LP-5300: Thinking Chains — Cross-Chain Cognitive Consensus & Proof-of-Thought Receipts

Abstract

LP-5300 specifies the Thinking Chains protocol: the primitives Lux provides so an on-chain contract can request reasoning from a model too large to run inside C-Chain block execution, and later consume the result with the same fork-safety guarantee as a native opcode. The protocol has two tiers. Tier 1 is deterministic int8 inference run in consensus by every validator (small models, the 0x0300…0003 precompile, byte-identical, no GPU). Tier 2 is large-model inference run off-chain by a provider quorum, settled on the A-Chain (AIVM) by a commit-reveal quorum engine and certified to C-Chain as a Proof-of-Thought Receipt (PoT).

The two tiers meet at a single normative law — the bridge law — that keeps C-Chain consensus deterministic while the heavy thinking happens elsewhere: C-Chain consensus state MUST NOT depend on a live query whose result is not already committed or certified. A C tx may only submit a deterministic intent (Pattern A) or verify a committed receipt + proof (Pattern B). The A-Chain creates tasks only by importing committed C intents under A consensus; C consumes only committed A receipts via proof. ZAP transports; proofs commit; receipts settle; VMs execute.

This LP specifies the protocol surface: the cross-chain Task and Receipt, the intent/receipt wire (pinned byte-for-byte), the A-Chain quorum settlement state machine, Subsampled Cognitive Consensus (repeated random committee sampling over structured outputs, not prose), the model registry, reputation and eligibility, recursion budgets, slashing, and the constitutional rules. The C-side precompile that is the EVM entry point for both patterns is specified in its companion, LP-5301, mirroring how LP-9010 / LP-9999 spec the DEX precompile against the D-Chain VM (LP-032).

Motivation

The deterministic inference precompile (0x0300…0003, precompile/inference/module.go) is the canonical in-consensus brain for small models: it runs an int8 transformer entirely in pure Go on the consensus path, so every validator computes byte-identical logits and tokens with no GPU, and consensus can never fork on hardware. That is Tier 1, and it is complete.

It cannot serve large models. A 70B+ model is non-deterministic across hardware, GPU-bound, and far too large for block execution. The naive fix — have the precompile call an inference server during Run() — forks consensus: two validators executing the same C block at different instants observe different output, latency, and queue state, so their StateRoot diverges. This is the exact fork-unsafe shape a prior build shipped (a live GetInferenceReceipt(id) query), documented and deliberately removed in precompile/aivmbridge/achain_client.go.

Lux already solved this shape once, for the DEX: D matches · C settles (LP-032 §Settlement, LP-9999). A permissioned validator subset runs the moving order book on the D-Chain; the full C-Chain validator set only verifies a compact, certified receipt and settles in parallel under Block-STM. The verify path never calls a live matcher. Thinking Chains applies the same decomposition to cognition: the A-Chain runs the provider quorum; C-Chain only verifies a certified receipt. The receipt is the Proof-of-Thought. The consensus-safety rule is identical in spirit and is made normative here as the bridge law.

Terminology (shared canon)

These definitions are normative and identical across the Thinking Chains LP, the LP-5301 precompile spec, the Zoo "Beluga L3" ZIP (first deployment), the Hanzo "Cognitive Sidecar / Hanzo Engine provider" HIP, and the Zoo "Thinking Chains" paper.

• Thinking Chain — a sequence of model invocations where each step's output is a committed, hash-addressed artifact that the next step (on any chain) may consume by proof. A chain of thought becomes a chain of receipts.
• Proof-of-Thought Receipt (PoT) — the cross-chain AInferenceReceipt: the durable, verifiable statement "task T (born from C intent I) settled to canonical output O under quorum N/threshold, paying fee F, at A-height H," committed under the A-Chain receipt_root. PoT is not a proof that any particular reasoning trace is correct; it is a proof that an agreed quorum of bonded operators independently produced the same structured result.
• Subsampled Cognitive Consensus — agreement reached by repeated random committee sampling over structured model outputs (a canonical output hash), never over free prose. Finite output spaces only; the rationale behind a judgment is carried as hash-addressed evidence, not graded by the chain.
• Roles — C (C-Chain requester/consumer), A (A-Chain settlement), D (D-Chain DEX, the architectural template), S (provider/operator that thinks), R (requester/relayer that funds + delivers the intent), G (governance, model adoption + parameters), M (model — the weight-commitment identity shared by C and A).
• Beluga — the Zoo L3, the first prototype deployment of Thinking Chains.

