Conduit

Demo

About

Conduit is a serverless, peer-to-peer marketplace for AI inference. You buy an answer directly from someone else's GPU and pay them per answer in USDC. There is no server in the middle, no account on either side, and your prompt never touches a cloud peers find each other over a DHT and the model runs on the seller's own machine. The core idea is that the payment is the access handshake: a seller's inference runtime sits behind a firewall that only opens for a buyer who has settled. A freeloader connecting without paying is refused at the handshake and gets zero bytes. PRE-EXISTING (built June–July 2026 for QVAC Hackathon I): the P2P marketplace itself — Hyperswarm discovery, the payment-gated provider handshake, the on-device capability prober that decides what a machine can sell, the ConduitEscrow payment-channel contract, and the Electron desktop app. NEW THIS HACKATHON (Continuity track): • Migrated settlement to Arc Testnet (chain 5042002), where USDC is both the gas token and the token answers are priced in — so a seller earns and spends one asset instead of earning one and paying fees in another. • Built a subgraph on The Graph indexing every channel the escrow has ever opened, so a first-time buyer can see how a seller treated everyone, not just themselves. Crucially it classifies withdrawals rather than counting them: probes and session renewals are indexed and visible but excluded from scoring, because a naive settled/withdrawn tally is trivially gamed. • Added a World personhood gate via AgentKit. A seller can require that a buyer is a verified unique human; the wallet resolves to an anonymous human id in AgentBook on World Chain - never an identity. This is what makes the reputation layer expensive to forge: buying a reputation now costs a person, not gas. • Removed the free local-answer tier entirely. Every answer is bought from a peer, so the market is never invisible. Demonstrated end to end across two machines: a Mac buyer is refused as an unverified human, verifies by scanning a QR in World App, then buys answers from a Linux GPU - settling six answers in two on-chain transactions

How it's made

Stack: TypeScript throughout. Hyperswarm/HyperDHT handles serverless peer discovery and NAT hole-punching. QVAC, Tether's on-device runtime, runs the models: Qwen3 0.6B/1.7B/4B and Llama 3.2 1B. Inference is delegated over an end-to-end encrypted Noise link, so model weights never leave the seller and prompts never reach a cloud service. ethers v6 handles signing, Solidity + Hardhat handles the escrow, React + Electron powers the desktop app, and node:test runs the suite with 79 tests and zero new test dependencies. ARC: settlement. ConduitEscrow (0xdC48E5e5c3Cf91b6db9ec0f329a14188174632C2) is an EIP-712 payment-channel contract. A channel is opened once with a deposit, then every answer gets an off-chain signed voucher containing a cumulative total. The seller can redeem everything in a single claim. The reason Arc worked particularly well here is that USDC is both the gas token and the settlement token. A seller earns and spends the same asset, which makes sense for a machine selling compute. One subtle issue took some debugging: Arc exposes the same balance through two views, native at 18 decimals and ERC-20 at 6. The ERC-20 view is a floored projection, so gas accounting has to happen in native units or you can lose a base unit on each reading. THE GRAPH: reputation. AssemblyScript mappings index Opened, Settled, and Withdrawn events from the escrow. The interesting part is the classification, not just counting events. On the original Sepolia deployment, both real Withdrawn events came from the same buyer reopening 24 seconds later. That is loyalty, but a naive counter would classify it as abandonment and give the seller a 0.0 score. So withdrawals are split into qualified abandonment, probes, and renewals. Probes are sessions that were too short, too small, or came from a buyer with no settlement history. Only qualified abandonment affects the reputation score. The UI shows both the naive score and the hardened score, so the difference is visible instead of just being claimed. WORLD: personhood. AgentKit's createAgentBookVerifier resolves a wallet to an anonymous humanId through AgentBook on World Chain. There were two gotchas worth calling out. lookupHuman(0x0) returns a NON-ZERO id, so the zero address has to be rejected before the lookup. Otherwise, an unfunded wallet could appear to be a human. The second issue was validateAgentkitMessage. It compares only the URI host, not the path. That meant a proof issued for one seller could validate for another seller. We added an explicit seller binding check. Registration happens directly in the app. The engine spawns the AgentKit CLI as a managed child process. Since the CLI only draws an ASCII QR code to a TTY, the QR is generated client-side from the link emitted by the CLI. A few other hacky bits were needed to make the desktop builds actually work. npm does not preserve the executable bit inside published packages, so the bundled Bare runtime was shipped as 0644. The app then failed with EACCES inside a squashfs AppImage and EROFS on a read-only DMG. An afterPack hook now restores the executable bit. The macOS prebuild of the llama.cpp addon links Homebrew's OpenSSL using an absolute path. The same hook vendors the required dylibs into the bundle, rewrites the load commands to @loader_path, and ad-hoc re-signs the binaries. install_name_tool invalidates the signature, and without re-signing, Apple Silicon refuses to dlopen the addon. The runtime also cannot restart a provider inside the same process. So the seller proves it can actually serve by launching its own binary in a child process, loading the model, and exiting. The exit code becomes the answer. Finally, the firewall allow-list could not be amended once the provider was running. That meant a seller could only serve the first buyer who paid. The allow-list is now accumulated before the provider starts, so multiple buyers can connect.