Recursive Autonomous Mesh for Policy-Aware Acceleration, Governance, and Evolution
Rampage turns the hardware you already own into a private, evidence-bearing compute fabric—then adds an autonomous intelligence layer that can improve how work is planned without ever inheriting the authority to run wild.
One installer. Desktop shortcut included. Release notes and SHA-256 · All releases
Launch the showcase · Architecture · Easy pairing · Security · 0.2.2 release evidence · Owner-relay evidence · Resumable-storage evidence · Native distribution · Mobile edge · Mobile evidence
Install Rampage on an owner PC. Install it on another machine. Choose Join my fabric, compare the same four digits on both screens, and approve once on the owner PC. There are no addresses, accounts, terminals, or secrets to copy. Rampage discovers usable CPU, GPU/VRAM, RAM, storage, power, thermals, runtimes, and local Ollama models automatically—then moves bounded work to the machine that can actually perform it.
| The old constraint | The Rampage move |
|---|---|
| A powerful desktop sits idle while another machine struggles | Place the whole job on the best available node |
| Small machines cannot host the full workload | Give them restart-tolerant shards, preprocessing, evaluation, cache, or relay work |
| Donated disks become brittle network mounts | Turn them into encrypted, resumable, content-addressed artifact capacity with independently signed repair evidence |
| “Autonomy” quietly becomes administrator access | Let intelligence propose; let deterministic Rust policy decide |
| Distributed systems fail opaquely | Sign leases and receipts, fence stale work, and write every transition to a hash chain |
| A kill switch depends on the system it is stopping | Keep STOP local, non-agentic, and independent of the controller and network |
The result: more useful compute, less wasted hardware, and an autonomous system whose ambition is separated from its authority by construction.
Rampage 0.2.2 is the current Windows x64 pairing candidate. It combines the established compute, mesh, storage, and gateway foundations with zero-copy nearby enrollment, durable worker identity, private-network firewall setup, and a self-contained packaged 3D Arena. Evidence links distinguish automated and packaged proof from the still-pending physical laptop and phone gates.
| Proof surface | Validated result |
|---|---|
| Trust kernel | Scoped Ed25519 leases; durable one-shot nonces; restart-safe monotonic epochs; crash-reconciled native STOP fencing; fail-closed admission and sidecar auth isolation |
| OnePool | Three independent evaluation shards placed across bounded offers, completed with signed results, and recovered after restart |
| Private mesh | Authenticated direct QUIC plus a forced-relay proof through the bundled owner-operated relay; no third-party overlay account or silent public relay |
| Storage fabric | Encrypted chunked CAS, flushed restart-resumable QUIC frames, full-content possession proofs, corruption quarantine, budgeted independent repair, staging, and retrieval |
| Real AI workload | OpenAI, Anthropic Messages, and OpenRouter-style text requests crossed authenticated QUIC to a worker's loopback Ollama, streamed back, and ended in a transcript-matched signed receipt |
| Universal capability contract | Signed offers advertise exact workload domain, adapter, operation, execution pattern, isolation, runtime digest, and qualification status; candidate profiles grant no authority |
| Autonomous self-scan | Stable evidence digests cover routes, links, failures, denials, thermal/battery pressure, capability gaps, idle capacity, and protected-artifact replication |
| Compute Strategy | Read-only Maximum Model, Speed Boost, Throughput, Efficiency, and Autonomous placement previews with exact capacity and qualification blockers |
| Packaged product | Native Tauri shell, role-aware system tray, close-to-tray, start-at-login, governed sidecars, clean explicit shutdown, installer, and automatic desktop launcher |
| Verification | Rust, desktop, TypeScript SDK, Python intelligence, Python SDK, deterministic universal-gateway, forced-relay mesh, packaging, and lifecycle gates |
The packaged 0.2.2 qualification record—including artifact hashes and the unsigned-release boundary—is in the current release evidence. The original 0.2 record remains in its immutable evidence page. The newer API, workload-contract, self-scan, and signed-canary campaign is recorded separately in universal-compute evidence. The self-hosted hard-NAT fallback and its forced-relay transport proof are recorded in owner-relay evidence. Restart-safe two-node protected storage, signed possession challenges, and autonomous repair are recorded in resumable-storage evidence.