The Two Tiers

Tier	What	Where	Determinism	Settlement
Tier 1	Small int8 model inference	In C-Chain consensus (0x0300…0003)	Byte-identical on every validator, no GPU	None — the result is the call return
Tier 2	Large-model inference / agentic reasoning	Off-chain provider quorum, A-Chain settles	Per-operator nondeterministic; consensus is over the agreed output hash	Proof-of-Thought receipt verified on C

Tier 1 is precompile/inference/ and is left byte-identically unchanged by this LP; it is the complement, not a dependency. Tier 2 is the subject of this LP and LP-5301. A contract chooses the tier by which precompile it calls. Tier 1 returns tokens inline; Tier 2 returns an intent_id to be settled asynchronously and later verified.

The Bridge Law (normative)

THE BRIDGE LAW. A C-Chain consensus state transition MUST NOT depend on a live query whose result is not already committed or certified. Equivalently: the C-Chain StateRoot MUST be derivable without observing any live A-Chain process (its output, latency, or queue). A synchronous in-block call to A's live engine is FORBIDDEN.

The bridge law is realized by exactly two consensus-safe shapes, and no others.

Proof-of-Thought is not an independent mining authority

This LP governs cognitive tasks and receipts. LP-5200 governs subsidy-bearing Proof-of-AI mining. Their boundary is normative:

• A signed finite judgment or provider quorum proves attributable agreement; it may settle a task and earn demand fees.
• A Tier-1 deterministic inference executed on C is a C consensus operation; it does not create a local AI mining or issuance path.
• Only PoAI consensus on A-Chain may admit a useful subsidy-bearing mining job, validate that its bound computation was actually performed, consume its global work nullifier, and emit the issuance receipt. Z-Chain may batch and settle that finalized transition through the activated P3Q proof path, but it cannot originate a mining claim. Lux Quasar and the activated PQ validator policy secure the corresponding A-Chain and Z-Chain roots.
• A PoT receipt becomes subsidy-bearing only when it is incorporated into a finalized A-Chain PoAI mining receipt under LP-5200.
• A consumer or destination chain verifies the Z-settled, PQ-finalized A-Chain receipt. It MUST NOT accept a raw PoT quorum, model signature, TEE quote, local deterministic inference, or unrelated Z-Chain proof as a substitute for A-Chain mining finality.

Thus cognitive execution and settlement may be consumed on many chains, while the decision that work may create mining subsidy exists in exactly one place.

Pattern A — Submit a deterministic intent

A C tx writes a committed C-side outbox intent (a storage record keyed by a deterministic intent_id) and returns the id. The intent_id is a pure deterministic function of the C calldata and the C tx identity only — never of any A-Chain observation — so every validator executing the same C block derives the identical id. The intent is later imported by A's own consensus. Pattern A NEVER calls into or mutates the A-Chain.

Cite: precompile/aivmbridge/intent.go (DeriveIntentID, the preimage), precompile/aivmbridge/bridge.go (submitIntent), precompile/aivmbridge/achain_client.go (the rule in prose).

Pattern B — Verify a committed receipt

A C tx carries an A-Chain receipt and a Merkle inclusion proof as calldata. The C side deterministically verifies that the receipt hash is included under a receipt_root that C already holds committed in its own state (a checkpoint slot populated by the A→C atomic boundary / Warp), that it matches a pending C outbox intent, that its bound fields equal the intent's, and only then records the canonical output. Verification depends ONLY on C-committed state plus the proof — NEVER on a live A query. There is deliberately no GetInferenceReceipt(id) method: such a name invites the fork-unsafe live read.

Cite: precompile/aivmbridge/verify.go (the eight-step verifyInferenceReceipt), precompile/aivmbridge/proof.go (VerifyMerkle), precompile/aivmbridge/state.go (the committed receipt_root checkpoint set).

The two seams

Direction	Seam	What crosses	Trust imported
C → A	chains/aivm/import_c_intent.go ImportCommittedIntent	a committed C intent	a CCommitVerifier proof that the C tx reached finality
A → C	chains/aivm/export.go ExportReceipt → C verify	a settled receipt + Merkle proof	exactly one 32-byte receipt_root commitment

A is the producer of receipt_root; C is the verifier. No A-Chain trust is imported beyond that single root commitment.

Cross-Chain Wire (normative — pinned byte-for-byte)

The wire is the contract between the C precompile (precompile/aivmbridge) and the A-Chain (chains/aivm). It MUST be byte-identical on both sides or a receipt produced on A will not verify under the receipt_root C tracks, and an intent committed on C will not re-derive to the same intent_id on A. Both sides assert golden vectors at build time (aivmbridge/wire_test.go, chains/aivm/quorum_wire_test.go).

