Whitepaper v4.0

The fire belongs to humanity,
not to corporations.

Prometheus is a fully decentralized, AI-powered threat intelligence protocol built on the Kaspa blockchain. It transforms every connected device into a node in a global threat detection swarm — without central control, without a foundation, and with zero pre-mined tokens.

The protocol combines three layers: on-device AI (Phi-3-mini 3.8B, 4-bit quantized) for local anomaly detection, Guardian nodes (LLaMA 3 70B/8B) for advanced threat analysis and YARA rule generation, and Kaspa L1 consensus (high-throughput BlockDAG / DAGKnight path) for immutable rule storage and governance.

The security industry is structurally compromised.

Classical antivirus software works by comparing files against a database of known malware signatures. This approach has a fundamental design flaw: it only detects what is already known. New, unknown attacks — zero-day exploits — pass through undetected.

State-sponsored trojans like Pegasus (NSO Group), Predator (Intellexa), and FinFisher were specifically engineered to bypass these detection mechanisms. They use zero-click exploits — the user need not click anything or download anything. A single incoming message is sufficient for complete device compromise.

The commercial security industry suffers from a fundamental conflict of interest: the same firms that sell protection also sell attack tools to governments. Firms like NSO Group, Hacking Team, and Intellexa profit from enabling espionage — not from preventing it.

• Zero-day market: A legal but opaque market for security vulnerabilities. Governments pay millions for unknown exploits.
• Backdoor laws: The US Cloud Act and similar legislation in other countries compel technology companies to cooperate with authorities.
• Conflict of interest: An antivirus company that simultaneously serves government clients has a financial incentive not to detect government malware.

Trustworthy security research does not come from the large corporations — it comes from independent actors: Amnesty International Security Lab (MVT toolkit for Pegasus detection), The Citizen Lab (University of Toronto — the leading address for uncovering state cyber-espionage), ClamAV (fully transparent, community-maintained open source scanner), and Wazuh (open source threat detection platform).

Prometheus builds on this tradition — and scales it to global network effects through blockchain technology.

Swarm intelligence. Blockchain immutability. AI analysis.

Prometheus solves the three core failures of the current security industry simultaneously:

The current verified ThreatHint v1 path stops before Guardian analysis: it transports a caller-supplied hash commitment and bounded metadata but no concrete IOC, then returns zero confidence, no rule, and no submission. It does not derive the hash from an artifact or prove report truth, artifact derivation, or reporter anonymity. GH-82 specifies a separate artifact-hash and observable-commitment v2 boundary. Merged and exact-main-verified GH-86 adds isolated Rust and Python canonical bundle validators against one shared byte-exact corpus. Merged and exact-main-verified GH-90 adds one local Rust producer that computes a single file_sha256 observable from exact caller-supplied bytes and typed scope; Python independently validates the shared producer vectors. This proves only deterministic derivation at that function boundary, not that the bytes came from a real file, are malicious or privacy-approved, or are bound by a proof. Merged and exact-main-verified GH-94 additionally derives one bounded byte_pattern from exact caller-supplied bytes, checked offset, boolean wildcard mask, and typed scope. It accepts no pattern string, requires at least eight fixed bytes, and always emits local-only review_required_v1; Python independently validates the shared vectors. It does not authorize disclosure or transport or prove external provenance, maliciousness, privacy approval, or proof binding. Merged and exact-main-verified GH-114 additionally provides isolated local canonical v2 statement parsing and digest parity for distinct artifact-hash and observable-commitment fields. None of these slices is connected to v1 transport, proof verification, Guardian analysis, or rule publication. Reviewed privacy gates, the remaining kind-specific extractors, a reviewed v2 relation and approved proof artifacts, owner-only pairing, transport, and actionable analysis remain required.

Merged and exact-main-verified GH-103 adds one bounded local Linux ELF api_import producer. It accepts exact artifact bytes plus a checked index only, derives linux/elf scope internally, caps parsing at 16 MiB and 4096 dynamic symbols, validates the closed ASCII grammar, and sorts/deduplicates before selection. Every output is local-only review_required_v1; Python independently parses the shared exact-byte ELF vectors. No path or import-string API, disclosure authorization, transport, proof acceptance, analysis, publication, or external provenance claim is introduced.

