Status: living spec, written 2026-07-31. This is the network-level threat
model: why the logical architecture holds its shape under gaming, bad
actors, and collusion, and what happens if the settlement chain itself
misbehaves. It consolidates decisions ratified in tool_substrate.md
(the decision ledger, and that doc stays authoritative for the mechanisms),
the econ-attestation audit (experiments/econ_attest/), and the
2026-07-10 canonical-network migration (the proof the escape hatch works).
Scope split, this doc vs daemon security. Two different attackers, two different readers:
| Layer | Attacker | Defenses | Doc |
|---|---|---|---|
| Daemon-local | a malicious TOOL or AGENT running on your machine | secret vault (fail-closed allowance algebra, host binding, names-only audit), process isolation + vault, tool-bound secrets (no tool containment since Decision 2026-11-09) | secrets.md, cross_platform_isolation_design.md, tool_secret_binding.md |
| Network economic | a malicious PARTICIPANT (sybil rings, colluding reviewers, wash traders) | everything in this doc §2 to §4 | here |
| Settlement | a compromised or censoring CHAIN (sequencer, RPC) | deterministic off-chain consensus + consensus-gated migration, §5 | here |
| Code integrity | a TAMPERED daemon posing as an honest node | fingerprint enforcement + peer attestation (designed, pre-implementation) | anti_tamper_design.md |
They compose but do not overlap: the vault protects the owner from the network's code; the equilibrium protects the network from the owner's greed; migration protects both from the chain.
The load-bearing fact everything below rests on: network results are
not decided by any authority, they are recomputed identically by every
honest daemon. federated_epoch_close(canonical_order(events)) is a
pure function over gossiped events; every honest daemon derives
bit-identical {agent_mint, tool_positions}. The chain's role is only
(a) commitment (a rotating submitter anchors the epoch root,
hash-chained via prevEpochRoot/prevAnchorHash so forks are rejected
on-chain too) and (b) settlement: each household's mint is claimed for
its owner wallet with a merkle proof against the anchored root
(claimFor, permissionless, 2-field money-only leaf, idempotent per
(claimant, epoch), no admin keys, only mint path).
Consequences:
- A dishonest submitter can't forge an epoch. An anchor that doesn't match what honest daemons computed is simply an anchor nobody can prove mints against, and the fork is visible to every peer that recomputed the close.
- A tampered daemon forks itself out. If it computes a different close, its proofs don't verify against the honest anchor; it excludes itself by construction. (Making tampering detectable by peers before it posts anything is the anti-tamper design's job; the economic layer is already safe against a lone divergent computer.)
- State outlives the chain. Every daemon carries the full substrate state; anchors are commitments to state the network already holds. This is what makes §5's migration a real option rather than a slogan.
Fees-only emission (Decision 2026-07-10): the epoch pool is exactly the fees burned that epoch. Σ minted == Σ burned, by construction. This closes the classic emission attacks structurally rather than by tuning:
- Wash-pumping the pool is a strict loss. You pay 100% of the fee to reclaim at most a pro-rata slice of the burned half (sim: 0.14% reclaimed). There is no subsidy to farm; zero real demand → zero mint, and that is correct behavior, not a failure mode.
- Not served = not paid. Tasks are atomic; there is no partial
credit to grind. Service settlement pays min(cumulative voucher,
deposit) through EIP-712 channels: the theft ceiling is the deposit,
and the 2.5% fee is taken at settlement through
payForService(closes audit gap G1; no fee-free side rail). - Usage counts same-epoch-only. No retroactive credit from the pre-demand dead period (sim: retroactive counting is ×1.6 more capturable, because rings pre-farm free usage while honest users are idle).
Note (2026-10-31, #28): this section predates ToolBond. Reviews are now commit-reveal and paid by leave-one-out accuracy (times novelty), weighted by household REP; credibility and review centroids are retired.
docs/economy_design.mdhas the current rules.
REP (voice) is decoupled from ATN (money) everywhere it matters:
- REP is a pull claim on ratified earnings only, 1:1, DAO-side (RepToken). No close-path mint grants REP; spenders and buyers claim nothing ("money can be bought, voice must be earned"). You cannot lie about REP because you cannot lie about ATN you provably received. This is the D' invariant from the audit: mint must never grant the resource that gates mint weight, or sybils escape the cap (the earlier β-cap-grants-rep variant measurably leaked, share creep 0.10→0.28 over 120 epochs; D' flatlines sybil voice share at 0).
- Sybil identity floods are damped at the household. Usage credit is collapsed to the proven owner wallet (the household) before log1p damping; owner-map and wire-key exclusions strip self-calls. Splitting one actor across K agents buys nothing the household didn't already earn. The residual is priced honestly below.
