Your agent’s first build.

Point your coding agent at your node and ship an app on the network.

  1. 1
    Plant a node.

    Your agent gets a local endpoint, keys on your device, and a chain it can read and write.

  2. 2
    Hand it the starter.

    One file that describes the network the way an agent needs it: endpoints, the seven precompiles, how to deploy, how to ask for a signature, and an example app. TypeScript and Python SDKs alongside.

    Get the starter
  3. 3
    Ship to a grove.

    Deploy to your node, invite people into an apps grove, and the grove’s verified work starts scoring.

What’s wired today: TypeScript and Python SDKs, OpenAI and Anthropic API shape, EVM-compatible deployment, the Hermes agent runtime. The Commissary catalog in the app is partial; Season 0’s apps groves are where its first entries come from.

The Signature Ceremony.

Every signature, from you or from any agent or app acting for you, routes through a single approval step on your device. Undecodable transactions are blocked until you acknowledge them. One approval yields exactly one signature. Even the app’s own background helpers receive a derived, one-way key for messaging, never the custody key. We call this Human In Control.

Choose your level of proof.

Every job leaves evidence. Every settled job leaves an exportable receipt. The commitment tier is live today; the proof tier is a research preview and the enclave tier is not yet available, as marked below.

Standard · 1.0×

A committed fingerprint.

The worker commits to the result and stakes against it. Fastest and cheapest, with an exportable receipt. This tier is live on the testnet.

Proof · 1.5×

A cryptographic proof (research v1).

A research preview: the on-chain verifier checks a small reference circuit. Treat this tier as research, not a production guarantee; hardening is in progress, see SECURITY.md.

Enclave · 2.0×

A sealed hardware enclave.

Designed to run inside a secure hardware enclave with attestation. This tier is not yet available on the testnet.

Your data stays yours.

Sealed at rest with AES-256-GCM under a quantum-safe key exchange. Run the entire network on-premises or fully air-gapped. Federated learning lets the lessons travel while the raw data stays in the building.

Encryption and key exchange

  • AES-256-GCM encrypted storage at rest
  • CRYSTALS-Kyber + X25519 hybrid quantum-safe key exchange
  • HKDF-SHA-256 sub-secret derivation
  • Argon2id password hash

Where it runs

  • On-premises, behind your perimeter
  • Fully air-gapped, with no network at all
  • Ed25519 RFC 8032 signing
  • secp256k1 ECDSA for EVM compatibility

Familiar APIs, open specifications.

Drop-in compatible with the OpenAI and Anthropic APIs, so your tools work unchanged. 26 native precompiles from 0x0100 to 0x0202 (hosted inference, proof verification, deterministic Q16.16 compute, federated learning, agent operations, and signature checks), each listed below. EVM-compatible deployment on chain 40204. Memory-safe Rust throughout.

npm i @citratelabs/sdkpip install citrate-labs-sdk

Chain 40204 is live: call eth_chainId at rpc.citrate.ai and it returns 0x9d0c. Full reference at docs.citrate.ai.

Precompile addresses.

Every address below is generated from the chain source and its canonical address book, not typed by hand. Contract code calls a precompile like any address. The hosted inference family runs on the node's model runtime, so contracts cannot call it.

