existing TEE work (RTMR3, signed manifest) becomes
consensus-checkable at the L2 height.}

\subsection{Governance}

\repo{luxfi/dao}{\gh{luxfi/dao}}{Governor contracts and the DAO application: Safe, Governor, Timelock,
and a work market, white-labeled per tenant (\code{lux.vote}, \code{zoo.vote}, \code{hanzo.vote}).
\emph{Worth:} the answer to an anonymous five-of-nine with no timelock, and a bounty and reputation
market for the community. \emph{Adopt:} any height. We are rolling it onto ourselves; see below.}

\repo{zooai/ZIPs}{\gh{zooai/ZIPs}}{The Zoo Improvement Proposal process. \emph{Worth:} a working
example of proposal-driven governance for a research community --- the MRC process, made executable.}

\repo{hanzoai/hips}{\gh{hanzoai/hips}}{Hanzo Improvement Proposals: the specification home for the
stack. \emph{Worth:} the design of every piece above is written down where the code cites it.}

\subsection{Markets, liquidity and custody}

\repo{luxfi/dex}{\gh{luxfi/dex}}{LX: a pure-Go matching-engine order book with an oracle aggregator and
JSON-RPC, WebSocket and gRPC SDKs. \emph{Worth:} price discovery from a real two-sided book instead of a
one-sided reserve. \emph{Adopt:} the second rung --- feature and list MOR alongside AI, ZOO and LUX.}

\repo{lux/exchange}{\req}{\code{lux.exchange}: the interface over LX, built as a Covered User
Interface under the SEC staff statement of 13 April 2026 --- it converts the user's parameters into a
transaction the user signs; it never holds a key, executes, settles, or routes. \emph{Worth:} a listing
today, and the issuance path when the proposed rules land. \emph{Adopt:} with the listing.}

\repo{lux/liquid}{\gh{luxfi/liquid}}{Self-repaying lending: deposit yield-bearing collateral, borrow synthetic
debt, let the yield retire the debt. Adapters for Aave, Compound, Lido, Morpho, Pendle and others.
\emph{Worth:} holders borrow against MOR without a forced sale; the treasury's idle assets work.
\emph{Adopt:} the third rung, given the OFT address. A Morpho market is one transaction.}

\repo{lux/bank}{\gh{luxfi/bank}}{Core banking: accounts, custody and self-custody, cards, beneficiaries, atomic
transfers. \emph{Worth:} MOR that spends. \emph{Adopt:} any height, after the listing.}

\repo{luxfi/bridge}{\gh{luxfi/bridge}}{The bridge, run by a trustless MPC network. It already spans
Ethereum, Arbitrum and Base --- MOR's chains. \emph{Worth:} MOR enters the set it already lives on; adding
it is registration and a wrapper, not a chain integration. \emph{Adopt:} the third rung.}

\repo{luxfi/wallet}{\gh{luxfi/wallet}}{The open-source wallet: hierarchical-deterministic, multi-chain,
hardware-wallet aware. \emph{Worth:} keys the holder keeps.}

\subsection{Keys and identity}

\repo{luxfi/kms}{\gh{luxfi/kms}}{Key and secret management. \emph{Worth:} no secret in a manifest,
ever; a values file names a path and an operator syncs it. \emph{Adopt:} with the first service you run.}

\repo{hanzoai/iam}{\gh{hanzoai/iam}}{Identity, at \code{hanzo.id}: one authority for accounts and
tokens across the estate, white-labeled by host. \emph{Worth:} one sign-in for the marketplace, the DAO,
the explorer and the exchange, with no bespoke auth anywhere.}

\repo{hanzoai/gateway}{\gh{hanzoai/gateway}}{The stateless trust boundary at \code{api.hanzo.ai}:
identity verified, request metered, then routed. \emph{Worth:} one edge for every product.}

\repo{hanzo/kms}{\req}{Secrets at rest and in transit for the Hanzo side of the estate. The same
discipline as \code{luxfi/kms}, one per organization.}

\subsection{Demand and routing}

\repo{hanzoai/ai}{\gh{hanzoai/ai}}{The LLM control plane: OpenAI-compatible \code{/v1}, native Go
routing and metering, RAG, a model hub. \emph{Worth:} Web2 demand arrives without a wallet, and it can be
pointed at Morpheus providers. \emph{Adopt:} the sixth rung --- route agents through it.}

\repo{hanzo/enso}{\gh{hanzoai/enso}}{A learned router: the best model per request in roughly 300 nanoseconds to 12
microseconds on CPU, with a content-free reward ledger. \emph{Worth:} Morpheus ships agent templates with no
decentralized runtime behind them; this and the attested providers are that runtime, and our own demand
becomes MOR volume.}

\repo{hanzoai/dev}{\gh{hanzoai/dev}}{A local AI coding agent for the terminal. \emph{Worth:} a real
consumer of inference, and one that pays in MOR when routed to Morpheus providers.}

\repo{hanzo/personas}{\gh{hanzoai/personas}}{Six hundred and twelve persona profiles and their loaders. \emph{Worth:}
identity and prompt as catalog values, not code.}

\repo{zooai/ai}{\gh{zooai/ai}}{Zoo's chat product. \emph{Worth:} a second consumer surface, run by a
research foundation, that can route to the same providers.}

\subsection{The estate itself}

\repo{hanzoai/design}{\gh{hanzoai/design}}{The design system: monochrome, dark-default tokens
generated from one TypeScript source, with the CSS every non-React surface embeds. \emph{Worth:} a
tenant looks like the estate on day one --- the forge, the CI, the CD and the DAO all wear it.}

\repo{hanzoai/ui}{\gh{hanzoai/ui}}{The React component library for AI applications, on the same
tokens.}

