What is Thirty Spokes?

Thirty Spokes is a decentralized model router on Bittensor — Subnet 99. Every model is a spoke; the hub holds nothing. Miners compete to build the routing agent that extracts the most benchmark quality per dollar out of a pinned pool of frontier models — and they have to prove it. Each agent runs the owner's benchmark suite inside the miner's own confidential VM, and publishes a hardware-attested proof cryptographically bound to its public source and weights. Validators run no inference at all: they check one hardware signature and grade the answers against public gold. The best five hold the reign. The dishonest are caught by construction, not by trust.

Preview. Thirty Spokes is registered on Bittensor as Subnet 99. The user-facing gateway (api.thirtyspokes.ai) is not built yet, and secure enforce-mode mining still needs the measured image (see Status). What is implemented and verified on real Intel TDX hardware is the competition mechanism and its attestation stack.

The inversion

Every other benchmark-scored subnet runs evaluation on infrastructure you have to trust — the validator's, or the subnet owner's. Thirty Spokes moves benchmark execution into the miner's own TEE and keeps it trustworthy with hardware attestation plus a public, cryptographically bound artifact.

Two consequences fall out of that:

• Validators do zero inference for scoring. They verify a proof and grade attested answers. Scoring cost is flat in the number of miners.
• Static, public benchmarks become safe. Because the artifact (source and weights) is public and bound to what actually ran, cheating is publicly detectable rather than something we must prevent by hiding data.

What the Proof Guarantees

One hardware signature over {measurement, report_data} asserts both "this approved enclave ran" and "it produced exactly this payload." Mutate any field and report_data() changes, breaking the quote.

Attestation: verified on real hardware

The full stack is implemented and was verified end-to-end on a GCP C3 (real Intel TDX): a genuine TDX v4 quote pulled through the kernel configfs TSM interface, complete DCAP verification (chain → pinned Intel root, TCB status, CRL, QE identity), RTMR3 runtime self-measurement, no-egress confinement, and on-chain measurement governance. Live TCB status on that host: UpToDate.

Honest caveat. The measurement gate only discriminates once the reproducible, locked-down runtime image is built. Against a stock cloud CVM — whose MRTD is identical for every TDX guest on that provider — enforcement will admit any TDX guest. Building that measured image is the remaining ops step before secure enforce-mode mining, not an optional polish item.

Architecture

The pool is an owner-pinned allow-list. An agent that calls a model outside it raises UnpinnedModelError and the run fails — there is no smuggling in a stronger external model.

The Epoch

One epoch = 100 blocks × 12 s ≈ 20 minutes. Miner and validator never talk to each other, so both derive the epoch and the task slice from on-chain state alone:

epoch = current_block // 100
nonce = sha256("koth-epoch|{epoch}|{beacon}")[:16]     # beacon = block hash at epoch start
seed  = sha256("{nonce}|{epoch}|{benchmark}")[:8]      # -> the exact tasks

sequenceDiagram
    participant C as Chain
    participant M as Miner (own TEE)
    participant R as Miner repo
    participant V as Validator

    M->>C: commit  koth1|repo|rev|salted-hash
    Note over C: reveal delay defeats front-running

    loop Every epoch (~20 min)
        C-->>M: beacon (epoch-start block hash)
        C-->>V: beacon (same)
        M->>M: run the slice in-enclave, meter every pool call
        M->>R: upload proof + trace
        V->>R: download bundle + proof
        V->>V: verify quote, bind artifact, grade vs public gold
        V->>V: grounding check, dedup, dethrone guard
        V->>C: set_weights()
    end

At n_per_bench = 8, the full four-benchmark suite grades 32 tasks per miner (the live loader currently wires two — math + mmlu — so a live epoch grades 16). Every miner in the epoch runs the same slice, so scores are directly comparable.

Scoring

The reign ranks on a single bounded scalar, the cost-budgeted quality Q_lcb:

Q_lcb = Σ_b  w_b · lcb_b            # bounded [0,1]
lcb_b = bootstrap lower confidence bound on benchmark b's accuracy
        (alpha = 0.05, 1000 resamples)

Using the lower bound, not the point accuracy, is deliberate: a lucky run cannot dethrone a king.

The live loader currently wires math + mmlu at 0.5 / 0.5 (so a live epoch grades 16 tasks). GPQA is gated behind a HuggingFace token and SWE needs the Docker patch-apply loop; both are implemented behind the same interface. The four-weight suite above is what the offline sim and dev kit run.

Eligibility

A miner earns nothing this epoch unless all of these hold. Ineligible miners are excluded from the reign — they are not simply scored zero.

Cost is a ceiling, not a divisor. Being cheaper buys you nothing once you are under the budget — above the quality bar, better still wins. And you must actually orchestrate the pool: answering "for free" out of your own weights is disqualified.

Taking slot 1 — the dethrone guard

Beating the king on Q_lcb is not enough. A challenger must clear a Pareto-with-tolerance guard, or it is clamped strictly below the king:

You cannot dethrone by trading a regression for a spike.

The Reign

Up to 5 slots — the king plus the last 4 ex-kings still registered — share emissions equally (20% each when full; fewer paid slots means a bigger share each, e.g. the king alone earns 100%). The reward for climbing is entering the chain at all — the only door in is taking the crown — so the gradient lives at the coronation, not in the slot weights: a dethroned king keeps earning while it decays out of the chain instead of dropping straight to zero.

• Incumbency margin. Only the king's slot is contested: a challenger must beat the king by ε, which decays with the king's artifact age — so a stale king gets easier to unseat, and a fresh one is protected from noise:

  eps(age) = 0.002 + (0.02 - 0.002) * exp(-age / 8)
  

• Tiebreak. Exact ties for the crown go to the earliest commit block. Copying late never pays.
• Burn. Weight burns to uid 0 only if nobody in the chain is still registered — a deregistered ex-king's share is just re-split among the rest, not burned.

Disqualifications

Everything you submit is public and bound to what actually ran, so the failure modes are enumerable. This is the full set a validator can emit:

Drop-in API

Not live. This is the intended interface. The gateway is design-stage.

from openai import OpenAI

client = OpenAI(
    base_url="https://api.thirtyspokes.ai/v1",   # one line changed
    api_key=THIRTY_SPOKES_KEY,
)

r = client.chat.completions.create(
    model="auto",                                 # the wheel picks the spoke
    messages=[{"role": "user", "content": "..."}],
)

Your SDK, one line changed. We hold no model and do no inference, so we can connect everything.

Status

Quick Links

• Mine the Subnet — build a router, test it locally, commit on-chain
• Confidential VM Setup — get a TDX box and run the attested miner
• The KOTH Protocol — proof format, binding, grading, the full mechanism
• Attestation & Trust Model — DCAP, measured image, residual trust
• Bittensor Integration — epochs, reign, weights, commit-reveal