Routing, Inference & Settlement Security Maps

Every routing decision is cryptographically signed by the Coordinator and verifiable offline by the SDK. No routing decision is honored without a valid signature. The trust chain proceeds through five stages: (1) the Gateway verifies the caller's identity token and API key, evaluates the privacy policy claim synchronously, and authorizes the routing class against the subscription tier; (2) the Router Engine assembles the eligible node pool and selects a candidate using reputation, uptime, model cache state, and latency; (3) the decision is signed with a quantum-resistant signature scheme and logged to the append-only audit chain; (4) the SDK verifies the signature against the Coordinator's published public key before dispatching; (5) the task is dispatched through the internal message bus with an envelope encrypted to the destination node's public key.

Attack surface controls. Routing forgery is blocked by signature verification. Loop injection is caught by a circuit breaker on re-dispatch storms. Priority escalation is tier-gated at the Gateway. Traffic monopolization is prevented by exploration in candidate selection. Routing table corruption is caught by TTL expiry and periodic reconciliation. DDoS is mitigated at the edge with per-key rate limiting.

Inference results are protected by a three-layer integrity chain. Layer 1 — Transport: task envelopes and results are encrypted end-to-end between Coordinator and node using keys derived from the TLS channel; tampering causes authentication failure. Layer 2 — Proof-of-Inference attestation: each task carries a deterministic seed bound to the task identity and model. The node runs inference under deterministic decoding conditions and submits a hash of its output. A sample of tasks is re-dispatched to an independent verifier to detect mismatches. Layer 3 — Append-only hash chain: every result hash is chained into an append-only audit log stored for compliance evidence. The chain is append-only — no past entry can be modified — and uses a PQC-compatible leaf format for future upgrade paths.

Attack surface controls. Inference tampering is caught by the encryption auth tag. Replay attacks are blocked because the seed is bound to the task identity. Model spoofing is detected because the model identity is embedded in the seed. Result substitution triggers a hash mismatch and investigation. Fake compute is caught by PoI sampling. Unauthorized execution is blocked at the Gateway by the identity token check.

The Distributed Intelligence Unit (DIU) is compute-backed, non-inflationary, and non-spoofable by design. The issuance trust chain proceeds in three stages.Step 1 — Task completion: the node submits its result hash and token count, signed with its device key. Step 2 — Coordinator verification: the result is verified (or sampled for PoI), latency is checked against the SLO to derive a quality multiplier, and the token count is validated against a model heuristic. If all checks pass, the Billing Meter emits a signed issuance event crediting the node's wallet. Step 3 — Settlement: MeshNativeExchange receives the batch of issuance events, verifies the Coordinator's signature and batch integrity, checks for duplicate requests, and commits wallet credits atomically and irrevocably.

Non-inflation guarantees. No issuance event is created without a matching completed request in the routing log. No node-side issuance API exists — issuance is Coordinator-internal only. Self-dealing tasks (where the requester is also the node) are capped at a reduced quality multiplier. Sybil creation is capped by the Identity Service's limit on node identities per user.

The DIU spend trust chain governs requester wallet debits. Step 1:when a request is accepted at the Gateway, the caller's identity and subscription tier are extracted from the token, and a synchronous spend-cap check ensures the estimated spend fits within the plan limit — if not, the request is rejected immediately with a 402 status. Step 2: after task completion, the Billing Meter computes the actual spend based on output tokens and route tier, and debits the requester's wallet atomically with the metering event write. Every charge is recorded in the audit log with the request identity, organization, and timestamp.

Attack surface controls. Hard-cap bypass is prevented by the synchronous cap check at the Gateway. Self-issuance is impossible because no node-side issuance API exists. Supply inflation is caught by the per-epoch conservation check. Settlement tampering is detected by the signed batch hash chain. Sybil issuance is capped by the Identity Service node-identity limit.

Auditors verify DIU integrity across four dimensions:

• Compute-backed: every issuance event has a matching completed request in the routing log; PoI verification pass rate meets the required threshold; submitted token counts fall within the model heuristic bounds.
• Non-inflationary: per epoch, the sum of node issuance, platform fees, and reserves reconciles against total spend with zero duplicate request IDs and no issuance from unregistered nodes.
• Non-spoofable: all issuance events carry a valid Coordinator-internal signature; no issuance is accepted from non-Coordinator sources; self-dealing tasks are capped at the reduced quality multiplier; no user exceeds the Identity Service node-identity limit.
• Settlement integrity: the batch hash chain is verified, settlement audit records are written for every epoch, and no epoch is committed with conservation drift.