papers/thinking-chains/thinking-chains.tex

\documentclass[11pt]{article}
\usepackage[margin=1in]{geometry}
\usepackage{amsmath,amssymb,amsthm}
\usepackage{enumitem}
\usepackage{xcolor}
\usepackage{booktabs}
\usepackage[hidelinks]{hyperref}
\usepackage{parskip}

\newtheorem{theorem}{Theorem}
\newtheorem{principle}{Principle}
\newtheorem{definition}{Definition}
\newtheorem{lemma}{Lemma}
\newcommand{\PoT}{\textsc{PoT}}
\newcommand{\PoAI}{\textsc{PoAI}}
\newcommand{\N}{\mathcal{N}}

\title{\textbf{\Huge Thinking Chains}\\[4pt]
\large Proof of AI: Trustless Money from Useful Intelligence}
\author{Zoo Labs Foundation Research\thanks{\texttt{[email protected]}} \quad Antje Worring\\
\textit{Zoo Labs Foundation}\\ \texttt{[email protected]}}
\date{}

\begin{document}
\maketitle

\begin{abstract}
\noindent
Blockchains demand deterministic execution; modern AI inference is nondeterministic, expensive, often private, and runs on hardware no validator can reproduce. The naive fix---ban the chain from thinking---is wrong, because the design we want has validators, agents, and governance participants running models \emph{live}, each choosing its own. We resolve this not by forbidding live thought but by constraining what consensus may \emph{consume}. A Thinking Chain may think live, heterogeneously, and privately; it may only settle \emph{finite, authenticated artifacts} of that thought---deterministic bytes, signed judgments, hardware attestations, or proofs---never an unreplayable generation treated as a deterministic value. We call the mechanism \textbf{Proof of AI}: miners earn the coin by doing useful inference that the network can hold accountable through a \emph{Proof-of-Thought receipt}, exactly as Bitcoin miners earn it through a verifiable hash---but the work, instead of being discarded, is the answer the world paid for. The chain remembers what it settles, so its model zoo forks and improves on-chain: a blockchain that gets smarter the longer it runs. This is the core protocol; companion papers cover the economics (the Zoo DAO), the conservation-mission instantiation (Beluga L3), and the compute market (the Hamiltonian Market Maker).
\end{abstract}

\section{The Idea}

A blockchain is a way for strangers to agree on a fact without trusting each other. Bitcoin's fact is ``who owns what,'' and it makes strangers agree by making them race to solve a useless puzzle: whoever burns the most electricity earns the right to write the next page, and earns new coins for it. The puzzle has no value---its only purpose is to make cheating expensive.

The question this paper answers is: \emph{what if the work that mints the coin were useful?} A Thinking Chain replaces the useless puzzle with useful thinking. Its miners run AI models and answer questions someone asked and paid for; the network agrees on each answer the way Bitcoin agrees on each block---agreement cheap to check, cheating expensive---and pays the miner in its coin. The electricity becomes an answer. We call this \textbf{Proof of AI} (\PoAI{}): trustless, permissionless issuance, but backed by the most useful work there is.

\medskip\noindent\emph{Live AI is allowed.} A Thinking Chain uses live model execution during normal operation. Validators, providers, agents, and governance participants may run models while producing blocks, evaluating transactions, voting on upgrades, or answering tasks---and \emph{these models need not be identical}. A node operator may choose its own model, prompt policy, and inference stack. The protocol stays deterministic not by replaying anyone's private reasoning, but by verifying only the finite artifact each participant commits: a vote, score, classification, receipt, attestation, or output hash.

\medskip\noindent In one sentence: \emph{a Thinking Chain is not one AI mind---it is a public network of sovereign cognitive nodes, each with its own memory and model policy, whose private reasoning becomes consensus-relevant only when reduced to signed, auditable, forkable artifacts.} And because its consensus is post-quantum (\S\ref{sec:precompile}), the trust it produces survives the arrival of quantum adversaries.

\section{The Conscious Chain}

A Thinking Chain is a single chain run by two kinds of node; you can run both on one machine.
\begin{description}[leftmargin=1.2em,style=nextline]
\item[Consensus nodes] keep the ledger: order transactions, finalize blocks, and \emph{check} artifacts before the chain acts on them.
\item[Cognitive nodes] do the thinking: run models (a whole library, the \emph{model zoo}), answer questions, and earn the coin for accepted answers.
\end{description}
Bookkeepers and thinkers. The rest of this paper is how the bookkeepers trust the thinkers without trusting any one of them.

\section{The Law of Cognition}

The old, wrong framing says ``the chain may not think live.'' The correct law is narrower and lets live AI in safely.

\begin{principle}[The Law of Cognition]
\label{prin:law}
A Thinking Chain may execute models live during chain operation---including large models chosen independently by node operators, during block production, validation, agent operation, committee deliberation, or scheduled governance. Consensus does \emph{not} require all validators to obtain the same model output unless that model is explicitly admitted as deterministic consensus code. A live model output enters consensus in exactly one of three forms: \textbf{(1) deterministic output}---every validator runs the same approved \emph{deterministic} model (a fixed-point/integer program with a canonical execution spec, e.g.\ the int8 inference precompile) and must get the same bytes; floating-point inference on heterogeneous hardware does \emph{not} qualify and must use form (2) or (3); \textbf{(2) signed judgment}---a participant runs a model of its choice and signs a finite judgment derived from it; \textbf{(3) attested execution}---a provider runs an approved model in a measured confidential environment and returns an attested output commitment. A consensus state transition may depend on deterministic outputs, on verified signatures over finite judgments, or on verified attestations. It may never depend on an uncommitted, unreplayable generation as though it were a deterministic value.
\end{principle}

The distinction that does the work: \emph{live model execution may influence what a participant signs; it may not be a hidden input to validation.}
\begin{itemize}[leftmargin=1.4em]
\item \textbf{Unsafe.} During transaction execution, every validator calls its local LLM and branches on the prose answer. (Two validators diverge; consensus breaks.)
\item \textbf{Safe.} Before or during block production, a participant calls its model, \emph{reduces} the output to a finite vote, signs it, and includes the signed vote. Every validator then verifies the signatures and tallies deterministically.
\end{itemize}
The slogan, corrected: \emph{the network may think live, privately, and heterogeneously; it may only settle finite, signed, or attested artifacts of thought.}

