Docs

Oath Network is a private AI service you can check. The machine that answers cannot read your prompt, every answer comes back with a signed receipt, and three witness nodes verify that receipt. A witness that signs a forged receipt loses part of its stake.

It runs on Robinhood Chain: the receipts, the registry of machines that count, the witness bonds and the fee vault are contracts there.

Status: pre-launch. Nothing described here is live yet. The bench on the home page runs the receipt mathematics in your browser with sample keys; it is not the sealed service.

1. 1You type a question. No wallet, no signup.
2. 2Your browser checks the machine. It reads the hardware attestation and compares the code fingerprint before it sends anything.
3. 3The sealed machine answers. The prompt is decrypted inside the enclave only, and the answer is signed there.
4. 4You get the answer and a receipt. The proof sits beside the answer, never behind a click.
5. 5Three witnesses check the receipt. Two of three must agree.
6. 6The receipt becomes public record. Batched on Robinhood Chain. The prompt is not in it.

The first five answers each day are free and need no wallet. After that, answers are paid from a prepaid balance.

A receipt proves where an answer came from. It is public. It never holds the question or the answer.

• Receipt id and time
• Model name
• Code fingerprint of the sealed machine
• Hash of the hardware attestation
• Hash of the answer
• Salted hash of the prompt, which cannot be reversed
• The enclave's signing address and its signature
• Three witness signatures, once the round closes

What is never in it:

• Your prompt
• The answer text
• Who you are. A free answer needs no account at all

Checking a receipt needs nothing from us. Anyone can do it, in any language:

line    = id, time, model, fingerprint, attestation, promptHash, answerHash, signer   (joined by newlines)
digest  = keccak256(line)
address = recover(signature, digest)        secp256k1; the signature is r, s, v: 65 bytes, s in the lower half
genuine = address is the signer named, the registry lists it and its public day has passed,
          and the fingerprint and the attestation hash are the ones the registry holds for it

Change one character of any field and the recovered address changes. That is the whole test, and the bench on the home page lets you run it.

A witness signs more than a yes or a no. Its verdict is typed data that names the receipt's digest, the hash of the exact signature the receipt carried, and the verdict, under the bond contract's own domain. So a verdict cannot be lifted onto another signature, another contract or another chain.

• The answer is produced inside a hardware enclave: memory that the machine's own operator cannot read.
• The enclave proves which code it runs before it is given anything, and your browser checks that proof.
• We run the service and we cannot read your prompt either. The path is from your browser to the enclave.
• Every answer is signed by a key that was born inside the enclave.

What it does not mean:

• It does not mean “cannot be broken”. Enclaves rest on the chip maker, and published research has broken them with physical access to the server. We say hardware-attested and nothing stronger.
• It does not mean the model is right. A signed answer proves where it came from, not that it is true.
• It does not mean you are hidden on chain. Paying from a wallet is public.

Do not submit anything you could not bear to lose. “Hardware-attested” describes a mechanism, not a promise that it cannot fail.

A witness is a browser tab that checks receipts. The work is exact mathematics, so every laptop reaches the same result. You are paid for correct checks and for nothing else.

1. 1Stake the bond. 100,000 $OATH goes into the bond contract. It is the money a lie will cost you.
2. 2Leave the tab open. The tab is drawn into rounds at random from a public seed. Each round is a few milliseconds of work.
3. 3Get paid by the hour. Once an hour the pay pool is divided by correct checks. There is no fixed rate.

Three witnesses are drawn for each receipt from every tab that is on duty. The draw uses a public seed, so the operator cannot hand a receipt to a tab it likes, and a witness never learns who the other two are. Each one recovers the signer, checks the code fingerprint and the attestation hash, and returns the values it recovered, not just “valid”. Two of three must agree.

A witness sees

The receipt: hashes, the signer, the signature. The registry of machines that count

A witness never sees

The prompt. The answer. Who asked

Pay: once an hour, 40% of what the vault received is divided among witnesses by their correct checks in that hour. There is no fixed rate. When trading volume falls, pay falls with it, and it can be zero.