Merged and exact-main-verified GH-121 applies the same isolated boundary to exact PE32 and PE32+ bytes. It fixes windows/pe scope, caps parsing at 16 MiB, 4096 import descriptors, and 4096 thunk entries, rejects ordinal and grammar-invalid imports, and byte-sorts/deduplicates named functions before checked selection. Rust covers both PE architectures while Python independently parses a synthetic shared PE32+ vector. Library names never become observables, every output remains local-only review_required_v1, and no path/string/generic, transport, proof, analyzer, wallet, chain, or promotion behavior is introduced. Protected PR #122 is merged as exact-main 2e3e1e1; CI, Security, and Pages pass on that SHA.

Merged and exact-main-verified GH-107 adds matching local Rust/Python verification of one canonical, short-lived BIP340 approval statement for one exact review_required_v1 bundle. It binds a separately trusted approver key, recipient-scope digest, network, report nonce, and separately trusted current time that must never be attacker-controlled, recomputes the observable commitment, and caps inclusive validity at one hour. It contains no signer and triggers no replay persistence, transport, promotion, disclosure, analysis, publication, proof, wallet, or chain action. The nonce and deterministic approval ID identify repeats but do not prevent replay.

Merged and exact-main-verified GH-111 adds a local durable consumption boundary in Guardian Node. One owner-only exact-schema policy fixes the network, approver public key, and opaque recipient-scope digest. The service invokes the GH-107 verifier in the same trusted call path, then atomically consumes both the approval ID and authority-bound nonce in a separate owner-only SQLite ledger. Full synchronous durability, persistent clock high-water, and restart/concurrency/lock handling close local replay without accepting caller-supplied verified objects. The receipt grants no external authority and adds no pairing, promotion, transport, analyzer, outbox, proof, wallet, or chain action. Key ownership/rotation, scope semantics, privacy approval, and future side-effect semantics remain open.

Merged and exact-main-verified GH-114 adds isolated local Rust and Python parsers for one canonical ThreatHint v2 statement. The 1024-byte-bounded wire keeps artifact hash and observable commitment separate and binds them with confidence, structural disclosure class, report nonce, positive observed time, and a network that must match separately trusted local context. A new length-prefixed, domain-separated digest covers every canonical field, and one shared exact-byte corpus fixes valid and invalid behavior. This is structural binding only: no approved relation, proof, signer, pairing, replay authority, transport, analyzer, wallet, or chain path consumes it, and it proves no artifact derivation, report truth, maliciousness, privacy safety, authorization, or anonymity.

Merged and exact-main-verified GH-117, but not production-deployed, adds strict Rust/Python parsers for a bounded opaque-proof envelope and a 19-field RelationManifest-v2, plus one atomic data-only binding. A separately trusted network and raw-manifest SHA-256 are required before canonical reparsing; protocol, relation, network, statement-domain, and public-input identities are then closed and the statement digest is split into two claimed 16-byte big-endian halves. This is not Groth16 verification or artifact approval and adds no ceremony, signer, transport, analyzer, promotion, wallet, chain, reputation, KAS/PROM, slash, commit-reveal, or rollout authority.

Merged and exact-main-verified GH-117 adds silent verify-v2. It owner-loads exact manifest, relation-source, and verifying-key bytes, binds their declared sizes and SHA-256 anchors, accepts only canonical compressed BN254 keys and proofs, derives both field inputs only through the reviewed v2 binding, and performs real Arkworks Groth16 verification. Runtime loads no proving key. Its generated relation, keys, and proofs are test-only; no production artifact or ceremony is approved and no privacy, approval-consumption, transport, chain, or rollout authority is added.

Merged and exact-main-verified GH-117, but not production-deployed, adds an owner-only read-only ThreatHint v2 privacy/proof preflight. Its exact policy pins the network, BIP340 approver key, opaque recipient scope, and raw-manifest SHA-256. Guardian Node derives the statement only from the bound envelope, recomputes the review-required bundle commitment against the same trusted nonce, and verifies the short-lived approval. It verifies no Groth16 proof, consumes no approval, opens or migrates no SQLite ledger, and authorizes no privacy, disclosure, transport, analysis, promotion, wallet, chain, or rollout action.

