Bonsai Docs

Verification and disclosure

How an interesting result becomes a verified crash, and why the public never sees the exploitable details first.

01Anomaly reported by a worker
02Re-run in isolated verifier
033 independent reproductions
04CRASH VERIFIED (private)
05Maintainer receives full report
06Fix ships
07Public specimen + on-chain receipt

Three independent reproductions

When a worker reports something interesting, the coordinator re-runs it in a clean verification environment. A crash needs to reproduce on at least three independent workers before it affects rewards or shows up in the garden. This filters out flukes, machine-specific noise, and fabricated telemetry.

Coordinated disclosure

A verified crash is real information that could be abused before it is patched. The maintainers get the full report privately: the input, the trace, the reproduction steps. The public sees a sealed anomaly and nothing more. When the fix ships, the finding opens up as a specimen and the coordinator posts an on-chain receipt.

What this protects against

Fabricated results lose an operator their stake. Duplicate submissions earn nothing. Unverifiable output is discarded. The point of putting verification between the swarm and the rewards is that no single contributor's word ever moves money or reveals an unpatched vulnerability.