papers/morpheus/onepagers/lp-314-sovereign-l1.tex

\documentclass[10pt,a4paper]{article}
\usepackage{../shared/proposal}
\usepackage[utf8]{inputenc}\usepackage[T1]{fontenc}
\usepackage{amsmath,amssymb}\usepackage{listings}\usepackage{xcolor}
\input{../shared/lstlang}

\newcommand{\code}[1]{\texttt{\small #1}}

\begin{document}

\proposalhead{A Sovereign Layer 1 for Inference Settlement}{%
Renting execution from Base bought a working market years before a chain of your own could have
existed. This is what the rental costs and what sovereignty would buy.}{LP-314}

\noindent\textbf{The choice, and its price.}
Morpheus settles a per-second compute market in one EIP-2535 diamond on Base, with no chain,
validator set or fee asset of its own. That is defensible; most protocols that build a chain first
never reach the point where it matters. The price is a settlement rule enforced in blocks you do not
produce: \code{SIGNATURE\_TTL} is ten minutes against a five-minute
\code{MIN\_SESSION\_DURATION} (\code{SessionStorage.sol:34--35}), and
\code{\_rewardProviderAfterClose} withholds provider funds on a dispute only when the close is
early (\code{SessionRouter.sol:279--289}), so an inclusion delay near a session length turns an
early close into a late one and deletes the consumer's remedy. The other costs are a fee asset you
do not issue and a precompile set you cannot extend.

\vspace{0.35ex}
\noindent\textbf{What a sovereign chain changes.}
\emph{Operations become consensus transactions.} ``Used stake cannot be recycled inside the same
UTC day'' becomes a validity condition every validator checks rather than a branch across five
facets sharing a storage layout. The same error is writable in Go; the invariant just has one home.
\emph{MOR becomes the gas asset.} Fee revenue stops leaving for another chain's fee market, and a
consumer stops needing a second asset before opening a session.
\emph{Validator identity carries the session material.} Lux identity is already hybrid classical and
ML-DSA-65 with \code{X25519MLKEM768} key agreement, so address-to-key binding is read from state
rather than asserted in a frame, which retires the parallel secp256k1 PKI.
\emph{Verification becomes a precompile.} FIPS 203/204/205 verification costs 50{,}000 to 150{,}000
gas natively against upward of ten million in Solidity, which does not merely cost more, it does not
fit. That gap is what makes per-request checking affordable rather than per-audit, and what LP-313
rests on. \emph{Liveness stops depending on another chain's sequencer.} Not better liveness on a
good day, a single sequencer wins that, but a different failure profile: partial degradation at a
fault threshold the protocol chose.

\vspace{0.35ex}
\noindent\textbf{How the chain comes into existence.}
Three transactions against the upstream Lux P-chain, then independence. \code{CreateChainTx}
creates the chain and its genesis, \code{AddValidatorTx} sets the genesis validators, and
\code{ConvertNetworkTx} promotes the network from inherited security to its own set under an
on-chain staking contract (\code{platformvm/txs/convert\_network\_tx.go}). The L1 then runs its
own primary network with networkID equal to its EVM chainID, one number for wallet, indexer and key
derivation path, and validators stop talking to Lux at runtime. Sovereignty is not binary: a hybrid
mode that restakes the parent while running an own set pays the budget $B = ySP$ as that set grows
rather than on day one.

\begin{stake}{What Morpheus gets}
\item An execution environment whose precompiles it specifies, the only route by which per-request
verification is priced in gas rather than audits.
\item MOR as gas, fee policy under protocol control, and post-quantum session keys from validator
identity live on Lux mainnet today.
\end{stake}

\begin{stake}{What we get, stated plainly}
\item A real inference market as the first economic load on the PQ precompiles and Quasar finality,
worth more to us than fee revenue.
\item Enso routing measured against live provider bids instead of benchmarks.
\end{stake}

\noindent\textbf{First step, and who takes it.}
Lux builds the chain and runs it empty against real Base state, with the diamond still canonical.
A Morpheus contributor exports \code{SessionOpened} and \code{SessionClosed} and joins them against
Base inclusion history to compute $p$, the fraction of closes pushed past \code{endsAt}. That number
decides the liveness argument and it is a day of work. Bid discovery migrates before settlement, or
nothing does.

\vspace{0.35ex}
\noindent\textbf{Thresholds rather than a recommendation.}
Per-request verification entering the roadmap is decisive alone: no rented environment hosts a
predicate whose precompile its operator did not deploy. Fee capture is weak, since
$365\lambda c > ySP$ does not close until roughly $10^5$ sessions a day. Measured late-close loss
above annualised migration risk is strong; one observed censorship event is strong; a team that
cannot staff chain operations is a veto and the best reason to stay.

\vspace{0.35ex}
\noindent\textbf{What this does not solve.}
Not substitution: every validator can be correct about a block paying for a session an 8B model
answered as a 70B. Not the transport, a channel property that remains an application decision on any
chain. Not demand. And it adds a validator set paid for in emission that would otherwise be compute
subsidy.

\vspace{0.4ex}
\noindent{\color{muted}\footnotesize\sffamily
LP-314, full paper available: migration sequencing, decision arithmetic.
Companions LP-313, LP-312. \; \textbullet\; \texttt{[email protected]}}

\end{document}