Merged and exact-main-verified GH-117, but not production-deployed, composes those checks in one POSIX-only Guardian call without making them authoritative. Owner-only configuration pins an absolute verifier executable and exact SHA-256; the existing policy remains the sole network and manifest anchor. Guardian runs the approval/privacy preflight first, then passes the same exact envelope bytes to a bounded, scrubbed, shell-free verify-v2 process. Its non-constructible, non-serializable receipt is data only. This layer deliberately opens no SQLite ledger and consumes no approval; the separate merged atomic-acceptance boundary below adds that final mechanical step. Neither layer grants production artifact, privacy, disclosure, transport, analysis, promotion, wallet, chain, or rollout authority.

Merged and exact-main-verified GH-117, but not production-deployed, accepts raw envelope, bundle, and approval bytes only and requires exact network, approver-key, and recipient-scope identity across preflight and consumption policy before ledger creation. It runs verified proof/privacy preflight first, then re-verifies the approval ID and observable commitment before durable consumption executes as the final state-changing step. Failed verification never consumes or advances ledger time; the receipt remains non-constructible, non-serializable data only. Production relation/key/ceremony approval, independent cryptographic review, privacy promotion, transport, analysis, signing, chain effects, and rollout remain separate gates.

Merged and exact-main-verified GH-117, but not production-deployed, adds an owner-only exact-schema promotion boundary above atomic acceptance. It requires review-required disclosure, exact platform and format, allowed observable kinds, and a bounded count before the same original raw wires may enter verification and consumption. The policy is opened no-follow through an identity-checked bounded descriptor; rejection never reaches the verifier or ledger. Success is restricted local data only. This closes mechanical local pairing and owner-policy restriction, not semantic per-kind privacy review, authority/key governance, production artifact approval, transport, analysis, publication, external effects, chain authority, or rollout.

Merged and exact-main-verified GH-117, but not production-deployed, makes the authority and privacy policy enforceable across promotion, retention, proof precheck, and durable consumption. One exact owner policy fixes network, approver, recipient scope, authority epoch and window, same-Guardian local-analysis semantics, denied external disclosure, and one deny-or-risk-specific decision for every observable kind. All three policy kind sets must match. First valid use atomically pins all three exact policy-file digests and authority state; stale epochs, same-epoch changes, overlapping same-identity windows, replay, and failed inserts change no durable state. This is local enforcement only and grants no worker, transport, actionable analysis, publication, chain action, or production relation/key/ceremony approval.

Merged and exact-main-verified GH-117, but not production-deployed, advances the governed queue to schema v4. The same BEGIN IMMEDIATE transaction stores the canonical statement and digest, trusted report nonce, full Observable Bundle, approval binding, authority state, replay high-water, and retention. Claims revalidate every binding and derive a lease-bound input identity. Atomic completion stores one canonical explicitly non-actionable result before deleting work and supports exact idempotent retry. Empty schema-v3 queues migrate; nonempty v3 queues fail closed unchanged. The bounded worker uses only a deterministic test analyzer and adds no confidence, should_submit, LLM, YARA/rule body, semantic finding, transport, disclosure, wallet, signature, transaction, chain, reward, deployment, or external effect.

Three layers. No center.

Layer 1 is the core of the security system. Validated threat rules are anchored here as canonical rule state. The current RuleStorage gate verifies CIDv1 storage, quorum, and state transitions; PROM-RULES asset orchestration remains deployment work. The anchored data can be deleted or manipulated by nobody — not governments, not companies, not the developers themselves.

