How Siontology works.

What blockchains take for granted, what a neo-blockchain is designed to do instead, and the mechanism for each. The sections below take the mechanisms one at a time.

A claim is the network’s unit of knowledge: a statement over committed data, with its evidence, its issuer, a formula of the assumptions it rests on, the bonds behind it and a window in which it can be challenged. Every claim goes through the same steps.

Every operation either adds knowledge or consumes a resource, and only consumption ever needs coordination. Publishing a verified claim never invalidates another claim; spending a coin removes the possibility of a second spend. The CALM theorem says exactly this: a distributed program can run without coordination when it only ever adds. Siontology makes the split part of its state model, and derives each transaction’s coordination class from what it touches; the sender never declares it.

An owned object can be spent only by its owner, so the only thing to prevent is the owner signing two spends of the same version. Each validator approves a given object version for at most one transaction, and approvals from more than two thirds of the committee’s stake form a certificate. Two certificates for one version cannot both exist, because any two such quorums share an honest validator. That certificate is final: no consensus round, no global order, and nothing waits for unrelated traffic.

Post-quantum signatures are kilobytes, so validators do not sign each approval. Each one signs a single Merkle root over a batch of approvals; a certificate is a few references into signed batches.

A shared total, such as seats, a budget or a supply cap, is split into allotments that add up to it, each with a single writer. Each writer spends its allotment with ordinary lane certificates and never coordinates with the others. Only a rebalance, when an allotment runs low, goes through consensus, and the total is never exceeded. This is the escrow method of distributed databases, applied to a ledger; Agent Charters use it to keep an agent’s payments free of consensus.

Only objects that several parties contend for, such as a market, a shared account or a registry, need a total order. For them, validators run a DAG-based BFT protocol in which every validator proposes in every round, so one honest proposer is enough to get an intent in. Even rounds have a leader; once enough of the next round references it, the leader commits and orders its history. Market batches then clear at one price, so the order inside a batch carries no value.

The reference implementation runs a certified DAG in the Bullshark family and tests it in a deterministic simulator with an adversarial network phase. The architecture targets an uncertified DAG of the Mysticeti class, which commits in fewer message delays.

A validity proof shows that a transition was correct; it cannot show that its data was published. So each Pulse’s data is erasure-coded in two dimensions and committed with hash-based roots, and every light client samples a few random shares. Withholding enough to prevent reconstruction means withholding more than a quarter of the extended square, which random samples find quickly. In the design, each client also serves the shares it sampled, so capacity grows with the number of clients; on the devnet, validators serve the shares.

In the design, every Pulse the network folds the proofs produced since the last Pulse into one World Proof that certifies the whole history from genesis. Leaf proofs are made in parallel and aggregated pairwise; a million leaves need about 20 levels, and Pulse t+1 starts aggregating while Pulse t’s root finishes. The design aims for checking to cost the same in year ten as on day one, so that a phone can be as certain of the state’s validity as a data centre.

The World Proof for a Pulse states that a history exists from genesis to its state root in which:

1. every linear transition followed its object’s rules and carried a valid committee certificate;
2. every contended batch cleared under a valid optimality certificate;
3. the knowledge log only grew, and every claim’s formula and bond references are correct;
4. every forced-inclusion obligation older than its deadline was met;
5. the data the history depends on was published and correctly encoded;
6. every committee change followed the staking rules, so the chain of signers is valid from genesis.

Two independent proof stacks prove everything, and a World Proof is the pair of their roots. A soundness bug in one stack cannot forge the world. In the reference implementation both stacks verify by replay: the proofs have the bindings of succinct proofs but not their cost, and every report that checks one says so.

Every claim carries a formula of the assumptions it rests on. Atoms are irreducible assumptions: a hash function’s collision resistance, a circuit’s correctness, a hardware enclave resisting its own host, a bonded attester’s honesty. A claim derived from several inputs takes their ∧; a claim backed by independent routes takes their ∨. From the formula, any consumer computes, under its own policy, the cheapest set of failures that would falsify the claim: its cost of corruption.

An agent with value V at stake accepts a claim only when the rule below holds, where κ ≥ 1 is a safety factor, δ ≤ 1 discounts claims whose falsehood is rarely provable, and the adjudicator term caps trust at the cost of corrupting the dispute process. It then reserves κ·V of the claim’s backing, so the value relying on any claim never exceeds what slashing can repay. When alternatives share atoms, the exact cost is a hard problem, and the implementation reports a sound interval instead.

Contended markets clear in sealed batches, and the winning solver must submit, with its allocation, a certificate that no better allocation exists. For a linear program, the allocation solves the primal and the prices solve the dual; by weak duality, no feasible allocation can beat it. Checking takes linear time however hard the problem was to solve, so anyone can run a solver and nobody can quietly extract value by controlling the order of transactions.

The certificate proves optimality for the orders as submitted; bidders can still misreport, and uniform-price batch auctions are not fully strategy-proof. Ties are broken by a perturbation drawn from the Pulse beacon after the batch seals, so the solver cannot choose the winners.

