IOI Vision & Economics Litepaper

The cryptographic labor economy is a market where work is routed, authorized, executed, observed, verified, disputed, paid, and settled through cryptographic state, authority scopes, receipts, artifact refs, and public commitments when needed.

The unit is not model access. The unit is authorized, evidence-backed work. The cryptographic part comes from authority signatures, policy-bound receipts, state roots, artifact hashes, delivery bundles, and settlement commitments — public roots only when trust requires it.

Modern models hallucinate, drift, and improvise. Blockchains do not negotiate. The structural mismatch between probabilistic reasoning and deterministic settlement is why autonomous software cannot yet safely hold authority over capital, credentials, or private data.

The prevailing fix bolts an LLM onto a wallet and hopes for the best — a dangerous coupling in which fuzzy logic controls hard money and the human absorbs every failure mode.

IOI takes a different approach. We do not try to make a model's private cognition deterministic. We make the boundary between reasoning and consequence deterministic. Inside the boundary, models reason creatively. At the boundary, every proposed action must pass through scoped authority, policy gates, tool boundaries, receipts, and verification before it can spend, deploy, message, mutate state, or settle.

We call this the Deterministic Execution Boundary, and the discipline around it process-level alignment: the running process is governed as a whole — its authority, state, and evolution — with every consequential effect gated at the execution boundary. It is the load-bearing idea of Web4.

Filtering a model's outputs is fragile. Constraining its actions is structural. As systems become tool-using, memory-bearing, and self-improving, prompt-level safety is the wrong layer to bet civilization on.

IOI shifts the alignment target from making the process of intelligence safe to making the consequences of intelligence governable.

The economy is credible because the architecture separates execution, authority, state, artifacts, storage, interop, and settlement into distinct, accountable owners. No single layer is asked to do everything.

A concrete trace. A team hires a code-audit service before a contract release: find the vulnerabilities, prove the tests ran, deliver a signed report. Here is what each step produces — and who owns the record.

Hypervisor can use local, cloud, or DePIN compute while keeping protected workspace state out of provider-readable plaintext by default. The node can compute against the workspace; the node must not become the plaintext custody domain for protected state.

Cryptographic Trusted Execution Envelopes (cTEE) split the workspace into public trunks, redacted projections, encrypted refs, private handles, capability exits, and private heads. Sensitive files, credentials, private memory, and final action authority stay with the user, wallet.network, local guardians, approved cryptographic operators, or an explicit confidential profile.

Automation can act without ownership — a Web2 bot can send an email — but it cannot be held accountable. Sovereign Act must carry the same canonical, replayable, settleable, remediable properties that Web3 gave to value.

Software-as-a-Service sells you a seat to a dashboard and asks you to supply the labor. Service-as-a-Software sells you the outcome. IOI calls this SaS, and it dissolves the structural waste of the SaaS era.

Developers no longer pay for 24/7 idle compute. Worker and service packages are referenced through Agentgres-governed artifact refs; the payload bytes may live on local disk, S3, Filecoin, CAS/IPFS, object stores, or provider blobs, and are hydrated only at the moment of execution. Storage holds bytes; Agentgres defines what those bytes mean, which policy created them, which authority can use them, and whether they can be replayed or restored. Users pay for verified success — if a worker fails the acceptance criteria, the provider wastes their compute, not the user's money.

Traditional hypervisors virtualize machines. Hypervisor virtualizes machines, workloads, private workspaces, and autonomous authority.

Hypervisor manages the infrastructure estate — machines, VMs, containers, microVMs, WASM workloads, images, volumes, networks, GPU pools, DePIN/cloud/local nodes, storage and cTEE posture, model mounts, receipts, replay projections, placement, cost, and health. HypervisorOS is the bare-metal node profile where the daemon is node root, Type-1-compatible for autonomous systems and a foundation for broader VM/container/microVM/WASM estate management. The day-one wedge is private persistent agents and workspaces; the substrate naturally grows toward the broader infrastructure-manager lane.

A layered ecosystem. Hypervisor is the runtime and infrastructure environment; ioi.ai is the control plane; aiagent.xyz and sas.xyz are sibling application surfaces. Beneath them sit the foundations — authority, operational truth, and public settlement — mapped below.

Not every action goes on-chain. Most runs settle first in Agentgres: accepted operations, receipts, state roots, artifact refs, delivery records, and replay state. IOI L1 receives only the commitments that require public trust — marketplaces, escrow, disputes, rights, reputation, registries, cross-domain proof, or user-requested public commitments.

Settlement also abstracts payment. Consumer and enterprise surfaces can accept fiat, credits, subscriptions, or contracts; under the hood, settlement translates approved payments into provider compensation, developer royalties, protocol fees, and dispute reserves when required. Users should not need to think in tokens.

The IOI economy is a triangle held in tension. Three stakeholders — each indispensable, each captured by the same canonical settlement event. No one's reward depends on another's loss.