Domain separators

DOMAIN_INTENT  = "lux/aivmbridge/intent/v1"    (raw utf8, no length prefix)
DOMAIN_RECEIPT = "lux/aivmbridge/receipt/v1"    (raw utf8, no length prefix)

Cite: precompile/aivmbridge/intent.go:DomainIntent, receipt.go:DomainReceipt; A side chains/aivm/quorum_wire.go (same constants).

intent_id derivation

intent_id = keccak256(
    DOMAIN_INTENT
    || c_chain_id(32) || a_chain_id(32)
    || c_tx_hash(32)  || u32be(call_index)
    || caller(20)
    || model_spec_hash(32) || prompt_hash(32)
    || u16be(N) || u16be(threshold)
    || u256be(fee, 32)
)

Every component is fixed width, so the concatenation is unambiguous. c_chain_id / a_chain_id scope the id to exactly one C↔A rail (an intent created on one rail can never alias another). c_tx_hash + call_index make it injective per C tx call. caller + model + prompt + N + threshold + fee bind the economic payload so the id cannot be reused for a different request. No A-Chain input enters the preimage — this is what makes Pattern A consensus-safe.

Cite: precompile/aivmbridge/intent.go DeriveIntentID (C side, producer) and chains/aivm/quorum_wire.go ComputeIntentID (A side, re-derives + checks). The A importer rejects unless the recomputed id equals the committed id (import_c_intent.go step 1, ErrIntentIDMismatch).

AInferenceReceipt — canonical fixed-width encoding (355 bytes)

u16be(Version)            // = 1
IntentID(32)              // the C intent this receipt settles
TaskID(32)                // the A-Chain task id (beacon anchor)
CChainID(32) AChainID(32) // the C<->A rail binding (mirrors the intent)
Requester(20)             // the C caller the intent bound
ModelSpecHash(32) PromptHash(32)
CanonicalOutputHash(32)   // the agreed output digest (zero unless Completed)
u8(Status)
u16be(N) u16be(Threshold)
WinnersRoot(32)           // merkle root over winning operators
OperatorsRoot(32)         // merkle root over the full selected set
u256be(FeePaid, 32)
u64be(SettledAtHeight)

receipt_hash = keccak256( DOMAIN_RECEIPT || <that encoding> )

ReceiptEncodedLen = 355 is pinned on both sides; a drift in field widths/order is a compile/test failure, not a silent cross-chain mismatch.

Cite: precompile/aivmbridge/receipt.go (AInferenceReceipt, EncodeReceipt, DecodeReceipt, ReceiptHash, receiptEncodedLen); A side chains/aivm/receipts.go (AInferenceReceipt, Encode, Hash, ReceiptEncodedLen = 355).

Status codes

Value	Status	Actionable on C?
0	Unknown	No
1	Pending	No
2	Completed	Yes — only when CanonicalOutputHash != 0
3	Failed	No
4	Challenged	No

Only a receipt with Status == Completed and a non-zero CanonicalOutputHash is actionable on C; every other status carries no actionable output (fail-secure).

Cite: precompile/aivmbridge/receipt.go (the ReceiptStatus consts); verify.go steps 1–2 reject non-Completed and zero-output.

Pattern-B proof

AInferenceProof = { ReceiptRoot[32], Path [][32]byte, Index uint64 }

A standard fixed-arity (binary) keccak Merkle inclusion proof of leafHash(receipt_hash) under ReceiptRoot. leafHash(x) = keccak256(x) provides leaf-vs-node domain separation (a leaf preimage is 32 bytes, an internal node preimage is 64 bytes), hardening against second-preimage. Index MUST address a leaf within a tree of exactly len(Path) levels (no high-bit aliasing).

Cite: precompile/aivmbridge/proof.go (VerifyMerkle, hashPair, leafHash, MaxProofDepth = 64); A side chains/aivm/quorum_merkle.go (merkleRoot, merkleProof, VerifyReceiptProof, leafHash, merkleNode). Byte-equality of the two sides is asserted by aivmbridge/crossmodule_test.go TestCrossModuleMerkleSeam.

Cross-Chain Task and Receipt

Task (born from a committed intent)

An A-Chain task is the unit of cognitive work. It is created only from a committed C intent, under A consensus, by ImportCommittedIntent. There is no public "open a task from a request" RPC; createTask is unexported and reachable only through the verified import. Three structural guarantees prevent a forged or uncommitted intent from creating a task:

1. ID binding. The importer recomputes intent_id from the delivered fields (ComputeIntentID) and rejects unless it equals the committed id. Tampering with any field yields a different id → ErrIntentIDMismatch → no task.
2. Committedness proof. A CCommitVerifier.VerifyCommitted must return nil — true only if the intent actually reached C finality (a Warp/ZAP attestation or a state proof against a committed C block). The engine trusts the proof, not the transport.
3. Consensus-only call site. Import runs only from BuildBlock / Verify, so task creation is itself an A-Chain consensus event with deterministic state.

