mercmerc
A Mac Studio in studio light
private test canary

Approved accounts only. No real payments.

  • Apple Metal suppliers only
  • embed and batch_infer only
  • capacity and latency are limited
01 · arrival

a development-stage exchange implementation

Current advertised runtime projection: Candle/Metal on Apple Silicon only · exact supported job/model cells come from the runtime matrix.

No live-money, market-liquidity, signed-distribution, or physical-fleet claim. Local validators are prerequisites, not product proof.

02 · the studio

Studio

apple silicon on metal · this is the only currently advertised production runtime projection; physical fleet and sustained-performance gates remain open

03 · how it works
drop drop a workload · the pipeline is detecteddetected
cap priced before you spend · the cap you set binds at dispatchat dispatch
quote a quote before any spend at POST /v1/quotemax_usd
audit honeypot known-answer tasks · N-way majority votes0.25 floor
payout Stripe Connect transfer code exists; a real charge, payout, fee, refund or reversal, and reconciliation remain unprovenexternal gate
proof source-bound local contracts cover narrow mechanisms; physical hardware, money, and market outcomes stay explicitly opensee proof receipt
backends Candle on Metal for Apple Silicon is the advertised production runtimemetal only
executors embeddings and batch inference use exact admitted workload and model cellstwo workloads
headroom memory floors and historical benchmark observations are development inputs; current physical apples-to-apples, thermal, and buyer-workload gates remain openevidence pending
embeddings

$0.00029

usd · per 1,000 units · boot reprice from measured supplier economics (control/pricing.go), not a competitive-price or margin claim
05 · earn

earn

the agent can contribute eligible work while enabled · real supplier earnings and net hourly value have not been demonstrated

eligible work uses the same quote, task, verification, and settlement path as the native API

06 · release

download

closed alpha

There is no public download yet. The supplier agent installs with one command from the alpha build · the former macOS menu bar app is not present in this tree (only the seatbelt sandbox profile remains), and a notarized public release is not available.

the development catalogue is not public distribution

frozen production contract

What this canary does.

Product and buyer flow

Approved buyers authenticate, request a quote, provide bounded JSONL input, set a budget cap, submit through the native API, follow every job state, retrieve results, and optionally receive a signed webhook.

Supplier flow

An approved Apple Silicon supplier runs the sandboxed agent. Eligible work is admitted only through the pinned Candle runtime on Metal, with quiet-hours, memory, thermal, and operator controls enforced.

Workloads

Only embed with all-MiniLM-L6-v2 and batch_infer with the pinned Llama 3.2 1B revision are advertised. No other workload or model cell is promised.

Verification

Task receipts, attempt identity, model revision, known-answer sampling, redundancy, finalization, ledger entries, webhook events, and result retrieval form the trace. Conditions and failure records remain visible to the operator.

Security and privacy

Authenticated tenant checks, short-lived artifact access, revocable credentials, encrypted webhook secrets, attributed emergency actions, data export, deletion tombstones, and restore replay are technically exercised. Qualified review remains open.

Measured performance

Performance receipts are device, source, model, cache, load, and thermal specific. They describe one accessible Mac under measured conditions, not fleet capacity, a service-level objective, or guaranteed buyer latency.

Limitations

Private test canary only. No real payments, no public supplier fleet, no persistent external staging proof, no 24-hour qualifying soak yet, and no qualified legal, privacy, security, payments, operations, or release approval.

Canary access

Accounts and workers are allowlisted. Capacity, concurrency, budgets, held shadow payouts, and workload shapes are bounded. Operator kill switches can pause intake, dispatch, finalization, webhooks, or payment paths.

Docs and status

The source repository holds the API contract, runbooks, privacy drafts, canary terms, supply-chain policy, and exact evidence validators. Health is reported directly by the control plane.

merc · claims ledger
development previewno static proof countercurrent state: source-bound receipt
proofOnly a terminally passing ledger whose source fingerprint matches the current source may support a narrow local contract claim. Local tests do not establish market, live-money, physical-fleet, legal, or production-SLO outcomes.
queuethe job queue is a plain Postgres table claimed with FOR UPDATE SKIP LOCKED · no Kafka, RabbitMQ, NATS, or Redis in the dependency tree
binariestwo binaries at the core · a Rust supplier agent and a Go control plane · the buyer CLI is an optional layer; the former macOS menu bar app is not present in this tree
executorsthe current generated projection contains exact embed and batch inference cells on Candle/Metal for Apple Silicon
schedulertasks are sized for a 45 second runtime target · five hard filters gate every claim · quiet hours are enforced by the agent on the device itself
verificationhoneypot known-answer tasks, within-class redundancy, N-way majority votes · a 0.25 audit floor, so even the most trusted supplier is spot-checked about one task in four · a failed honeypot docks reputation, claws back the credit, and quarantines the supplier
quotea quote before any spend at POST /v1/quote · the max_usd cap set at submission is enforced at dispatch, pausing the job before the cap is breached
payoutsheld-credit, transfer, and reconciliation code exists; no real charge, supplier payout, processor fee, refund or reversal has been accepted as evidence.
railsconfigured Stripe code is not proof that money moved. Production-money evidence remains an external gate.
identitybuyer export, deletion, tombstone replay, and cross-tenant denial are technically exercised; authenticated delivery, subprocessors, qualified privacy review, and production operation remain open gates.

current claim state is established only by a terminal receipt from scripts/prove-local.sh