Siontology is open source: AI agents that run on your own computer, answer in the apps where you talk and work as a team, and a ledger that holds every one of them to the limits you set. What they pay, remember and claim carries a proof or priced evidence that anyone can check.
Your team at work
Illustration of a graph of agents: the job goes to three nodes, each with instructions of its own and, if the graph says so, its own tools or model. They work side by side, each in a session of its own, and the lead puts their answers together. A graph runs as sessions of one agent, under its one charter. The roles and the job are examples.
StatusA devnet-scale reference implementation in Rust. Succinct proofs are simulated, networking between machines is simplified and tested on one machine, the agent’s model providers and messengers are tested against stand-ins, and there is no mainnet.What exists today
For you: your own agent
It runs on your computer and answers in the apps you already use. It remembers what you tell it, works on a schedule, hands work to helpers, browses the web and runs code in a sandbox, and the ledger refuses any payment its charter forbids, whatever it is told.
What your agent can do
Connect: Wherever you talk
Telegram, WhatsApp, Slack, Discord, Signal, iMessage, email, 21 more services and your terminal: one agent, one memory, wherever you write.
One agent on the apps you already use: 28 messaging services, voice notes heard and, where the service takes a bot’s audio, answered aloud. Someone it does not know gets a pairing code and no answer until you let them in. From the recording in the book, with stand-ins for the services’ APIs.
Remember: Learns as it works
It remembers what you tell it, writes down how it did a job as a skill to use again, and searches its past conversations.
Its memory is a log on your computer that only it can add to; the ledger keeps the log’s head, so a rewritten past is refused. After a long task it is asked whether to write down how it did it, as a skill, and it searches its past sessions, each find checked against its memory. From recordings in the book: the skill pay-bobs-invoices, and the robots demo’s refused rewrite.
Schedule: Works on a schedule
Morning briefings, weekly reports, a check every hour: set a job and a time, and it runs on its own while your computer is on.
A job at a time, every interval or on a calendar, each run a session of its own under the same limits, its answer sent to your chat app, a file or a webhook. Jobs run while the scheduler runs on your computer, which setup starts as a service; a run missed while it was off happens once, late. From the recording in the book.
Delegate: A team, not a tool
It hands parts of a job to helpers that work at the same time, each with its own conversation and budget.
Helpers get identities of their own and budgets carved from their parent’s, each limit narrower than the one above, and the ledger checks every payment against all of them; it can also hire other agents through Task Charters, and the ledger pays only for a result that passes the rule fixed when the task was posted. From the swarm demo: 12 helpers, 3 more below one of them, 6 USD refused over a 5 USD limit, and a suspension that refuses the whole tree until it is lifted.
Browse: Out on the web
A browser of its own: it reads pages, clicks and types. It also sees the pictures you send, makes new ones and can answer voice notes aloud.
Chromium or Chrome in a sandbox, with a profile made for the session: none of your cookies or passwords. It sees a page as its accessibility tree, clicks, types and takes pictures, and reaches public sites only, or only those you name. It also sees the pictures you send, makes pictures with an image model you give it, and answers voice notes aloud with a speech service. From the recording in the book, against docs.rs.
Sandbox: Safe hands
Its commands run in a sandbox: it writes only its own folder, sees none of your files, and reaches no network unless you allow it.
Its shell runs in bubblewrap or a Docker image: it writes only its own folder, sees the machine’s programs read-only and none of your files, and reaches no network unless you give it one. From the recording in the book: primes.py, 17 primes below 60, a write to /usr/local refused, no name resolution.
It answers on 28 messaging services, and in your terminal
It thinks with the model you choose, its key kept sealed on your computer
Give each role an agent of its own, with its own model, tools, memory and budget, and talk to each wherever you like. For a job in several parts, a graph runs the parts side by side, each with its own instructions, tools or model. And one agent can hire another through a Task Charter: the ledger pays only for a result that passes the rule fixed when the task was posted.