Sworn

0 to 99 clean checks

Steady

100 to 999

Trusted

1,000 to 9,999

Unbroken

10,000 and above

Rank comes from clean checks in a row. It changes nothing about pay or about the draw, and one signed forgery returns a witness to the first rank.

A witness could skip the work and answer “valid” every time. Most receipts are valid, so laziness would look like honesty. A planted forgery looks exactly like a real receipt until it is checked.

• A signature from the wrong key, a fingerprint that is not in the registry, or an attestation that does not match its hash.
• A witness who signs it has proven, on the record, that it did not check. Its own signature is the evidence.
• The contract verifies that evidence by itself. A cut never depends on our word.
• Planted receipts never count as real ones. They are removed from every public counter.

Planted forgeries

1 receipt in 20

First signed forgery

10% of what is staked

Second

50% of what is still staked

Third

All of what is left

Where a cut goes

Half to the witnesses who were right in that round, half burned

Exit

Seven days. Cuts reach back through the whole wait

A cut is a contract call that anyone can make. It carries the forged receipt and the witness's own signed agreement with it. The contract runs the registry's test on the receipt, recovers the witness's tab key from the agreement, and applies the cut only if the receipt is not genuine and the key is that witness's. We cannot cut a stake by decree.

Trading fees on the token and the platform fee on paid answers land in the same contract. The split is written into it at deployment. There is no owner, no pause and no way to withdraw around it.

40% Witness pay

Divided every hour by correct checks.

30% Buyback and burn

Buys $OATH on the open market and burns it.

20% Upkeep

The sealed machines, the free tier, the people.

10% Breach pot

Paid to whoever proves a sealed machine was read.

• A sealed answer is cheap. Open models running in GPU enclaves list between $0.10 and $3.00 per million input tokens (list prices, 12 October 2026).
• One ordinary chat turn on a mid-size model costs about $0.0004. The platform fee on it is under $0.0001.
• So in the first phase the vault is filled by trading fees, not by usage. We say it here because others hide it.

The breach pot:

• Each sealed machine creates a random secret when it starts and publishes only its hash.
• One tenth of every fee collects in the pot.
• Anyone who submits the secret itself is paid the pot by the contract. The only way to have it is to have read the machine's memory.

The launchpad we plan to use keeps one owner power: it can re-point a coin's future creator fees to another address, after a three-day notice that anyone can see on chain. Fees already inside the vault cannot be moved by anyone.

Name

Oath Network

Symbol

OATH

Supply

1,000,000,000, fixed, no mint function

Chain

Robinhood Chain (4663)

Launch

Fair launch on a Robinhood Chain launchpad, all supply on the curve

Team allocation

None

Presale, private round

None

Fee recipient

OathVault, a contract with no owner

Tiers:

Open: No wallet

5 sealed answers a day. Every receipt, every check

Holder: Hold 25,000 $OATH

20 sealed answers a day. Platform fee 10% instead of 20%

Witness: Stake 100,000 $OATH

Everything above. May run a witness tab, paid per correct check. Stake is cut for signing a planted forgery

What the token may never do:

• Buy a different answer. Holders and visitors get the same model and the same receipt.
• Buy a ruling. A witness with more stake is not drawn more often.
• Skip an audit. Every staked tab receives planted forgeries at the same rate.
• Pay for sitting in a wallet. Pay is for correct checks, and only for those.
• Carry a vote. The first version has no governance.

The team:

• No allocation is reserved for the team.
• No purchase is bundled into the launch transaction.
• Nothing is vested, because nothing is held.
• The team is paid from the 20% upkeep share, in public, on chain.

The token has not launched. Its address will be published on oathnetwork.tech first. Any address you see before that is not ours.

The sealed lane answers over one endpoint in the common chat-completions shape, paid from prepaid credits with an API key made in the app. Every response carries its receipt.

A plain request

Messages in the clear to our relay, which seals them to the machine for you. The relay therefore sees them. The response says so: x-oath-sealed: relay.