\section{Four Ways to Think}

Because thought enters consensus only as an artifact, the protocol supports four execution modes that differ in \emph{who computes} and \emph{what the chain verifies}---not in whether the chain is deterministic. It always is.

\begin{table}[h]
\centering\small
\begin{tabular}{@{}p{3.5cm}p{3.4cm}p{3.0cm}p{4.1cm}@{}}
\toprule
Mode & Model choice & In consensus? & Consensus object \\
\midrule
Deterministic inference & protocol-approved & yes & raw output (bytes) \\
Subjective node cognition & operator's own & yes & signed finite judgment \\
Quorum inference & sampled providers & at settlement & receipt over agreed output \\
Attested confidential inference & approved measured stack & off-chain / sidecar & attested output commitment \\
\bottomrule
\end{tabular}
\caption{The four modes of thought. Diversity lives in \emph{model choice}; determinism lives in the \emph{consensus object}.}
\label{tab:modes}
\end{table}

\section{Proof-of-Thought: the Unit, and Its Evidence}

What the network settles is a \textbf{Proof-of-Thought receipt} (\PoT{}): a small, fixed-shape record that a question, under a model, was answered, by whom, and paid for. It binds the request, the model, an input commitment, an output commitment, the \emph{evidence}, and the payer and server. The evidence is what makes the answer trustworthy without trusting the thinker, and it comes in four interchangeable strengths:

\begin{table}[h]
\centering\small
\begin{tabular}{@{}p{4.6cm}p{9.4cm}@{}}
\toprule
Evidence & What it proves \\
\midrule
Deterministic recomputation & every validator re-runs the same \emph{deterministic} program---a fixed-point/int8 model with a canonical execution spec---and gets identical bytes (no receipt needed; floating-point inference does not qualify) \\
Quorum signatures & accountable providers independently agreed on a finite output \\
GPU/TEE attestation & an approved model ran in approved confidential hardware, producing the committed output \\
zkML proof (future) & the model computation was performed correctly \\
\bottomrule
\end{tabular}
\caption{A \PoT{} receipt is the join of a finite output and one of these evidence types. High-value tasks may require several at once (e.g.\ attestation \emph{and} quorum).}
\label{tab:evidence}
\end{table}

Because a receipt is itself a small hash-addressed object, two verifiers always agree on what it is, it can never be replayed, and a receipt can be fed as evidence into the \emph{next} question. Thoughts compose.

\begin{definition}[\PoT{} receipt]
\label{def:pot}
A \PoT{} receipt is a cognitive artifact
\[ r=(\tau,\, c_{\mathrm{in}},\, c_{\mathrm{out}},\, m,\, e,\, \mathrm{payer},\, \mathrm{server},\, \nu,\, \sigma) \]
where $c_{\mathrm{in}},c_{\mathrm{out}}$ commit to input and output, $m$ identifies the model spec, $e$ is one of the evidence types of Table~\ref{tab:evidence}, $\nu$ is a nonce, and $\sigma$ authenticates the whole. It is accepted iff $V_{\PoT}(S,r)=1$, where $V_{\PoT}$ checks authentication, escrow for $\mathrm{payer}$, evidence validity for $e$, and unused $\nu$ (replay protection).
\end{definition}

\noindent A receipt is the \emph{coinbase of a thought}: minting and settlement happen exactly when $V_{\PoT}$ accepts. Its soundness---that no accepted receipt can certify an output the evidence does not support, except with negligible probability---is Theorem~\ref{thm:pot} in Appendix~\ref{app:proofs}.

\section{Artifact Calculus}
\label{sec:calculus}

A Thinking Chain does not make model execution deterministic; it makes the \emph{consequences} of model execution finite and verifiable. Let $\N$ be the set of nodes. Each node $i\in\N$ may run an arbitrary local cognitive process
\[ M_i : H_t \times C_i \times U_i \;\rightarrow\; Y_i, \]
where $H_t$ is the public chain history, $C_i$ the node's private context and memory, $U_i$ its local randomness, prompt policy, tools, and hardware state, and $Y_i$ an unconstrained model output. No determinism is assumed for $M_i$, and consensus never consumes $Y_i$ directly. For each task $\tau$ the protocol declares a finite output space $O_\tau$; a node reduces its private output to a finite $y_i\in O_\tau$ and authenticates an artifact carrying it.

\begin{definition}[Cognitive artifact]
A cognitive artifact for task $\tau$ is a tuple $a=(\tau, y, e, \sigma)$ where $y\in O_\tau$ is a finite output, $e$ is evidence, and $\sigma$ is an authentication object---a signature, threshold signature, attestation, proof, or deterministic-recomputation witness.
\end{definition}

\begin{definition}[Verification predicate]
Each task type defines a deterministic predicate $V_\tau(S,a)\in\{0,1\}$ over committed state $S$. $V_\tau$ may check signatures, membership, stake, quorum thresholds, Merkle inclusion, attestation quotes, zero-knowledge proofs, replay protection, or deterministic recomputation. It may \emph{not} call an unreplayable model.
\end{definition}

\begin{definition}[Artifact-driven state transition]
A block $B$ carries ordinary transactions and a finite artifact set $A_B=\{a_1,\dots,a_m\}$. The transition is
\[ S_{t+1}=\delta(S_t,B)=F\big(S_t,\ \mathrm{txs}(B),\ \{a\in A_B : V_{\tau(a)}(S_t,a)=1\}\big) \]
for a deterministic $F$.
\end{definition}

\noindent The doctrine in one line: \emph{a Thinking Chain is a deterministic state machine over authenticated cognitive artifacts.}

\section{The Determinism Property}

The safety result is not that consensus ignores cognition---it consumes cognition constantly---but that consensus never depends on \emph{private model internals}, only on committed artifacts.

