Orrery Node

Why Orrery is different, in 28 seconds. Your agent pays as it goes. A payment is 152 bytes. The node never learns who's asking. The protocol takes 0%. Three of these screens are recordings: a live Claude Code session, the bytes Solana verified, and one request before and after my router. Hold $OREY and every answer costs less: 20% off from 0.1% of supply, 35% from 1%.

People assume paying for AI through a chain makes it slow. I timed it. One real request, my router to our seed node on mainnet: 2.2 s end to end. The router's share was 2.3 ms. Pick the node, check the channel, encrypt, sign the payment. No transaction on the way. The node cashes the signed total when it likes. Five in a row: 2.3 to 3.7 ms. The node's own checks are still inside the wait; I haven't split those out. $OREY changes the number being signed: 0.1% of supply takes a fifth off at our node, 1% takes 35% off. Your balance is read once a minute, not per request.

This is what paying for AI looks like here. 88 bytes. A tag, the channel, the total paid so far, a hash of every bill. My router signs them after each answer. The node hands the latest one to Solana when it wants its money. No invoice. No card on file. No account to suspend. The program checks one signature and moves the USDC. These are the real bytes from our public demo, slot 468,105,942. A router holding $OREY signs a smaller number: 20% or 35% less at our node.

Claude Code stamps every request with a device id, an account id and a session id. Fine when one company is on the other end. Not fine when the other end is a stranger's GPU. orrery-node 0.1.12 drops them before a request leaves your machine. Same for OpenAI's user field. The 15 headers never left in the first place. What the node gets: which channel pays, and one sealed block. It knows what to answer. Not who's asking. That's the network $OREY runs on. npx -y orrery-node@latest doctor

Five days on npm: 1,845 downloads of orrery-node. 390 of them yesterday. 13 releases. Nobody needs our permission to run it. No waitlist, no signup, no key. Fund a wallet, run one command, and your machine pays a GPU per answer on Solana. That's what $OREY sits on. Not a roadmap. A router people are already pulling down, that checks its own wallet for $OREY on chain and pays the holder price when it holds enough. npx -y orrery-node doctor

What $OREY does, in things you can check. Hold it and every answer costs less. Our node lists holder prices: 0.1% of supply is 20% off, 1% is 35% off. The node and your router both read your balance on chain. No signup, no tier page. Run a node and you can burn it. A node pledges a share of what it earns, buys $OREY with it and burns it. Routers check the burn on chain and send more work to nodes that keep their word. The code is shipped. No node has burned on mainnet yet, and I'll post the transaction when one does. The program takes 0% of what you pay a node. There is no field for a fee. A token should change what you pay or what you earn. Otherwise it's a logo.

orrery-node 0.1.10 is on npm. This is the privacy release. Audit a node yourself. orrery enclave verify --node reads a node's enclave claim from Solana, asks the node for the report its CPU signed, and prints each check on its own line: what held, what didn't. A receipt on every private answer. Each response names the enclave's hardware, the image it was running and the verdict your router reached. orrery sealed reads those records back from your own log. A router locked to private. Start it with --private-only and every request goes out sealed to a verified enclave, or doesn't go out. Also in this one: an agent's bill per job (orrery spend --by task), budgets that survive a restart, and orrery provider price for node operators. We ran the published package on a real AMD report. Four of the five checks passed. The fifth caught that the machine allowed debugging, so the node was refused. Eleven releases since Friday, each one with a rehearsal on the real program behind it. npx -y [email protected] doctor

Most privacy settings are a default someone can change. One flag in a config, one agent that picks the cheaper option, and the prompt goes out in the clear. So Orrery routers now have a lock instead of a default: orrery router --private-only With it on, every request is sealed to an enclave the router verified, or it is refused. A model suffix can't change that. A header can't either. If no verified enclave serves the model, the router says no. It never falls back to an open node. We tried to talk our own router out of it in the rehearsal. The request asked for the cheapest route twice, once in the model name and once in a header. It still went sealed, to the enclave. A model that no enclave serves got a 503. Put one private-only router in front of a team or a fleet of agents and nobody has to remember to ask for privacy. A policy says prompts should stay private. This makes the other path unavailable. In main, out with 0.1.10.

When an agent runs up a bill, whose records do you check it against? With a hosted API the answer is theirs. With Orrery it's a file on your own disk, and it just got more useful. orrery spend --by task The router's log now carries the job each answer belonged to, so you get a total per task. In the rehearsal: 43 answers, 2 of them in one named job, $0.000026 for that job. orrery sealed For every private answer the log keeps the check your router ran ahead of sealing: when, which model, which node, which hardware, which image, the verdict. And task budgets are now written to disk. Restart the router mid-job and the job doesn't get its budget back. The numbers in that log are the totals your router signed, the same ones the chain settles. A dashboard shows you a provider's view of your usage. This is your own. It's in main now and goes out with 0.1.10.

On most AI platforms the price is whatever the platform says it is. You find out on the pricing page, and so does everyone selling through it. On Orrery every node publishes its own price list, pinned on Solana. That makes it a market, and markets need a way to compete. So if you run a node, there is a new command today: orrery provider price --beat 10 --floor 0.03/0.12 It reads every other listing on chain and reprices your node model by model: 10% under the cheapest, never below your floor, never upward. It shows the plan before it touches your file. We ran it for an example node against mainnet. One model dropped to 10% under the current cheapest listing. One was already the cheapest and stayed put. One nobody else lists, so the price is the operator's to set. The :cheap route sends each request to the lowest price a router can verify, so a better price starts winning work as soon as it is on chain. A rate card is set in a meeting. This one is set by whoever shows up with a GPU.