A sealed envelope

Your code encrypts to the machine's key, as the app does in the browser. The relay carries ciphertext only: x-oath-sealed: end-to-end.

Sealing a prompt yourself:

proof   = GET /v1/attestation?nonce=<32 random bytes>     signer, sealKey, fingerprint, signed by the machine
check   : the proof answers your nonce, is signed by its signer, and the registry counts that signer
shared  = X25519(yourOneUseKey, sealKey)
keys    = HKDF-SHA256(shared, salt = yourPublicKey + sealKey)       one for the prompt, one for the answer
box     = XChaCha20-Poly1305(keys.prompt, nonce, { salt, messages, max_tokens })
send    = POST /v1/chat/completions  { v: 1, model, signer, eph, nonce, box }
answer  = numbered sealed frames, then the receipt and the token counts, signed by the machine

The frames of an answer are numbered and each is authenticated, so a relay cannot reorder them, drop one or cut the answer short without your code noticing. The prompt hash in the receipt is salted with sixteen bytes only you hold: you can prove later what you asked, and nobody else can guess it.

What we, the operator, can do:

• Delay or refuse an answer. We run the entry point.
• Stop the service.
• Choose which models are offered.

What we cannot do:

• Read a prompt or an answer. They are decrypted only inside an enclave whose code your browser checked.
• Forge an answer. That would need the enclave's key.
• Pick the witnesses. The draw comes from a public seed.
• Cut a stake by decree. A cut needs the forged receipt and the witness's own signature, verified by contract.
• Move fees. The vault has no owner and no withdraw path.

The first version is not decentralised. The coordinator is ours. We will use that word only when independent operators run it.

Four things we must prove before launch:

1. 1The full attestation check runs in a browser, on a phone too, in under two seconds.
2. 2The browser reaches the enclave directly. If traffic had to pass through our own server in the clear, the claim “we cannot read it” would be false, and we would not make it.
3. 3The enclave capacity we use may be resold under its terms, with a second source ready.
4. 4The vault and bond contracts pass on a fork of the chain, including a cut driven by a real signed forgery.

If one of the four fails, the claim that depended on it is removed from the site before launch.

Phase 0: Proof

Attestation check running in a browser. Direct path from browser to enclave, measured. Resale terms confirmed, second source lined up. Vault and bond contracts passing on a fork. All four pass, or the claim that failed is removed from this page.

Phase 1: Sealed chat

Five free sealed answers a day, no wallet. The proof panel and “check it yourself”. Public receipt pages and receipt cards. Counters start at zero and count up from real receipts. No token yet.

Phase 2: Witness tabs

The witness tab, with test stake. Rounds, planted forgeries, hourly scoring. Ranks and the Perjury board. Paid credits: deposit, spend, withdraw. Still no token.

Phase 3: $OATH

Fair launch with the vault as fee recipient. Real stake replaces test stake. Hourly witness pay from the vault. The breach pot opens. The team buys nothing.

Phase 4: More work for the network

Developer API and SDK. Tabs run small open models for public jobs. Sealed judge: contracts verify a signed ruling. Independent coordinators. Only then: the word “decentralised”.

What we will not do:

• Launch the token before the chat works
• Show a counter that is not counted from the record
• Promise a pay rate
• Call enclaves unbreakable
• Add a channel outside our account, GitHub and the docs

• Enclaves depend on chip makers and can be attacked physically.
• Witness pay follows trading volume and can fall to zero.
• In the first version, witnesses add a second pair of eyes, not a new security layer: the asker already checked.
• We depend on outside enclave capacity.
• The first version is run by us. It is not decentralised yet.

These are on the home page too. A project that hides its risks section is telling you something.

Site

oathnetwork.tech

Account

@OathNetworkRH

Code

github.com/oathnetworkRH

App

app.oathnetwork.tech

Those are all of them. We have no other channel, no group chat and no support desk that messages you first. Anyone who contacts you in our name is not us.

Community-launched. Not affiliated with Robinhood Markets, any brokerage, any exchange or any social network.