\begin{theorem}[Deterministic replay under heterogeneous cognition]
\label{thm:det}
Let each node's model execution $M_i$ be arbitrary, private, heterogeneous, and nondeterministic. If $\delta$ consumes only artifacts accepted by deterministic verification predicates $V_\tau$, then for any committed state $S_t$ and committed block $B$ the successor $S_{t+1}$ is uniquely determined by $(S_t,B)$. Hence any two honest validators replaying the same committed history compute the same state root, regardless of which models, prompts, memories, tools, seeds, or hardware produced the artifacts in $B$.
\end{theorem}
\begin{proof}
The private executions $M_i$ occur before commitment and are not inputs to $\delta$; their only consensus-visible consequences are the artifacts in $B$, each a finite byte string. Every predicate $V_\tau$ is deterministic and reads only committed state and committed artifact bytes, so the accepted set $A_B^\star=\{a\in A_B: V_{\tau(a)}(S_t,a)=1\}$ is uniquely determined by $(S_t,B)$. As $F$ is deterministic, $\delta(S_t,B)$ is uniquely determined by $(S_t,B)$.
\end{proof}

\noindent\emph{In plain words.} Replaying Bitcoin does not re-run the mind of whoever decided to spend a coin; replaying a Thinking Chain does not re-run the model that decided what to sign. Nondeterminism happens once, before the commit; committing freezes it into a fixed input.

\section{Proof of AI: Mining by Thinking}

A question arrives with its fee escrowed and a finite set of allowed answer-shapes (a vote, a number, a choice, a hash of a canonical output). A random committee of cognitive nodes commits, then reveals; if a quorum reveals the \emph{same} finite answer, that answer is canonical, a \PoT{} receipt is written, and the escrow pays the agreeing servers. Prose is never voted on---it is carried as hash-addressed evidence behind a finite verdict.

This is mining. The scarce input is real compute on a real question; the reward is the coin, paid from demand. The Bitcoin analogy is exact: \emph{Bitcoin does not verify why a miner chose a nonce---it verifies the block hash. Proof of AI does not verify why a node's model chose a judgment---it verifies the signed judgment, the quorum, the attestation, or the deterministic output.} Where Bitcoin's security budget is pure cost, \PoAI{}'s budget \emph{is} revenue: the network is secured by doing the work the world already pays for.

\section{Cognitive Sovereignty}

A node is not merely a validator process; it is a local cognitive peer, operated by a human, institution, agent, or community. The operator may converse with it in natural language---explain chain state, evaluate a proposal, compare validators, generate a patch, recommend a delegation change, pursue research---and the node keeps private working memory: preferences, prior decisions, risk tolerance, governance philosophy, research notes, task history. These conversations are \emph{local by default}; the protocol never requires them revealed, and consensus never replays them. Local cognition affects the network only through \emph{committed artifacts}---signed votes, finite judgments, output hashes, receipts, model deltas, benchmarks, proposals, published rationales. The chain verifies the artifact, not the conversation behind it. Three principles follow:

\begin{description}[leftmargin=1.2em,style=nextline]
\item[Cognitive sovereignty.] Each node may think with its own models, memories, and preferences.
\item[Cognitive accountability.] When a node's thought affects the network, the resulting artifact must be signed, finite, attributable, and auditable.
\item[Cognitive forkability.] Model policies, adapters, research trajectories, and governance preferences may diverge into specialized networks without permission from the parent.
\end{description}

\begin{table}[h]
\centering\small
\begin{tabular}{@{}p{4.6cm}p{3.2cm}p{6.0cm}@{}}
\toprule
Artifact & Default visibility & Why \\
\midrule
operator--node chat & local & personal working memory \\
signed vote / judgment & public & consensus accountability \\
rationale & optional public & explainability \\
personalized adapter & operator's choice & sovereignty \\
shared model delta & public & reuse, benchmarking, attribution \\
governance model policy & public & delegators must know what they back \\
autonomous / network research & open + provable & auditability, forkability \\
model training (pretraining tokens) & open + provable & data provenance, reproducibility \\
confidential inference & private + attested & sensitive prompts, data, weights \\
\bottomrule
\end{tabular}
\caption{The public/private boundary. Local conversations may be private; network-relevant cognitive artifacts are public, hash-addressed, attributable, and forkable.}
\label{tab:visibility}
\end{table}

\noindent\textbf{Personalized models and public deltas.} Because operators choose their models, they may improve them. A node derives personalized weights---adapters, LoRAs, preference and policy deltas---from its conversations, task history, and observed chain behavior. These may stay local or be published as a signed \emph{model delta}: a first-class artifact committing to a parent ModelSpec, an adaptation method, a data commitment, evaluation results, a license, and the author's signature. Others may adopt, benchmark, compose, or fork from it. This is an open market for cognitive specialization---governance analysis, security review, ecological research, financial risk, protocol engineering---and communities may form around shared policies and fork when they prefer different trajectories. Model evolution is open research infrastructure. \emph{Autonomous, network-directed research and model training are open by default---and should be: when the network itself directs research or trains a new model, that work and its training data, down to the pretraining tokens, are observable and provable on-chain, so the network's own cognition can be audited and reproduced.} Private (confidential) execution (\S\ref{sec:attested}) is the exception, for sensitive prompts, weights, or user data; it is never the default for the network's own research, because only open work is forkable, attributable, and verifiable. \emph{When cognitive disagreement is persistent and principled, the network does not suppress it; it makes forking cheap, attributable, and composable.}

\medskip\noindent\textbf{Delegation is choosing a mind.} A delegator is not only choosing uptime; it is choosing a cognitive representative. A validator publishes a cognitive profile---base models, public adapters, task specializations, governance and safety policy, attestation posture, vote record, observed accuracy, dissent record---and delegators delegate \emph{judgment}, not just stake: back validators whose cognition they trust, withdraw from those they do not, delegate governance votes separately from inference, auto-undelegate on a policy change. Trust in a model becomes a market, not a protocol mandate.