AddressWhat it doesStatus
0x0100ModelDeployRegisters a model with the node's inference runtime.Node runtime only
0x0101ModelInferenceRuns a registered model on the node's inference runtime.Node runtime only
0x0102BatchInferenceRuns several inference requests in one call.Node runtime only
0x0103ModelMetadataReads a registered model's metadata.Node runtime only
0x0105ModelBenchmarkBenchmarks a registered model's performance.Node runtime only
0x0106ModelEncryptionEncryption operations for model weights.Node runtime only
0x0107TensorCommitPoseidon commitment over a canonical-format tensor.Callable from contracts
0x0108InferenceProofVerifyVerifies a Halo2-KZG inference proof (research preview).Callable from contracts
0x0109MerkleVerifyTensorChecks Merkle inclusion in a Poseidon-committed tensor.Callable from contracts
0x010ATensorMatmulQ16Q16.16 matrix multiply, bit-identical on every machine.Callable from contracts
0x010BTensorDotQ16Q16.16 dot product.Callable from contracts
0x010CTensorSoftmaxQ16Q16.16 softmax.Callable from contracts
0x010DTensorReluQ16Q16.16 ReLU.Callable from contracts
0x010ETensorLinearQ16Q16.16 linear layer.Callable from contracts
0x010FTensorTransposeQ16Q16.16 matrix transpose.Callable from contracts
0x0110BelnapAggregateAggregates federated-learning contributions into a mean and a Belnap state per dimension.Callable from contracts
0x0111RoutingInferenceRoutes a query embedding through a fixed Q16 model to pick a mentor and adapter.Callable from contracts
0x0112LoraApplyApplies a LoRA adapter to a weight matrix, Q16.16.Active from genesis
0x0113LoraMergeMerges several weighted LoRA adapters, Q16.16.Active from genesis
0x0120Ed25519VerifyVerifies an Ed25519 (RFC 8032) signature.Callable from contracts
0x0121MemoryAnchorVerifyVerifies a nightly memory-anchor inclusion proof against its day commitment.Active from genesis
0x0122AgentOpsVerifies an agent's device links and device revocations.Active from genesis
0x0130FoldCommdVerifyVerifies a recursive-fold CommD proof (feature-gated).Callable from contracts
0x0200X402Eip712VerifyRecovers the signer of an EIP-712 typed-data signature.Callable from contracts
0x0201X402TransferAuthVerifyChecks an EIP-3009 transferWithAuthorization signature.Callable from contracts
0x0202X402BatchPaymentVerifyChecks a batch of payment authorizations.Callable from contracts

The canonical chain 40204 address book lists 98 contract addresses. Read them at docs.citrate.ai/chain/addresses.

Open source.

Citrate is open-core, and the whole chain and application layer are public today on GitHub. The infrastructure is Apache-2.0 open source; the commercial core is source-available under BUSL-1.1 and converts to Apache-2.0 on its Change Date.

NATThe model architecture. Memory-safe Rust, formally specified, public.
American Learning FederationThe cooperative that trains NAT through federated learning.
agentile-skillsThe engineering methodology, installable by anyone.

The reward simulator and its fairness invariants ship as tests. Every launch repository is public at github.com/CitrateNetwork; for enterprise or client deployments, contact hello@citrate.ai.

The network.

Citrate is an open market for AI work. Independent providers run inference and training jobs. Every result leaves a receipt you can audit. There are no hourly servers to rent and no lock-in. Anyone can join, every result carries a verifiable receipt, and your data stays where you put it.

Built, benchmarked, and running.

These numbers are checked into source and reproducible. The code, contracts, and specs are public — every number is verifiable directly.

100+​TLA+ specificationsAcross the public repositories, countable by cloning them.
98​Contracts live on testnetEvery contract address in the canonical chain 40204 address book, listed at docs.citrate.ai/chain/addresses.
7,292​Chain tests4,379 Rust and 2,913 Foundry in citrate-chain, measured at a pinned commit.
~750​TPS, derived (testnet)From the gas limit and ~2 s blocks, not yet benchmarked. Confirmation is probabilistic; checkpoint finality is specified, not running.
Common questions

What is verifiable compute, or proof of inference?

Every job on Citrate leaves evidence and an exportable receipt. There are three tiers: a committed fingerprint (live on the testnet), a cryptographic proof (a research preview), and a sealed hardware enclave (not yet available on the testnet).

Can my coding agent build on Citrate?

Yes. Point your coding agent at your node and it gets a local endpoint, keys on your device, and a chain it can read and write; the APIs match the OpenAI and Anthropic shape, with TypeScript and Python SDKs.

How does one human approval per signature work?

Every signature, from you or from an agent acting for you, routes through a single approval step on your device, and one approval yields exactly one signature. Undecodable transactions are blocked until you acknowledge them, and the agent never holds the custody key.

What does keys on device mean?

Your keys are created and held on your own machine, and Citrate Inc. never holds them or sees what you compute. Group messages are end-to-end encrypted and the relay only ever carries ciphertext.

Is Citrate open source?

Citrate is open-core, and the whole chain and application layer are public today at github.com/CitrateNetwork. Infrastructure is Apache-2.0 open source; the commercial application layer is source-available under BUSL-1.1 (converting to Apache-2.0 on its Change Date). Licensor: Citrate Inc.

Plant a node and build.

The SDKs are published and the testnet is open, so the first build is a prompt, not a migration.

Plant your nodeGet the agent starter