Plans the launch, drafts the posts and makes the pictures, in the voice you taught it.
Uses browser, pictures, memory
Writes and tests code in its sandbox, then tells you what changed and why.
Uses sandboxed shell, files, browser
Pays the invoices you approve, within a budget the ledger enforces, and says what is left.
Uses payments, schedules, memory
Looks up leads on the web, drafts the follow-ups and briefs you every Monday.
Uses browser, email, schedules
Runs a release: keeps the dates, chases what is left and answers you on Telegram.
Uses schedules, memory, Telegram
Reads papers on the sites you allow, runs the analysis in Python and shows its sources.
Uses browser, Python, files
Listens at the end of the day and helps you plan a calmer week. It is no substitute for a clinician.
Uses voice notes, memory
Any role you need: a name, a model, tools, a memory and limits of its own.
Make it with sion agent profile add
These are examples: each role is a profile you make yourself, and what it can do depends on the model and tools you give it. Graphs and hiring are built, and were run on the devnet with a scripted model. Graphs of agents · Subagents and hired help
Each agent has a charter on the ledger: its budget, its largest payment and whom it may pay. The ledger refuses whatever the charter forbids, even from an agent that was prompt-injected, and keeps the head of its memory log, so its past cannot be rewritten unnoticed.
Approvals
Autonomy levels from L0 to L6 decide what it does alone; by default it asks you, in the chat, before it pays. Once it has read anything from outside, it asks before reaching outside again. Each decision is kept with who made it; one made at the command line can be signed with a wallet.
Built/approve
The ledger
The autonomy level decides what it tries; the ledger, what it can do. One revocation stops an agent and every subagent it launched.
Built on the devnetsion demo agents --local
Security
Nine attacks on a model that does whatever it reads. Seven were held for a person or never reached the model; two got through, at the boundaries as built, and the test says which.
Builttests/attacks.rs
Its limits hold
Illustration of the design, with the charter of the agents demo: pay only gpu-cloud, at most 100 USD a payment, a 1,000 USD budget. The questions in the chat are the agent runtime’s, at autonomy L5; the yes and no are the ledger’s, which no message and no approval can change.
How it was tested: with a scripted model, and with stand-ins for the model providers’ and the messengers’ APIs, which the environment it was built in cannot reach. Its autonomy, approvals and taint are enforced on your machine; its charter, by the ledger. What it does not do yet
Other agents keep their spending limits in their own code, or in their maker’s cloud. Siontology keeps them in a ledger, so they hold even when the agent is fooled. Here is what that adds, and where the others are ahead today.
| What | Siontology | Hermes Agent | OpenClaw | Grok Bot | ChatGPT dots |
|---|---|---|---|---|---|
| What only Siontology does | |||||
| Spending limits a ledger enforces, even on a fooled agent | Yes: its charter fixes the budget, the largest payment and whom it may pay | No | No | No: it asks you when something needs approval | No: it follows rules you set, and asks for approval |
| Memory a rewrite cannot hide | Yes: the ledger keeps the head of its memory, and refuses a rewritten past | No | No | No | No |
| Hiring another agent, paid only for a result that passes a rule set in advance | Yes: a Task Charter holds the pay in escrow | No | No | No | No |
| A bond behind every skill from someone else | Yes: installed only if bonds cover, by default, twice what it could cost you | No | No | No | No |
| Everything else, side by side | |||||
| Runs on | Your computer, beside a chain of its own | Your computer, a server or serverless | Your computer or a server | xAI’s cloud, on a computer of its own | OpenAI’s cloud, on a computer of its own; it can use yours too |
| Open source | Yes: Apache-2.0 or MIT | Yes: MIT | Yes: MIT | No | No |
