Mesh-LLM: accountability for strangers' machines

Mesh-LLM turns a network of ordinary machines — mostly strangers' computers, joined into meshes by their communities — into a shared inference substrate. A requester sends a prompt; a provider serves it on its own hardware; a coordinator routes requests and, for larger models, splits one run across several nodes. No central operator runs the mesh, and by design no one keeps a central ledger or ranks the nodes.

The gap

Everything a node says about itself is a claim: “I ran this model, at this precision, on this hardware.” The requester gets a response and a log line. Nothing binds the response to the node, the node to the model, or the model to the hardware — so a dispute is one party's logs against the other's. The decentralized posture rules out the usual fix: no platform keeps the ledger, no operator computes a rating, and the mesh is designed not to have one.

Each party needs something different from a record: the requester wants to know they got the model and hardware they were routed to, and that the response they're holding is the one the node actually signed. The provider wants proof it served honestly. The coordinator wants to know a node served what it advertised.

Why a record layer fits a system with no central authority

Five properties, chosen so that no party has to be trusted and no party becomes the authority — each stated with the limit that applies today, not rounded up:

1. Sealed locally, at the moment of serving. Every served exchange becomes a signed, content-addressed capsule in the node's own append-only log, made contemporaneously and committing to the request and response by digest. The log is complete over what was sealed — completeness against reality is a reconciliation property between counterparties who each keep records, not a property of any one log alone.
2. Non-repudiation that cuts both ways. The receipt a requester uses to check a provider is also the provider's own defence. When a requester signs a commitment to its request and the provider's half cites it, attribution follows the author, and a verifier derives the trust level from the record's bytes — the producer never gets to assert it for itself.
3. Completeness of a history without a central log. Each node's log is a Merkle accumulator; small checkpoints are published on a schedule and registered with a Transparency Service the node does not run, which returns a Receipt. Today there is one such service, and we operate it — the design requires that any Transparency Service be addressable and forbids hardcoding ours, and a second independent operator would matter more than any statement of neutrality.
4. Properties, never a ranking. The record layer defines no ranking, and no party gossips one. What it yields are properties — whether a node served what it advertised, in three honestly-labeled states, with corroborated/contradicted/inconclusive outcomes where disputes are checked. Any relying party computes its own policy over these numbers and brings its own resistance to fake identities — the record layer does not supply either.
5. Checkable on demand. A peer can ask a node for evidence — its full history, a range, or one specific exchange — and the node answers from its own log with either an artifact or a labeled refusal. Nothing is inferred on a node's behalf.

Two rules hold all five together: absent is recorded as absent (a field the serving path doesn't surface is marked unknown, never fabricated), and the measurement ladder is labeled, never rounded up — a software-reported hardware claim is never presented as a hardware-signed one.

Settling disagreements without a platform or a ranking

Records settle who said what. They cannot, by themselves, settle a disagreement about content between two honest-looking signed halves. One proposal explored here uses a property most actions lack: inference at a fixed seed is replayable. For a sampled fraction of requests, the same deterministic request could go to two providers under different keys; if their outputs agree, nothing more is needed. If they disagree, a third node holding the same model weights re-runs the shared prefix once and the divergence point settles which output was more likely, with the margin published so anyone can recompute the verdict.

The honest limits, stated before anyone else finds them: replay only agrees exactly within one hardware family, so cross-hardware disagreement is expected and is treated as inconclusive, not as a verdict; a disagreement is always a trigger for a check, never itself a verdict; and the check is blind to the cheapest form of cheating — serving a smaller model than advertised — because that failure mode looks the same as ordinary near-tie noise. This mechanism resists casual and accidental disputes; it does not defeat someone determined to run multiple identities.

What this demonstrates today

A stranger's node can produce a contemporaneous, content-addressed, witnessed record of what it served — and any requester can verify that record offline, from the bytes, without trusting the node or any platform. Settling disagreements about the content of two honest-looking records by replaying inference, without a platform or a ranking, is a proposal with real open engineering questions still ahead of it — not a shipped guarantee.