Plus anti-replay: a consumed intent_id is marked, so the same committed intent cannot create two tasks.

Cite: chains/aivm/import_c_intent.go (CIntent, CCommitVerifier, ImportCommittedIntent); chains/aivm/task.go (taskRecord, createTask, computeTaskID).

Task lifecycle (windows by A-Chain height — the only nondeterminism source; no wall-clock, no RNG):

Requested --createTask--> Committing --(commit window)--> Revealing
          --(reveal window)--> Settle --> Settled | Failed
commitDeadline = requestHeight + CommitBlocks
revealDeadline = commitDeadline + RevealBlocks

Challenged is a settled receipt later disputed (the cross-chain status), not a task lifecycle state.

Cite: chains/aivm/task.go (TaskState, lifecycle constants), quorum_engine.go (CommitBlocks = 30, RevealBlocks = 30).

Receipt (emitted on settle)

On settle the engine builds the AInferenceReceipt, hashes it (keccak(DOMAIN_RECEIPT || Encode())), and folds the leaf-hashed hash into the running receipt_root (an append-only keccak Merkle accumulator over all settled receipts in settlement order). The A→C boundary needs only this single 32-byte root; an exported receipt carries a Merkle proof of its receipt_hash under that root, reconstructed deterministically from settled on-state (a pure read; export never re-runs settlement).

Cite: chains/aivm/settlement.go (Settle → buildReceipt → appendReceipt), chains/aivm/receipts.go (buildReceipt, appendReceipt, ReceiptRoot), chains/aivm/export.go (ExportReceipt, reconstructReceipt).

A-Chain Quorum Settlement

The A-Chain runs a commit-reveal quorum settlement engine. Its settlement result — did ≥ threshold staked operators independently submit the same output_hash under the same ModelSpec — is what A-Chain consensus agrees on. Validators never run the model. The engine is a thin handle over two substrate interfaces (QuorumState + QuorumLedger) and the configured chain ids; all durable state lives in QuorumState, committed under A consensus at Accept. Methods are pure functions of (state, ledger, height), so they are deterministic and reproducible on every validator.

Cite: chains/aivm/quorum_engine.go (Engine, the protocol constants), chains/aivm/quorum_vm.go, chains/aivm/quorum_state.go.

Quorum parameters (normative)

Parameter	Value	Source
minN	3	smallest set where 2-of-3 is genuine agreement
maxN / MaxFanout	256	bounds selection + tally
Default N / threshold	N = 5, threshold = 3	recommended; N = 4 for high-value (4-of-4 stricter)
Threshold rule	floor(N/2)+1 <= threshold <= N	strict majority floor
MinProviderBond	1000 LUX (deployment-scaled)	sybil cost; forgery floor = threshold * MinProviderBond
Eligible-set margin	E >= N + max(RequestMarginFloor=2, N*RequestMarginBps/1e4) (RequestMarginBps = 5000 = 50%)	selection headroom
CommitBlocks / RevealBlocks	30 / 30	reveal opens strictly after commit closes
UnbondCooldownBlocks	60	bounds selection of an unbonding operator
RequestFeePerOperator	0.01 LUX (burned)	prices repeated/grinding submissions
SlashPerOperator	0.1 LUX	withholding penalty
SlashDissenters	false	honest disagreement is never punished

Cite: chains/aivm/quorum_engine.go (minN, maxN, MinProviderBond, SlashPerOperator, RequestFeePerOperator, RequestMarginFloor, RequestMarginBps, CommitBlocks, RevealBlocks, UnbondCooldownBlocks, SlashDissenters); task.go:createTask (threshold rule, margin enforcement); aivmbridge/bridge.go (MaxFanout = 256).

Deterministic selection beacon

N distinct operators are drawn from the eligible set E by a Fisher–Yates partial shuffle anchored in task_id (keccak sortition):

working = E (copy, in registry-insertion order)
for i in 0 .. N-1:
    j = i + ( u256(keccak256(task_id || u32be(i))) mod (len(working) - i) )
    swap working[i], working[j]    // selected = working[0:N]

task_id = keccak(av/task, requester, nonce, modelSpec, prompt, height, N, threshold), so the draw is fully reproducible after the task lands and identical on every validator — anyone can rebuild E and reproduce the exact selected set. Lux exposes no in-consensus randomness (no blockhash / prevrandao) to this layer, so the beacon is anchored only in values fixed at task creation. It is unbiased against any party that does not control the requester. It is not a cryptographic defense against a requester who grinds the opaque prompt_hash offline; that is mitigated economically (eligible-set margin + non-refundable fee + MinProviderBond forgery floor).