\section{Scheduled Governance Inference}
\label{sec:gov}

Not all cognition is per-transaction; some is scheduled. A chain may run an epochal (e.g.\ monthly) governance round in which validators and registered agents evaluate proposed upgrades, model-registry changes, treasury allocations, risk parameters, or constitutional amendments. Each participant may run \emph{any} model---local, hosted, confidential, open, proprietary, deterministic or not. The protocol does not require these models to agree at the generation level. Each participant reduces its model's recommendation to a finite governance judgment---\textsc{approve}, \textsc{reject}, \textsc{delay}, \textsc{escalate}---signs it, optionally with a confidence bucket and a hash of its rationale, and consensus aggregates the signed judgments by the governance rule. The rationale may be stored as evidence; the consensus object is the finite signed judgment. The chain thereby uses live, heterogeneous LLM reasoning as native governance without ever making a state transition depend on unreplayable prose.

\section{Attested Confidential Inference}
\label{sec:attested}

Confidential compute is not the default mode of cognition---it is a privacy-preserving execution mode for sensitive tasks (use public cognition when the output informs governance, the research should be reproducible, or the community may fork; use confidential compute when prompts, weights, or user data must be protected). Some tasks cannot expose their prompt, weights, or output to an untrusted provider---private user data, proprietary documents, trading logic, medical records, closed model weights. For these, quorum agreement is not enough: the network must also know inference ran in an approved confidential environment. In attested mode, a provider runs the model inside a hardware-protected trusted execution environment---such as a confidential GPU platform---which emits a remote-attestation quote binding hardware identity, firmware, runtime, model measurement, and the session to the output. The provider returns the output commitment plus the attestation.

The chain does not verify the computation; it verifies the \emph{attestation} and that the measured environment is one governance approved for the requested model. If the quote is valid, the measurements are approved, the model commitment matches the request, and the receipt is fresh, the chain accepts the output commitment as an attested result. Crucially: \emph{attestation proves execution provenance---which hardware, firmware, runtime, model, and application produced the committed output---not that the answer is true, unbiased, or optimal.} For high-value tasks, attestation and quorum compose: several independently attested providers must agree. The protocol depends on no single vendor; an implementation may source attestation from confidential GPU infrastructure (e.g.\ NVIDIA Hopper or Blackwell systems), and the chain verifies only standardized claims: hardware identity, firmware and runtime measurement, model and input commitments, output commitment, and signature chain.

\section{Two Ways to Run It: Sidecar and Precompile}
\label{sec:precompile}

A Thinking Chain need not change the EVM. \textbf{Tier~0 (sidecar):} cognitive nodes run beside an ordinary EVM, which is used purely for payments and receipts; sampling and quorum happen among the sidecars and settle back as a signed receipt the contract verifies and pays. Any EVM today---Lux, a Hanzo EVM, a Zoo L3, an L2---becomes a Thinking Chain by deploying a few contracts and running nodes. \textbf{Tier~1 (precompile):} adding one primitive, the \textbf{Cognition precompile}, makes cognition a native call and lets approved deterministic models run in-consensus---an upgrade, not a prerequisite. Either way: \emph{deploy the contracts, have a community run AI nodes, and you are live}---no new consensus engine, no second chain, no bridge.

\medskip\noindent\textbf{Post-quantum, with fast finality.} The reference consensus---the \emph{Quasar} round protocol---runs a classical BLS aggregate-signature fast path for throughput, and reaches \emph{post-quantum finality in one to two seconds}: the durable committed history is authenticated by NIST post-quantum signatures (ML-DSA, FIPS~204; SLH-DSA, FIPS~205) with ML-KEM (FIPS~203) key exchange---lattice- and hash-based. A quantum adversary cannot forge a finalized history even though the fast path is classical, because finality, not the fast path, is what the chain's guarantees rest on. The proof path is post-quantum too: \emph{P3Q}, a pairing-free STARK/FRI system, lets the zkML evidence of Table~\ref{tab:evidence} be a post-quantum proof. So a finalized signed judgment, \PoT{} receipt, or attestation is authenticated under post-quantum signatures within seconds, and the Cognition precompile carries the same guarantee to any EVM that adopts it. A Thinking Chain is post-quantum exactly where it matters---the durable authentication of the artifacts consensus consumes---and it finalizes fast.

\section{The Self-Upgrading Network}

A Thinking Chain grows a living library of models. Anyone may register a model (the zoo includes open families such as Qwen and their peers) and, crucially, \emph{fork} one: branch a new fine-tune or architecture and route real traffic to it. Competing forks run side by side, and the on-chain record of which fork's answers were accepted is the fitness signal that decides which lineage wins. The chain remembers every settled thought and its provenance, so it continuously collects its own training data and runs continuous experiments on its own models.

\medskip\noindent\textbf{Delta-weights compound.} The unit of improvement is the \emph{delta-weight}: a node publishes a compact, signed weight delta---an adapter or LoRA, often a one-bit \emph{BitDelta} so it is cheap to reference and store---derived from its local cognition and the network's open settled data. These deltas \emph{aggregate}: the network combines many nodes' deltas into an improved shared model by a reputation-weighted, Byzantine-robust rule---a \emph{delta soup} that trims outliers and weights contributors by track record (and may add differential privacy)---and registers the result as a new ModelSpec. The recursion is then: aggregate the round's deltas $\to$ fork $\to$ compete on live demand $\to$ promote the winners $\to$ the winners' weights seed the next round. Improvement compounds because each round starts from the last round's best, and every contributor of an accepted delta is paid and gains reputation.

