Compute Leasing

Lease lifecycle, cost model, attestations, VM management, and provider economics.

XE extends the block lattice with an on-chain compute marketplace. Consumers lease virtual machines from providers, paying XUSD. Providers earn XE emission rewards upon settlement.

[!WARNING] Nothing on this page can be exercised right now No compute providers are online — GET /providers returns an empty list. The lease block types, escrow, attestation and VM machinery described here are implemented and in the binary, but with no provider to accept a lease, none of it can run end to end on the live testnet. GPU leasing is not implemented at all.

Lifecycle

  1. Consumer creates lease block — escrows XUSD for the full cost, specifying vCPUs, memory, disk, and duration
  2. Provider creates lease_accept block — stakes XUSD collateral, locks the emission rate, provisions VM, gets attestations
  3. Provider creates lease_settle block — mints XE emission, recovers stake, burns the escrow, tears down VM

Two blocks cover the paths where that does not happen — the consumer's escrow is recoverable on both:

  • lease_cancel — the consumer withdraws a lease no provider accepted; the escrow is refunded in full
  • lease_settle never arrives — once the provider has abandoned the lease, the consumer submits lease_force_settle: full escrow refund, provider stake burned

A lease ends in one of six states: created, accepted, settled, cancelled, unfulfilled (force-settled), or expired (neither party acted; escrow burned after the refund window closes). Windows: LeaseSettleGrace 1 h (expiry → end of provider settle window), LeaseForceSettleGap 25 min (dead zone before the consumer force-settle window opens), LeaseEscrowExpiry 365 d (expiry → escrow burn deadline).

Cost Model

All amounts are micro-units. Single ceiling divide for the provider price multiplier:

perHourMicro = vCPUs × 20_000 + ceil(memMB / 1024) × 10_000 + diskGB × 1_000
hours        = ceil(duration / 3600)
cost         = max(1, ceil(perHourMicro × hours × multiplierMilli / 1000))
stake        = ceil(cost / 5)                        // min 1 µXUSD
XE emission  = max(1, ceil(cost × R_capped / 1000))  // µXE, rate locked at accept

Provider PriceMultiplierMilli range: 500 (0.5×) to 10000 (10×), default 1000 (1×). Duration limits: 60s to 31,536,000s (365 days).

Attestations

  • Signed timestamps from trusted timekeeper nodes
  • Timekeeper keys stored in state chain under sys.timekeepers
  • SHA-256(leaseHash || timestamp) signed with ed25519
  • Max skew: ±10 minutes
  • Median of valid timestamps used as canonical time
  • Max 20 attestations per block
  • Rate limited: 1 per peer per lease per 30s

VM Management

  • Lima (QEMU-based) VMs with KVM acceleration
  • Ubuntu 24.04 cloud images
  • Cloud-init for SSH key injection
  • ~21 second boot time
  • VMs named xe-{leaseHash[:12]}
  • Manager interface: Provision, Teardown, DialSSH, Get, List
  • VM access is SSH-only, through the tunnel — there is no exec API

SSH Gateway & Tunnel

  • Protocol: /xe/tunnel/2.0.0
  • SSH gateway authenticates via lease's AccessPubKey
  • ProxyJump for end-to-end encryption
  • HTTP tunnel endpoint: POST /tunnel/{leaseHash}/tcp
  • Max 100 concurrent SSH connections

Economics

  • XUSD is escrowed at lease creation, burned at settle, and refunded in full on cancel or force-settle
  • XE is inflationary — minted on lease settlement: emission = ceil(cost × R_capped / 1000) µXE, with the rate locked at accept (live epoch.0: r_effective 2000 ⇒ 2× cost)
  • Provider price multiplier range: 500 (0.5×) to 10000 (10×), default 1000 (1×)
  • 5:1 stake-to-escrow ratio (stake = ceil(cost/5)); an abandoned lease is recoverable via lease_force_settle, which refunds the consumer's escrow and burns the provider's stake

Provider Policy

Providers can filter incoming leases before expensive stake/attestation/VM-provision gates run. Five flags:

  • --min-lease-duration — Go duration string (e.g. 5m)
  • --max-lease-duration — Go duration string (e.g. 720h)
  • --min-lease-cost — minimum XUSD cost (uint64)
  • --max-lease-cost — maximum XUSD cost (uint64)
  • --max-concurrent-leases — max active leases (uint64)

All default to zero (fully permissive). Gate runs in autoAcceptLease immediately after idempotency check. Defined in core/node/policy.go.

Performance Certificates

  • ~60 second benchmark on startup
  • Phase 1: 375M sequential SHA-256 iterations (CPU)
  • Phase 2: 256 MB memory table + 1M random reads (memory)
  • Score = 1.0 / elapsed_seconds
  • 7-day validity
  • Required for lease_accept blocks
  • Broadcast via xe/certificates gossip topic