EXP-01 / Condensation record for model output
Vapour / what the vessel is for
A vapour vessel never shows you the particle. It shows the trail the particle left, and that is enough to know it went through. Kortx commits the same kind of trail for an inference -- input hash, model fingerprint, sampling seed -- on Solana, at a verification tier that states its own limits.
Contract address
Every track in the vessel above is one committed inference. Its shape is its tier.
Opacitythe state of the art
An API answers. A field in the response says the output came from a GPT-4 class model. There is no procedure -- not a slow one, not an expensive one, not one available to enterprise customers under NDA -- by which you can check that field.
You are not being asked to trust a claim that is hard to verify. You are being asked to trust a claim that is structurally unverifiable, because nothing was ever recorded that a second party could compare against.
Every AI evaluation, every model card, every procurement decision and every safety review downstream of that field inherits the same gap.
Five of those eight fields are the ones that decide whether the output could be reproduced. All five are missing, and the invoice does not wait for them.
A smaller checkpoint answers the request because it is cheaper to serve under load. The response header still names the model you paid for. Nothing in the payload changes shape.
A fine-tune ships, or the deployment quantises to int8 to fit more traffic on the same accelerators. Same model name, same version string, different weights, different answers.
Temperature and top_p move by a tenth. The distribution you evaluated against and signed off on is gone, and no field in the response records that it moved.
The provider writes the audit log, stores the audit log and decides how long the audit log is kept. The audited party owns the only record of the thing being audited.
A receipt is not proof of purchase when the seller writes it afterwards and keeps the only copy.
Collimatethree tiers, three limits
One undifferentiated word is how this technology gets oversold. Kortx never ships it alone: every trace carries a tier, and every tier is published as a pair -- what it establishes, and what it leaves open. The second half is not fine print. It is the reason the first half can be believed.
Cost: lowest
ProvesA signed enclave ran the declared binary on the declared hardware.
Does not proveThat the loaded weights match the registered hash. You are trusting the enclave vendor.
Cost: middle
ProvesIndependently re-run inferences matched the committed output hash.
Does not proveAnything about the inferences that were never sampled. The guarantee is statistical.
Cost: highest
ProvesA zero-knowledge proof of the covered operations, checkable by anyone.
Does not proveWhole large models. Today only a stated subset of operations is provable, and the subset is published.
Cost rises with each row down. So does what the tier is prepared to claim.
Proving a full forward pass of a frontier-scale transformer is not practical today, at any price, with any published system. The proven tier covers a stated subset of operations and publishes the subset instead of implying the whole.
An attested trace inherits the trust assumptions of the hardware vendor and its attestation service. If that root is compromised the attestation is worth exactly what the vendor is worth, and no amount of on-chain recording changes that.
The sampled tier is a statement about a population. It says nothing about one specific request unless that request was in the sample, and the record never pretends otherwise.
A provider without enough re-run evidence is reported as unrated. It is not scored zero and it is not ranked last, because not measured and measured badly are opposite findings.
Downstreamwho reads a trace
The engineer who serves a model is not the only one who inherits the gap. A trading call, an autonomous agent, a one-off answer -- each reaches someone who has to decide whether to believe it, usually with less to go on than the engineer had. The same committed record answers all of them, because it is the one thing here that is not a claim.
Runs inference and wants the output to be checkable rather than taken on faith.
A project whose pitch is that an AI makes its calls, and the people holding the thing it issues.
Deciding whether to follow a call an AI made, before the outcome is in.
Received an output and would rather not take the provider's word for where it came from.
None of these ask the reader to trust Kortx. They ask the reader to check a record instead of a claim, and to read the tier that record carries before leaning on it. The tier is where the honest limit of each use is written down.
Read what each tier does and does not proveIncidentthe challenge path
A record nobody can contest is a press release. Every committed trace on Kortx can be disputed by anyone willing to put a bond behind the dispute, and the dispute is settled by re-running the input rather than by asking the provider what happened.
open_incidentA challenger posts a bond against one specific trace. The bond is at risk from this instruction onward, so a challenge costs the person making it something real before anybody has looked at anything.
submit_rerunRegistered verifiers execute the same input under the determinism the plate declared -- the same temperature, the same top_p, a seed inside the same bound -- and post a commitment to the result. Nothing readable is on chain, so the next verifier cannot skip the work by copying the last one's answer.
submit_rerunOnce the commit window shuts, each verifier publishes its output hash and the divergence it measured. The program checks the reveal against the commitment, then rules it a match or not under the plate's declared reproduction policy -- which is not always byte-for-byte equality, because floating-point non-determinism on the hardware would slash honest providers if it were.
resolve_incidentThe revealed verdicts are counted and the majority writes Upheld or Rejected. Too few reveals to make quorum voids the challenge instead of blaming anybody. An incident with no ruling is Pending and is displayed as Pending -- a deadline going by does not manufacture a verdict out of silence.
resolve_incidentThe same call moves the money. An upheld challenge slashes the plate bond of the provider, a rejected one forfeits the bond of the challenger, verifiers on the losing side forfeit part of theirs, and a share of everything collected is burned. Every direction costs somebody, which is the only reason any side stays careful.
Ionizewhat the token is for
Everything on this instrument is a claim somebody made. The token exists so that each claim has something behind it that can be taken away, which is the only mechanism here that does not depend on anyone being trustworthy.
There is no yield on this page: no emission, no staking return, no dividend to holders, and no price target. Verifiers are paid from usage fees for checks they perform, and part of every fee is burned. A bond is useful in exactly one way: it makes being wrong expensive.
Contract address
Trackwhat you can do now
The instrument is public and nothing below asks for an account. The point of the whole design is that you do not have to take our word for any of it, so the useful next step is not to read more -- it is to go and disagree with a record.