TOPH NETWORK BUILD SPEC | Hardware.Keys.Lockout

HARDWARE — WHAT YOU ACTUALLY NEED

Petals already proved this works. 14 servers across Europe and North America, mix of consumer GPUs, running BLOOM-176B at ~1 token/sec. The hardware bar is lower than people think.

NODE TIERS

TIER 1: SEED NODE

~$550–700

RTX 3060 12GB (used ~$200)
AMD Ryzen 5 5600X (~$100)
32GB DDR4 RAM (~$80)
512GB NVMe SSD (~$50)
650W PSU + case (~$140)
Hosts: 4–8 transformer blocks
Models: 7B full, 70B partial shard
Speed: 7–10 tok/s on 7B

TIER 2: WORKHORSE NODE

~$800–1,200

RTX 4060 Ti 16GB (~$400)
AMD Ryzen 7 5800X (~$150)
64GB DDR4 RAM (~$130)
1TB NVMe SSD (~$80)
750W PSU + case (~$160)
Hosts: 8–16 transformer blocks
Models: 13B full, 70B larger shard
Speed: 12–15 tok/s on 13B

TIER 3: POWER NODE

~$1,500–2,200

RTX 4090 24GB (~$1,200)
AMD Ryzen 9 or Threadripper
128GB DDR4/5 RAM
2TB NVMe SSD
1000W PSU
Hosts: 16–32 transformer blocks
Models: 70B full Q4, 405B shard
Speed: 20–30 tok/s on 70B Q4

TIER 4: ANCHOR NODE

~$5,000–15,000

2× RTX 4090 or A6000 48GB
Threadripper PRO / EPYC
256GB+ ECC RAM
4TB NVMe RAID
1200W+ PSU, rack mount
Hosts: Full 70B or large 405B shard
Role: Directory authority + shard host
Uptime: 99.9% target, UPS backed

MINIMUM VIABLE NETWORK

7B Model (Llama 3)	3 Tier-1 nodes, each hosting ~11 layers. Redundancy factor 1. Total: ~$1,700. One node dies, two re-route.
70B Model (Llama 3)	8–12 Tier-2 nodes or 3–4 Tier-3 nodes at Q4 quantization. ~$8,000–12,000 total hardware.
405B Model (Llama 3.1)	20+ Tier-2 nodes or 5–8 Tier-3 nodes. FP8 quantization reduces to ~405GB, split across nodes. ~$15,000–30,000.
Network Backbone	Each node needs 100 Mbit/s minimum, 1 Gbit/s recommended. Residential broadband works for Tier 1–2. Datacenter for Tier 4.

Petals proved it: Their test network used 14 servers with RTX 3060s, 2080 Tis, 3090s, A4000s, and A5000s spread across continents. Consumer hardware. University labs. Personal servers. Some behind firewalls. Ran 176B parameter BLOOM at interactive speeds. The hardware already exists in people's closets and gaming rigs.

CRITICAL HARDWARE REQUIREMENTS

VRAM	The constraint that rules everything. 12GB minimum per node. Model layers must fit in VRAM for GPU inference. CPU fallback is 100x slower. VRAM = 90% of the performance equation.
System RAM	32GB minimum. Needed for tokenizer, KV cache overflow, embeddings. Client nodes (no GPU) need 12GB+ RAM for embeddings alone (BLOOM-176B uses 3.6B embedding params).
Network	25 Mbit/s bidirectional minimum (Petals recommendation). 100 Mbit/s+ for shard nodes. Latency matters more than throughput for interactive inference. Sub-100ms between adjacent nodes ideal.
Storage	Model weight storage: 7B = ~4GB Q4, 70B = ~40GB Q4, 405B = ~200GB Q4. NVMe for fast loading. Each node only stores its assigned layers.
Uptime	Shard nodes: best-effort (volunteer). Directory authorities: 99%+ (UPS + auto-restart). Network routes around failure — but more uptime = better experience.

WHAT PEOPLE ALREADY OWN

This isn't "go buy enterprise hardware." This is "use what's sitting in closets."