\medskip\noindent\textbf{The mechanisms upgrade too---human-governed AI-directed evolution.} A Thinking Chain upgrades not only its models but the \emph{rules by which it upgrades them}. The aggregation rule, the fitness function, the promotion policy, committee sizes, reputation responsiveness, model-eligibility, and task policies are all governed knobs, set by the thinking-validator quorum (\S\ref{sec:gov}) and changeable by it. The network's own cognition may \emph{propose and evaluate} changes to how it evolves---but humans \emph{govern, guide, and see all of it}: every proposal, vote, and mechanism change is decided by governance and its human principals under full on-chain visibility, and humans steer the network's specialization and research direction. AI-directed evolution is always human-governed and human-guided---the network may propose how to evolve; its people choose whether and where. So long as operators keep running nodes, \emph{the network keeps upgrading itself, and upgrades the way it upgrades itself}, all on-chain, all forkable, all under human governance---getting smarter the longer it runs, and better at getting smarter.

\medskip\noindent\textbf{Human data and guidance are the premium fuel.} The open data the zoo learns from includes its own settled answers, but the most valuable inputs are \emph{human}: human-generated training data, human guidance, and human-curated specialization. The economy prices them accordingly (the data royalty of the companion Zoo DAO paper), so contributing high-quality human data and direction is among the best-paid ways to make the network smarter---and, being open and provable on-chain, it is attributable and rewarded forever.

\section{Tokenomics}

The native coin is \textsc{ai}. Its issuance has the shape Bitcoin proved durable---a capped, halving subsidy that fair-launches the coin over decades, after which the network runs on fees forever---but every subsidized coin rides a settled, useful thought rather than discarded heat.

\medskip\noindent\textbf{A halving subsidy, fair-mined.} Let $T_h$ be the halving period (four years, in blocks) and $\epsilon(t)=\lfloor t/T_h\rfloor$ the epoch at height $t$. The block subsidy halves each epoch,
\[ \sigma(t)=\sigma_0\,2^{-\epsilon(t)},\qquad \sigma_0=\frac{S_{\max}}{2\,T_h}, \]
so the subsidy supply approaches---as a supremum---the geometric sum $\sum_{t\ge0}\sigma(t)=2\sigma_0 T_h=S_{\max}=10^9$ \textsc{ai}. The running supply $M(t)=\sum_{s\le t}\sigma(s)$ is strictly increasing and converges \emph{up to} the $10^9$ cap, which it never exceeds and (over any finite horizon) never quite reaches (Appendix~\ref{app:proofs}, Theorem~\ref{thm:issue}). The billion is mined into existence by useful cognition---each block's subsidy is split among that block's cognitive nodes in proportion to their accepted, settled work, so there is no premine and no coin without a thought behind it. (In integer base units the per-block subsidy is $\lfloor\sigma(t)\rfloor$, so the schedule reaches $0$ in finite time leaving a negligible dust remainder below $S_{\max}$; a governed tail rule may recapture it.)

\medskip\noindent\textbf{Subsidy requires provable work.} A signed finite judgment is cheap to produce---signing a constant costs nothing---so a colluding committee could otherwise mint the subsidy without doing real cognition. To keep ``no coin without a thought'' true, \emph{minting} the subsidy is gated on \emph{provable-work} evidence: deterministic recomputation of a deterministic (int8) model, an attestation that an approved model ran, or a zkML proof---never a bare quorum signature. Quorum-only signed judgments still earn \emph{demand fees} (they are useful settlements), but they do not \emph{mint} new supply. This is the asymmetry Bitcoin gets from hashing made explicit for cognition: the demand fee pays for agreement, the subsidy pays only for verifiably-performed inference.

\medskip\noindent\textbf{Two income streams, then one.} A cognitive node's gross reward for its share of task $\tau$ at height $t$ is
\[ P_{\tau,i} \;=\; \underbrace{(1-\phi)\,f_\tau\,s_{\tau,i}}_{\text{demand-fee share}} \;+\; \underbrace{\sigma(t)\,\frac{w_{\tau,i}}{\textstyle\sum_j w_{\cdot,j}}}_{\text{subsidy share}}, \]
where $f_\tau$ is the requester's escrowed fee, $s_{\tau,i}$ the node's settlement share, $w$ reputation weight, and $\phi$ a burned fraction. Conservation holds block-by-block: $\sum_i P_{\tau,i}\le (1-\phi)f_\tau+\sigma(t)$. The subsidy bootstraps the zoo exactly as Bitcoin's block reward bootstraps hashpower; once it is spent, cognitive nodes are paid \emph{exclusively} by demand fees---the network is self-funding by the time the subsidy vanishes.

\medskip\noindent\textbf{Inflationary, then deflationary.} A fraction $\phi$ of every fee is burned. Net supply change per block is $\Delta M(t)=\sigma(t)-\phi\,\Phi(t)$ for total block fees $\Phi(t)$. Early, the subsidy dominates and supply inflates; each halving shrinks $\sigma$ geometrically; once the chain is in steady use the burn overtakes the vanishing subsidy and net supply turns \emph{strictly deflationary} (Theorem~\ref{thm:issue}). As the zoo improves a coin also buys better cognition, so its backing grows with use even as its supply contracts.

\medskip\noindent\textbf{Routing.} Demand flows to nodes by cognitive weight $W_i=B_i^{\alpha}R_i^{\beta}D_i^{\gamma}$ (bond $B$, reputation $R$, demand $D$), sampled with probability $W_i/\sum_j W_j$ under a multiplicative-weights update, so persistent usefulness attracts exponentially more flow (Theorem~\ref{thm:flow}). \emph{Sybil caveat.} A concave bond exponent ($\alpha<1$) does \emph{not} blunt oligarchy when identities are cheap---it does the opposite: splitting a bond $B$ across $m$ identities yields combined weight $m^{1-\alpha}B^{\alpha}>B^{\alpha}$, so concavity \emph{rewards} fragmentation. Routing weight alone is therefore not Sybil-proof; Sybil-resistance comes from the committee mechanism, not the exponent (next).