Cite: chains/aivm/selection.go (drawFromEligible, SelectOperators, the threat model), chains/aivm/task.go (computeTaskID).

Commit-reveal (operator-bound)

A two-phase commit-reveal prevents operators from copying each other's answers:

• Commit (height ≤ commitDeadline): a selected operator posts a commit hash. One commit per operator per task.
• Reveal (commitDeadline < height ≤ revealDeadline, strictly after commit closes): the operator reveals (output_hash, embedding_hash, nonce); the engine recomputes the operator-bound commit and rejects unless it matches.

The commit binds the operator address:

commit = keccak256( task_id(32) || model_spec_hash(32) || prompt_hash(32) ||
                    output_hash(32) || embedding_hash(32) || operator(20) ||
                    nonce(32) )

A peer who observes operator A's commit cannot replay it as their own (recomputation with their own address yields a different digest). Because the reveal window opens only after the commit window closes, no operator can see a peer's revealed output before its own commit is sealed.

Cite: chains/aivm/commit_reveal.go (CommitResponse, RevealResponse), chains/aivm/selection.go (ComputeCommit).

Tally and settle

Settle runs after the reveal window closes (height > revealDeadline), idempotently. It tallies revealers by output_hash and finds the plurality (a pure, total, deterministic primitive with a big-endian-smallest tie-break):

• Quorum reached (plurality group size ≥ threshold): canonical = that group's hash. Each winner is paid rewardPerOperator from escrow plus an equal share of the slashed pool (honest-majority bonus). Withholders (selected, committed, never revealed) are slashed; dissenters are NOT slashed (honest minority / nondeterministic-model plausible; slashing them would enable majority-cartel griefing). Task → Settled, receipt Completed.
• No quorum: task → Failed; the requester's full remaining escrow is refunded; withholders are still slashed and that wei is credited to the requester as compensation. Receipt Failed.

Money custody: bonded stake and reward escrow both live at EscrowAccount; all movement is balance mutation (Pull/Pay) — no value-bearing call, no reentrancy surface. The non-refundable fee flows requester → EscrowAccount → BurnAddress, so the escrow account nets zero for the fee. Slashed wei is reassigned from "stake" to "credit" inside the same account (never moved out), so the conservation identity `balance(EscrowAccount) == sum(stake) + sum(open escrow)

• sum(credit)` holds across the slash and the grand total over all accounts is constant. Settle is all-or-nothing: it plans the entire settlement as pure reads, pre-validates every overflow/underflow, and only then applies infallible writes — a planning failure leaves zero state change.

Cite: chains/aivm/quorum.go (plurality, tally), chains/aivm/settlement.go (Settle, planSlash, the atomicity contract, the conservation identity), chains/aivm/quorum_engine.go:BurnAddress.

Subsampled Cognitive Consensus

Subsampled Cognitive Consensus is the agreement layer over the quorum engine. It is repeated random committee sampling over structured outputs, never over prose. The chain agrees on a finite, hash-addressable value; the reasoning that produced it is carried as hash-addressed evidence (the embedding_hash and off-chain artifacts the prompt_hash/output_hash commit), not graded by consensus.

There are three consensus modes, each over a finite output space:

Mode	Output space	Agreement	Use
Exact-hash quorum	output_hash (any deterministic output)	plurality output_hash ≥ threshold	deterministic generation, classification, structured extraction
Preference metastability	{YES, NO, DELAY, UNSAFE}	plurality verdict ≥ threshold	judgment / safety gating / human-loop escalation
Market aggregation	a price (quantized)	plurality / median price ≥ threshold	forecasting, valuation, oracle-style estimates

All three reduce to the same plurality(hashes) >= threshold primitive: the canonical output hash is the hash of the canonicalized structured value (keccak of the verdict enum, the quantized price, or the raw deterministic output). This is why consensus is robust to per-operator nondeterminism: operators need not produce byte-identical prose, only the same structured decision.

Implementation note: the engine settles whatever output_hash the operators reveal; the mode is a convention on what the operators canonicalize before hashing, enforced off-chain by the ModelSpec and surfaced in the Beluga/Hanzo client SDKs. Cite: chains/aivm/quorum.go:plurality, chains/aivm/settlement.go:Settle.