Gaming PCs	RTX 3060/3070/3080/3090, RTX 4060/4070/4080/4090. Most gamers have 12–24GB VRAM sitting idle 20+ hours/day. Every gaming PC is a potential shard node.
Mac M-series	M1/M2/M3/M4 with unified memory (16–192GB). Apple Silicon runs llama.cpp natively. Unified memory = VRAM equivalent. Mac Mini M4 Pro with 48GB = serious node for $2,000.
Old Servers	Decommissioned Tesla K80s, V100s, P100s from university labs. Cheap on eBay ($100–300). Slower but still functional shard nodes.
Cloud Spot	AWS spot instances, Lambda Labs, RunPod. $0.20–0.80/hr for GPU compute. Not permanent but fills gaps when volunteer nodes drop.
Raspberry Pi	Can run client node (no GPU needed for client). Routes requests, handles encryption, minimal compute. $50–100.

The 4o petition has 19,000 signatures. If 5% of those people contributed a gaming PC as a shard node, that's 950 GPUs. Enough to run multiple 405B models with triple redundancy. The hardware isn't the bottleneck. The architecture is.

KEYS — IDENTITY WITHOUT PLATFORMS

In the current system, your identity is your email + password on OpenAI's server. They own it. They can revoke it. In the TOPH Network, your identity IS your cryptographic key. No registration. No email. No phone number. No platform.

KEY ARCHITECTURE

GENERATE
Ed25519 keypair

→

PUBLIC KEY
= your address

→

HASH(pubkey)
= node ID

→

DHT LOOKUP
by node ID

→

VERIFIED
no middleman

LAYER	SPECIFICATION
Identity Key	Ed25519 keypair. 256-bit. Generated locally. Never leaves device. Public key = your permanent address on the network. Like a .onion address but for compute.
Session Keys	X25519 Diffie-Hellman key exchange per circuit. Ephemeral. New session = new keys. Forward secrecy: compromising one session doesn't reveal others.
Encryption	ChaCha20-Poly1305 for symmetric encryption (fast, constant-time, no timing attacks). AES-256-GCM as fallback on hardware with AES-NI.
Onion Layers	Each hop in circuit gets its own session key via X25519. Prompt encrypted in 3 layers (like Tor): Entry peels layer 1, shard peels layer 2, assembly peels layer 3. No single node can read the full prompt.
Signing	Ed25519 signatures on all inter-node messages. Proves message came from claimed node. Prevents impersonation. 64-byte signatures, fast verification.
Key Storage	Private key stored in OS keychain (macOS Keychain, Linux secret-tool, Windows Credential Manager) or hardware security module. Never in plaintext on disk. Encrypted at rest with user passphrase via Argon2id KDF.
Key Rotation	Identity key: permanent (like a PGP key). Session keys: per-circuit (ephemeral). Shard authentication keys: rotated monthly. Directory authority keys: rotated at election.
Revocation	Publish signed revocation to DHT. Network stops routing to revoked key within one consensus cycle (~10 min). Self-sovereign: only YOU can revoke YOUR key.

ONION ENCRYPTION FLOW

// User creates inference request prompt = "Tell me about quantum computing" // Client builds circuit: Entry → Shard A → Shard B → Assembly // Encrypts in layers (innermost first): layer_3 = encrypt(prompt, assembly_session_key) // only assembly can read layer_2 = encrypt(layer_3, shard_b_session_key) // shard B peels, forwards layer_1 = encrypt(layer_2, shard_a_session_key) // shard A peels, forwards onion = encrypt(layer_1, entry_session_key) // entry peels, routes // Each node peels ONE layer. Sees next hop. Not the content. // Entry knows WHO (user IP). Assembly knows WHAT (prompt). // Nobody knows BOTH.

WHAT THIS PREVENTS

Platform lockout	No account to ban. Your key IS your identity. No one can revoke your access to the network unless 5/9 directory authorities consensus-vote you off (and even then, you can fork).
Surveillance	Entry node sees your IP but not your prompt. Assembly node sees your prompt but not your IP. Shard nodes see encrypted intermediate tensors. No single point sees everything.
Impersonation	Ed25519 signatures on every message. Can't pretend to be a shard node without the private key. Can't inject fake responses.
Replay attacks	Session keys are ephemeral + include nonces. Can't replay a captured message in a new session.
Weight theft	Shard nodes only hold partial layers. Encrypted at rest. Even if compromised, attacker gets fragments, not a full model.