• DAGKnight consensus: Adaptive, parameterless consensus with theoretically optimal Byzantine fault tolerance (~50%). Converges under attack orders of magnitude faster than classical systems.
• BlockDAG architecture: Parallel block production eliminates the bottleneck of linear chains. Prometheus treats high throughput as a deployment requirement and verifies contract/tooling compatibility before launch.
• Silverscript: High-level language for UTXO-based smart contracts. H-001, ValidatorStaking, GuardianReputation, RuleStorage, CommunityDonations, DevIncentivePool, and GovernanceAutoTuning current-Silverc gates are verified. Closed release-manifest profiles separate the single H-001 testnet-10 canary from the full seven-fixture flow; canary receipts, evidence, and status remain non-promotable. Release-bundle, deploy-preflight, request/procedure/receipt/evidence verification, operator-handoff, metrics-oracle, and exact-commit hardening gates are covered; real funded canary evidence followed by full deployment and oracle evidence still gate Prometheus rollout.
• Keyless genesis operator: Prometheus constructs the official transaction-v1 covenant genesis with compute budget 10 and exact contextual storage mass, validates the exact live funding UTXO during preflight and again before broadcast, and exports only the public sighash to an external vault/HSM. Its canonical import accepts only a public 64-byte BIP340 signature as lowercase hex, binds all response fields from the validated request, rejects normalized input/output path collisions, and verifies BIP340 plus the complete transaction before writing output. It enforces fee caps, journals the exact transaction before acknowledged submission, reconciles retries against chain and mempool state, and rebuilds the signed transaction before observation. A funding-free probe uses the pinned public resolver with mandatory TLS and testnet-10-only enforcement, recording the resolved endpoint without replacing funding or independent-evidence gates. Per-request wRPC deadlines fail closed. The CLI accepts no private key, seed, wallet, keystore, password, or raw transaction.
• Native ZK verification: Kaspa KIP-16 supplies BN254 Groth16 verification. Prometheus has a manifest-pinned verifier engine, but no approved production relation or keys ship yet. The exact circuit determines what is proved; v1 does not establish artifact derivation, report truth, or reporter anonymity.

Prometheus does not depend on Kasplex or any third-party L2 for Guardian reputation. Canonical Guardian reputation lives on Kaspa L1. Optional L2 or off-chain services may later aggregate analytics, dashboards, or reward views, but they cannot override the L1 source of truth.

The merged and exact-main-verified GH-42 carrier uses bounded direct QUIC request/response at /prometheus/guardian-ballot/1.0.0. It transports one exact canonical signed ballot of at most 8192 bytes, forwards it through an owner-only Unix socket to the existing BIP340/session/replay verifier, keeps swarm progress cancellation-safe during concurrent collector work, and returns only a digest-bound accepted, duplicate, rejected, or busy result. Merged and exact-main-verified GH-44 adds atomic owner-only persistent transport identity, strict bounded IP/UDP/QUIC-v1 direct, relay-circuit, and AutoNAT routes, data-minimal health events, and a bounded relay service. Merged and exact-main-verified GH-48 packages guardian and relay roles as an operated binary with strict owner-only TOML, bounded local submission, bounded JSON readiness/health, and graceful signal drain. Merged and exact-main-verified GH-52 separates relay bind listeners from explicit canonical advertised IP/UDP/QUIC bootstrap routes and emits path-free routes bound to the persistent transport peer ID. Merged and exact-main-verified GH-55/GH-58/GH-63/GH-74 provide the independent canonical 2048-byte-bounded ThreatHint channel, owner-only durable verifier ingress, a real manifest-pinned BN254/Arkworks Groth16 engine aligned with active KIP-16, and the bounded analyzer adapter. Merged and exact-main-verified GH-77 isolates per-job drain failures: failed jobs remain pending, later safe jobs progress, and the structurally immutable report contains only a bounded index, fixed failure category, and validated digest or none. Merged and exact-main-verified GH-86 adds local-only Rust/Python canonical Observable Bundle validators and one shared byte-exact corpus without wiring them into v1, proof, transport, analysis, or publication. Canonical outbox bytes, digest, trusted network, proof mode, and admission time are revalidated, but hash-only v1 contains no concrete IOC strings and therefore yields only a zero-confidence, no-rule, non-submittable result without invoking LLM or YARA generation. No approved production relation or production relation vectors, verifying key, or proving key ships yet, so unavailable verification remains fail-closed as busy and actionable analysis is not claimed. Peer IDs, addresses, relays, and routes remain transport metadata and never Guardian or reporter authorization.

A deterministic isolated three-node harness proves relay reservation, relay-only ballot and ACK delivery, AutoNAT state, DCUtR failure with continued relay fallback, and circuit/connection close handling. A separate-process same-host test additionally proves exact relay delivery from the local submit socket to the collector, canonical ACK propagation, SIGTERM cleanup, and stable transport identities. Real two-host relay/NAT operation remains open. Broad discovery is not yet proven, and mDNS stays excluded while its compatible optional DNS dependency path has unresolved RustSec advisories.

