Compute Leasing

XE extends the block lattice with an on-chain compute marketplace. Consumers lease virtual machines from providers, paying XUSD. Providers earn XE emission rewards upon settlement.

Lifecycle

1. Consumer creates lease block — debits XUSD, specifying vCPUs, memory, disk, and duration
2. Provider creates lease_accept block — stakes XUSD collateral, provisions VM, gets attestations
3. Provider creates lease_settle block — earns XE, recovers stake, tears down VM

Cost Model

Two-stage calculation with provider price multiplier:

perHourMilli = vCPUs × 20 + ceil(memMB / 1024) × 10 + diskGB × 1
hours        = ceil(duration / 3600)
base         = ceil(perHourMilli × hours / 1000)   // min 1
scaled       = base × multiplierMilli
cost         = max(1, ceil(scaled / 1000))
stake        = cost / 5                             // min 1
XE reward    = cost

Provider PriceMultiplierMilli range: 500 (0.5×) to 10000 (10×), default 1000 (1×). Duration limits: 60s to 31,536,000s (365 days).

Attestations

• Signed timestamps from trusted timekeeper nodes
• Timekeeper keys stored in state chain under sys.timekeepers
• SHA-256(leaseHash || timestamp) signed with ed25519
• Max skew: ±10 minutes
• Median of valid timestamps used as canonical time
• Max 20 attestations per block
• Rate limited: 1 per peer per lease per 30s

VM Management

• Lima (QEMU-based) VMs with KVM acceleration
• Ubuntu 24.04 cloud images
• Cloud-init for SSH key injection
• ~21 second boot time
• VMs named xe-{leaseHash[:12]}
• Manager interface: Provision, Teardown, Exec, DialSSH, Get, List

SSH Gateway & Tunnel

• Protocol: /xe/tunnel/2.0.0
• SSH gateway authenticates via lease's AccessPubKey
• ProxyJump for end-to-end encryption
• HTTP tunnel endpoint: POST /tunnel/{leaseHash}/tcp
• Max 100 concurrent SSH connections

Economics

• XUSD is deflationary — burned when lease cost is debited
• XE is inflationary — minted on lease settlement (emission = cost)
• Provider price multiplier range: 500 (0.5×) to 10000 (10×), default 1000 (1×)
• Known 5:1 griefing ratio (stake = cost/5)

Provider Policy

Providers can filter incoming leases before expensive stake/attestation/VM-provision gates run. Five flags:

• --min-lease-duration — Go duration string (e.g. 5m)
• --max-lease-duration — Go duration string (e.g. 720h)
• --min-lease-cost — minimum XUSD cost (uint64)
• --max-lease-cost — maximum XUSD cost (uint64)
• --max-concurrent-leases — max active leases (uint64)

All default to zero (fully permissive). Gate runs in autoAcceptLease immediately after idempotency check. Defined in core/node/policy.go.

Performance Certificates

• ~60 second benchmark on startup
• Phase 1: 375M sequential SHA-256 iterations (CPU)
• Phase 2: 256 MB memory table + 1M random reads (memory)
• Score = 1.0 / elapsed_seconds
• 7-day validity
• Required for lease_accept blocks
• Broadcast via xe/certificates gossip topic