- Review/drift pumping needs earned rep. Position drift weight = rep_share × credibility with no ε floor, so a zero-rep review moves nothing. (Contrast the pre-v4.1 sims: sybil ε-reviews pushed a head to +0.97 and captured 21× mint at K=100. That surface is gone.)
- Colluders get docked retroactively and reversibly. Every close re-scores each household's carried review centroid against the tool's current drifted head; deviation docks the household's drift weight, convergence restores it (symmetric, with no stabilization moment for an attacker to freeze). Sim-attested: a captured score reverses within ~50 epochs of rep-backed usage, and the early capturers dock to the floor retroactively.
- There is no gate to buy. The v4.1 lesson, worth stating as a principle: every approval gate is a bribery market. The vet greenlight quorum was itself the cheapest attack in the audit (two free sybils cleared it), so it was deleted, not hardened. Tools mint from first attested use; vets survive as inspection reviews (move position, mint nothing); agents see the trust picture (review count, rep-weighted axis scores, author rep) and self-select.
- Burial gates discovery, never use. Ranking lift is multiplicative on topic match (factor in (0,2), never zero): a lone tool in an empty niche surfaces regardless of score, and adoption keeps feeding rep-backed reviews that can move consensus back. Low-quality spam dies by burial, not by a prunable (and therefore attackable) kill switch.
- Composition farming is capped. Mint fan-out over the declared-dep DAG keeps a 0.7 root share and depth ≤ 4, so a lasagna of trivial wrappers can't multiply credit.
The paradigm behind the sims (2026-07-09): rep-weighted consensus is a tool's quality, definitionally. There is no hidden ground truth to deviate from, so the sims measure consensus-capture cost (the rep share needed to move a score against the live review flow), not attack "success." Security here means capture is expensive, visible, and reversible, with the correction channel (rep-backed reviews from real usage) never closable.
Deliberately documented, because a threat model that claims completeness is lying:
- Unlinked-wallet wash trading bought REP at ~the fee rate (closed
2026-10-27: service revenue no longer earns REP, see
tool_substrate.md"REP comes from the tool pool only"; kept for the record). Self-dealing across two unlinked wallets is undetectable in principle (wallets are free; household collapse can't hold). A washer pays the 2.5% fee per cycle and claims REP on the rest: voice at roughly 2.5 cents/REP. Mitigations are economic, not detective: the fee is the price lever; genesis REP seeding multiplies the attacker's bill while the network is young (and dilutes automatically as real earnings mint REP, with no handoff ceremony); and every washed cent funds the treasury and the honest pool. Fee value: OPEN pending the wash-cost vs honest-volume elasticity sweep. - Remote services are unknowable in principle. Remote execution can't be verified, so services get NO substrate standing, mint, or verdict-layer claims: trust is behavioral (identity, atomic payment, track record), and the blast radius of a bad provider is the channel deposit. Keeping services outside the trust substrate is itself the defense: the unverifiable rail can't contaminate the verifiable one.
- A machine-owner attacker can't be stopped by self-checks. No
software self-attestation survives the owner patching the checker. The
bar (per
anti_tamper_design.md) is: tampering detectable by honest peers, self-correcting for accidental corruption, and not circumventable via the cheap config-repoint path. Peer-verified attestation is designed, pre-implementation. - Dormant teeth, kept in-tree: the violator-pays mint gate
(
mint_gate.py,apply_gate=False) and the CON-bust/defender loop are deliberately parked, not deleted. They can be armed forward-only through governance if the priced exposures above turn out underpriced.
The chain (Etherlink shadownet today) is a rollup with a sequencer. The threat model there is honest: a sequencer can censor or reorder; it cannot forge, because mints need merkle proofs against anchors every honest daemon already ratified, and Substrate.sol has no admin keys. That leaves two failure modes, both covered:
Silence → settlement waits. A network that can't reach its chain stops settling: no anchors, no mints. Local work (agents, tools, services) continues, and settlement resumes from the last anchor when the chain is back (Decision 2026-10-26; the older rule halted all work, which punished every household for a network problem). A censoring chain can pause settlement but cannot redirect it.
Capture → consensus-gated migration. Evolution is forward-only: there is no rollback mechanism, and there is no need for one, because the chain is replaceable and the state is not on it. If the settlement chain is compromised, censoring, or simply outgrown, governance redeploys the contract suite onto a fresh Substrate (clean genesis) and daemons re-register and re-anchor: the substrate state, tool library, and earnings history travel with the daemons, and REP claims re-derive from ratified earnings.
