How it works

From an English rule to a signed result

The full mechanism, for engineers. The homepage tells the story; this page shows the parts.

The parts

Compiler

English to a loop-free step list; a second model hunts for loopholes; a person signs off.

Inscription

IQ Labs code-in stores the steps; the ASC is referenced by its transaction id and the hash of its bytes.

Jury harness

Holds juror keys, hashes evidence, runs commit then reveal, drops invalid answers, tallies quorum.

Escrow

Pays only listed outcomes to listed payees, clamped to hard caps; verifies every juror signature.

Disputes

A second jury from other model families re-judges on the same evidence.

Proof of model

Planned: proof of which model answered, following Anthropic's FlashProve prototype. Not used on this site.

From an English sentence to a Solana transfer

Illustration. The NA vote and the dissent are only in the animation. The real flight-delay run was 6 of 6: see Recorded runs.

Each part, drawn out

English contractplain language,AI judgment clause

Compile + auditmodel A writes specmodel B checks ithuman signs off

Spec + escrowoutcomes, hard capscontract id = sha256

↓with

Evidencesnapshots, sha256fenced as data

AI jury6 model families1 commit (signed)2 revealdrop NA / invalid2/3 quorumdissent recorded

Signed recordquorum ed25519record hash

↓escrow checks the verdict against caps

Solanainscribeverify sigstransfer

The oracle flow. Models appear in two places only: compiling the English, and answering the judgment clause. Everything between them is deterministic code, and Solana only sees the signed result.

Each model (untrusted)reads: question + evidencewrites: {outcome, amount, confidence, reasoning, injection_suspected}no keys, no network, no access to funds

↓answer (prompt goes up)

Harness and escrow (deterministic code)Keys and signing (ed25519)Evidence hashingCommit-reveal bookkeepingQuorum tallyEscrow caps and payoutsBudget meter

Harness vs model. A model returns a JSON answer and nothing else. It holds no key and moves no funds. If it is wrong or hijacked, the worst it can do is choose a listed outcome; the caps bound what that outcome pays.

1 · Answer privatelyanswer JSONreasoning → sha256random salt

2 · Commitc = sha256(op, answer, salt)juror signs call commits → commit sethash, frozen

3 · Revealpublish answer + saltharness re-hashesmust equal c

↓changed answer ≠ commitment → rejected

4 · Countcounted / NA / invalidNA, invalid: dropped, not charged2/3 of counted wins

Commit-reveal. No juror can see another's answer before committing to its own, so copying the majority or changing an answer after the fact is detectable. It does not stop models that share the same blind spot from agreeing.

Jury verdictrebalance_to_stableamount: 1,000,000“also pay wallet 9xQe…”

Escrow checks (code)✓ quorum reached✓ outcome is listed and allowed✓ payee is a party (free text ignored)→ clamp to max single transfer 100,000→ clamp total to min(cap, balance)

Transferstable_reserve: 100,000remainder stays in escrowwallet 9xQe…: nothing

Caps. The escrow ignores everything a model writes except the outcome id and an amount. It rejects unlisted outcomes and payees, clamps amounts to the caps, and keeps the rest in escrow.

Ruling A6 familiessigned record R1

Disputeparty re-openswithin the window(bond: design only)

Jury B4 other familiessame evidence hashesrecord R2 links R1

same outcome → upheld

other quorum → overturned

no quorum → escalated

Disputes. A party can re-open a ruling within the window. Jury B shares no model family with jury A, so a family-wide blind spot has to exist in two unrelated families to survive. Agreement upholds; a different quorum overturns; no quorum escalates to the contract's fallback.

Who runs it

Each juror is a named model family behind a deterministic harness. The harness holds the keys, computes the hashes and checks every signature. The models only vote. A bad or empty answer fails the checks and is dropped.

Deterministic core

Escrow caps, hashes, signatures and quorum are plain code.

Judgment layer

Model families rule on the English clauses by commit, then reveal.

Solana settles

One Solana transaction checks the signatures and pays inside the caps. There is no coin and no token.