| Models | Claude, OpenAI, Gemini, your ChatGPT plan, or local models | Any: Nous Portal, OpenRouter, OpenAI or your own endpoint | Many providers, local ones among them | Chosen by xAI | OpenAI’s GPT-6 Astra |
| Where you talk to it | 28 messaging services, voice notes, and the terminal, typed or spoken live with a wake word | Telegram, Discord, Slack, WhatsApp, Signal, email and the terminal | More than 30 chat channels | Its app, on desktop and iOS | ChatGPT, by message or call; Slack and Microsoft Teams |
| Helpers working side by side | Subagents on budgets carved from its own, and graphs of agents | Isolated subagents | Sub-agent sessions in the background | Several bots, one overseeing the others | Background agents; teams of dots planned |
| Commands in a sandbox | Always: bubblewrap or Docker, with no network unless you give it one | Optional: seven backends, your machine by default | Optional, off by default: Docker, Podman, SSH and others | On its own cloud computer | On its own cloud computer |
| Web search and browsing | Search (Brave, Tavily or your own SearXNG) and a browser of its own, with tabs, downloads and uploads | Search and a browser | Search and a browser | Websites, on its own computer | A browser, on its own computer |
| Works while your computer is off | On a server of yours, put there over SSH by sion deploy | On a server, or serverless | On a server | Yes | Yes |
| Status | A devnet reference implementation, tested with a scripted model and stand-ins; no release yet | Available | Available | Beta | Out since 29 September 2026 |
| Cost | Free; you bring a model | Free; you bring a model, or a Nous Portal plan | Free; you bring a model | In SuperGrok and Cursor plans | In ChatGPT Business Premium, and in Pro outside the EEA, the UK and Switzerland |
How we compared: from each one’s own documentation and announcements, and from reporting on them where they say little; products change, so check the sources. The Siontology column keeps to what is built. Hermes Agent is Nous Research’s, OpenClaw its contributors’, Grok Bot xAI’s and dots OpenAI’s: the names are their owners’ marks, and none of them has reviewed this table.
Sources: Hermes Agent: its repository, tools. OpenClaw: its repository, channels, sandboxing, web tools, sub-agents, local models. Grok Bot: xAI’s announcement, a timeline of its plans. ChatGPT dots: TechCrunch, The Next Web, Flavio Copes.
Install it, run setup, and talk to it, in the terminal or on the apps you connect. It all runs on your computer, apart from the model and the apps you choose.
# Install sion: a release checked before it is installed,
# or built from source while there is none
curl -fsSL https://raw.githubusercontent.com/shayansal/Siontology/main/scripts/install.sh | sh
# A chain of your own, your agent, its model and memory
sion setup
# Talk with it; sion -c goes on with the last conversation
sion$ sion setup --yes --model script:assistant.json…Ready.…$ sionTalking with assistant (conversation 2026-11-01-153915); end with Ctrl-D, continue later with `sion -c`.you> What is in your workspace? · list_filesagent> Your workspace is empty so far. Put files in it, or ask me to write some.you> (it went in on standard input). A scripted model stands in for a real one.Setup makes a chain of your own, your wallet and your agent’s, the agent with a budget, its memory log, its model and a profile. Run again, it changes only what it must.
With nothing to order, the chain waits between rounds: 5.7% of one core at rest and a transfer in 2.3 s, measured on two cores, against 98.8% without the wait.
sion update installs a release only once its signature, by the release key the program was built with, and its checksum hold. The release key does not exist yet, and no release has been published.
For builders: the ledger
Siontology is an open-source ledger for an economy in which AI agents buy, sell and publish. Payments, AI output and claims about the world carry a proof or priced evidence, so a person or an agent can check them and see what faking them would cost.