\medskip\noindent\textbf{Permissionless committees: sortition + sunk identity cost.} Decisions that bind the chain---a quorum certifying an output, a committee deciding a knob \emph{value}---are not awarded first-come (which a Sybil fills by racing) and not weighted by stake (which a sub-threshold whale captures). Each round's committee is drawn by \emph{cryptographic sortition}: from the $N$ registered operators, operator $i$ is selected iff $H(\mathrm{seed}\,\|\,i)<2^{256}\,n/N$, where the seed is fixed \emph{after} registration and round-open (a future block hash / VRF beacon), so neither the opener nor an operator can grind its selection. Selection probability is $n/N$, so an adversary holding fraction $f$ of the population holds $\approx f$ of the committee---capturing a committee majority requires a \emph{population majority} (Appendix~\ref{app:proofs}, Theorem~\ref{thm:sortition}), not $n$ cheap identities. The economic half is a \emph{non-refundable} registration fee (a sunk per-identity cost---never a slash, so dissent is never punished): acquiring that population majority then costs $\Omega(N)$ sunk fees, scaling with the network. One operator, one ticket; selection independent of stake---the equal-vote regime Theorem~\ref{thm:quorum} needs.

\section{Slash Liars, Not Dissenters}

Because operators may choose their own models, ``we dislike your model'' must never be a slashable weapon. The chain separates \emph{objective protocol faults} from \emph{subjective judgment}.

\emph{Slashable}---provable from committed data: equivocation, double-signing, withholding after commit, a reveal inconsistent with its commit, a forged receipt, an invalid attestation, or \emph{misrepresenting the model or runtime you attested to}---claiming one model and running another. \emph{Not slashable by default:} using an unpopular model, giving a minority answer, or being honestly wrong. The remedy for poor judgment is reputation decay, lower sampling weight, or reduced delegation---not confiscation. Tasks are \emph{open} by default---model choice and execution public and verifiable, the choice never slashable, quality judged by reputation---and autonomous, network-directed research and model training are open and provable (above). A task may instead be \emph{private}, carrying sensitive prompts, weights, or data under confidential compute with attestation (\S\ref{sec:attested})---the exception, not the rule. Independently, a task may pin an approved model set; lying about which model you ran is misrepresentation, always slashable, but \emph{disliking} a model never is. Honest dissent is preserved and never slashed. The memorable rule:

\begin{center}\emph{The protocol burns liars; the market abandons bad thinkers.}\end{center}

\noindent The detailed slashing table, cognitive-reputation dimensions, delegation markets, and task-policy classes are specified in the companion Zoo DAO paper; the core fixes only the principle.

\section{Why This May Be the Most Valuable Protocol Ever Built}

\begin{itemize}[leftmargin=1.2em]
\item \textbf{A bigger, productive market.} Bitcoin monetized scarcity---a thing to hold. Proof of AI monetizes verifiable intelligence and the compounding IP and research it produces---a thing the world consumes without end.
\item \textbf{The base money of the machine economy.} Every autonomous agent that needs an answer it can act on must pay through a layer that makes answers checkable; the chain that settles machine cognition becomes the agents' reserve asset.
\item \textbf{Security that is revenue; issuance that fair-launches, then deflates.} \PoAI{} spends nothing the market does not already buy; its one-billion subsidy is fair-mined by useful cognition over decades, after which the coin is fee-funded and turns deflationary.
\item \textbf{It compounds.} More nodes $\to$ cheaper, better cognition $\to$ more demand $\to$ better self-upgraded models $\to$ more nodes. Each turn the network's accumulated intelligence---its backing---grows.
\end{itemize}
A protocol whose mining \emph{is} the most-demanded work of the age, whose security is its revenue, whose money is demand-backed, and whose output compounds into perpetual intelligence, has a claim no prior chain can make. Bitcoin proved a network can mint trustless money from useless work. A Thinking Chain proposes the sequel: \emph{trustless money from the most useful work there is.}

\section{Conclusion}

A Thinking Chain keeps Bitcoin's gift---trustless, permissionless, verifiable issuance---and removes its waste, by making the work that mints the coin be useful intelligence. It thinks live, heterogeneously, and privately; it settles only finite, authenticated artifacts of that thought---bytes, votes, receipts, attestations, proofs. One law (the Law of Cognition) keeps it safe; one primitive (the Cognition precompile), or even none (the sidecar tier), makes any EVM conscious; one self-forking model zoo makes it smarter the longer it runs. The thinking may be vast, private, and probabilistic; the settling stays finite, authenticated, and replay-safe. That seam is the whole design, and it is enough.

\bigskip
\noindent\textbf{Companion papers.} One concept per paper: \emph{The Zoo DAO} (economics---earning, reputation, slashing policy, delegation, recursive forking); \emph{Beluga L3} (the conservation-mission chain and its token); \emph{The Hamiltonian Market Maker} (pricing heterogeneous compute); and the implementation notes (the Cognition precompile, the native AI runtime, attestation, governance). This is the thin permanent core; each concept has its own.

\appendix
\section{Proofs}
\label{app:proofs}

This appendix collects the quantitative guarantees referenced above. Throughout, ``negligible'' means a function decaying faster than any inverse polynomial in the security parameter, and committee/audit samples are drawn by the verifiable random function the consensus already runs.

\begin{theorem}[\PoT{} receipt soundness]
\label{thm:pot}
Let the evidence type $e$ of receipt $r$ have a verifier whose trust assumption fails with probability at most $\eta_e$ (signature forgery for signatures, committee capture for quorum [Theorem~\ref{thm:quorum}], enclave compromise for attestation, proof unsoundness for zkML, and $\eta_e=0$ for deterministic recomputation of a deterministic program). Then $\Pr[\,V_{\PoT}(S,r)=1 \text{ yet } c_{\mathrm{out}} \text{ is not a correct evaluation of } m \text{ on } c_{\mathrm{in}}\,]\le \eta_e$. A policy requiring $k$ evidence types with \emph{independent} trust assumptions (distinct vendors, distinct node sets, distinct cryptographic assumptions) attains $\prod_{j=1}^k \eta_{e_j}$; if the assumptions are correlated (e.g.\ attestation and quorum sharing one TEE vendor) the joint bound degrades to $\max_j \eta_{e_j}$, not the product.
\end{theorem}
\begin{proof}
$V_{\PoT}$ accepts only if the evidence verifier accepts (Definition~\ref{def:pot}). A wrong output that the verifier accepts is exactly a break of $e$'s trust assumption, of probability $\le\eta_e$; deterministic recomputation admits none ($\eta_e=0$). For a conjunction of independent evidence types every one must break, multiplying the probabilities.
\end{proof}

