Recursive Autonomous Mesh for Policy-Aware Acceleration, Governance, and Evolution
Rampage turns the hardware you already own into a private, evidence-bearing compute fabric—then adds an autonomous intelligence layer that can improve how work is planned without ever inheriting the authority to run wild.
One installer. Desktop shortcut included. Release notes · SHA-256 · All releases
Launch the showcase · Architecture · Universal fabric blueprint · Easy pairing · Security · 0.3.1 release evidence · Owner-relay evidence · Resumable-storage evidence · Native distribution · Mobile edge · Mobile evidence
Install Rampage on an owner PC. Install it on another machine. Choose Join my fabric, compare the same four digits on both screens, and approve once on the owner PC. There are no addresses, accounts, terminals, or secrets to copy. Rampage discovers usable CPU, GPU/VRAM, RAM, storage, power, thermals, runtimes, and local Ollama models automatically—then moves bounded work to the machine that can actually perform it.
| The old constraint | The Rampage move |
|---|---|
| A powerful desktop sits idle while another machine struggles | Place the whole job on the best available node |
| Small machines cannot host the full workload | Give them restart-tolerant shards, preprocessing, evaluation, cache, or relay work |
| Donated disks become brittle network mounts | Turn them into encrypted, resumable, content-addressed artifact capacity with independently signed repair evidence |
| “Autonomy” quietly becomes administrator access | Let intelligence propose; let deterministic Rust policy decide |
| Distributed systems fail opaquely | Sign leases and receipts, fence stale work, and write every transition to a hash chain |
| A spare laptop needs attention from across the room | Open a visible, paired-owner Remote Assist session without adding a second account or remote-access service |
| A kill switch depends on the system it is stopping | Keep STOP local, non-agentic, and independent of the controller and network |
The result: more useful compute, less wasted hardware, and an autonomous system whose ambition is separated from its authority by construction.
Rampage 0.3.1 is the current Windows x64 recovery and automatic-role release. It preserves the Remote Assist and fabric-proof foundation, then closes the complete device lifecycle: repair in place, return a worker to pairing, revoke a stale enrolled identity from the owner, or factory-reset the local Rampage runtime without uninstalling external model stores. A failed native status bridge now produces an actionable recovery state instead of an infinite loading surface. Nearby pairing fans out over every active LAN interface and uses local bounded lifetimes, so a VPN adapter or a wrong device clock cannot silently strand a laptop on “Looking for your main PC.” Pair again now waits for the retiring worker process tree before rotating identity, and setup mode can remove only its bounded stale worker credentials before accepting a new encrypted invitation.
| Proof surface | Validated result |
|---|---|
| Trust kernel | Scoped Ed25519 leases; durable one-shot nonces; restart-safe monotonic epochs; crash-reconciled native STOP fencing; fail-closed admission and sidecar auth isolation |
| OnePool | Three independent evaluation shards placed across bounded offers, completed with signed results, and recovered after restart |
| Private mesh | Authenticated direct QUIC plus a forced-relay proof through the bundled owner-operated relay; no third-party overlay account or silent public relay |
| Storage fabric | Encrypted chunked CAS, flushed restart-resumable QUIC frames, full-content possession proofs, corruption quarantine, budgeted independent repair, staging, and retrieval |
| Real AI workload | OpenAI, Anthropic Messages, and OpenRouter-style text requests crossed authenticated QUIC to a worker's loopback Ollama, streamed back, and ended in a transcript-matched signed receipt |
| Automatic local AI | Windows bootstrap detects or installs the pinned Ollama runtime, pulls the exact 2.5 GB qwen3:4b artifact, verifies its complete SHA-256 digest, and advertises it without an agent restart |
| Signed fabric benchmark | One bounded CPU grant per capable live node; deterministic SHA-256 chains; node-pinned placement; signed receipts; aggregate and scale-over-fastest results in the desktop |
