Docs · Protocol summary
How AndroNode is meant to work
Short, plain-language summaries of all 23 sections of the protocol design.
Release status
| Website labs | Simulation | Every lab panel uses bundled examples, never real tasks or money. |
|---|---|---|
| Testnet app | Live on testnet | Real tasks, verification and settlement on Robinhood Chain Testnet with tUSDC test tokens that have no value. |
| Escrow contract | Deployed on testnet | Not audited. Mainnet needs an independent audit first. |
| Settlement admin | Single testnet key | The protocol design calls for 2-of-3 administrator keys before any paid release. |
| Review window | 10 minutes on testnet | Shortened for testing. The proposed paid-release window is 48 hours. |
| Result verifier | Fixture checks | Testnet checks results against fixtures. The full ONNX recomputation verifier is not running yet. |
| Android app | Coming soon | In development. No download exists yet; ignore anyone offering one. |
| Paid service | Not live | No real-money deposits or payouts are accepted. |
§1 Protocol scope
Asynchronous batch inference on compatible Android hardware. Each device runs one complete small task on its own.
- First product: batch text embeddings for public or approved non-sensitive text.
- Not pooled memory, not split models, not training, not real-time chat.
- Pays only for accepted outputs. Uptime, installs, taps or tokens earn nothing.
- Coordinator-managed: customers and contributors trust the operator; receipts and on-chain balances make parts auditable.
§2 Participants and responsibilities
Customers fund work, contributors run it, a coordinator schedules, a verifier checks, and 2-of-3 administrators approve settlement.
- One account may control several devices; device and account reputation are separate.
- A TV box earns nothing extra for being always plugged in.
- Pilot verifier and coordinator may share an operator: operational separation, not independent governance.
§3 Supported devices and admission
Proposed baseline: Android 11+, 64-bit ARM, 4 GB installed RAM, 1.5 GB available memory and 1 GB free storage.
- Only tested model and OS combinations are paid. Meeting specs is not approval.
- Admission: 1,000 calibration records, a 30-minute supervised thermal test, stop, disconnect and restart tests.
- Identity is the device public key, not an IMEI or advertising ID.
- Phones and tablets first; TV boxes and other hardware in separate cohorts.
§4 Workload catalog
Short English text embedding with a fixed encoder. Candidate model: all-MiniLM-L6-v2 (384 dimensions), ONNX Runtime Android CPU FP32.
- Max 256 tokens per record; up to 64 records and 256 KiB per task.
- Long text is rejected unless the customer picks a documented split policy. No silent truncation.
- No customer code, custom operators or arbitrary model uploads.
- Classification, OCR and audio come later, each with its own rules.
§5 Android application and execution
Explicit Start Session with a visible screen. Default 30 minutes, adjustable up to two hours.
- External power required; battery ≥ 80% to start, pause below 70%.
- Unmetered network, one task, at most two CPU threads, 1 GiB/day data, 512 MiB model cache.
- Reduce load at moderate heat; pause at severe; wait 5 stable minutes before resuming.
- Target: stop heavy work within 5 seconds of Stop. No silent restarts. Shows Waiting for work, never invented jobs.
§6 System architecture
Client, coordinator API, authoritative database, object store, and isolated verification workers.
- Transactions for leases and completion; an outbox publishes events after commit.
- Handlers tolerate duplicate messages; unique IDs enforce exactly-once money effects.
- Tasks contain data and fixed parameters, never commands or customer URLs.
- AI work stays off-chain. Only deposits, settlements, refunds and withdrawals are on-chain.
§7 Model registry and runtime profiles
A profile ID binds model digest, tokenizer, pooling, runtime, backend, precision, schema, limits and validation policy.
- Changing any part creates a new profile ID.
- Signed release manifest; the app checks signatures and SHA-256 digests before loading.
- An unavailable accelerator never silently changes a job's model or precision.
- Revocation stops new leases immediately.
§8 Job lifecycle and scheduling
Orders are split into tasks; each attempt has its own lease of at most 120 seconds.
- A lease is issued only if estimated time plus a 30-second upload margin fits.
- Payable only if the full submission arrives before lease expiry and passes verification.
- Verifier backlog never invalidates an on-time submission.
- At most three automatic attempts. Cancellation stops new leases; already-leased work stays payable.
