Layer 01Containerized Environment
Pinned CUDA 12.0 runtime with production-verified tuning.
Every worker is shipped as a sealed OCI image with a pinned CUDA 12.0 runtime, driver-floor enforcement, and a curated kernel-tuning manifest. There is no in-place driver upgrade path — replacement workers ship with a new tagged image or they do not ship at all.
CUDA 12.0OCI-signedDriver-floor pinned
Layer 02Immutable Infrastructure
No runtime hot-swaps. Every release is cryptographically signed and tag-pinned.
Workers and orchestrators never patch themselves in place. Each release is built reproducibly, signed with our release key, and pinned by tag in the allocator's manifest. Rollback is a tag flip — never a hand-edit on a running host.
Cosign verifiedTag-pinned manifestReproducible builds
Layer 03Automated Fast-Sync Overrides
Bootstrapped chain archives eliminate server-hop sync delays.
Cold-starts pull a verified archive snapshot from the nearest mesh edge instead of replaying the chain peer-by-peer. The snapshot is hash-checked against the signed release manifest before the worker is allowed to attach to a payout address.
Edge snapshotsManifest-checkedSub-minute cold start
Layer 04Autonomous Spot-Market Allocation
The allocator locks the cheapest qualified worker before your container ships.
A continuous bidder walks the mesh's spot inventory, filters on driver floor, thermal headroom, and uplink class, then locks the cheapest match against a signed lease. Margin gating happens server-side; the public API never sees the underlying provider quote.
Signed leasesMargin-gatedProvider-blind
Layer 05Hard-Capped Thermal Routing
Workers are migrated off hosts that breach per-class thermal ceilings.
Telemetry samples are graded against a per-class thermal ceiling. A breach drains the worker, signs a migration receipt, and rehydrates on a healthy host without losing the active payout binding. No silent throttling.
Per-class ceilingsDrain-and-migrateReceipted moves
Layer 06Custody-Free Payout Plane
Payout addresses are injected as env, never persisted to host disk.
Wallet addresses are passed to the container as USER_WALLET at boot, kept in memory for the lease duration, and discarded when the worker drains. Arca Grid never takes custody of the underlying funds.
No host persistenceMemory-onlyCustody-free