| Universal capability contract | Signed offers advertise exact workload domain, adapter, operation, execution pattern, isolation, runtime digest, and qualification status; candidate profiles grant no authority |
| Autonomous self-scan | Stable evidence digests cover routes, links, failures, denials, thermal/battery pressure, capability gaps, idle capacity, and protected-artifact replication |
| Compute Strategy | Outcome-first Automatic, Biggest AI, Fastest AI, More Work, and Protect This PC placement previews with exact capacity and qualification blockers |
| Nearby pairing | Zero-copy X25519 pairing over multicast, global broadcast, and every active directed LAN broadcast; owner-local expiry removes cross-device clock dependence |
| Lifecycle recovery | One-screen Fix Rampage, race-proof Pair again, setup-only stale-credential healing, enrolled-device Forget, redacted receipt, and typed local factory reset; restart replay keeps revoked nodes and offers gone |
| Remote Assist | Worker opt-in; paired-owner view/control; dedicated authenticated QUIC protocol; request-, node-, controller-, epoch-, size-, frame-rate-, and input-sequence bounds; visible active state; STOP/revoke |
| Packaged product | Native Tauri shell, role-aware system tray, close-to-tray, start-at-login, governed sidecars, cold-start tolerance, controller-restart recovery, clean explicit shutdown, installer, and automatic desktop launcher |
| Verification | Rust, desktop, TypeScript SDK, Python intelligence, Python SDK, deterministic universal-gateway, forced-relay mesh, packaging, and lifecycle gates |
The 0.3.1 source, package, and physical-device boundary is recorded in the current release evidence. The previous 0.3.0 Remote Assist record remains immutable in its release evidence. The packaged 0.2.3 qualification record—including artifact hashes, live Qwen proof, and its unsigned-release boundary—remains in the 0.2.3 evidence. The 0.2.2 pairing record remains in its immutable evidence page. The original 0.2 record remains in the original qualification page. The newer API, workload-contract, self-scan, and signed-canary campaign is recorded separately in universal-compute evidence. The self-hosted hard-NAT fallback and its forced-relay transport proof are recorded in owner-relay evidence. Restart-safe two-node protected storage, signed possession challenges, and autonomous repair are recorded in resumable-storage evidence.
flowchart LR
H["Human owner"] --> X["Fabric Arena · Ops Grid · CLI · SDK"]
X --> C["Controller\nintent · scheduling · recovery"]
I["Intelligence plane\nDBOS · Pydantic AI · scientific memory"] -. "typed proposals only" .-> C
C --> G["Governor\ndeterministic Rust policy"]
G --> L["Signed capability leases\nexpiry · scope · fencing"]
L --> W1["Command rig\nCPU · GPU · Ollama"]
L --> W2["Spare PC\nshards · cache · storage"]
L --> W3["Edge class\nforeground-safe work"]
W1 <--> M["Authenticated QUIC mesh"]
W2 <--> M
W3 <--> M
M -. "hard-NAT fallback only" .-> R["Owner relay\nsigned admission · rate caps"]
M <--> A["Encrypted artifact fabric\nresumable · content-addressed · self-repairing"]
C --> E["Hash-chained evidence ledger"]
G --> E
W1 --> E
W2 --> E
W3 --> E
S["Independent local STOP"] -. "revokes authority" .-> G
classDef mint fill:#102a28,stroke:#67f5c5,color:#f4fff9,stroke-width:2px;
classDef trust fill:#211b2d,stroke:#c7a7ff,color:#fbf8ff,stroke-width:2px;
classDef node fill:#101722,stroke:#728199,color:#f6f9ff;
class G,L,S trust;
class X,C,I,M,A,E mint;
class H,W1,W2,W3 node;
The narrow waist is the capability lease. Interfaces above it can become dramatically smarter; devices and engines below it can become dramatically more diverse. Neither change bypasses policy.
That waist is durable, not merely signed. A normal controller restart preserves the current authority generation and recoverable work. Owner STOP advances the hash-chained generation; controllers reject old claims and receipts, while workers and artifact gateways persist consumed nonces and the highest epoch they have observed so replay remains denied after restart.
Select an eligible Windows worker and choose View desktop or Control desktop. Rampage opens the worker inside the owner app, renews a 30-second signed session while it remains active, and routes bounded JPEG frames plus ordered mouse/keyboard events over its existing authenticated mesh. The worker must first turn on Allow owner remote control. That durable opt-in grants no authority to any unpaired peer and can be turned off immediately without changing the rest of the fabric.