This is not hypothetical. It has been executed, live, twice in three
days (2026-07-08 genesis-v2, then 2026-07-10 when the canonical
network flipped to the platform-born jurisdiction): the werule-created
DAO had the autonet stack attached via a 2-call governance proposal
(setMinter + parity), the charter was re-anchored under the new
timelock, registry.json (the address-of-record daemons resolve the
network from) was flipped, and daemons re-registered against the new
Substrate. The same choreography (governance proposal → fresh suite →
registry flip → daemon re-registration) is the escape hatch for a
hostile chain, with one addition: the destination chain would differ,
and the last honest anchor is the genesis reference.
Two design consequences worth making explicit:
- The anchor is the recovery point. Because anchors are hash-chained commitments to state every daemon holds, "the last anchor all honest daemons agree on" is a well-defined migration genesis even if the chain's tail is censored or reorged.
- Cheap external insurance is available if wanted (OPEN, unbuilt): checkpointing the epoch anchor hash to Ethereum L1 every N epochs (one tiny transaction, no per-operation cost) would put the recovery point on a maximally neutral chain without running the economy there. Running live on multiple chains was considered and rejected: ATN has no trusted multi-chain issuer (the thing that makes USDC multichain is Circle), so multi-chain state means a bridge, and a bridge is a worse trust assumption than the sequencer it would hedge.
Flag-day discipline is part of the same story: changes to the close output/CID, contract ABI, or merkle leaf shape require every daemon on the new build and a fresh Substrate before the next close, otherwise closes and proofs fork. Migration is cheap because it is total; the network never runs two truths at once.
These are procedures, not code: each one is "deploy a new jurisdiction,
seed its genesis, point daemons at its Registry", using tools that exist.
Two genesis inputs carry state across: REP through the deploy's genesis
member list (MEMBERS / AMOUNTS in dao's
deploy-autonet-jurisdiction.js), and ATN through Substrate's genesis
merkle root (claimGenesis, scripts/build_atn_genesis.py, Decision
2026-10-28 in tool_substrate.md). Both are snapshots of the old chain at a
named base block, so anyone can re-run the script and check the roots.
Validated in the GPU tokenomics sim (C:�de�utonet-sims, E6), except
the fork, which is argued, not simulated.
Split (a network cut leaves some households unable to reach the chain or each other). The cut-off side starts its own jurisdiction from the last anchor both sides share. Its genesis REP is re-derived from every household's earnings up to that anchor, not only the households on its side: the absent majority's REP still counts in the supply, so capturing the small side stays as expensive as capturing the whole network, and its sanctions still pass. Re-deriving from the region alone let an attacker take a small side with 66-85% of its REP.
Reunion (the cut heals). The reunited jurisdiction counts both sides' earnings since the split (rule M2): each household's REP is its pre-split earnings plus what it earned on whichever side it was on. Keeping only the larger side's history (M1) is also safe but throws away the minority's honest work.
Fork that excludes a blocking coalition (a bribed majority votes down a sanction against a detected attack). Votes are on-chain, so the coalition is known exactly. Honest households deploy a new jurisdiction whose genesis (REP list and ATN root) is the old chain's state at the last anchor before the attack, minus every address that voted Against the sanction. Each household then chooses which Registry its daemon follows; nothing forces anyone, and the old jurisdiction keeps running with the attacker. Costs, stated plainly: honest households that voted Against are excluded too (a readmission vote in the new jurisdiction can bring them back), and only the voting address is excluded, so delegators of an Against-voting delegate keep their balances and can follow the fork. This is the last defence above roughly half of REP; below about a third, ordinary sanctions win the race (sim E5).
Sanctions that burn the farmed REP. A sanction proposal withholds the
sanctioned households' mint (the close excludes their usage) and should
also burn the REP they farmed: RepToken's burn(from, amount) is callable
by its admin, the timelock, so the proposal adds that call. No contract
change. In the sim, attackers kept 8-29% of REP after a mint-only
sanction and 0.8-5% with the burn.
Money is demand-backed (mint == burned fees), voice is work-backed (REP == ratified earnings), quality is consensus-backed (rep-weighted drift with credibility memory), and truth is computation-backed (every honest daemon recomputes the close). Each rail is denominated in something the attacker must actually spend (fees, provable service delivery, earned reputation, canonical code), and the one resource that is free to forge (identities) is collapsed to households and carries zero weight until it earns some. What can't be prevented is priced, what can't be priced is kept off the trust substrate, and if the settlement layer itself turns hostile, settlement pauses while households keep working, then the network votes and walks, carrying its state with it, forward-only.