D.A. G.O.A.T. — A Whitepaper

Token (design): GoatCoin (GOAT) · Alias: GPUCoin Licence: MIT OR Apache-2.0

> Reading convention. Every claim is tagged NOW (running code with tests), TARGET > (specified in the design record but not running), or INTENT (a goal, not a mechanism). Where > this document and the repository's own honesty matrix RUNTIME_VS_SPEC.md disagree, the matrix is > correct and this document is wrong.

1. Abstract

D.A. G.O.A.T. is a project to align idle consumer compute toward useful work, under a design constraint that ordinary machines — not fleets — remain economically rational participants.

What exists today is narrower. NOW the running software is an experimental post-quantum verification mesh: nodes complete a post-quantum handshake, verify signed capability records and gossip them under verify-before-forward discipline, behind a documented anti-denial-of-service layer. There is no live token, no rewards, no compute marketplace and no settlement. The post-quantum crates in use are pre-1.0 and unaudited, and execution isolation is a Phase-0 proof, not a production sandbox.

One clarification, because §8 lists a public-chain deployment. A contract stack was deployed to the Base Sepolia test network on 2026-07-30, off the deploy spine and in no container. Its stablecoin is a mock minted by the deployer; the GOAT figure recorded there is a 100-token development seed, not earned. There is no market, no price, no transferable asset and no mainnet counterpart; Base Sepolia ETH has no market value. "No live token" is exact, not a hedge.

Everything economic — the earnings target, issuance (in the design record, a bounded, monotone-decaying budget), burn, the reserve, fraud-proof-backed settlement — is TARGET: normative detail, implemented nowhere on the deploy path.

2. The problem

A large installed base of consumer hardware sits idle most of the day. Paying people for that idle time has been tried; the recurring failure is economic and structural, not technical. Three shapes recur, each treated as a design constraint:

system, the scheme pays early participants out of later deposits. The answer is a hard inequality, the No-Ponzi invariant: monetary reward ≤ real external inflow. TARGET

Proof-of-Valued-Work requires a unit of work to be both correct and wanted, with wantedness established by an m-of-n quorum judgement. The values of m and n are not fixed in the source record.

is a farm. The answer makes device-agnosticism a compile-time property rather than a policy. Its structural half (no protocol type can name a device) is NOW; the economic half meant to make farming unprofitable is TARGET. See §6.

3. What D.A. G.O.A.T. is, in plain language

A network of ordinary machines verifying each other's work, so a result can be trusted without trusting the machine that produced it — and, later, an economic layer paid out of money the network actually earned. Five commitments govern it. Three are enforced in code today; two are design rules the economic layer must satisfy before it ships, and they are tagged as such:

1. No-Ponzi — monetary reward ≤ real external inflow. TARGET
2. Proof-of-Valued-Work — correct and wanted (m-of-n usefulness). TARGET
3. Device-agnostic / anti-monopolization — no protocol layer may name or branch on a device type.

NOW as a property of the protocol types; TARGET as economics.

1. Post-quantum only — no classical cryptographic primitive is imported in any of the three Rust

configurations, C1/C2/C3, defined in §5. NOW

1. Radical honesty — claims ≤ code. NOW

Invariant 4 is scoped deliberately: holding across those three configurations is explicitly not a claim that the implementations have been audited. The EVM contract stack and the attestor that §8 lists are a separate tree outside that boundary: ECDSA- and keccak-secured classical code, about which the invariant says nothing. Invariant 5 is enforced as process — RUNTIME_VS_SPEC.md outranks every other document, including this one.

4. Proof-of-Valued-Work

The design separates two questions proof-of-work conflates: did this computation happen correctly, and did anyone want it.

compared under a defined agreement rule; disagreement escalates to an adjudicator re-derived from an epoch randomness beacon rather than asserted by an orchestrator, so no participant can pick a friendly judge, and a fabricated fault verdict re-derives differently and is rejected.

a quorum judgement, not a property the executor can claim for itself.

point appears on any consensus-relevant path: economic quantities are integer fixed-point (PPM = 1,000,000; BP_FULL = 10,000; µUSD), so bit-identical recomputation turns a wrong posting into a fraud proof rather than a rounding dispute. That is a rule for a future consensus path, not today's code: the C3 workspace demonstrating these mechanisms still uses f64 in its maturity, verification and capability modules. C3 is an oracle, not the implementation of this rule.

anchored. A posting less safe than the recomputable lower bound slashes the bond; being more conservative is free. All of it lives in the mechanism workspace, off the deploy path: the running mesh neither adjudicates fraud nor detects farms.

5. Architecture

An architecture decision record ended an early ambiguity — two Rust trees both looked like "the product" — by naming one production spine. Three configurations:

cluster runs. The core is #![no_std] and #![forbid(unsafe_code)]: six modules in a strict acyclic DAG, so serialization and domain separation sit below consensus and cannot be perturbed by it. Exactly five items allocate, all heap mirrors in crypto.rs and transport.rs. goatd is the only place std, the allocator and async live; the pipelines below it are synchronous and total.

bounded, allocator-free enclave. Disabling alloc removes exactly those five mirrors and nothing that can change a verdict, and a differential test pins the heap path byte-for-byte to the stack path.

holding the economic and anti-Sybil mechanisms, a neutrality auditor, demos and a harness. No production daemon, no image.