The screenshot is a source-current browser showcase using labeled demonstration topology; it is not presented as a physical two-machine control receipt. Native Windows capture/input, signed-heartbeat, durable replay-fence, protocol-digest, and UI contract tests are recorded separately. Exact physical laptop installation and interactive control remain an explicit release-evidence line item until run.
Once an opted-in worker is live, the owner can produce a fail-closed physical frame receipt with
scripts/Qualify-RampageRemoteAssist.ps1. The command accepts only the loopback protected API,
requires a fresh shipped Remote Assist offer, verifies the signed lease bounds and JPEG SHA-256, closes
the session, and proves the controller returns 404 for the revoked session. It never injects input.
The wrench in the app header—and Already paired or stuck? Fix Rampage on first-run setup—opens a
single recovery surface. Fix Rampage safely restarts a consistent installation. Pair again
removes only the worker's old fabric identity and returns it to nearby pairing. On the owner PC,
Forget revokes the selected identity, live offer, outstanding work, Remote Assist sessions,
artifact locations, and replay state. Factory reset is deliberately separate and requires the
full RESET RAMPAGE phrase.
This image is a source-current browser showcase of the real Recovery Center. Native deletion, restart, auto-start, and sidecar behavior is verified separately in the packaged Windows campaign.
Remote memory and VRAM do not become magically coherent across commodity networks. Rampage instead pools the parts that are useful in the real world:
- Place a complete workload on one capable device.
- Split independent map, evaluation, rendering, preprocessing, or search tasks into a bounded shard set.
- Add replicas where throughput or evidence benefits.
- Prefer data-local execution and encrypted artifact movement.
- Admit multi-GPU or cross-host model sharding only after a specific engine/topology adapter proves it wins.
Phones and tablets are not pretend GPU servers. Their best future contribution is thermally bounded, foreground, restart-tolerant work: data preparation, scoring, validation, sensor processing, relay, cache, and small-model inference. Console support remains constrained by platform-holder policy.
The current native mobile source narrows that expansion vision to two adapters that are implemented and safe to preempt today: hashing and independent evaluation shards. The app reads battery, external power, low-power mode, thermal pressure, foreground lifecycle, and phone/tablet identity from Kotlin on Android or Swift on iOS. It offers CPU for 20 seconds at a time and stops locally on pressure, lifecycle loss, network failure, or owner STOP.
The screenshot is the real React interface in its labeled browser showcase state. Native packages replace the demonstration values with direct platform telemetry. The worker runs in-process—no mobile daemon, shell, model server, protected replica, public marketplace, or ambient background authority. See Rampage Edge for the trust flow and exact platform boundary, and the mobile evidence record for source-bound Android ARM64 and Apple-silicon iOS simulator build proof, artifact identities, checksums, and release exclusions.
The desktop defaults to Automatic and exposes five outcome choices while assigning technical device roles itself:
| Toggle | What Rampage optimizes |
|---|---|
| Automatic | Measure the work, devices, and paths; continuously choose the safest high-value role |
| Biggest AI | Largest compatible model placement; engine-native cross-node layouts only after qualification |
| Fastest AI | Fastest evidence-supported chat; slow distributed links are rejected |
| More Work | Independent replicas and shards for concurrent users, agents, builds, renders, and batches |
| Protect This PC | Preserve the foreground game, call, or production session by spending remote capacity first |
On Windows, Local AI Autopilot now qualifies a pinned Ollama runtime and exact starter model in the background. Prove my speed runs sustained, lease-bounded work on every capable live 0.3.1 node and accepts a node only after its signed execution receipt arrives. This measures useful distributed work; it does not imply remotely addressable local VRAM.
The planner reports visible versus compatible memory, requested weights plus KV cache, selected ranks, parallelism, predicted speedup, and the exact missing qualification. Planning remains read-only. Separately, the shipped whole-model lane can select an exact installed Ollama model on one contributor, mint a one-shot model-session lease, stream it over authenticated QUIC, and expose the result through bounded OpenAI, Anthropic Messages, and OpenRouter-style text APIs. Cross-host tensor and pipeline launch remain gated until a backend proves runtime, topology, isolation, recovery, and measured benefit.
rampage model-plan local/70b-quantized --weights-gib 40 --kv-cache-gib 4 --strategy maximum-model-size
rampage model-plan local/fast-chat --weights-gib 20 --kv-cache-gib 2 --strategy speed-boostSee Model Fabric for planner rules and topology thresholds, and Universal compute for the operation-exact workload contract, API surfaces, self-scan, and honest device roles.