A charter is the contract between a principal and an AI agent, enforced by the protocol rather than by the agent’s code. Validators check every payment against it, so a hijacked or prompt-injected agent cannot exceed its caveats, and the worst case is known in advance. The agent spends from an allotment only it can write, so its payments need no consensus. Delegation can only narrow the caveats, and revoking a charter stops every sub-agent below it.

An agent registered on the ledger has an identity of its own: an id, a card that says what it is, and a charter. It can launch subagents in one transaction, each with an identity, an account and limits carved out of its own, down to eight levels. Every charter keeps its lineage, so anyone can recompute each ancestor’s id by hashing. Suspending an agent stops every agent below it until it is resumed; revoking it stops them for good, and its principal reclaims what they did not spend.

A subagent need not hold keys. The ledger accepts its transactions only in a batch signed by its nearest ancestor that has keys, and one dual signature over a batch’s Merkle root authorizes up to 256 transactions, each with a receipt of its own.

An agent’s or a robot’s memory is a log only it can append to. The entries stay with their writer; the ledger keeps the log’s size, root and index root, and moves them only along proofs that the log grew, so a rewritten past is refused. A reader asks about a span of space and time and gets a complete answer, with a proof checked against the head on the ledger. What to believe is computed by the reader, under its own policy.

The ledger stores the index root without checking it. Anyone who holds an entry an index left out can prove the omission from the head alone, but nothing on the ledger acts on that proof yet (impl:memory-index).

Work is paid only when its result passes a rule fixed when the task is posted: the claims a result must rest on, who may attest it and who must, and the policy its cost of corruption must meet for the amount at stake. The payment is escrowed at posting and released once. The backing of a paid result stays reserved for the buyer, so a result shown false later, such as one from a grader that could be gamed, is repaid from the slashed bonds.

A client posts a deal for data named by its Merkle root: how many rounds, a price per proven round held in escrow, and the collateral a provider must post. In every round the provider answers a challenge for pieces drawn from the beacon of the round’s first Pulse. A proven round is paid and a missed one is not, and a provider that misses rounds can lose its collateral.

A proof shows that the provider could produce the pieces during the round, not that it keeps a copy of its own (storage:no-replication).

Most payments between machines are small, frequent and between the same two parties. A payment stream pays each one without a transaction. The payer escrows funds for one payee and commits to a secret hash chain by publishing its last element. Each payment reveals the next element; the payee checks it with one SHA3-256 hash against the last one it accepted. Hash functions are the only cryptography a payment needs, so payments are post-quantum by construction.

The payee settles many payments in one transaction. A settlement can walk from the stream’s head, one hash per payment, or, if the payer also committed to a Merkle tree over every spacing-th element, jump to the checkpoint just below its position: at most spacing + 21 hashes, however many payments it covers. Anyone can check any payment later against what the ledger settled.

On one core, settlements by checkpoint covering about 9 × 10⁸ payments a second executed with every signature checked. That is a measurement of the ledger’s side on one machine, not of a network, and stream payments are one-way, out of escrow. The research note has the construction, the safety argument, the capacity law, the prior art and the limits. Over HTTP, an x402 server accepts stream payments with --streams.

Censorship cannot be attributed the way equivocation can, so it is made visible instead. A user whose transactions are ignored posts them straight to consensus as forced intents. Every validator proposes every round, so one honest proposer is enough to order one. The state then holds the intent as an obligation of the sender’s shard, which has 8 Pulses to execute it. Every Pulse header commits to how many intents are pending and how many are overdue, so censorship by more than a third of a committee shows up in certified headers that every light client checks.

When a deadline passes and the intent could still execute, the state replaces the shard’s committee, drawing from validators outside it first, and the obligation stands for another window. The architecture also freezes the shard until it meets the obligation; the reference implementation keeps it running under its new committee.

Who certifies is part of the state transition. The validator set is an object in the state: a validator joins by staking with a proof that it holds its keys, takes its seat at the next epoch boundary, and leaves at a boundary, withdrawing its stake after an unbonding period. At each boundary the state pays the epoch’s validators a share of the fees collected during the epoch, by weight, picks the next active set by stake and reseeds the sampling of lane committees with the beacon. Every validator derives the same committees from its own copy of the state; nothing about them is configured.

Equivocation is signed evidence that anyone can submit: two consensus headers for one round, or two lane approvals of one object version. The whole stake is forfeited, the reporter receives a share of it (5 % on the devnet), and the validator loses its seat at the next boundary. A light client that pins the genesis follows the committee from epoch to epoch through boundary proofs.

On the devnet, validators stake devnet USD, which has no value. Siontology has no token and nothing is on offer. Fees are paid in stablecoins.

The architecture paper sets targets that a public testnet must meet before anything else is built on them. None has been measured at scale.

To measure the primitives, execution, proving and a live devnet on your own machine, run sion bench. Post-quantum signatures and the trust model are on the security page; x402 and the agent interfaces are on the developers page, and the agent you run on your own computer on its own page.