Compute Contracts

Marketplace spec: https://github.com/publicdomainrelay/compute-contract

• Alice, Bob, and Eve are on the network
• Alice wants to issue a Compute Contract Request For Proposal (CCRFP)

• Bob has plenty of builder machines
• Eve wants to know what Alice is doing
• Alice has vouched for Bob
• Alice has denounced Eve
• Alice creates a CCRFP manifest
• Alice makes her CCRFP manifest available to the network
• Bob and Eve each issue a Compute Contract Bid (CCB) against the CCRFP

• Alice's policy engine sees that she's denounced Eve and vouched for Bob
• Alice prepares to accept Bob's bid by configuring her Workload Identity Federation (WIF) Role Based Access Control (RBAC) per Bob's bid.wif information

• Bob and Eve each issue a Compute Contract Bid (CCB) against the CCRFP
• Alice's policy engine sees that she's denounced Eve and vouched for Bob
• Alice issues a Compute Contract Bid Accept (CCBA) against Bob's CCB.
  1. TODO: CCBA
• Alice issues a x402 payment to Bob per info provided in his CCB.
  1. Using the CCBA AT URI and CID.
     1. TODO: ^ (first pass was using CCB, need CCBA)

npx awal x402 pay \
  https://builder.bob.example.com/ccr/${AT_URI}/${CID}

• Bob builds to the CCRFP manifest's spec and issues a Compute Contract Receipt (CCR) over the CCRFP, CCB, and CCBA
  1. TODO: CCBA in CCR

• Alice's user_data runs within Bob's compute and interacts with Bob's WIF to token exchange to get a token which will interact with the downstream service she configured her RBAC for.
  1. In our example we are leveraging a Workload Identity Reverse Proxy which enables calling XRPC createRecord against https://rp.fedproxy.com to proxy the POST to a PDS

• The record we POST is of type com.fedproxy.sshPublicKey which is also for use with https://fedproxy.com (aka the same repo, different service/binary it hits: https://github.com/publicdomainrelay/atproto-reverse-proxy)

• This SSH key registration allows us to expose an HTTP service to the internet. Also acting as service discovery.

ssh -NnT -p 2222 \
  -o UserKnownHostsFile=/dev/null \
  -o StrictHostKeyChecking=no \
  -o PasswordAuthentication=no \
  -R ${SERVICE}:80:127.0.0.1:8080 \
  ${HANDLE}@fedproxy.com

• The end result is auto HTTPS server coming from arbitrary compute

https://cfb3c8d2.johnandersen777.bsky.social.fedproxy.com