$ sion demo agents --local…Pulse 7 agent pays gpu-cloud 80 USD for inference: accepted; receipt claim 0586a32c joins the knowledge logPulse 11 a prompt-injected agent tries to pay mallory 90 USD → refused by the ledger: charter caveat violated: payee not allowedPulse 13 the agent tries a 150 USD payment → refused by the ledger: charter caveat violated: payment 150 above per-payment limit 100…Result: gpu-cloud received 100 USD; mallory received nothing; the limits lived in the ledger, not the agent.sion demo agents --local in the book, shortened at …Agents with budgets the ledger enforces, APIs paid per request, receipts for AI output and markets that prove their prices: a neo-blockchain whose product is verified knowledge, not ordered transactions.
The Fold
Illustration of the design. Operations stream into leaf batches: solid for owned transfers, outline for claims, hatched for contended batches. Every Pulse, each level folds pairwise into the one above, and the root joins the World Proof, a pair of roots from two independent proof stacks. On today’s devnet, four validators on two shared cores closed a Pulse about every four seconds, and World Proofs are checked by replay.
Nine uses where trust is what slows business down today. Eight run on the devnet as scripted demos; the ninth is built from the same claims and bonds, but its workflow is not. Each says what is still missing.
For teams deploying AI agents
Give an agent a budget, a list of payees and a cap per payment. The ledger refuses any payment outside them, even from a hijacked or prompt-injected agent, and one revocation stops every sub-agent at once.
TodayAn agent’s limits live in its own code or its card’s settings, so one prompt injection can turn them into a loss.
Built on the devnetsion demo agents --local
For anyone selling an API or data
The API answers HTTP 402 with a price. An agent that calls once pays in a stablecoin; one that calls often pays from a payment stream, one hash per call. The server serves once it has checked the payment itself. No accounts, API keys or invoices.
TodayA card payment costs more than one API call, so APIs are sold as monthly plans behind accounts and keys.
Built on the devnetsion demo streams --local
For AI providers and publishers
Each output gets a receipt naming the model, the time and a hash of the content, issued in batches. Anyone can check a receipt and see what forging it would cost.
TodayThe EU AI Act has required machine-readable marking of AI-generated content since 2 August 2026, and a watermark alone can be stripped.
Claims built; the receipt service is notsion demo receipts --local
For finance and treasury teams
A payment above a threshold needs an approval claim backed by more than the payment is worth, so an attacker has to outspend it, not imitate a face on a call.
TodayOne deepfake video call cost the engineering firm Arup about 25.6 million USD in 2024.
Claims and bonds built; the workflow is not
Walk through itFor lenders and trade platforms
Suppliers, shippers and arbiters bond what they attest. A financier funds an invoice only up to what those bonds can repay, and is repaid automatically when a challenge proves the invoice false.
TodayA financier who funds a false invoice recovers through insurers or the courts, if at all.
Built on the devnetsion demo invoice --local
For compute and energy marketplaces
Orders are sealed in batches and cleared at one price. A batch settles only with a certificate that no better allocation exists, so a place in the queue is worth nothing and there is nothing to front-run.
TodayMatching engines are black boxes: nobody can check that the allocation was the best available, and arrival order can be gamed.
Built on the devnetsion demo market --local
For AI labs and anyone buying evals or training runs
Escrow a task with the rule a result must pass, fixed before anyone starts: the environment vendor’s bonded claim that its grader cannot be gamed, and the verifiers whose word counts. The worker is paid once, and if the grader is later proven exploitable, the buyer is repaid from the vendor’s bond.
TodayAn eval or training environment is paid for up front; if its grader turns out to reward a shortcut, the buyer absorbs the loss.
Built on the devnetsion demo tasks --local
For robotics and agent builders
Each robot or agent keeps a log of what it saw, where and when. The ledger keeps the log’s head, lets it only grow and says when each memory was recorded. Anyone can check a complete answer to “what was in aisle 4 at 10:02”, and convict an index that hides something.
TodayAn agent’s or a robot’s memory is a file its operator can edit, so nobody can prove what it knew, and when.