flowchart LR
H["Human owner"] --> X["Fabric Arena · Ops Grid · CLI · SDK"]
X --> C["Controller\nintent · scheduling · recovery"]
I["Intelligence plane\nDBOS · Pydantic AI · scientific memory"] -. "typed proposals only" .-> C
C --> G["Governor\ndeterministic Rust policy"]
G --> L["Signed capability leases\nexpiry · scope · fencing"]
L --> W1["Command rig\nCPU · GPU · Ollama"]
L --> W2["Spare PC\nshards · cache · storage"]
L --> W3["Edge class\nforeground-safe work"]
W1 <--> M["Authenticated QUIC mesh"]
W2 <--> M
W3 <--> M
M -. "hard-NAT fallback only" .-> R["Owner relay\nsigned admission · rate caps"]
M <--> A["Encrypted artifact fabric\nresumable · content-addressed · self-repairing"]
C --> E["Hash-chained evidence ledger"]
G --> E
W1 --> E
W2 --> E
W3 --> E
S["Independent local STOP"] -. "revokes authority" .-> G
classDef mint fill:#102a28,stroke:#67f5c5,color:#f4fff9,stroke-width:2px;
classDef trust fill:#211b2d,stroke:#c7a7ff,color:#fbf8ff,stroke-width:2px;
classDef node fill:#101722,stroke:#728199,color:#f6f9ff;
class G,L,S trust;
class X,C,I,M,A,E mint;
class H,W1,W2,W3 node;
The narrow waist is the capability lease. Interfaces above it can become dramatically smarter; devices and engines below it can become dramatically more diverse. Neither change bypasses policy.
That waist is durable, not merely signed. A normal controller restart preserves the current authority generation and recoverable work. Owner STOP advances the hash-chained generation; controllers reject old claims and receipts, while workers and artifact gateways persist consumed nonces and the highest epoch they have observed so replay remains denied after restart.
Remote memory and VRAM do not become magically coherent across commodity networks. Rampage instead pools the parts that are useful in the real world:
- Place a complete workload on one capable device.
- Split independent map, evaluation, rendering, preprocessing, or search tasks into a bounded shard set.
- Add replicas where throughput or evidence benefits.
- Prefer data-local execution and encrypted artifact movement.
- Admit multi-GPU or cross-host model sharding only after a specific engine/topology adapter proves it wins.
Phones and tablets are not pretend GPU servers. Their best future contribution is thermally bounded, foreground, restart-tolerant work: data preparation, scoring, validation, sensor processing, relay, cache, and small-model inference. Console support remains constrained by platform-holder policy.
The current native mobile source narrows that expansion vision to two adapters that are implemented and safe to preempt today: hashing and independent evaluation shards. The app reads battery, external power, low-power mode, thermal pressure, foreground lifecycle, and phone/tablet identity from Kotlin on Android or Swift on iOS. It offers CPU for 20 seconds at a time and stops locally on pressure, lifecycle loss, network failure, or owner STOP.
The screenshot is the real React interface in its labeled browser showcase state. Native packages replace the demonstration values with direct platform telemetry. The worker runs in-process—no mobile daemon, shell, model server, protected replica, public marketplace, or ambient background authority. See Rampage Edge for the trust flow and exact platform boundary, and the mobile evidence record for source-bound Android ARM64 and Apple-silicon iOS simulator build proof, artifact identities, checksums, and release exclusions.