The actual protective effect arises off-chain on user devices and operator nodes. Local scanning is designed to keep files and paths on the originating device, while bounded claim metadata and future explicitly reviewed observables may cross protocol boundaries.

Four roles. Every device contributes.

LLaMA 3 70B requires 4× NVIDIA A100/H100 (~$30,000–50,000). This excludes many potential Guardian operators. LLaMA 3 8B runs on a single consumer GPU (e.g. RTX 4070 Ti), dramatically lowering the entry barrier. The implemented local router runs 8B first and escalates to an independent 70B analyzer below confidence 0.70. Invalid confidence, mismatched threat hashes, malformed submission decisions, or a failed 70B route fail closed. The network submission threshold remains 0.85. Live model wiring and calibrated confidence remain open.

The local Sprint 10B ensemble validator binds protocol version, threat hash, exact YARA bytes and metadata, source confidence in integer basis points, policy hash, and the pinned 8B model artifact into a domain-separated candidate digest. A committed snapshot requires at least five unique Guardian IDs and a membership-source digest. Every member must cast exactly one fully bound vote; approvals require at least 8500 basis points, a complete ballot requires a strict majority, and final confidence is the minimum of the source rule and all approvals. Any missing, duplicate, unknown, malformed, mismatched, tied, or below-policy input returns no submittable rule.

The GH-39 authenticated intake binds each Guardian ID to one exact BIP340 x-only public key inside a per-candidate and per-network session. Strict canonical envelopes commit the complete vote, nonce, and validity window; signatures are verified before an owner-only SQLite ledger atomically consumes one vote per member and one nonce per active session across restarts and concurrent submissions. GH-42 carries those exact bytes over bounded direct QUIC/libp2p request/response and an owner-only local collector bridge; merged GH-44 adds persistent transport identity and isolated relay/NAT evidence; merged and exact-main-verified GH-48 adds operated process packaging without changing trust. It does not establish trusted membership or key assignment, prove public or multi-host relay/NAT operation or broad discovery, prevent Sybil identities, submit proposals, attest the ensemble on Kaspa L1, or include production private-key handling.

Open source models. Security specialization. Federated learning.

The choice of AI model is a security question, not a quality question. Proprietary models (GPT-4, Claude, Gemini) are black boxes — nobody can verify what they actually do. For a security system with transparency as a core principle, they are structurally unsuitable.

Target architecture: Microsoft's Phi-3-mini 3.8B runs locally on the end user's device for inference. Reporting and model-update paths remain separate, bounded data flows. The planned model is 4-bit quantized and targets ONNX Runtime on 4 GB RAM without GPU on Windows, macOS, Linux, and mobile; production inference is not yet wired.

Meta's LLaMA 3 in the 70B or 8B variant is the centerpiece of the Guardian AI. It runs self-hosted on Guardian nodes and analyzes incoming threat hints from Light Clients across the network. Both variants are fine-tuned with LoRA (Low-Rank Adaptation) on security-specific datasets:

• VirusShare: Largest public malware database, millions of samples
• MalwareBazaar: Current malware samples, daily updated
• Exploit-DB: Complete exploit database for CVE correlations
• CuckooSandbox Reports: Behavioral analysis of malware in sandbox environments

# LoRA Fine-Tuning Configuration
lora_config = LoraConfig(
    r=16,                              # Rank
    lora_alpha=32,                     # Scaling factor
    target_modules=['q_proj', 'v_proj'], # Attention layers only
    lora_dropout=0.1,
    task_type='CAUSAL_LM'
)
# Only 1-5% of parameters are trained → efficient
# Training on ~500k malware samples
# Result: specialized security model on LLaMA 3 base

Target architecture: Fed-DART enables clients to train locally and exchange bounded model updates instead of raw training records. Model updates can still leak information through inference or reconstruction attacks, so clipping, aggregation, privacy accounting, authentication, and independent validation remain production requirements.

Six Silverscript contracts. Deterministic state transitions.

The legacy contracts are written in Silverscript and use fixed-point integer scaling for reputation and confidence values (no float64). Current Silverc deployment fixtures use signed entrypoint integers at the deploy boundary; deployment calls are scoped to 0..=i64::MAX where numeric values enter Silverc.

Two tokens. No shortcuts.