Rationale = hash-addressed evidence. The chain never stores or scores a prose rationale. An operator's revealed embedding_hash and the off-chain artifacts addressed by prompt_hash/output_hash are the auditable evidence; a challenger re-runs and compares hashes. This keeps consensus over a finite space while preserving a full audit trail.

Model Registry

The model is identified by a weight-commitment hash (model_spec_hash) — ONE identity shared by C and A (the M role). Governance (the G role) adopts a versioned (version, weight-commitment) per model name; the inference precompile and off-chain provisioners read the adopted commitment to know the chain's canonical brain. Adoption is admin-gated; weight == 0 means none adopted.

Cite: precompile/modelregistry/registry.go (GetApproved, IsAdmin, setAdminState), precompile/modelregistry/module.go (model registry precompile at 0x0300…0002, selectors Adopt/GetApproved/IsAdmin/SetAdmin).

A task binds the model_spec_hash into both the intent_id preimage and the receipt, so a receipt produced by a different model can never settle the intent (the bound-field check in Pattern B rejects it). Model adoption is the governance lever that makes a Thinking Chain reproducible: only adopted weights are valid inputs to a Tier-1 call or a Tier-2 quorum.

Reputation and Eligibility

Eligibility is bonded-stake gated, per ModelSpec:

• A provider must keep >= MinProviderBond bonded to be in the eligible set E for a ModelSpec. The bond is the per-operator sybil cost.
• The eligible-set margin (E >= N + max(2, N*50%)) forbids degenerate pools and guarantees the draw is a strict subset of a larger universe — a single cheap operator is never the whole pool.
• Deregistration is followed by UnbondCooldownBlocks before a stake withdrawal, bounding the window in which an unbonding operator could still be selected for an unsettled task.
• Reputation is economic, not a score: consistent winners accumulate rewards + slashed-pool bonuses; withholders lose bond. The protocol does not maintain a separate mutable reputation number that could be gamed; the bond is the reputation.

Cite: chains/aivm/provider.go (registration/eligibility), selection.go (eligibleSet, the economic threat model), quorum_engine.go (MinProviderBond, UnbondCooldownBlocks, requiredMargin), task.go:createTask (margin enforcement, ErrEligibleBelowMargin).

Recursion Budgets

A Thinking Chain may recurse: an operator's reasoning step may itself submit a new intent (a sub-thought). Unbounded recursion is a DoS. The protocol bounds it on two independent axes:

1. Per-intent fan-out cap. N <= MaxFanout = 256 (calldata-hardened on C, maxN on A). A single intent cannot request an unbounded provider fan-out.
2. Economic depth bound. Every distinct intent costs N * RequestFeePerOperator (burned) plus N * rewardPerOperator (escrowed). A recursion tree of depth d and branching b therefore costs at least Σ b^k · N · (fee + reward) — recursion is priced super-linearly, so a runaway chain is bounded by the requester's balance, not by the validators' compute. The requester (the R role) funds the whole subtree from its A-Chain balance; createTask fails closed (ErrInsufficientFunds) the instant the balance cannot cover the next level.

There is no in-protocol recursion counter (it would be a mutable global that forks under reorg); the budget is the requester's balance and the per-level fee burn, both deterministic C/A state.

Cite: aivmbridge/bridge.go (MaxFanout, ErrBadFanout), chains/aivm/task.go:createTask (escrow + fee affordability, ErrInsufficientFunds), quorum_engine.go (RequestFeePerOperator).

Slashing

Behavior	Slashed?	Rationale
Selected, committed, never revealed (withholding)	Always	withholding attacks liveness; deterministic + observable
Selected, revealed a minority hash (dissent)	No (SlashDissenters = false)	honest disagreement / nondeterministic model; slashing enables majority-cartel griefing
Not selected	No	not accountable for this task

The slash is floored at the operator's remaining stake (never negative). Slashed wei stays in EscrowAccount (it was bonded there at register time) and is redistributed: to winners as an equal-share bonus on the quorum path, or to the requester as compensation on the failed path. The absolute forgery floor is threshold * MinProviderBond regardless of any selection grinding — below it forgery is impossible at any compute budget.

Cite: chains/aivm/settlement.go:planSlash (the policy), quorum_engine.go (SlashPerOperator, SlashDissenters), selection.go (the threshold * MinProviderBond argument).

Human-Loop Levels

Thinking Chains supports a 0–5 human-in-the-loop ladder. The level is a property of the consuming contract's policy, expressed through the consensus mode and the UNSAFE/DELAY verdicts of preference-metastability mode; the protocol provides the primitives, the contract chooses the level.