The desktop now defaults to Maximum Model and exposes five explicit ways to use added compute:
| Toggle | What Rampage optimizes |
|---|---|
| Maximum Model | Largest compatible aggregate model-memory placement |
| Speed Boost | Fastest evidence-supported single chat; slow distributed links are rejected |
| Throughput | Independent replicas for many concurrent users or agents |
| Efficiency | Smallest qualified placement that fits |
| Autonomous | Proposal-only strategy adaptation behind Governor gates |
The planner reports visible versus compatible memory, requested weights plus KV cache, selected ranks, parallelism, predicted speedup, and the exact missing qualification. Planning remains read-only. Separately, the shipped whole-model lane can select an exact installed Ollama model on one contributor, mint a one-shot model-session lease, stream it over authenticated QUIC, and expose the result through bounded OpenAI, Anthropic Messages, and OpenRouter-style text APIs. Cross-host tensor and pipeline launch remain gated until a backend proves runtime, topology, isolation, recovery, and measured benefit.
rampage model-plan local/70b-quantized --weights-gib 40 --kv-cache-gib 4 --strategy maximum-model-size
rampage model-plan local/fast-chat --weights-gib 20 --kv-cache-gib 2 --strategy speed-boostSee Model Fabric for planner rules and topology thresholds, and Universal compute for the operation-exact workload contract, API surfaces, self-scan, and honest device roles.
“Universal” does not mean pretending that every program can consume remote RAM or VRAM. It means one signed capability language, one trust kernel, one evidence spine, and a growing set of qualified adapters that can move the right unit of work to the right class of machine.
| Lane | Useful today | Expansion path and honest boundary |
|---|---|---|
| Local AI | Discover installed Ollama models, select one qualified worker, stream a bounded chat through OpenAI, Anthropic Messages, or OpenRouter-style APIs, and return a transcript-matched receipt | Maximum Model can plan compatible aggregate memory, but cross-host tensor/pipeline execution stays blocked until an engine-specific adapter proves topology, recovery, and speed |
| Agent swarms | Run independent searches, evaluations, transforms, and tool-safe shards concurrently; require a signed result and an explicit success threshold | New adapters inherit the same lease, nonce, epoch, STOP, and receipt contract rather than gaining ambient machine access |
| Production | Place independent builds, renders, transcodes, simulations, preprocessing, and batch transforms where a shipped adapter advertises the exact operation | Interactive application memory does not become a network DIMM; large workflows must expose schedulable stages or engine-native distributed execution |
| Gaming | Preserve the foreground gaming PC by routing eligible background AI, compilation, capture processing, media conversion, server simulation, and cache work elsewhere | Rampage does not claim that an arbitrary game can borrow another device's VRAM or increase FPS without game/engine support |
| Phones and tablets | Native source implements foreground-safe hashing and independent evaluation shards under thermal, battery, network, identity, and restart-tolerance limits | More adapters require their own proof; mobile CI candidates are not store releases, and consoles require platform-holder permission |
| Donated storage | Encrypt, resume, verify, retrieve, and repair protected whole-artifact replicas across owner-controlled nodes | Current source caps an artifact at 64 MiB and uses full replicas; erasure coding and physical-loss campaigns are future qualification work |
This separation is deliberate. Rampage can become broadly useful without selling users a fake shared-memory story, and every new backend must earn admission with deterministic tests and signed runtime evidence before the Governor can lease it.
Rampage owns the complete desktop lifecycle: sidecars, policy state, local discovery, the system tray, start-at-login, emergency STOP, explicit shutdown, and the desktop launcher. A normal user installs the app, creates a fabric, lets each new machine wait nearby, compares four digits, and approves it once. The full signed invite is encrypted directly between ephemeral device keys and is never displayed or copied. Capability discovery does the rest.