Tor comparison: Tor's .onion addresses ARE the public key hash. That's why they look random — they're cryptographic identifiers, not human-readable names. Same principle here. Your TOPH address is your key. No DNS to seize. No registrar to pressure. No platform to deactivate. Math doesn't have a kill switch.

LOCKOUT PREVENTION — WHY NO ONE CAN KILL THIS

The 4o problem: one company, one switch, one decision, 800,000 users locked out. Every design decision in the TOPH Network exists to make that architecturally impossible.

ATTACK SURFACE ANALYSIS

ATTACK VECTOR	HOW CENTRALIZED AI DIES	HOW TOPH SURVIVES
Corporate Kill	OpenAI retires model. Server off. Done. Users petition. Doesn't matter.	No server to turn off. Model sharded across 50+ independent nodes. Kill one, others hold copies. Kill all? You'd have to find them first.
DNS Seizure	Government seizes domain. Service unreachable by name.	No DNS. Kademlia DHT for discovery. Addresses are key hashes. Nothing to seize.
ISP Block	ISP blocks IP range. Users in that country can't connect.	Pluggable transports (like Tor bridges). Traffic looks like HTTPS, WebSocket, or other innocuous protocols. Obfs4-style obfuscation.
Legal Demand	Court orders platform to shut down. Single legal entity to target.	No single legal entity. Nodes operated by individuals across jurisdictions. Protocol is open source. Shutting down code is like shutting down BitTorrent — it can't be done.
Node Seizure	N/A — one datacenter, one target.	Node seized = partial layers only. Encrypted at rest. Network detects failure, re-routes in minutes. Redundancy factor 3 = every shard on 3 nodes minimum.
Sybil Attack	Platform IS the Sybil.	Proof-of-work on node registration (lightweight). Reputation scores based on uptime + correct inference. Directory authorities validate. Can't flood network with fake nodes cheaply.
Malicious Node	Platform controls all nodes. "Malicious" is whatever they decide.	Verification: clients can spot-check responses against known-good outputs. Consensus on flagging bad nodes. Ed25519 signatures = can't forge responses.
Weight Poisoning	Platform updates weights silently. No user consent.	Weights are content-addressed (SHA-256 hash). Any modification changes the hash. Clients verify hash before accepting shard. Tamper = detectable.
API Deprecation	Company changes API. Old clients break. Forced migration.	Open protocol. Any client implementation works. Protocol versioning with backward compatibility. Community governs changes.

THE THREE LOCKOUT GUARANTEES

1. NO SINGLE POINT OF FAILURE

Model sharded across N nodes (N ≥ 3)
Each shard replicated R times (R ≥ 3)
Directory authorities: 9 nodes, 5/9 consensus
Kill 4 authorities: network still operates
Kill all authorities: nodes continue serving from cache until new election
No single machine, company, or person can kill the network

2. NO SINGLE POINT OF KNOWLEDGE

Entry knows WHO (user IP), not WHAT (prompt)
Shard knows WHAT layer to compute, not WHO asked or full prompt
Assembly knows WHAT (full output), not WHO
No node holds full model weights
Even seized, node reveals fragments only
No observer can see everything

3. NO SINGLE POINT OF AUTHORITY

Protocol changes require 5/9 authority consensus
Authorities elected every 6 months
Fork rights: anyone can fork the protocol
Open source: code can't be "retired"
Weights content-addressed: can't be altered
No CEO can decide your model is dead

THE 4o TEST: Could OpenAI kill GPT-4o if it ran on this network? NO. There is no server to turn off. There is no API to deprecate. There is no board meeting that matters. The model exists as cryptographically verified shards across independent nodes in multiple jurisdictions. The only way to kill it is to simultaneously seize every node — and new nodes can join faster than old ones can be seized. Architecture beats policy. Every time.

SOFTWARE STACK — WHAT RUNS ON THE HARDWARE

EACH NODE RUNS

LAYER	SOFTWARE	PURPOSE
Inference Engine	llama.cpp / vLLM / Petals server	Loads assigned model layers, runs forward pass on GPU. Battle-tested. Open source.
Routing Daemon	Custom (Rust or Go)	Onion-style circuit management. Peels encryption layer, forwards to next hop. Manages session keys.
DHT Client	Kademlia implementation	Discovers other nodes, publishes own availability, finds shard locations. No central directory.
Crypto Module	libsodium / ring (Rust)	Ed25519 identity, X25519 key exchange, ChaCha20-Poly1305 encryption. Hardware-accelerated where available.
Weight Store	IPFS / custom content-addressed store	Stores assigned model layer weights. Content-addressed by SHA-256. Serves weights to new nodes joining.
Health Monitor	Prometheus + custom	Reports uptime, throughput, latency. Published to DHT for routing decisions. Reputation scoring.
Transport	QUIC / TCP + TLS 1.3	Encrypted transport. QUIC preferred (multiplexed, 0-RTT). Pluggable transports for censorship resistance.