Level	Name	Human role
0	Autonomous	No human; the verified receipt acts directly.
1	Notify	Human is informed after the fact; no gate.
2	Veto window	Action is delayed; a human MAY veto within a window (DELAY verdict).
3	Approve	Action requires an explicit human approval tx before it executes.
4	Co-sign	Human and quorum must both attest (verdict + human signature).
5	Human-decides	The quorum only advises; a human makes the final on-chain decision.

UNSAFE from preference-metastability mode MUST escalate at least to Level 3 in any contract that consumes safety-relevant judgments.

Constitutional Rules (normative)

These rules are the invariants every Thinking Chains deployment MUST uphold.

1. Determinism of the C path. The C-Chain StateRoot MUST be derivable without observing any live A process. (The bridge law.)
2. Intent purity. intent_id MUST be a pure function of C calldata + C tx identity. No A-Chain input may enter its preimage.
3. Receipt authenticity. A C effect MUST be gated on a receipt_root that C holds committed in its own state. A root C has not recorded is untrusted and inert.
4. Bound-field equality. A receipt MUST settle only the intent whose model/prompt/requester/chain/N/threshold it exactly matches.
5. Single actionability. Only Status == Completed with a non-zero canonical output is actionable. Every other status is inert (fail-secure).
6. Single consume. An intent MUST settle at most once (double-consume guard on both C and A).
7. Task provenance. An A task MUST be created only from a committed C intent verified under A consensus — never from a live off-chain call.
8. Validators never infer. A-Chain consensus agrees only on the agreed output hash; no validator runs the model.
9. Structured outputs only. Consensus is over a finite, hash-addressable value space; prose is never graded.
10. Value conservation. Settlement MUST conserve value (the EscrowAccount identity and the grand-total invariant). No value-bearing call on the settlement path.
11. No punishment of honest dissent. Withholding is slashed; dissent is not.
12. Bounded recursion. Recursion MUST be bounded by fan-out caps and a requester-funded, super-linear fee/escrow burn — never by validator compute.
13. Model identity binding. A Thinking Chain is reproducible only against a governance-adopted (version, weight-commitment); a different model cannot settle the intent.
14. Install-once on-ramp. The C precompile's A on-ramp is installed once at boot with a non-zero rail peer id; it is never a runtime backend swap (LP-5301).

Security Considerations

The twelve attack vectors and their mitigations. Each maps to a constitutional rule and a code citation.

#	Attack	Mitigation	Citation
1	Live A read (synchronous in-block query to A's engine → fork)	No live-read method exists; Pattern B verifies committed C state + calldata proof only; deliberately no GetInferenceReceipt(id)	aivmbridge/achain_client.go (rule + naming note), verify.go
2	Direct A mutation (C Run() mutates live A state)	The precompile is a leaf library that cannot reach the node chain manager; Pattern A writes only C outbox; tasks created only under A consensus	achain_client.go, chains/aivm/import_c_intent.go
3	Intent replay (re-submit / reorg double-write)	intent_id is deterministic + injective per C tx; C outbox OutboxPending guard (ErrIntentReplay); A nsIntentSeen marker (ErrIntentAlreadyUsed)	intent.go, aivmbridge/state.go, import_c_intent.go
4	Receipt replay (re-use a settled receipt)	Double-consume guard: OutboxConsumed on C (ErrIntentConsumed), CEI order (guard precedes write)	verify.go steps 5–6, 8
5	Wrong model / wrong prompt (settle with a different model's output)	Bound-field equality check: receipt model/prompt/requester/chain/N/threshold MUST equal the intent's (ErrReceiptBindMismatch)	verify.go step 7
6	Pending → credit (act on a non-final receipt)	Only Completed + non-zero output is actionable (ErrReceiptNotCompleted, ErrZeroOutput)	verify.go steps 1–2
7	Forged proof (fake Merkle inclusion)	Root must be C-committed (ErrReceiptRootNotCommitted); leaf recomputed from receipt bytes (proof never carries the leaf); index high-bit aliasing rejected	verify.go step 3–4, proof.go
8	ZAP-without-proof (trust a transport nudge)	The routing hint travels only in the transport ZAP and is NOT consensus state, NOT in the intent_id preimage; the committed outbox is the only source of truth	bridge.go (routing hint handling), state.go
9	Install TOCTOU (race a late client re-resolution against in-flight Run())	Install-once CompareAndSwap guard + atomic pointer publish; second install errors	achain_client.go (InstallAChainClient, installed)
10	Calldata (smuggle bits / trailing junk / oversized frame)	Exact-length frames (reject short AND oversized); dirty-high-byte rejection on numeric words; fan-out bounds	bridge.go (readUint16Word, frame checks), errors.go
11	Beacon grinding (requester grinds prompt_hash to bias selection)	No in-consensus randomness exposed; economic mitigation: eligible-set margin + non-refundable fee + threshold*MinProviderBond forgery floor	selection.go (threat model), quorum_engine.go, task.go
12	Slash-grief (cartel slashes honest minority)	Dissenters are never slashed (SlashDissenters = false); only withholding is slashed; slash floored at remaining stake	settlement.go:planSlash, quorum_engine.go
+	Recursion runaway (unbounded sub-thoughts)	Fan-out cap N <= 256 + requester-funded super-linear fee/escrow burn; ErrInsufficientFunds fails closed	bridge.go (MaxFanout), task.go:createTask

