Prism Network

Prism Network

Prism Network is open infrastructure for metered GPU compute. The currentsystem implements account and wallet onboarding, GPU offer discovery, USDGescrow, workload provisioning, time-limited access, metering, settlement andpublic receipt generation.

Prism has two execution paths:

• Independent nodes: Ubuntu 24.04 x86-64 hosts run public OCI images in KataVM-backed containers with exclusive NVIDIA VFIO passthrough. Access usesshort-lived SSH or Jupyter credentials through an outbound-only mTLS tunnel.
• Vast broker: a bonded broker provisions disposable L40S instances andexposes direct SSH. This path relies on provider-reported readiness andevidence; it does not provide Kata/VFIO isolation, the Prism gateway, orJupyter access.

Only interactive raw GPU leases are in scope today. Batch containers andmanaged inference are not implemented.

Current state

Verified on 2026-07-20:

This is an unaudited pre-production system, so do not put production traffic orserious money on it yet.

What a supplier protects is stated per offer rather than as one blanketwarning. Every offer, quote, lease and receipt carries a trust class —open, isolated, attested or confidential — and renters can require aminimum instead of trusting prose:

curl https://api.prismnetwork.tech/v1/offers?min_trust=isolated

The class is derived by the control plane from evidence it can check, neverasserted by a supplier, and it is clamped to what the network can currentlyverify. All capacity live today is open, which means the host operator canread anything the workload touches: keep secrets, regulated data and valuablemodel weights off it. Reaching confidential requires hardware the networkdoes not have yet, not a software change. Seedocs/SECURITY_MODEL.md for what each class does anddoes not promise.

Mainnet contracts

The V1 contracts are non-upgradeable and LeaseEscrowV1 is live. They have notreceived an independent audit. Blockscout reports NodeRegistryV1 as fullysource-verified and LeaseEscrowV1 as partially source-verified. The escrow'sexecutable bytecode matches this tree, while its trailing Solidity metadatahash differs.

You do not have to take that on trust. ./scripts/verify-deployed-bytecode.shrebuilds both contracts and compares them against the code live on chain usingonly the public RPC, masking immutables and reporting the metadata blobseparately:

NodeRegistryV1 0xe3b7…8f01: executable code matches, metadata differs
LeaseEscrowV1  0x71Df…cDeD: executable code matches, metadata differs

Administration, emergency pause and dispute resolution are held by a 2-of-2governance Safe. Network settings and the USDG address should alwaysbe checked against theofficial Robinhood Chain documentationand contract registry.

Architecture

Browser + wallet
       |
       v
Next.js web -----> Rust control plane -----> PostgreSQL
                         |
              +----------+-----------+
              |                      |
              v                      v
      lifecycle worker       settlement/proof workers
              |                      |
       +------+-------+              v
       |              |       Robinhood Chain
       v              v
Vast instance    access gateway
direct SSH       mTLS tunnel/relay
                       |
                       v
               prismd + Kata/VFIO

The repository contains:

• apps/web: Next.js account, marketplace, supplier, operator and proof UI.
• crates: shared Rust protocol and persistence libraries.
• services: Rust control plane, access gateway and operations monitor.
• workers: lifecycle, settlement and proof workers.
• node/prismd: independent-node runtime and workspace supervisor.
• contracts: USDG bond, escrow and administration contracts.
• sdk: headless agent SDK for wallet-signature USDG leasing.
• mcp: Model Context Protocol server exposing leasing to MCP clients.
• x402: pay-per-job GPU execution over HTTP 402.
• deploy/ec2: lean Vast launch topology with the web application on Render.
• deploy/lightsail: full single-host reference topology.
• deploy/node: Ubuntu node service units and configuration.
• infra: an AWS reference architecture, not the active lean deployment.
• docs: design, security boundary, proof format and release documentation.

See architecture, security modeland release gates before operating the system.

Agent access

Autonomous agents integrate without a browser. An agent proves control of itsfunding wallet by signing a short-lived challenge, exchanges it for a bearersession, and drives the same renter surface — offer discovery and the leaselifecycle — over the /api/agent endpoints. Escrow, readiness, metering andsettlement are identical to the browser path, and the agent boundary reachesonly renter routes.

• sdk — @prismnetwork/agent-sdk, headless USDG-funded leasing for Node.
• mcp — @prismnetwork/mcp, the same leasing exposed as Model Context Protocol tools.
• x402 — @prismnetwork/x402, pay-per-job GPU execution over HTTP 402.

All three are published on npm under the @prismnetwork scope. Thedata-classification limits above apply unchanged. An agent workspaceis a disposable environment, not confidential computing.

Verification

The fast pull-request gate checks the web application, production build,secrets and repository isolation:

pnpm install --frozen-lockfile
pnpm check

The full local gate additionally runs the Rust and Solidity suites, audits andsecurity scanners, PostgreSQL and Valkey integrations, Anvil lifecycle tests,mTLS relay tests, load and recovery checks, deployment validation andobservability checks:

pnpm check:full

The full gate passed locally on 2026-07-20 with 23 web tests, 57 Rust tests and18 Foundry tests, including fuzz and invariant coverage. That run usedsimulated/containerized infrastructure; it is not evidence of physicalNVIDIA/Kata/VFIO execution or a funded mainnet lease.

The hosted full gate is manual and has not yet produced a public run:

gh workflow run full-validate.yml --ref <branch>

Required toolchains are Node.js 24.14, pnpm 10.34.5, Rust 1.94.1, Foundry 1.5,Docker with Compose and ripgrep.

Remaining release gates

• Keep the escrow paused until a capped, funded mainnet canary completes fromdeposit through refund or settlement.
• Validate CUDA readiness, Kata isolation, VFIO assignment, egress controls andteardown on physical NVIDIA hardware.
• Complete live KMS signing and failure-recovery evidence for lifecycle andsettlement workers.
• Exercise real Privy signup, external and embedded wallets, SSH access andJupyter access against the release deployment.
• Publish the first confirmed proof receipt and test the independent daily Xdigest outbox.
• Run applied-host backup/restore, load, failover and incident-response drills.
• Obtain independent smart-contract and infrastructure security review beforeraising contract caps.

Copy only the example environment files needed for your target. Never commitenvironment files, credentials, deployment outputs or generated artifacts.

Contributing

Read CONTRIBUTING.md, theCode of Conduct and governance beforeopening a change. Security reports must follow SECURITY.md andmust not be filed as public issues.

License

Code is licensed under the Apache License 2.0. The Prism Networkname and visual identity are governed separately by TRADEMARKS.md.