§9 Result verification
Every output is recomputed by a trusted verifier. Candidate FP32 thresholds: cosine ≥ 0.9999, max error ≤ 0.001, norm 0.999–1.001.
- All checks must pass: IDs, count, dimensions, finite values, digests, normalisation.
- Reason codes: INVALID_SIGNATURE, WRONG_PROFILE, SCHEMA_ERROR, NONFINITE_OUTPUT, NUMERIC_MISMATCH, LEASE_EXPIRED.
- Contributors may appeal within 7 days; customers dispute within 48 hours.
- Sampled checks are research only. A receipt or transaction is not proof of AI execution.
§10 Contributor identity and abuse prevention
Each device has its own signing key, separate from the withdrawal wallet.
- Signed results bind job, task, lease, profile, input and output digests and deadline.
- Probation: $1 provisional cap per new device until 100 accepted tasks and 7 clean days; $10 per account.
- Shared IPs are not automatically fraud. Reputation affects allocation, never pay per unit.
- No signup bonuses or referral payments.
§11 Customer data and privacy
A device owner can see the data their device processes. Only public, synthetic, licensed or cleared non-sensitive data is accepted.
- Excluded: personal records, credentials, private conversations, regulated or biometric data, confidential models.
- Signed task URLs expire after 10 minutes and are scoped to one task.
- Retention: 7 days for inputs and results, 30 days for dispute evidence, 90 days for minimised telemetry.
- Receipts use opaque IDs and salted hashes. Deletion on a contributor's device cannot be guaranteed.
§12 Pricing and contributor payments
Customers pay per 1,000 accepted records. 75% goes to contributors and 25% to the service pool.
- Per-record charges must divide by 4, so there is no rounding dust.
- Quotes expire after 15 minutes. Unfunded orders are not scheduled.
- Illustrative only: $0.20 per 1,000 records; 1,000 accepted records earn a device $0.15 gross.
- No fixed daily return, guaranteed utilisation or payback period.
§13 Settlement and customer funds
USDC escrow on one low-fee EVM chain. fundOrder, settleChunk, closeOrder, refundRemainder and withdraw.
- Execution deadline ≤ 7 days, hard close 14 days, settlement target day 11.
- 2-of-3 administrators sign chunks of at most 100 recipients; contract enforces 75/25 and funding limits.
- Pull withdrawals. After hard close, customers recover unallocated funds without anyone's signature.
- Pilot caps: 500 units escrow, 50 units unsettled exposure, 100-unit operator reserve. Contracts are non-upgradeable.
§14 Native token policy
No AndroNode token is required. Payments are customer-funded stablecoins.
- Pilot test points are non-transferable with no promised value or airdrop.
- Any future token needs a separate approved specification.
- A token may never unlock ordinary earnings or sell reward multipliers.
§15 Product interfaces and developer API
Contributor app with clear status labels; asynchronous batch API for customers.
- Statuses: Not compatible, Ready, Waiting for work, Working, Paused by owner, Paused for temperature, Verifying, Provisional reward, Claimable, Withdrawn.
- No contacts, location, photos, microphone or camera permissions.
- Endpoints: /v1/profiles, /v1/quotes, /v1/orders, /v1/devices/register, /v1/leases/acquire, /v1/leases/{id}/result, /v1/rewards.
- Signed webhooks with event IDs; idempotency keys on writes.
§16 Security and operational recovery
The threat model covers malicious contributors, hostile inputs, replay, dishonest administrators, supply chain and outages.
- Isolated verifier workers with no unnecessary network access.
- On coordinator failure devices stop taking work; state rebuilds from the database without double acceptance.
- Verifier backlog keeps timely submissions in Verifying; target to clear within 24 hours.
- Pilot targets: 5-minute recovery point, 4-hour service recovery.
§17 Distribution and operating requirements
AndroNode runs customer-funded inference, not mining, but Play approval is not assumed.
- Engineering pilot may use a signed APK with published checksums and controlled enrolment.
- Paid launch needs a legal entity, terms, privacy policy and reviewed jurisdictions.
- No minors in paid participation; owners must own or administer the hardware.
- Android and Google names describe compatibility only.
§18 Pilot and commercial launch plan
Evidence gates instead of dates: prototype, closed pilot, limited paid beta, then expansion.
- Prototype: 20 supervised devices, five models, synthetic data, testnet settlement.