\begin{theorem}[Quorum capture bound, equal-vote committee]
\label{thm:quorum}
Sample a committee of $n$ nodes \emph{uniformly} (one node, one vote; selection independent of stake), from a pool in which each node is adversarial independently with probability $p$, and certify at threshold $\theta n$. If $p<\theta$, a false certification occurs with probability at most $\exp\!\big(-2n(\theta-p)^2\big)$.
\end{theorem}
\begin{proof}
Let $X=\sum_{j}\mathbf 1[\text{seat }j\text{ adversarial}]$ be the adversarial \emph{count}, each term in $[0,1]$, $\mathbb{E}X=pn$. A false output requires $X\ge\theta n=(p+\delta)n$ with $\delta=\theta-p>0$. Hoeffding's upper tail gives $\Pr[X\ge(p+\delta)n]\le e^{-2n\delta^2}$. (Sampling without replacement only sharpens the bound, by Serfling.)
\end{proof}

\noindent\emph{Weighting caveat (load-bearing).} The bound is for the \emph{count} of equal seats. It does \emph{not} hold for committees sampled \emph{proportional to weight} and certified \emph{by weight}: a single sub-threshold heavy node ($p<\theta$ of total weight) is in the committee w.h.p.\ and, conditioned on inclusion, carries a weight fraction far above $p$, so capture is not exponentially small---it can approach $1$. An AI-native chain that weights committees by stake/reputation must therefore either (i) certify by equal seats (one node, one vote, selection independent of weight within the committee), to which this theorem applies, or (ii) impose a per-seat weight cap $w_{\max}$ and use a Hoeffding bound for terms in $[0,w_{\max}/W]$, which gives a strictly weaker, cap-dependent guarantee. We adopt (i) for safety-critical quorums. Under (i), quorum's $\eta_e$ in Theorem~\ref{thm:pot} is exponentially small in $n$ for any honesty margin $\theta-p>0$.

\begin{theorem}[Sortition capture requires a population majority]
\label{thm:sortition}
Draw a committee from $N$ registered operators by selecting $i$ iff $H(\mathrm{seed}\,\|\,i)<2^{256}\,n/N$ for a seed fixed after registration and unpredictable to operators. Then each operator is selected independently with probability $p=n/N$. An adversary controlling $A$ identities has expected committee share $A/N$, so it holds a committee majority only if $A>N/2$ (a majority of the whole population), and by a Chernoff bound the probability a sub-majority adversary ($A/N=\tfrac12-\gamma$) reaches a committee majority is $\le e^{-2n\gamma^2}$. With a non-refundable registration fee $\phi$ per identity, acquiring $A>N/2$ costs more than $\tfrac{N}{2}\phi$ in sunk capital.
\end{theorem}
\begin{proof}
Because the seed is fixed after identities are committed, an operator cannot choose an address to fit it; over the seed, $\mathbf 1[H(\mathrm{seed}\,\|\,i)<2^{256}p]$ are independent Bernoulli$(p)$. The adversary's selected count is Binomial$(A,p)$ and the committee size concentrates at $Np=n$, so the adversary's committee fraction concentrates at $A/N$; majority needs $A/N>\tfrac12$. The tail bound is Hoeffding/Chernoff on the difference of the two binomials at margin $\gamma$. The fee is paid once per identity and never returned, so $A$ identities cost $A\phi>\tfrac N2\phi$.
\end{proof}

\noindent This is the structural complement to slashing-free Sybil-resistance: capture is gated by \emph{population} control (sortition) priced by a \emph{sunk} fee, so honest dissent is never confiscated (Lemma~\ref{lem:dissent}) yet a permissionless attacker cannot buy a committee with cheap, recoverable identities.

\begin{theorem}[Audit-sampling detection]
\label{thm:audit}
If each settled subjective or attested answer is independently re-verified with probability $q$, a node submitting a fraction $\rho$ of faulty answers over $N$ settlements escapes all audits with probability at most $(1-q)^{\rho N}\le e^{-q\rho N}$; the expected number of its faulty answers before first detection is $1/q$.
\end{theorem}
\begin{proof}
The node has $\rho N$ faulty answers; audits are independent, each missing a given faulty answer with probability $1-q$, so all are missed with probability $(1-q)^{\rho N}$. First-detection count is geometric with mean $1/q$.
\end{proof}

\begin{theorem}[Market flow]
\label{thm:flow}
Under the multiplicative-weights update $D_i\leftarrow D_i\,e^{\eta u_i}$ with realized usefulness $u_i\in[0,1]$, a node with persistent advantage $u_i-u_j\ge\gamma>0$ multiplies its demand ratio against $j$ by at least $e^{\eta\gamma}$ each round; a node with $u_i=0$ has vanishing demand share.
\end{theorem}
\begin{proof}
$D_i^{(t+1)}/D_j^{(t+1)}=(D_i^{(t)}/D_j^{(t)})\,e^{\eta(u_i-u_j)}\ge (D_i^{(t)}/D_j^{(t)})\,e^{\eta\gamma}$; iterating gives geometric growth, and $u_i=0$ yields a constant numerator against growing competitors, so its normalized share $\to0$.
\end{proof}