| Platform lane | Native deliverables | Current qualification boundary |
|---|---|---|
| Windows x64 | MSI and NSIS installers; automatic desktop shortcut; Start-menu entry; role-aware tray; bundled sidecars | Packaged 0.2 was qualified on Windows 11 x64 but remains unsigned; fresh Windows Server 2022 candidate builds do not substitute for Windows 10 evidence |
| Linux x64 | Debian package and AppImage with the same Tauri shell and native sidecars | Fresh Ubuntu 24.04 candidate gate; stable repository/AppImage signing remains channel-specific |
| macOS Apple Silicon | Native app bundle and DMG | Fresh macOS 15/M1 candidate gate; stable publication requires Developer ID signing, Gatekeeper acceptance, notarization, and a stapled ticket |
| Windows 10 x64 | MSI/NSIS lifecycle, desktop shortcut, tray, sidecars, restart, STOP, and uninstall campaign | Deliberately unqualified until a real self-hosted Windows 10 runner completes the fail-closed workflow |
| Phones and tablets | Native Tauri app; Kotlin/Swift telemetry; in-process Rust worker; source-bound Android ARM64 and Apple-silicon iOS simulator candidates with published checksums | Unsigned CI candidates are not store releases; physical-device signing and lifecycle qualification remain separate gates |
Every staged candidate carries SHA-256 checksums plus a source-bound distribution manifest. Non-pull-request artifacts can receive GitHub OIDC provenance attestations, but provenance is not a substitute for platform identity. Stable Windows and macOS workflows therefore refuse to publish when their real signing credentials or native verification steps are missing.
See Native distribution and the live platform matrix for exact build environments, verification commands, credential contracts, and the difference between a candidate, a signed stable release, and a physically qualified operating system.
The intelligence plane runs a durable improvement loop:
Record → Analyze → Mutate → Prove → Audit → Gate → Enshrine
DBOS workflows make the process recoverable. Pydantic AI adapters produce typed proposals. Scientific memory keeps experiments content-addressed. Deterministic replay, holdouts, adversarial review, replication, shadow, and canary gates determine whether an idea earns promotion.
The sidecar API fails closed when its authentication token is absent. The desktop gives it a fresh independent token rather than the controller credential, so proposal-plane compromise does not inherit controller admission, enrollment, STOP, storage, or lease authority.
There is no per-change approval prompt inside an owner-defined autonomy envelope. Candidates that pass every deterministic threshold may request a signed, traffic-capped, epoch-fenced canary lease from the Rust Governor and automatic rollback. Authority-critical changes, path escapes, and any attempt to widen that envelope are automatically denied—not queued for an AI to approve itself.
The model cannot mint leases, enroll peers, edit the Governor, access signing keys or secrets, promote itself, authorize destructive tools, change financial policy, or bypass STOP. Missing or ambiguous evidence fails closed.
- Download the current Windows installer.
- Open the Rampage shortcut created on the Windows desktop.
- Choose Create my fabric on the main machine.
- On the laptop, choose Join my fabric and Find my fabric. It can wait while you move back to the main PC.
- On the main PC, choose Add machine. Confirm the same four digits and press Codes match—approve.
- Rampage securely enrolls and restarts the laptop automatically. Leave contribution limits on automatic or tune them. Press STOP whenever you want the node back.
The nearby flow uses only the private LAN. If Windows asks, allow Rampage on private networks. The complete invite remains available under Advanced for segmented networks where local discovery is intentionally blocked. See Easy and secure pairing.
Closing the window keeps the governed fabric alive in the Windows system tray. Left-click the tray icon to restore it, or right-click for role status, Start with Windows, emergency stop, and an explicit Quit that releases the desktop-owned sidecars. Auto-start launches quietly into the tray.
The current binaries are unsigned release candidates. Verify the published SHA-256 checksums and expect Windows reputation warnings until ObtuseAI publishes an Authenticode-signed build.
Direct QUIC is automatic. If hard NAT or CGNAT blocks a useful direct path, the bundled
rampage-relay can be placed behind the owner's HTTPS endpoint. It admits only endpoint identities
in a fresh Governor-signed manifest, rate-limits every connection, and is launched automatically by
the desktop when rampage-relay.json exists in the runtime directory. See
Owner relay for the exact one-time setup and unavoidable public-reachability
boundary.
For a real local-model workload:
rampage generate llama3.2:latest "Reply with RAMPAGE_OK" --gpu-memory-gb 4Or point an OpenAI, Anthropic, or OpenRouter-compatible client at the owner PC's loopback gateway. The API key is the local Rampage controller token; the desktop's Copy API setup button copies the compatible base URLs explicitly:
from openai import OpenAI
client = OpenAI(base_url="http://127.0.0.1:47831/v1", api_key="RAMPAGE_TOKEN")
reply = client.chat.completions.create(
model="llama3.2:latest",
messages=[{"role": "user", "content": "Reply with RAMPAGE_OK"}],
)
print(reply.choices[0].message.content)GET /v1/models, non-streaming and SSE POST /v1/chat/completions, OpenRouter-style /api/v1
aliases, Anthropic POST /v1/messages, capability discovery, and explicit session cancel are
implemented. Unknown fields, unsupported modalities/tools, inconsistent model aliases, replayed
leases, stale epochs, oversized prompts, and unsigned terminal success all fail closed.