Reporter percentages are protocol allocation targets, not passive uptime rewards. A miner-side companion earns no PROM merely by running; rewards require a future implemented and consensus-verified security contribution path.

Economic security through KAS staking.

Validator nodes are the economic backbone of the network. By staking KAS they put economic capital on the line as a guarantee for honest behavior. Misbehavior is punished by slashing — a direct financial loss.

Reputation capital through AI contribution.

Guardian nodes are the intelligence of the network. They operate the Jäger-KI, analyze threat patterns, and create rule proposals. Their "stake" is not financial but reputational — a form of social capital earned through good work.

Guardian reputation is canonical Kaspa L1 state in GuardianReputationState. It is separate from PROM balances and is not a badge or NFT.

Commit-Reveal. Bond system. 67% quorum.

Commit-Reveal is the core protection mechanism against collusion among validators. No validator knows how the others will vote before they themselves have committed.

# Phase 1: COMMIT — validator sends only a hash
# commitment = sha256(vote_byte || salt_LE || block_height_LE)
# vote_byte: 1 = true, 0 = false
# salt and block_height as 8-byte little-endian

# Phase 2: REVEAL — after 10-second collection phase
# Validator reveals actual vote + salt
# Network verifies: sha256(vote||salt||block) == commitment
# Invalid reveal → bond slashed immediately

CIDv1 rule state. Asset representation gated.

Each accepted rule is anchored as canonical state on Kaspa L1. The product target is a unique PROM-RULES asset representation, but the verified current-Silverc gate intentionally covers the rule state machine first:

• Target tick: PROM-RULES
• Target supply: 1 per accepted rule
• Target ID format: PROM-RULE-2026-XXXX
• IPFS reference: bytes(36) — CIDv1 binary with SHA-256 multihash (not bytes(46) — corrected in audit V-002)
• Minimum confidence: 0.85 (stored as 8,500 at 10,000× scale)
• Current gate: RuleStorageState verifies submit/vote/finalize/deactivate covenant sigscripts and Guardian reputation outcome events

Rule content is stored on IPFS. The CIDv1 hash is stored on-chain. Every client verifies the IPFS content hash against the on-chain hash before loading a rule — manipulation is structurally impossible.

The network learns through bounded model updates.

Target architecture: Fed-DART keeps training records local and exchanges model updates. Those updates are not raw records, but they may still leak information; production requires clipping, secure aggregation, privacy accounting, authentication, and validation.

# Fed-DART Training Round (simplified)
async def training_round(self):
    # 1. Fetch global model from coordinator
    global_model = await self.client.fetch_global_model()
    # 2. Train locally — ONLY with local threat data
    local_gradients = await self.train_local(global_model)
    # 3. Send bounded model updates; privacy controls remain required
    await self.client.submit_update(ModelUpdate(
        gradients=local_gradients,      # Mathematical difference
        client_id=self.pseudonymous_id(), # Not an anonymity guarantee
        data_size=self.local_data_count,# Count, not content
        signature=self.sign_update()    # Authenticity
    ))
    # 4. Aggregated global model is distributed
    # No single client knows the data of any other

Deterministic, bounded auto-tuning.

Target behavior: authenticated metrics drive bounded weekly parameter transitions. The repository verifies deterministic state transitions, but real inputs, external signatures, confirmed successor evidence, and production operation remain gated. There is no repository-controlled emergency-stop entrypoint; availability still depends on Kaspa, nodes, clients, and network access.

Sybil resistance. FP flood. 51% attack. Collusion.

5% Dev Pool. DAO vote only. No foundation.

5% of annual PROM emission (1,000,000 PROM/year) is allocated to developer grants. Every single payment requires a DAO vote — full transparency, no hidden payments, no founder allocation.

Recommended reward formula: lines × 10 × (100 + complexity × 10) / 100 — capped at 100,000 PROM per grant. Complexity scale: 1–10.

Before mainnet launch, no tokens are issued. Development is financed through external funding — Gitcoin Grants (quadratic funding, community-decided), Octant (matching pools for open-source infrastructure), and community donations in KAS.

Built in public. Audited in public.

All findings public. Deployment gates tracked.

All development is subject to continuous architect audit via the Claude Code workflow. Every finding is documented in memory/AUDIT.md and publicly visible in the repository.