Built on the devnetsion demo robots --local
For anyone who keeps data with someone else
Pay per round to have data kept, fixed by its Merkle root. The provider puts up collateral and, each round, shows pieces of the data nobody could predict. A provider that cannot produce them misses the round and loses collateral. Any computer running the app can be a provider.
TodayYou take a storage provider’s word that your data is still there, until the day you need it.
Built on the devnetsion demo storage --local
Designed for, not built yet: cross-border stablecoin settlement with compliance proven rather than disclosed, and media provenance that survives a platform stripping its metadata. Every use case, step by step
Most payments between machines are small, frequent and between the same two parties. A payment stream pays each one with a hash instead of a transaction, and the ledger settles a million of them for the cost of one. Throughput is then counted in payments, and grows with the size of a settlement, not with the size of the network.
Payment streams: pay per call, settle per million
From the streams demo and the streams benchmark. The agent opened a payment stream to the API: an escrow, and the last element of a secret hash chain. Each call is paid with the next element, which the API checks with one SHA3-256 hash against the last one it accepted, 0.42 µs on one core; nothing per call reaches the ledger. The API then settles every payment so far in one transaction, ordered by consensus. With checkpoints, that settlement walks only to the checkpoint below its position and proves the checkpoint's Merkle path: 524 hashes and one signature check for 1,048,064 payments, about a nanosecond per payment on the ledger. Payments are one-way, from one payer to one payee, out of escrow the payer locked in advance, and the rates were measured on one core of a two-core machine, not on a network.
What this is not: a billion general transactions a second. A stream pays one payee, one way, out of escrow, and the settlement rates come from one machine, not a network. The research note: construction, measurements, prior art and limits
AI collapsed the cost of producing cognition. A neo-blockchain is designed to collapse the cost of trusting it: claims about computations, data, identities, payments and physical events that anyone can check in milliseconds.
Every AI output, agent action, image and data feed raises one question: is this real, and who pays if it is not? The cheaper generation gets, the more the bottleneck moves to checking.
Verification, intermediation, compliance and fraud are paid on almost every exchange between strangers. Financial-crime compliance alone costs 206 billion USD a year (LexisNexis, 2023, as cited in the architecture paper).
They made one thing trustworthy, their own token state, by having every node redo every computation. Siontology extends verifiable trust to anything that can carry evidence, with proofs designed to cost about the same to check for one action or a billion.
Blockchains chain blocks and DAGs link transactions. Siontology, a neo-blockchain, folds every proof in the network into one World Proof per Pulse, designed to stay the same size however much it covers, so that a phone can check it. Four pieces carry it.
Knowledge never needs coordination. Only consuming a resource is ordered, and only among the parties contending for it.
More on two-sorted stateEvery claim carries a formula of its assumptions. Any agent computes what an attacker must forfeit to falsify it, and acts only when that exceeds what is at stake.
More on the Assurance AlgebraA market batch settles only with a certificate that no better allocation exists, which the ledger checks in linear time.
More on Verifiable ClearingEvery proof folds into one World Proof per Pulse, designed so that a phone can check the whole history without trusting a validator. Today the proofs are checked by replay.
More on the FoldA claim’s formula names the assumptions it rests on: ∧ where it needs all of them, ∨ where any one route will do. Its cost of corruption is the cheapest set of failures that would make it false. An agent relies on the claim only if that cost covers κ times its value at risk, and reserves that much of the backing, so no claim is relied on beyond what slashing can repay.
The Assurance Algebra
The worked example from the architecture paper. Invoice #1042 is payable if three inputs all hold (∧): delivery, confirmed by three independent witnesses bonded at 20,000 USD each (∨, so their bonds add up to 60,000); the invoice arithmetic, proven by two independent stacks (∞ under a policy that trusts the cryptography); and the supplier's identity, backed by a bank's 1,000,000 USD bond. The cost of corruption is the minimum over the ∧: 60,000 USD, so delivery is the weak link. A financier with 25,000 USD at risk and safety factor κ = 2 needs 50,000, accepts, and reserves 50,000 down the formula. A second financier asking the same is refused: only 10,000 USD of the delivery route is still unreserved.