- Closed pilot: ~100 devices, 1 million checked records, 99.9% honest pass rate, p95 stop ≤ 5 s.
- Paid beta: audited contract, three independent paying customers, pilot caps applied.
- Expansion needs four weeks of positive contribution margin without grants or tokens.
§19 Governance and protocol changes
The operator runs scheduling, approvals and disputes. 2-of-3 administrators control settlement.
- Routine changes published at least 7 days before applying to new orders.
- Existing quotes and accepted leases keep their terms.
- Monthly public figures on volume, rejections, verification cost, payments and incidents.
§20 Risks and limits
There may be little paid work, and centralised compute may be cheaper once verification is counted.
- Rewards can be smaller than electricity, wear and connectivity costs. Do not buy hardware for projected earnings.
- Sustained inference uses energy, produces heat and may wear batteries.
- Contributors can retain inputs. Not for confidential, safety-critical or real-time work.
- Administrator compromise, bugs, contract errors, stablecoin issues, chain outages and policy changes can delay or destroy value.
§21 Release specification
Eight evidence-backed items define the first paid release.
- One approved profile with public fixtures; an ARM64 client with owner controls.
- Transactional coordinator; full recomputation with appeals and disputes.
- Non-sensitive data policy; double-entry ledger and audited escrow.
- Customer API, dashboards, receipts; distribution approval, reserves and passed economic gates.
§22 Reference job and operating scenarios
10,000 records at $0.20 per 1,000: maximum 2.000000, contributors 1.500000, service 0.500000.
- 156 tasks of 64 records plus one of 16. A 64-record task pays the contributor 0.009600.
- If 9,000 are accepted: charge 1.800000, contributors 1.350000, service 0.450000, refund 0.200000.
- Lost Wi-Fi: retry within the same lease. Lost acknowledgement: same receipt, no double pay.
- Stopping or protecting temperature is never penalised financially.
§23 Technical sources
Platform references checked on 2 November 2026: model card, ONNX Runtime Mobile, LiteRT, Android background limits, Thermal API, Keystore, Play Integrity and Play blockchain policy.
- They support platform capabilities, not unbuilt AndroNode performance or commercial targets.
FAQ
Is it live?
Only as a public testnet. The labs on this site are simulations. The testnet app runs real tasks and settlement on Robinhood Chain Testnet with tUSDC test tokens that have no value. There is no paid service, mainnet or real-money payout yet.
Can I download the app or earn money today?
No. The Android app is coming soon and no download exists yet. You can try the browser test node in the testnet app, which earns test tokens only.
What work is supported?
One workload: batch embeddings of short, approved, non-sensitive English text, up to 64 records of at most 256 tokens per task. Classification, OCR and audio come later, each with its own rules.
How are payments earned?
Only for accepted results from customer-funded work. Each accepted record pays a fixed amount set when the task is leased: 75% to the contributor, 25% to the service pool. Uptime, installs and tokens earn nothing.
Can I stop at any time?
Yes. Stop ends new tasks at once and cancels the running one; the target is under five seconds in the app. You are never penalised for stopping or for a heat pause, but unfinished work earns nothing.
Does my phone earn for being plugged in overnight?
No. Only accepted outputs from paid work earn. The first release uses explicit, visible sessions; automatic overnight sessions are a later feature that needs separate approval.
Is there an AndroNode token or contract address?
There is no required token. If a contract address is ever published it will appear in the header. Until then it reads "CA: Not announced"; be careful with anyone claiming otherwise.
Can the device owner see my data?
Yes. A device must read its assigned inputs. That is why only public, synthetic, licensed or cleared non-sensitive data is accepted.
How is a result checked?
A trusted verifier recomputes every vector with the same profile and compares cosine similarity, maximum error and norm against published tolerances.
Who decides disputes?
The operator, in the first release. This is managed administration, not trustless arbitration.
What happens to my money if the operator disappears?
Customers can recover unallocated escrow after the hard close without anyone's signature. Contributors can withdraw already-credited balances. Provisional, uncredited rewards still depend on the operator.
Which devices are supported?
None are approved yet. The proposed baseline is Android 11+, 64-bit ARM, 4 GB RAM, 1.5 GB available memory and 1 GB free storage, plus passing qualification tests.
No section matches. Try another word, or .