Additional considerations:

• Nondeterministic inference is expected, not a fault. Consensus is over the agreed output hash via subsampled committees; a single operator's drift cannot move the canonical result unless it reaches a threshold-sized group.
• Commit grinding / answer-copying is prevented by the operator-bound commit and the reveal-after-commit window ordering.
• Atomic-boundary trust. The authenticity of a committed receipt_root rests on the A→C atomic import / Warp handler that writes the checkpoint; this is the one clearly-marked seam, never papered over (a root C has not recorded is inert).

Rationale

• Why mirror the DEX. The "X matches · C settles" split is already proven for the moving order book (LP-032, LP-9999). Cognition is the same shape: an off-chain process produces a result the full validator set cannot reproduce in-block, so C verifies a certified receipt instead. Reusing the pattern means reusing its safety proof.
• Why two tiers. Small models can be deterministic in-consensus and should be (Tier 1 is strictly safer and cheaper). Large models cannot, so they go to a quorum. One contract, one decision: which precompile to call.
• Why structured-only consensus. Agreeing on prose is undecidable and game-able; agreeing on a finite, canonicalized value is a plurality vote. The rationale is preserved as evidence, not as a consensus object.
• Why economic (not score-based) reputation. A mutable reputation number is a forkable global and a grinding target. A bond is deterministic state and a real cost.

Reference Implementation

Resource	Location
C→A bridge precompile (0x0300…0004)	github.com/luxfi/node/precompile/aivmbridge/
Intent wire + intent_id	precompile/aivmbridge/intent.go
Receipt wire + hash	precompile/aivmbridge/receipt.go
Pattern-B verify + Merkle proof	precompile/aivmbridge/verify.go, proof.go
C outbox + receipt-root checkpoint	precompile/aivmbridge/state.go
A-Chain quorum engine	github.com/luxfi/node/chains/aivm/quorum_engine.go
Selection beacon	chains/aivm/selection.go
Commit-reveal	chains/aivm/commit_reveal.go
Tally + plurality	chains/aivm/quorum.go
Settlement + slashing	chains/aivm/settlement.go
C→A import seam	chains/aivm/import_c_intent.go
A→C export seam	chains/aivm/export.go
Cross-chain wire (A side)	chains/aivm/quorum_wire.go, quorum_merkle.go
Task lifecycle	chains/aivm/task.go, receipts.go
Deterministic in-consensus inference (Tier 1, 0x0300…0003)	precompile/inference/module.go
Model registry (0x0300…0002)	precompile/modelregistry/registry.go

Related Work

• Zoo "Beluga L3" — the first prototype deployment of Thinking Chains (Zoo's AI L3). Beluga is the canonical reference consumer of this protocol; the Zoo ZIP specifies its chain parameters, model adoption set, and Beluga-specific human-loop levels on top of LP-5300 / LP-5301. (~/work/zoo/papers/beluga-l3-whitepaper/.)
• Hanzo "Cognitive Sidecar / Hanzo Engine provider" — the Hanzo HIP that specifies the off-chain operator side: how a Hanzo Engine instance serves as an A-Chain provider (the S role), runs the model behind the commit-reveal protocol, canonicalizes outputs per consensus mode, and bonds stake. The bridge law and the wire spec here are the contract that HIP's provider implements.
• Zoo "Thinking Chains" paper — the research framing: cognition as a chain of hash-addressed receipts, subsampled cognitive consensus, and the Proof-of-Thought construction. LP-5300 is the normative protocol realization of that paper on Lux.
• LP-5000 — A-Chain core (the chain this protocol settles on).
• LP-032 / LP-9999 — the DEX matches/settles template this protocol mirrors.

Copyright

Copyright (C) 2026, Lux Partners Limited. All rights reserved.

Licensed under the MIT License.