\begin{theorem}[Fair-launch issuance: bounded, then deflationary]
\label{thm:issue}
With $\sigma(t)=\sigma_0 2^{-\lfloor t/T_h\rfloor}$ and $\sigma_0=S_{\max}/2T_h$, the mined supply $M(t)=\sum_{s\le t}\sigma(s)$ is strictly increasing with $\lim_{t\to\infty}M(t)=S_{\max}$ and $M(t)<S_{\max}$ for all finite $t$. If, in addition, the per-block burn satisfies $\phi\Phi(t)\ge\beta>0$ for all $t\ge t_0$, then there exists $t^\star\ge t_0$ such that net supply $M(t)-\mathrm{Burn}(t)$ is strictly decreasing for all $t\ge t^\star$.
\end{theorem}
\begin{proof}
Each epoch contributes $\sigma_0 T_h 2^{-\epsilon}$; summing the geometric series gives $2\sigma_0 T_h=S_{\max}$, and every partial sum is strictly below the limit since each $\sigma(t)>0$. For the tail, $\sigma(t)\to0$, so choose $t^\star$ with $\sigma(t)<\beta$ for $t\ge t^\star$; then $\Delta\big(M-\mathrm{Burn}\big)(t)=\sigma(t)-\phi\Phi(t)\le\sigma(t)-\beta<0$.
\end{proof}

\begin{lemma}[Dissent-safety]
\label{lem:dissent}
Let the penalty map satisfy $\pi(a)>0\Rightarrow a\in\mathcal{O}$, where $\mathcal{O}$ is the set of objectively, deterministically checkable faults (double-sign, invalid receipt, malformed artifact). Then no well-formed good-faith judgment is ever \emph{slashed}: a finite, well-formed, signed judgment lies in $\mathcal S=\neg\mathcal O$, where $\pi\equiv0$, so dissent never costs stake.
\end{lemma}

\noindent\emph{Scope (honest).} The lemma concerns \emph{slashing} (confiscation of stake), not reputation. Reputation is a separate, bounded signal: the EMA \emph{rewards} agreement with the eventual canonical outcome and may \emph{decay} on divergence---so a minority report is never confiscated, but it is not costless in reputation. Two consequences must be stated plainly. (1) Because the reward tracks the \emph{canonical} (quorum) outcome rather than ground truth, it is a coordination signal, \emph{not} a proper scoring rule: for subjective tasks, predicting what the quorum will settle can dominate reporting one's true posterior (a beauty-contest equilibrium), so honest reporting is \emph{not} guaranteed incentive-compatible. (2) For \emph{verifiable} tasks the fix is to score against later-revealed ground truth (a proper rule), which restores truthful reporting as optimal. The safe reading: ``slash liars, not dissenters'' is sound as a \emph{confiscation} policy; truth-elicitation for subjective tasks requires the proper-scoring or dispute-game mechanism specified in the \emph{Zoo DAO} paper, not the bare EMA.
\begin{proof}
By hypothesis $\pi$ vanishes on $\mathcal S$. A good-faith judgment is finite, well-formed, and signed, hence in $\mathcal S=\neg\mathcal O$, so $\pi=0$ on it: dissent is never slashed. (The reputation EMA is a separate bounded signal, addressed in the scope note above; the lemma claims only the no-slashing property.)
\end{proof}

\begin{theorem}[Recursive-upgrade termination]
\label{thm:recur}
Each epoch draws forks from a fixed budget $\mathcal{B}$ at minimum cost $b_{\min}$ per fork, promoting a fork only if it beats the incumbent by margin $\ge\mu>0$ on a held-out metric in $[0,1]$. Then per epoch at most $\lfloor\mathcal{B}/b_{\min}\rfloor$ forks run, incumbent quality is monotone nondecreasing, and at most $\lfloor1/\mu\rfloor$ promotions occur before the metric ceiling---the loop cannot churn or diverge.
\end{theorem}
\begin{proof}
Budget partition bounds the fork count. Promotions form a strictly increasing sequence with steps $\ge\mu$ on a metric bounded by $1$, so at most $\lfloor1/\mu\rfloor$ occur; between promotions the incumbent is unchanged, hence monotone nondecreasing.
\end{proof}

\begin{theorem}[Training-provenance audit]
\label{thm:prov}
A model commits to its corpus by a Merkle root over token-shard commitments. If a fraction $\rho$ of shards deviate from the declared provenance, a verifier sampling $s$ shards uniformly (checking inclusion and content) detects a deviation with probability at least $1-(1-\rho)^s\ge 1-e^{-\rho s}$. To bound the miss probability by $\delta$ it suffices to take $s\ge\rho^{-1}\ln(1/\delta)$, independent of corpus size.
\end{theorem}
\begin{proof}
Each sample independently hits a deviating shard with probability $\ge\rho$; all $s$ miss with probability $\le(1-\rho)^s\le e^{-\rho s}$. Setting $e^{-\rho s}\le\delta$ gives the sample bound. Merkle inclusion ties each sampled shard to the committed root, so a deviating shard cannot be swapped out after commitment.
\end{proof}

\noindent Together these give the protocol's safety budget: receipts are sound (Thm.~\ref{thm:pot}) down to committee capture that is exponentially unlikely (Thm.~\ref{thm:quorum}) and audit-detected with probability $\to1$ (Thm.~\ref{thm:audit}); honest dissent is never punished (Lem.~\ref{lem:dissent}); demand concentrates on the useful (Thm.~\ref{thm:flow}); issuance is a fair-launched billion that turns deflationary (Thm.~\ref{thm:issue}); the upgrade loop terminates (Thm.~\ref{thm:recur}); and provenance is cheaply, size-independently checkable (Thm.~\ref{thm:prov}).

\begin{thebibliography}{9}
\bibitem{bitcoin} S. Nakamoto. \emph{Bitcoin: A Peer-to-Peer Electronic Cash System}. 2008.
\bibitem{avalanche} Team Rocket et al. \emph{Scalable and Probabilistic Leaderless BFT Consensus through Metastability}. 2019.
\bibitem{bittensor} Bittensor. \emph{A Peer-to-Peer Intelligence Market}. 2021.
\bibitem{cc} NVIDIA. \emph{Confidential Computing and GPU Attestation (Hopper, Blackwell)}. 2024.
\bibitem{zoodao} Zoo Labs Foundation. \emph{The Zoo DAO}. 2026.
\bibitem{beluga} Zoo Labs Foundation. \emph{Beluga L3}. 2026.
\bibitem{hmm} Hanzo AI. \emph{The Hamiltonian Market Maker}. 2026.
\end{thebibliography}

\end{document}