Generated — do not edit. Source: /Users/returniflost/abstract/terp-core/crates/private-inference-rent/product-docs/vocs/for-engineers.mdx. Change the crate/repo, then rebuild this site.

For engineers

This page names what the library already implements. State first, then the type. Crosslink 08-wasm is a different client. Pay inclusion is ZAP1 plus IBC v2 packet bind, verified on-chain with Halo2.

re-zerve lives in the private-inference-rent crate. A deployer (Akash also says tenant, once) creates a deployment / order; a provider answers with a bid; a lease is the agreement. You run the same store / attest / credit / spend sequence locally that you expect on a public network. There is no public re-zerve network.

The provider stays on the public Akash marketplace when PIR env is unset. The private path is a dedicated side-market in the same provider-services binary, fail-closed when required.

Lab vs public network

If the chain or proof host is required and missing, the path stops. Dependencies names the four surfaces on a lease.

Market shape

The deployer posts a public order (the public ask). The provider sends an encrypted bid envelope off-chain. The chain (or cw-pir-commit) records commitments only — no price, no identity, no ciphertext.

Shipped

• PublicAsk / ResourceAsk — SDL + resources. ask_commitment() is domain-separated and includes tenant_label.
• PlaintextBid stays off chain.
• EncryptedBidEnvelope::seal — ChaCha20-Poly1305; nonce generated in seal; AAD over ask_id + nonce. Tamper is an auth fail.
• BidCommitment — what the public record may hold.
• OnChainView / CommitmentModule — post_commitment stores ask and bid commitments. The chain payload must not contain price or identity.

Pay inclusion

Product credit binds a ZAP1 HOSTING_PAYMENT leaf. Off-chain prove; on-chain Halo2 proof_instance_verify(zkid, proof, instances) with a pinned verifying key (Pasta, k=17, four public instances). Merkle siblings are not in the CosmWasm execute. A missing host fails closed.

Product ingest

1. Zap1Ibcv2Bundle — group, note, amount, event kind (HostingPayment | ProgramEntry | OwnershipAttest), leaf, root, optional tip reference (hex recorded, not opened), IBC v2 packet fields.
2. zap1-verify 0.2.1 — BLAKE2b leaf and node hashes. Used to build the witness; the chain does not re-walk siblings on execute.
3. IbcV2PacketAttest — source/dest client, sequence ≠ 0, app_data_hash over note, amount, FROST group, and leaf.
4. Packet commitment is a local tagged hash. It is not a light client.
5. SpendAuth::from_quorum — group, note, amount, optional bid commitment, layered quorum. A quorum of labels that does not bind note/amount is rejected.
6. FrostThresholdPool::credit_deposit_zap1. If the pool is bound to FROST, the signature must verify over the spend message.
7. FROST DKG among deployer, provider, and resolver (frost-ed25519 part1/part2/part3). Dealer-generated packages are not product custody.

Sim only

• DepositAttestation::prove_for_test and transcript credit. Not Ironwood inclusion. Not a Zcash state root.

Not pay inclusion

• Crosslink headers / Crosslink 08-wasm. Crosslink is not ZAP1.
• Full ICS-08 nine-entrypoint host as the live Terp client.
• Opening a shielded memo.

Escrow and notes

cw-pir-escrow records open, accrue, close, and a grant. It must not move value with BankMsg. Accrued amount is f(open_height, close_height, rate) from Zakura heights, not a closer-supplied integer. No viewing key on escrow.

Shielded value is Ironwood pool notes on Zakura (NU6.3 v6). Spends are two intents: earned to the provider, remainder to the deployer, signed by the DKG threshold. ZIP-312 RedPallas is not in Zakura; the named stand-in is frost-spend-v1 plus ZIP-32 of the reconstructed DKG group seed.

Lease access

After accept, only the winner derived access bearer opens the lease. A foreign bearer and any call after close are denied. This bearer is the side-market lease credential, not the public ES256K JWT.

Shipped

• DerivedAccess::from_session(ask_id, oob_aead_key, bid_commitment) — 32-byte secret + bearer_hex(). The argument is the out-of-band ChaCha20-Poly1305 key.
• LeaseBook::accept_bid / access / close.
• Local settlement: WorkReceipt + SettlementBook (not an Akash lease object).

Provider gate

The provider takes an encrypted bid, allocates only after the commitment is recorded, and checks a derived access bearer at the gateway.

Fork (akash-provider-pir), available in the local lab

• Gateway AcceptBearer matches DerivedAccess.
• AuthProcess tries the hex bearer before public JWT.
• Bid engine: allocate only after commitment.
• Same binary: PIR env unset → public marketplace; private gate on → fail-closed without commitment.

Public network today: the stock Akash provider image. The fork is not the live process until that image is swapped. Not a public mainnet. Not a k8s fleet.

Contracts you should call (not reimplement)