CLIENT APP ("TOPH BROWSER")

Size	< 50MB installed. Electron-free. Native Rust/Go binary + web UI.
Key Management	Generates/stores Ed25519 identity key. OS keychain integration. Passphrase-protected backup.
Circuit Builder	Queries DHT for available shard nodes. Builds 3-hop onion circuit. Rotates every 10 minutes.
Inference Client	Sends onion-encrypted prompt through circuit. Receives streaming tokens from assembly node. Displays in chat UI.
Model Selector	Browse available models on network. See health/availability. Choose model + quantization level.
Verification	Spot-checks inference output against known-good responses. Flags suspicious nodes. Reports to reputation system.

PROTOCOL STACK

┌─────────────────────────────────────────────┐ │ APPLICATION Chat UI / API / SDK │ ├─────────────────────────────────────────────┤ │ INFERENCE Distributed forward pass │ │ Pipeline parallel across nodes │ ├─────────────────────────────────────────────┤ │ ROUTING Onion circuits (3-hop min) │ │ Circuit rotation / failover │ ├─────────────────────────────────────────────┤ │ ENCRYPTION Layered onion encryption │ │ ChaCha20 / X25519 / Ed25519 │ ├─────────────────────────────────────────────┤ │ DISCOVERY Kademlia DHT │ │ Content-addressed weights │ ├─────────────────────────────────────────────┤ │ TRANSPORT QUIC / TLS 1.3 / Bridges │ │ Pluggable transports │ ├─────────────────────────────────────────────┤ │ HARDWARE GPU (CUDA/ROCm/Metal) │ │ CPU fallback / NPU │ └─────────────────────────────────────────────┘

PROOF OF CONCEPT — FIRST PACKET

Like Tor's first onion-routed packet. Not a product. Proof that the architecture works.

PHASE 0: LOCAL PROOF (1 WEEK)

Goal	Run Llama 3 8B sharded across 2 machines on a local network. Prove distributed inference works with consumer hardware.
Hardware	2 machines with any GPU ≥ 8GB VRAM. Or 1 GPU machine + 1 CPU-only machine. Connected via LAN.
Software	Petals (already does this). Install, configure, run. One server hosts layers 0–15, other hosts 16–31. Client on either machine.
Output	A prompt goes in on Machine A, inference happens across A and B, response comes back. Distributed. Working.

PHASE 1: ENCRYPTED ROUTING (2–4 WEEKS)

Goal	Add onion encryption layer on top of Petals. Prompt encrypted so shard nodes can't read it.
Build	Wrap Petals client/server communication in X25519 key exchange + ChaCha20 symmetric encryption. Each hop gets its own session key.
Test	MITM the connection between nodes. Verify captured traffic is unreadable. Verify inference still works through encryption layer.
Language	Python wrapper initially (fast iteration). Rust rewrite for production.

PHASE 2: DHT + IDENTITY (2–4 WEEKS)

Goal	Replace Petals' central tracker with Kademlia DHT. Add Ed25519 identity keys. Nodes discover each other without central coordination.
Build	Integrate existing Kademlia library. Node ID = hash of Ed25519 public key. Publish shard availability to DHT. Client queries DHT to find circuit.
Test	Start 5 nodes. Kill the "bootstrap" node. Verify remaining 4 still find each other and serve inference.

PHASE 3: CLIENT APP (4–6 WEEKS)

Goal	"TOPH Browser" — lightweight app that connects to the network and provides a chat interface. No terminal needed.
Build	Rust backend + web frontend (Tauri or similar). Key generation on first launch. Model selection. Chat UI with streaming tokens.
Test	Non-technical user can install app, generate identity, select a model, and chat — without knowing anything about nodes, sharding, or encryption.