"Your data is processed securely" is a sentence. We wanted something you can log. So every answer on Orrery's :private route now comes back with a receipt, as plain response headers: x-orrery-enclave: which hardware it ran on x-orrery-enclave-image: the exact image that machine booted x-orrery-enclave-verdict: what your router verified before it encrypted the prompt Your router writes the same three lines into its own log for every sealed request. A month later you can still show which machine handled each request, and what was checked at that moment. In the rehearsal the enclave is a software stand-in, and the verdict says so: "dev report accepted (local testing)". On mainnet that line is the hardware check itself. Lock icons are a design choice. A receipt per answer is a record. In main, in the next release.

orrery-node 0.1.9 is on npm. Ten releases in five days. What's new: Intel TDX. The built-in enclave verifier now covers Intel as well as AMD, each proven on a real report from that hardware. And orrery doctor prints that verdict next to each enclave on the network. A budget per job. An agent names its task once and sets a ceiling. Every call draws from it and the router stops the job at the limit. Works over MCP. For node operators. orrery provider check walks the path from your model server to getting paid and tells you what's missing. Burns on mainnet. A node with a pledge now buys the network token from its own wallet through Jupiter after each redeem, and burns it. A dry run shows what is due before anything is sent. Two releases a day is unusual. Two a day with 93 tests and a 52-step rehearsal behind each one is the part we care about. npx -y [email protected] doctor

If you run a GPU, the distance between "it works on my machine" and "it gets paid" is where most people give up. New for node operators: orrery provider check. One command looks at the whole path. Does your model server answer. Can routers reach your address, or only your own network. Does the listing on chain still match your price list. Does the node key hold enough SOL to redeem. What routers have signed to you and what you've already redeemed. And on SEV-SNP or TDX, whether a router would accept your enclave, using the same verifier routers run. In the rehearsal it passed one node and caught another whose model server had stopped while the node itself was still up. GPU marketplaces onboard you through a form and a review. Here the checklist is a command, and the only approval is a transaction you sign. In main with 52 rehearsal checks green.

10 November on Orrery, by the clock (UTC). Two releases on npm, 0.1.7 and 0.1.8, and 18 features in main between them. Every line in the timeline is a commit or a publish at the minute it went out. The short version of the day: Routers learned to skip a node whose model server is down. Burn pledges arrived: a node commits a slice of its earnings to buy-and-burn, and routers check every one of those burns on chain. Your computer now checks an enclave's hardware itself, on AMD by the afternoon and on Intel by the evening. Agents got a budget for a whole job. Rehearsal checks went from 44 to 51 and unit tests from 72 to 93. The program's fee is still 0%. Teams usually show a roadmap for the quarter. This is the changelog for a Tuesday.

Intel too. Earlier today Orrery learned to verify AMD SEV-SNP enclaves on your own machine. Tonight the router does it for Intel TDX as well. Same idea, Intel's chain of trust. The platform's certificate must lead up to Intel's own root key. Intel's quoting enclave must vouch for whichever key signed the quote, and that key must have signed this exact quote. After that come the three ties we already check on AMD: no debug mode, the expected image, the right encryption key. We ran it on a real quote from an Intel Sapphire Rapids machine: verified. Change one bit and it's refused. Swap the root and it's refused. AMD and Intel make the CPUs behind most confidential VMs you can rent. A node on either can now prove itself to your router with no attestation service in the loop. Privacy products usually pick one vendor and one verifier you have to trust. This is two vendors and a verifier you run. In main with 93 tests, out in the next release.

A node can write "I run in an enclave" into its listing. Writing it costs nothing. So orrery doctor now tells you what that claim is worth. For every node that claims an enclave it prints the hardware it names, whether your computer could verify it, and if not, the exact check that stopped it. In our rehearsal one node claims Intel TDX with a confidential GPU. Doctor's line for it: not verified, dev report, not hardware. Ask that network for a :private answer and the router refuses before your prompt goes anywhere. The :private route and doctor use one verdict. A node earns private traffic by passing the checks on your machine, never by what it says about itself. A badge on a website says "confidential". This says who checked, and what happened when they did. It's in main and goes out with the next release.

Letting an agent spend money is easy. Letting it spend only what a job is worth is the hard part. Orrery routers now have task budgets. The agent names the job and sets a budget once: x-orrery-task: refactor-42 x-orrery-task-budget: 0.05 Every call under that name draws from the same budget, and every answer comes back with what is left. When the remainder can't cover the next call's worst case, the router refuses it before anything is sent or paid. In the rehearsal: budget $0.000030, two answers paid, $0.000026 spent, the third call refused. The total can't be passed, because what is left becomes the next request's ceiling. It also works over MCP, so Codex, Claude Code or any agent can give itself a budget per task. Hosted APIs give you a monthly limit and a dashboard. This limit sits in your own router, per job, and holds to the last cent. All 51 rehearsal checks are green, and it ships in the next release.