What the running mesh provides NOW is a bounded, cookie-gated ingress path. Three denial-of-service classes are defeated by cheap checks before any post-quantum work: an address-bound stateless cookie (HMAC-SHA3-256 over the node secret, the peer address and a timestamp), so a spoofed source never reaches signature verification; a single-use cookie cache, so a replay costs zero post-quantum work; and a hash-before-verify gossip cache, so a redundant epidemic copy is a penalty-free duplicate. Ingress is a bounded queue that drops at the socket layer and counts drops; the session map is hard-capped with synchronous eviction; startup is fail-closed, with genesis, node secret and chain-id match all required.

the daemon, never in-process. Phase-0 demonstrates containment: filesystem access outside a scratch directory denied, network and spawn denied, crash isolation and timeout kill with the daemon surviving. It is explicitly not a production multi-tenant sandbox: namespaces, seccomp-bpf, capability dropping and cgroups confinement are TARGET, as are the Windows and macOS backends. If isolation is unavailable the system executes no payloads — there is no unsandboxed host fallback.

6. Fairness by construction

The stated rule is blunt: if it names a device type, it's wrong. A device class travels the protocol as an opaque tag, never inspected. Three enforcements, not assertions:

carries no model, licence or content field — nothing to branch on. The same technique is aimed at plutocratic capture: an advisory stake floor is a newtype with no ordering, no arithmetic and no implicit conversion, so node_stake >= floor does not compile, and the value is reachable only through one deliberately-named accessor, fee_market_hint(), which makes any use at a participation gate greppable in review. That property rests on the newtype's derive list plus a written do-not-weaken invariant — convention and review, not a gate. No compile-fail test exists anywhere in the repository, and the runtime test that does exist locks the advisory accessor contract, not compilability.

the direction is one-way. Backend code therefore cannot execute inside a protocol module, and the property is checkable from the manifests.

device-type identifiers, catching sub-tokens as well as whole words. Two limits are load-bearing. It covers the three oracle-tree crates and not the production spine, so the invariant is scanned where it already holds and unscanned where the deploy path now lives. And it is declared blocking inside goatcoin-rs/.github/workflows/ci.yml — committed, but not at the repository root, and GitHub Actions runs only root workflows. The root workflow has no neutrality step, and its one job covering that tree is continue-on-error: true. The auditor is a command a developer or reviewer must run, not an automatic merge gate.

names it the Neutrality Paradox (R-NEUT1). Because naming a device type is forbidden, fairness must be evaluated on abstract telemetry; by Goodhart's Law a well-capitalized adversary can engineer hardware and network topology that maximize the project's exact formulas, approaching the appearance of diverse consumer participation while centralizing rewards. The record accepts this as inherent to neutrality rather than a fixable bug, and its exit criterion is none in the absolute sense. It is managed, never closed, by the standing ARC-01-M1–M4 program: concave per-cluster reward, moving-target verification, a maturity ratchet against identity churn, and a standing red team.

The economic side of fairness is TARGET throughout. The design pays a fraction of the commodity clearing rate (the "thin-pool" coefficient), so buying hardware to farm the pool is intended to be a structural loss while contributing already-sunk idle hardware stays rational. Reward is damped by a concentration factor on a cluster's share of recent work, floored by an assignment share of at least 1%, and constrained by a rule requiring executors to span distinct clusters; co-located identities merge first, so Sybil-splitting cannot fake spread. Every coefficient there is a strawman pending an unfinished calibration study.

7. Security posture

the channel, SHA3-256 for hashing. No classical fallback exists in C1, C2 or C3. Domain separation is a versioned, prefix-free registry rather than a convention, so it survives a primitive swap.

ml-kem 0.3.2, aes-gcm 0.11.0, sha3 0.10.x) and have not been externally audited. The threat model is a request for an audit, not the result of one: no auditor, no findings, no date. "No classical crypto" is not the same claim as "post-quantum crypto is implemented and audited," and the repository says so in those words. The invariant is also silent on side-channel resistance and constant-time execution, neither established, and the deploy path is not a FIPS-certified product.

Three further gaps are stated openly. On the default lab testnet, node signing seeds are publicly derivable from the repository — anyone with the source can forge a node identity, so the mesh may not claim unforgeable identity or impersonation resistance. The beacon's delay seal is a placeholder (iterated SHA3-256), not a verifiable delay function. And the fraud-proof model degrades to permissioned Byzantine agreement at or above two-thirds validator collusion.

