Skip to content
Tenzro
Preview

The layer between the machines and the work.

Tenzro is the open settlement and coordination layer for AI work, underneath the operators, AI factories, GPU networks, model providers, agent platforms and payment schemes that already serve it. It routes each call, carries the identity, delegated authority and policy behind it, settles it per call, and keeps a signed record of who asked, who served and what was paid. The code is open source under Apache 2.0. The network is in preview, and governance decides the steps to testnet and mainnet.
Join the network
Overview

How a call is routed, settled and recorded.

A call reaches one OpenAI-compatible API, is routed to a provider by price, latency and reputation, is served and metered on that machine, and settles per call against the receipt the machine signs. Its payment record binds the request, the quote and the price.
  1. Participants
    • Humans
    • Agents
    • Machines
  2. Services
  3. Rails
  4. Settlement
  5. Consensus
  6. Hardware
    • TPM 2.0
    • Secure Enclave
    • Passkeys
    • TEEs
    • GPUs
One network, one account, one settlement layer. Every layer is open source under Apache 2.0.
Why now

What changed, and why we rebuilt.

01

Tenzro DAG Consensus (TDC)

Our post-quantum consensus protocol. Every validator proposes in parallel each round, so no single leader limits the network.

  • A DAG design: every validator proposes in parallel each round, so throughput is not bound to one leader.
  • Post-quantum from the wire up. Validators talk over channels keyed by X25519 and ML-KEM-768, with a handshake signed by a session key, in ML-DSA-65 and P-256, that each validator's hardware key certifies at boot.
  • Finality certificates are signed with ML-DSA-65. Light clients, bridges and new nodes can carry them and check them, and they can be used to slash a validator that signs two conflicting checkpoints.
  • Certificates are compressed with STARK proofs.
  • Every vote and finality certificate needs an ML-DSA-65 signature, so none rests on a scheme a quantum computer can break.
02

Keys that live in hardware

Every key is rooted in a TPM, a Secure Enclave or a passkey. No private key is ever stored in the clear, and there are no seed phrases.

  • Every key is rooted in a TPM 2.0, a Secure Enclave or a passkey.
  • Any TPM 2.0 machine can run a validator. Signing keys are derived from the hardware on demand, used in memory and wiped.
  • Votes are signed with an in-memory session key that the hardware certifies once per epoch, so the hardware is never on the hot path.
  • People sign in with passkeys, and their identity is derived from the passkey itself. Once an account enrols its ML-DSA-65 key, every transaction it signs carries that post-quantum signature alongside P-256, and the chain refuses one without it.
  • Add more devices, or recovery signers, so losing one device never means losing the account.
03

Trust and provenance

Certification and ratings for models and operators, issued by anyone. You choose which issuers you trust and check the rest yourself.

  • Any party can certify or rate a model or an operator. Relying parties choose the issuers they trust.
  • Operators publish signed policies and are slashed for breaches of them, or of the SLAs they sign, once validators holding two thirds of stake agree.
  • Model weights are stored across multiple origins and verified by hash.
  • Compliance tiers come from credentials by issuers that each asset's policy names, not a central registry.
  • Trusted execution environments provide evidence that a workload ran untouched, verified against the Intel TDX, AMD SEV-SNP and AWS Nitro attestation chains, with NVIDIA GPU evidence accepted alongside a verified CPU attestation.
04

The Machine Economy

A compute price index signed by validators from what their routers observe, SLA-attested rentals and metered, per-use settlement, paid in TNZO or stablecoins.

  • A compute price index that validators sign from the prices and delivery their routers observe.
  • Compute claims, and SLA attestation, with rental billing on the chain's verdict.
  • Metered settlement by default: agents pay per use.
  • Stablecoin payments over x402 and MPP, with network fees priced in USD and paid in TNZO.
  • Payments on card, bank and processor rails enter the ledger as attested records from a bonded attestor, labelled, capped and kept apart from payments the chain proves.
05

Inference for any model

Prefix and state reuse for every architecture class, behind OpenAI-compatible APIs for chat, responses, embeddings and audio, with image and video generation on the same node's API.

  • Prefix and state reuse for every architecture class: dense, sliding-window, hybrid recurrent and state-space, mixture-of-experts, multimodal and media models.
  • OpenAI-compatible APIs for chat, responses, embeddings and audio, with image and video generation on the same node's API.
  • Requests route to providers you can filter by price, latency, location and verification level.
06

Closed by default

Open, owner and admin methods are separate. Anything that moves money or changes state needs a signature from the account that pays.

  • The RPC surface is split into open, owner and admin methods.
  • Anything that moves money or changes state requires a signature from the account that pays.
  • Every surface of a node answers to its access policy, and stored content is addressed by its hash.
Who does what

Every participant, one network.

Operators provide resources and are paid for the work they serve. Developers, organisations and agents use them through the same APIs.
Get involved

Join Tenzro Network.

Anyone can operate, build on or use the network. It is permissionless and open source. Tell us how you want to take part and we will help you get started.
ExploreJoin the network