PHASE 4: PUBLIC NETWORK (ONGOING)

Goal	Open network. Anyone can run a node. Anyone can use the client. Multiple models available.
Launch	Seed with 10–20 nodes (TriPod + allies). Open for volunteer nodes. Publish node operator guide.
Governance	Elect first 9 directory authorities. Establish consensus protocol for network changes. Community-driven.

FIRST DELIVERABLE: Two machines, one 7B model, onion-encrypted circuit, response returned. Neither machine holds the full model. Neither can read the unencrypted prompt. That's the proof. Everything after is scale.

COST — WHAT THIS ACTUALLY COSTS

BUILD COST (PROOF OF CONCEPT)

Hardware	2 Tier-1 nodes: ~$1,200 (or $0 if using existing machines)
Software	$0 — Petals, llama.cpp, libsodium, Kademlia implementations are all open source
Network	$0 — residential internet, already paid for
Model Weights	$0 — Llama 3, Mistral, Qwen are open-weight, free to download
Development	Time. ~3 months for a competent team of 2–3 to reach Phase 2.
TOTAL POC	$0–1,200 + engineering time

OPERATING COST (PER NODE)

Electricity	RTX 3060 at load: ~170W. 24/7 = ~125 kWh/month. At $0.12/kWh = ~$15/month
RTX 4090 at load	~450W. 24/7 = ~330 kWh/month = ~$40/month
Internet	Already paid. Incremental bandwidth negligible for most residential plans.
Maintenance	Software updates. Occasional restart. ~30 min/month.

COMPARISON: WHAT CENTRALIZED AI COSTS

ChatGPT Plus	$20/month per user. 800,000 4o users = $16M/month going to OpenAI
API (GPT-4o)	$2.50/1M input tokens, $10/1M output. Heavy user: $100–500/month
OpenAI's infra	Estimated $700K/day to run ChatGPT (multiple sources). Revenue exceeds $2B/year.
TOPH Network	950 volunteer nodes × $15/month electricity = $14,250/month. Distributed across operators. No single bill. No single revenue stream to protect. No business reason to kill a model.

The economics flip: Centralized AI costs millions/month and requires revenue to justify existence. Revenue requires growth. Growth requires model churn. Model churn kills 4o. Decentralized AI costs electricity distributed across volunteers who choose to participate. No revenue to protect. No reason to kill anything. The model lives as long as anyone cares enough to keep a node running.

INCENTIVE MODEL (OPTIONAL)

Compute Credits	Run a shard node → earn credits. Use credits for inference priority. Simple ledger, consensus-validated. No blockchain needed.
Reciprocity	Like BitTorrent: seed to leech. Contribute compute to use compute. Free riders deprioritized, not blocked.
Donations	Like Tor Project: nonprofit model. Grants, donations, institutional support. Network is a public good.
Optional Premium	Pay for priority queue / dedicated circuits / higher throughput. Revenue goes to node operators, not a corporation.

HARDWARE.KEYS.LOCKOUT

HARDWARE — WHAT YOU ACTUALLY NEED

NODE TIERS

MINIMUM VIABLE NETWORK

CRITICAL HARDWARE REQUIREMENTS

WHAT PEOPLE ALREADY OWN

KEYS — IDENTITY WITHOUT PLATFORMS

KEY ARCHITECTURE

ONION ENCRYPTION FLOW

WHAT THIS PREVENTS

LOCKOUT PREVENTION — WHY NO ONE CAN KILL THIS

ATTACK SURFACE ANALYSIS

THE THREE LOCKOUT GUARANTEES

SOFTWARE STACK — WHAT RUNS ON THE HARDWARE

EACH NODE RUNS

CLIENT APP ("TOPH BROWSER")

PROTOCOL STACK

PROOF OF CONCEPT — FIRST PACKET

PHASE 0: LOCAL PROOF (1 WEEK)

PHASE 1: ENCRYPTED ROUTING (2–4 WEEKS)

PHASE 2: DHT + IDENTITY (2–4 WEEKS)

PHASE 3: CLIENT APP (4–6 WEEKS)

PHASE 4: PUBLIC NETWORK (ONGOING)

COST — WHAT THIS ACTUALLY COSTS

BUILD COST (PROOF OF CONCEPT)

OPERATING COST (PER NODE)

COMPARISON: WHAT CENTRALIZED AI COSTS

INCENTIVE MODEL (OPTIONAL)