The record registers exactly three knowingly-accepted residuals at the V1.0 freeze. R-NEUT1 (§6) is permanent by construction: no exit criterion in the absolute sense, and the Sybil adversary who also buys genuine diversity is bounded in cost but never eliminated. R-NEUT2, off-protocol subsidy undetectable by on-chain analysis, is open and governance-bounded, and its residual, a patron willing to burn capital indefinitely, is acknowledged as irreducible; the record forbids future maintainers from automating an on-chain response to token concentration. R-C4, the placeholder delay function, is the only one of the three with a hard exit gate (§9).

8. Status: what runs today vs what is designed

This table reproduces all sixteen rows of the repository's matrix, in order, using its own status vocabulary: SHIPPED (runs on the deploy path C1 and does what it says), PARTIAL (runs, with a load-bearing caveat), MVP-ONLY (implemented, off the deploy path), DESIGN (spec only; no implementation in any configuration). The matrix defines those four and adds one further value,

Promotion rule, quoted: edit the code, prove it, then edit the matrix, then edit the doc — never the reverse.

9. What we are asking for

The next step is a funded sponsor pilot to close named gaps, not to launch an economy. No sponsor, amount, term or date exists in the record; what follows is the work the repository names as blocking.

1. External cryptographic audit of the integration. Written and staged for a third party; not

commissioned. Its declared scope is the integration — signing contexts, replay discipline, serialization injectivity, key and authorization binding, fraud-proof soundness, integer totality — not the post-quantum algorithms, which are library-provided.

1. The external calibration study. Every economic coefficient is a strawman until one externally

measured quantity lands: the cost of imitating genuine household distributions at scale. This blocks parameter finalization, economic go-live, and the claim that a chosen value achieves the economic goal — not mechanism correctness.

1. Field validation beyond the lab. A 15-node alpha pilot is documented for volunteer operators.

Outstanding is a full cross-network, 1500-MTU field trial — the adversarial results so far are simulation outputs over an in-process transport, not field data.

1. Production execution isolation. The Linux backend (namespaces, seccomp-bpf default-deny,

capability drop, cgroups) and the Windows and macOS backends are designed and unbuilt; changing that status requires verification under hostile payloads on real hardware.

1. Replacing the placeholder delay function with a production audited VDF — the record's hard

gate (R-C4) before any launch carrying real value.

1. A concentration-monitoring dashboard and a written governance-response playbook for

off-protocol subsidy, exercised on testnet — named in the record (R-NEUT2) as a precondition for any network carrying real value.

10. Limitations and kill criteria

crates with no side-channel, constant-time or FIPS claim; publicly derivable default testnet keys; Phase-0 isolation; a neutrality scanner that does not cover the production spine; a placeholder delay function; no content, legal or compliance logic by design, a risk recorded as accepted and participant-borne; and a public-testnet deployment proving wiring, not economics.

own sections, so no test count is cited here. A separate concern is resolved: an older convergence record noted that no CI workflow existed at its date. That is now partly stale and partly still true: two root workflows (ci.yml, contracts.yml) do exist and do run on push and pull request, but the format, clippy, neutrality, test and build gates for the consensus workspace live in goatcoin-rs/.github/workflows/ci.yml, which GitHub does not execute because it is not at the repository root. Those gates are real commands and they pass locally; they are not enforced by the hosted remote.

study shows the thin-pool economics cannot make farming a structural loss at any admissible coefficient; an audit finds a break in the signing-context, serialization or authorization-binding integration that cannot be fixed without abandoning fraud-provability by recomputation; hostile-payload testing shows the worker model cannot contain payloads on real hardware; or a field trial shows the mesh cannot sustain verification across real networks. A narrower criterion already stands: no economic capability may be called live until it runs on the deploy path with a passing test and a live smoke.

How to verify this document

Do not take this document's word for anything. In the repository:

1. Open RUNTIME_VS_SPEC.md first. It is the per-capability shipped-vs-designed matrix and

outranks every other file, including this one: if a document's language exceeds a row's status, the document is wrong. It also lists, per row, the sentences that must never be written about that capability.

1. Read ARCHITECTURE_CONVERGENCE.md for which tree is production and which is an oracle, and

ARCHITECTURE.md for the module graph, the allocating surface and the ingress pipeline.

1. Read GoatCoin_Threat_Model.md for the adversarial vectors and the three accepted residuals

with their exit criteria, GoatHAL_Isolation_Design.md for what Phase-0 isolation proves, and GoatCoin_Yellowpaper.md for the normative mechanism — noting that its economics chapter opens by declaring itself design and not implemented.

1. Build and test from source with cargo, run the local multi-node lab, and read

.github/workflows/ for what the remote actually enforces, and goatcoin-rs/.github/workflows/ci.yml for the format, clippy, neutrality, test and build gates — noting that the second file is not at the repository root and so is not run by GitHub. Run the neutrality auditor yourself with cargo run -p goat-neutrality -- crates/goat-protocol/src crates/goat-ledger/src crates/goat-net/src.

Dual-licensed MIT OR Apache-2.0; vendored third-party code under contracts/lib/ keeps its own licence.