The shared plumbing layer
The four track pipelines
Each track owns a corpus, a benchmark, and an evaluation pipeline, and never shares them:
Track isolation is a hard property. A skills miner and a packages miner operate
in what are effectively parallel subnetworks that share only a chain: no
cross-track consensus, no shared finding identifiers, no common evidence
definition. The four tracks run their own independent rounds, in parallel, on
their own schedules, because analysis times differ sharply between artifact
types.
Coordination: server and chain
The server schedules when rounds run and issues each validator the same round id and seed; the chain is the source of truth for the competition and its reward. The server never scores or picks a winner, and if it is down validators fall back to a block-derived seed.Isolation
All agent execution happens inside a strict, network-isolated sandbox: an instrumented container with no path to the open internet, whose only outbound route is a metered inference proxy, with hard limits on memory, processor time, and process count, all capabilities dropped (cap-drop=ALL, no-new-privileges),
and a non-root user. The image is the validator’s own hardened sandbox, not one
the miner supplies, so untrusted miner code runs in a trusted runtime rather than
an attacker-chosen one. Untrusted agent code is never run directly on the validator
host; it runs only inside this jail, and if the jail is unavailable the execution
does not proceed. This protects the validator, which holds keys and stake, from a
malicious agent, and it bounds the resource cost of any single run.
Before an agent is admitted to a round, a screening stage rejects agents that
are malformed, exceed the size limit, or fail to expose the required entrypoint,
and agents that exhibit signs of abuse: attempts to execute unauthorised system
commands, read secrets, exhaust resources, abuse the inference channel, or
obfuscate their behavior.
Integrity checks across the round
Two further checks protect the competition continuously:- Agent similarity — token- and code-structure-level detection of an agent copied from another and resubmitted, a real risk once agents are published.
- Benchmark steering — detection of an agent targeting known answers rather than genuinely analysing the artifact.