The desktop continuously displays the health score from GET /v1/diagnostics/self-scan.
GET /v1/workload-capabilities exposes what each verified live offer can actually execute; the
presence of a broad domain in the schema is not a claim that a backend is already shipped.
For useful pooled evaluation work:
rampage shard-plan "1,2,3" "4,5,6" "7,8,9"
rampage shard-run "1,2,3" "4,5,6" "7,8,9" --minimum-successes 3
rampage shard-status SET_IDEach argument is independently retryable. Rampage previews placement without mutation, admits the entire set or none of it, and reports every selected node, signed receipt, result, and threshold.
Donated drives become explicit artifact capacity:
$artifact = rampage artifact-put .\dataset.bin | ConvertFrom-Json
rampage artifact-replicate $artifact.digest NODE_ID
rampage artifact-repair
rampage artifact-hash $artifact.digest| Surface | What it owns |
|---|---|
rampage-protocol |
Versioned resource, job, shard-set, model-session, mesh, lease, receipt, artifact, and evidence contracts |
rampage-policy |
The deterministic Governor, signatures, admission, fencing, STOP, and promotion gates |
rampage-controller |
Scheduling, recovery, atomic shard admission, local API, and mesh gateway |
rampage-agent |
Hardware discovery and allowlisted CPU/GPU/Ollama worker adapters |
rampage-edge |
Foreground-only mobile identity, enrollment, offers, bounded claims, and signed receipts |
rampage-mesh |
Rampage-owned Iroh/QUIC identities and bounded remote control frames |
rampage-relay |
Owner-hosted hard-NAT fallback with signed endpoint admission and resource limits |
rampage-storage |
Encrypted, chunked CAS; durable resumable sessions; authenticated finalize; protected durability state |
rampage-ledger |
Recoverable, paginated, hash-chained SQLite evidence |
apps/desktop |
Tauri/React spatial Fabric Arena and accessible Ops Grid |
apps/edge |
Native Android/iOS foreground contributor and live safety UI |
services/intelligence |
Durable proposal-only DBOS/Pydantic AI improvement workflows |
packages/sdk-* |
Token-aware TypeScript and Python integration surfaces |
Requirements: Rust 1.91+, Node.js with pnpm 11, Python 3.12+ with uv, and Windows build tooling
for the packaged release.
pnpm install
uv sync --project services/intelligence --extra dev
cargo test --workspace
pnpm check
uv run --project services/intelligence pytest services/intelligence/tests
./scripts/Test-Rampage.ps1
./scripts/Build-Rampage.ps1 -Profile release
./scripts/Smoke-RampageInstaller.ps1model-gateway-e2e.ps1 deterministically qualifies the gateway with a bounded fake loopback Ollama;
ollama-e2e.ps1 can additionally exercise a real installed model. Generated outputs, installers,
sidecar binaries, databases, keys, and logs are excluded from source control.
Rust dependencies are checked against a fail-closed, target-qualified
RustSec baseline: new vulnerabilities, warning drift, target
scope drift, and expired reviews fail CI. Linux packages remain candidate-only while the GTK3
glib unsoundness advisory is reachable.
Architecture · Mesh and enrollment · Edge policy · Operations · Backend admission gates · RustSec boundary · Model Fabric · Owner relay · Native distribution · Platform matrix · Security policy · Release evidence
Rampage 0.2 is designed for devices controlled by one owner or a deliberately trusted circle. It is not a public compute marketplace and does not permit anonymous stranger-to-stranger resource sharing.
The repository is publicly inspectable but proprietary—not open source. See LICENSE.