Permissionless cloud and zero-trust applications

Evidence level: mixed. The forwarding plane, hop GB metering, mailbox ciphertext store, and fragment APIs are live. Storage, WASM / container, and GPU work that a given node actually offers is deployment-specific. Decentralized AI is an application composition, not a shipped L0 product.

Layer Minus is a permissionless, decentralized cloud. Anyone may use it. Anyone may join by offering resources. Developers build privacy-first applications on top of it. They must assume that any one node can be malicious.

What the cloud is

Layer Minus is not a licensed SaaS and not a single operator’s data center. It is a shared infrastructure of independent CoNET-SI nodes on the public Internet. Participants contribute one or more of:

The reward asset for DePIN service is GB (GBToken on CoNET L1). Forwarding is the live, byte-metered path. Storage and compute settlement follow the same rule: pay for useful ciphertext work, never for reading user plaintext.

Use of the plane is permissionless. A developer does not apply to CoNET to send Chat, store fragments, or schedule a job. A user does not need an account issued by a node operator.

The public Guardian roster is a discovery set, not a license. GuardianNodesInfoV6.getAllNodes is what current clients use to find domains and route keys. Adding a row with addNode today requires adminList. That is an L1 admission fact for the listed set. It does not make Layer Minus a permissioned application platform, and it does not make a listed node trusted. See Guardian nodes and Participate in mining.

Zero trust: any node may be malicious

Treat every Layer Minus node as an untrusted host:

• it may drop, delay, or replay traffic;
• it may log client IPs, sizes, and times;
• it may lie about storage or compute results;
• it may collude with other nodes.

L0 therefore must not require any node to see business plaintext. A/B/C roles, user-PGP encryption, and hop-sig metering are the live forwarding expression of that rule. They are not a promise that a node is honest.

Do not trust a node with
  ├─ message text, files, or model inputs in the clear
  ├─ a reconstructable whole object
  ├─ the only copy of a secret
  └─ an unverified compute result

Trust only
  ├─ keys the client holds
  ├─ ciphertext the client can re-encrypt or re-split
  └─ results the client can verify or recompute

Collusion of A+B or C+B still binds a wallet to an IP. Distinct Guardian addresses are not an operator-domain proof. See security limits.

How developers compose a privacy-first application

A privacy-first app is not “pick one honest node.” It is a combination of techniques so that a single malicious node cannot read, reconstruct, or silently rewrite the user’s work.

Privacy-first application
  ├─ privacy routing     (A ≠ B, C ≠ B, optional outer wrap, optional routing wallet)
  ├─ fragmentation       (no single node has the whole object)
  └─ other client crypto (encrypt, sign, verify)
        │
        ▼
Layer Minus nodes  (forward / store / compute — all untrusted)
        │
        ▼
Privacy-first surfaces
  communications · storage · compute · decentralized AI

Application surfaces

These are what developers build. They are not extra L0 protocols.

Chat, SilentPass, fragment history, and hop GB are the current production building blocks. Bulk DCDN, copyright delivery, and a general GPU / AI marketplace remain application designs on the same zero-trust cloud. Document them as compositions, not as automatic SI policy.

Future direction: privacy-first decentralized AI

Three independent roles. One open intelligence economy.

Centralized AI combines models, data, and user agents under one platform. CoNET separates them across independent wallet-addressed participants—and uses private application paths and programmable micropayments to make that separation economically sustainable.

Models, data, and AI agents need neither mutual trust nor ownership by the same platform. Layer Minus and web3:// reduce the need for one network intermediary to observe the complete user–service relationship. That benefit is conditional on operator separation, client-side key control, route diversity, limited identifier reuse, and the absence of collusion. CoNET-DLE micropayments are designed so value can move among independent participants for each measurable contribution. That is why the three-role split is not only a technical architecture. It can become an AI production relationship that economic incentives keep in place.