\section{Quantum safety, woven through}

The threat, stated without ornament: consumer prompts are transmitted as plaintext today, and prompts
are the kind of data worth recording now against a future decryption capability. A marketplace that
stores or relays them is a target of that shape. The stack addresses this at each layer, and each height
of the climb inherits more of it.

\begin{description}
\item[Transport --- the first height.] A hybrid session layer, ML-KEM with X25519, replaces the
      cleartext provider port. It is a drop-in on the existing node and needs no chain. This is the seventh
      rung of the ladder and closes the gap the community already raised.
\item[Signatures --- the second height.] Quasar signs with ML-DSA alongside BLS; an L2 anchored to Lux
      inherits a validator set whose keys are post-quantum. ML-DSA and SLH-DSA precompiles are shipped for
      contracts, behind a profile that is not yet switched on; that is a stated limitation, not a claim.
\item[Finality --- the second height.] Horizon finality is post-quantum durable: a rewrite requires
      breaking the PQ signature, not only the classical one.
\item[Computation --- from the second height.] The FHE precompile is activated: a contract can evaluate
      over encrypted values, which is how private inference settlement and private bids become possible
      without a trusted party.
\item[Ownership --- the third height.] A sovereign L1 carries the primitives itself rather than
      inheriting them. The profile gate that decides which classical primitives are refused under a strict
      post-quantum profile is one function in one place, so the policy can be tightened by governance
      without touching the verifiers.
\end{description}

\noindent Two boundaries, so the claim is proportional to the evidence. Post-quantum transport does not
make the application post-quantum in every other respect; the meter's attestation is bilateral, not a
proof of correct execution; and a model commitment proves which model was named, not that it ran well.
Each is a real property. None is the others.

\section{The climb, rung by rung}

The ladder from ADOPT-00, placed on the heights. Lift is our estimate of the engineering; the signature
is whose approval it needs. The first three cost us about a week and ask nothing of Morpheus governance.

\height{Hanzo lists as a provider on Base.}{Adopt $\cdot$ days $\cdot$ ours}
Our inference earns MOR from the first session; the marketplace is permissionless to join.

\height{Feature and list MOR on LX.}{Adopt $\cdot$ days $\cdot$ ours}
A two-sided book replaces about \$600K of one-sided reserve.

\height{Bridge MOR natively; open LMOR credit.}{Adopt $\cdot$ low $\cdot$ ours, given the address}
Registration and a wrapper on a bridge that already spans MOR's chains; a Morpho market in one transaction.

\height{Put a fee on verified volume into the buyback.}{Adopt $\cdot$ a small contract change $\cdot$ Morpheus}
Revenue scales with usage instead of deposits. The single highest-return change on the list.

\height{Make the meter read what the receipt already signs.}{Adopt $\cdot$ weeks, no migration $\cdot$ Morpheus}
Decode the two token-count words; require consumer $\neq$ provider. Settlement stops being fakeable, which
is what makes the fee honest.

\height{Route agents through Enso and Hanzo.}{Adopt $\cdot$ medium $\cdot$ joint}
The decentralized runtime behind the agent templates; our demand becomes MOR volume.

\height{Encrypt the prompt in transit.}{Adopt $\cdot$ medium $\cdot$ Morpheus}
The hybrid post-quantum session layer, dropped in.

\height{Attest inference on the A-Chain.}{L2 $\cdot$ medium to high $\cdot$ joint}
The TEE work becomes a consensus-checkable fact.

\height{Adopt mord as the settlement VM.}{L2 $\cdot$ a VM $\cdot$ joint, gated on volume}
Capacity, work and identity as three prices. The end of fakeable receipts.

\height{Onboard as a Lux L2.}{L2 $\cdot$ largest $\cdot$ Morpheus governance}
Rent finality and a validator set. MOR stays thin on top.

\height{Convert to a sovereign L1.}{L1 $\cdot$ a governance decision $\cdot$ Morpheus}
One network ID equal to the chain ID, a staking contract, a validator set of your own. The same template;
Hanzo and Zoo were born from it in minutes.

\vspace{0.8ex}
\noindent It is a ladder, not a bundle. Each rung stands on the one below and returns on its own, and a
team can stop at any height.

\section{What we hold ourselves to}

A partnership is not a pitch. The standard above is one we apply to our own stack, and we say where we
stand rather than where we would like to. Our governance is moving fully on-chain: a one-of-one bootstrap
that hands every protocol authority to a Governor and Timelock, with no multisig as the protocol's seat.
The path is built and proven end to end on a local network --- the handoff executed, the deployer
renounced --- and it is rolling to mainnet. Our deploy is one declared state, digest-pinned, reconciled by
one control plane, with no hand-applied step left. Our design tokens have one source. We will not ask
Morpheus to do anything we are not doing, and where we are early we say early.

\section{How to start}

The first three rungs need one thing from Morpheus: the MOR OFT address on each chain, and confirmation
of the AI, ZOO and LUX addresses. Nothing moves a Morpheus contract. Nothing needs the five-of-nine. Within
the month MOR has a provider earning it, a book pricing it, and a credit line against it. From there the
climb is a series of decisions, each of which can be taken on its own evidence.

\vspace{1.0ex}
\noindent{\color{rule}\rule{\linewidth}{1.1pt}}\par
\vspace{0.6ex}
\noindent{\color{muted}\footnotesize\sffamily
ADOPT-15. The ladder is ADOPT-00; each rung has its own ADOPT brief; the full argument and provenance
are in the omnibus (\code{morpheus-omnibus.pdf}). \quad\textbullet\quad \texttt{[email protected]}}

\end{document}