Compute Contracts

Marketplace spec: https://github.com/publicdomainrelay/compute-contract

• Alice, Bob, and Eve are on the network

• Alice wants to issue a Compute Contract Request For Proposal (CCRFP)

• Bob has plenty of builder machines

• Eve wants to know what Alice is doing

• Alice has vouched for Bob

• Alice has denounced Eve

• Alice creates a CCRFP manifest

• Alice makes her CCRFP manifest available to the network

• Bob and Eve each issue a Compute Contract Bid (CCB) against the CCRFP

• Alice's policy engine sees that she's denounced Eve and vouched for Bob

• Alice prepares to accept Bob's bid by configuring her Workload Identity Federation (WIF) Role Based Access Control (RBAC) per Bob's bid.wif information

• Bob and Eve each issue a Compute Contract Bid (CCB) against the CCRFP

• Alice's policy engine sees that she's denounced Eve and vouched for Bob

• Alice issues a Compute Contract Bid Accept (CCBA) against Bob's CCB.

  • TODO: CCBA

• Alice issues a x402 payment to Bob per info provided in his CCB.

  • Using the CCBA AT URI and CID.

    • TODO: ^ (first pass was using CCB, need CCBA)

npx awal x402 pay \
  https://builder.bob.example.com/ccr/${AT_URI}/${CID}

• Bob builds to the CCRFP manifest's spec and issues a Compute Contract Receipt (CCR) over the CCRFP, CCB, and CCBA

  • TODO: CCBA in CCR

• Alice's user_data runs within Bob's compute and interacts with Bob's WIF to token exchange to get a token which will interact with the downstream service she configured her RBAC for.

  • In our example we are leveraging a Workload Identity Reverse Proxy which enables calling XRPC createRecord against https://rp.fedproxy.com to proxy the POST to a PDS

• The record we POST is of type com.fedproxy.sshPublicKey which is also for use with https://fedproxy.com (aka the same repo, different service/binary it hits: https://github.com/publicdomainrelay/atproto-reverse-proxy)

• This SSH key registration allows us to expose an HTTP service to the internet. Also acting as service discovery.

ssh -NnT -p 2222 \
  -o UserKnownHostsFile=/dev/null \
  -o StrictHostKeyChecking=no \
  -o PasswordAuthentication=no \
  -R ${SERVICE}:80:127.0.0.1:8080 \
  ${HANDLE}@fedproxy.com

• The end result is auto HTTPS server coming from arbitrary compute

https://cfb3c8d2.johnandersen777.bsky.social.fedproxy.com