Prediction is not intervention. The governance risk becomes more severe when the same actor that predicts a user also controls the ranking, price, recommendation, or agent action presented to that user. A model can be packaged and replaced as a capability. An agent is a continuing relationship: it retains context, holds authority, selects services, and mediates action over time. See Privacy-first Decentralized AI — Whitepaper §1.3.

Private coordination

Implementation status. Layer Minus forwarding is an Implemented capability over L0 resources. web3:// is Under development: v1 components include wallet locators, signed requests, encrypted response correlation, Linux runtime support, and early persistent streams. Complete cross-platform handling and general public hosting are not production references.

Layer Minus and web3:// reduce the need for one network intermediary to observe the complete user–service relationship.

This benefit is conditional on operator separation, client-side key control, route diversity, limited identifier reuse, and the absence of collusion. Protocol-role separation alone does not prove legal-entity or infrastructure independence.

In the proposed application model, the durable application owner is represented by a wallet identity. Layer Minus routing additionally depends on OpenPGP identity and mailbox-route bindings; an exact @BeamioTag may provide an application-facing alias.

L0 GPU nodes remain an untrusted compute plane. Applications should encrypt and fragment sensitive state so that no single storage provider receives enough material to reconstruct the whole. Fragmentation thresholds, redundancy, recovery, deletion, and availability verification remain application-specific. Layer Minus provides forwarding and mailbox primitives; higher-layer client cryptography is application composition, not an automatic property of all L0 traffic.

The full paper defines contestable intelligence: independently sourced data, contestable model supply, user-controlled agents, and an operational evaluation matrix.

Economic coordination

CoNET-DLE is designed for small, frequent payments among agents, models, data providers, and infrastructure operators. Each participant can earn from a measurable contribution without controlling the entire AI stack. The one-basis-point protocol-value fee is a target for specified classes of applicable value movement, not a universal all-in fee for every AI task. AI event classes are proposed, not frozen DLE tip classes. Official developer documentation still lists DLE as a normative design and experimental environment, not a production SDK or a launched L2 service.

Privacy-preserving settlement requirement. A future AI payment protocol should prove only the service right, amount, and settlement condition required for one interaction. It should avoid placing prompts, dataset identifiers, long-term agent identity, or the complete service graph on a public ledger. This property requires a specified payment-session and unlinkability design; it is not provided automatically by wallet payments or by DLE. A public-chain micropayment can add metadata rather than hide it.

Privacy creates independence. Micropayments make independence sustainable.

The product-facing landing digest is Privacy-first Decentralized AI. The full architecture paper is Privacy-first Decentralized AI — Whitepaper.

What this page does not claim

• A listed Guardian is honest.
• Running an unlisted SI automatically appears in getAllNodes.
• Every node offers GPU or WASM.
• Fragmentation by itself is anonymity, or that all L0 traffic is automatically fragmented so no node holds a reconstructable whole.
• That web3:// is a complete production cross-platform handler or general public hosting service.
• That Layer Minus application identity is only a wallet address.
• Protocol-role separation proves legal-entity or infrastructure independence, or hides the complete user–service relationship without operator separation and limited identifier reuse.
• That wallet payments or DLE automatically hide prompts, dataset identifiers, long-term agent identity, or the complete service graph.
• That the one-basis-point protocol-value fee is a universal all-in fee for every AI task.
• That listed AI events (inference, licensed data access, verification) are frozen DLE tip classes, or that DLE is a production SDK or a launched L2 service.
• Decentralized AI is a live CoNET product name.
• That every predictive analysis is manipulation. Prediction and intervention are distinct stages.

Next

• How to use Layer Minus — forwarding primitives and combinations
• L0 development — client how-to
• Zero-trust mailbox routing — A/B/C path
• Security limits — what the live plane does not protect
• Privacy-first Decentralized AI — landing digest
• Privacy-first Decentralized AI — Whitepaper — full architecture paper