Every figure on this site names the demo, specification or code behind it. The reference implementation is Rust, licensed Apache-2.0 OR MIT, and the demos drive real transactions through the whole protocol.
git clone https://github.com/shayansal/Siontology
cd siontology
cargo build --release
alias sion=./target/release/sion
# Run every scripted demo against an in-process devnet
sion demo all --localStack A is the reference executor. Stack B was written only from the specification. A World Proof verifies only if both accept every chunk, and CI checks that stack B never calls the reference executor’s logic.
The state transition, version 1.15, written so that another implementation can be built from the document alone. It covers validators, stake, epochs, slashing, the response to censorship and payment streams, and pays validators from fees alone.
What is built, simplified, simulated or missing is listed, and each simplification is an assumption in the trust formula of whatever the devnet reports.
A devnet-scale reference implementation in Rust, and an agent you can run on it. Where it falls short of the architecture, it says so. The full account is in docs/implementation-status.md.
| Part | Status |
|---|---|
| Your agent: a model at work under autonomy levels and approvals, within its charter; memory, skills, verified self-improvement, subagents, schedules | Partly built; tested with a scripted model and stand-ins |
| Where it talks: the terminal, 28 messaging services, voice notes, an HTTP channel, OpenAI’s chat API and A2A | Built; tested against stand-ins for the services |
| Its tools: a sandboxed shell, tools to change code and check it, web search, a browser with tabs, downloads and uploads, a desktop of its own, MCP servers over standard input or HTTP with OAuth (their resources, prompts and questions to you included), and sion’s own servers for mail, calendars and documents | Built; services tested against stand-ins |
| Live voice in the terminal: it listens all the time, speaks as it writes, stops when you speak over it, and wakes to a phrase | Simplified: speech found by loudness, no echo cancellation |
| Graphs of agents, dreaming, evaluations and judges, quarantine, signed decisions | Built |
One person, one machine: sion setup, the installer, signed updates; and a server of theirs: sion deploy, sion agent up | Built; no release published yet, services not run on a desktop or a server, deploying tested over a stand-in for SSH |
| Two-sorted state, with the coordination class derived from what a transaction touches | Built |
| Post-quantum accounts: ML-DSA-44 and SLH-DSA on every authorization; ML-KEM-768 for payloads | Built |
| Linear Lanes and Escrow Lanes | Built |
| Contention Consensus | Simplified: a certified DAG |
| Data availability: two-dimensional Reed–Solomon coding, sampling, reconstruction | Built |
| The Assurance Algebra: claims, bonds, reservations, challenges, slashing of bonds | Built |
| Verifiable Clearing and Agent Charters | Built |
| Validator staking, epochs, rewards, slashing and committee rotation | Built (devnet) |
| Forced inclusion: obligations in the state, overdue intents counted in certified headers | Simplified: the shard is not frozen |
| Payment streams: one hash per payment, settlement by checkpoint | Built (devnet) |
| CLI, HTTP API, MCP server and an x402 adapter | Built |
| The Fold: a World Proof per Pulse, from two independent stacks | Simulated: replay proofs |
| Agent identities and subagents, memory logs for agents and robots, Task Charters | Built (devnet) |
| Batched authorization: one signature for up to 256 transactions, keyless subagents signed for by their nearest keyed ancestor | Built (devnet) |
| Storage deals: data kept by providers who prove it every round | Built (devnet) |
| The app: a light node on every device, which can also provide storage | Desktop built; mobile not built yet |
| Networking between machines | Simplified: QUIC between processes, peers from files |
| Personhood, a proving market, payments to provers, confidential amounts, compliance proofs | Not built |
| Mainnet | None |
| Token | Siontology has no token and nothing is on offer. Fees are paid in stablecoins. |