“Universal” does not mean pretending that every program can consume remote RAM or VRAM. It means one signed capability language, one trust kernel, one evidence spine, and a growing set of qualified adapters that can move the right unit of work to the right class of machine.
| Lane | Useful today | Expansion path and honest boundary |
|---|---|---|
| Local AI | Discover installed Ollama models, select one qualified worker, stream a bounded chat through OpenAI, Anthropic Messages, or OpenRouter-style APIs, and return a transcript-matched receipt | Maximum Model can plan compatible aggregate memory, but cross-host tensor/pipeline execution stays blocked until an engine-specific adapter proves topology, recovery, and speed |
| Agent swarms | Run independent searches, evaluations, transforms, and tool-safe shards concurrently; require a signed result and an explicit success threshold | New adapters inherit the same lease, nonce, epoch, STOP, and receipt contract rather than gaining ambient machine access |
| Production | Place independent builds, renders, transcodes, simulations, preprocessing, and batch transforms where a shipped adapter advertises the exact operation | Interactive application memory does not become a network DIMM; large workflows must expose schedulable stages or engine-native distributed execution |
| Gaming | Preserve the foreground gaming PC by routing eligible background AI, compilation, capture processing, media conversion, server simulation, and cache work elsewhere | Rampage does not claim that an arbitrary game can borrow another device's VRAM or increase FPS without game/engine support |
| Phones and tablets | Native source implements foreground-safe hashing and independent evaluation shards under thermal, battery, network, identity, and restart-tolerance limits | More adapters require their own proof; mobile CI candidates are not store releases, and consoles require platform-holder permission |
| Donated storage | Encrypt, resume, verify, retrieve, and repair protected whole-artifact replicas across owner-controlled nodes | Current source caps an artifact at 64 MiB and uses full replicas; erasure coding and physical-loss campaigns are future qualification work |
This separation is deliberate. Rampage can become broadly useful without selling users a fake shared-memory story, and every new backend must earn admission with deterministic tests and signed runtime evidence before the Governor can lease it.
Rampage owns the complete desktop lifecycle: sidecars, policy state, local discovery, the system tray, start-at-login, emergency STOP, explicit shutdown, and the desktop launcher. A normal user installs the app, creates a fabric, lets each new machine wait nearby, compares four digits, and approves it once. The full signed invite is encrypted directly between ephemeral device keys and is never displayed or copied. Capability discovery does the rest.
| Platform lane | Native deliverables | Current qualification boundary |
|---|---|---|
| Windows x64 | MSI and NSIS installers; automatic desktop shortcut; Start-menu entry; role-aware tray; bundled sidecars | 0.3.1 adds complete recovery and enrolled-device revocation to the Remote Assist foundation; exact package hashes and physical-worker status are in the current release evidence |
| Linux x64 | Debian package and AppImage with the same Tauri shell and native sidecars | Fresh Ubuntu 24.04 candidate gate; stable repository/AppImage signing remains channel-specific |
| macOS Apple Silicon | Native app bundle and DMG | Fresh macOS 15/M1 candidate gate; stable publication requires Developer ID signing, Gatekeeper acceptance, notarization, and a stapled ticket |
| Windows 10 x64 | MSI/NSIS lifecycle, desktop shortcut, tray, sidecars, restart, STOP, and uninstall campaign | Deliberately unqualified until a real self-hosted Windows 10 runner completes the fail-closed workflow |
| Phones and tablets | Native Tauri app; Kotlin/Swift telemetry; in-process Rust worker; source-bound Android ARM64 and Apple-silicon iOS simulator candidates with published checksums | Unsigned CI candidates are not store releases; physical-device signing and lifecycle qualification remain separate gates |
Every staged candidate carries SHA-256 checksums plus a source-bound distribution manifest. Non-pull-request artifacts can receive GitHub OIDC provenance attestations, but provenance is not a substitute for platform identity. Stable Windows and macOS workflows therefore refuse to publish when their real signing credentials or native verification steps are missing.
See Native distribution and the live platform matrix for exact build environments, verification commands, credential contracts, and the difference between a candidate, a signed stable release, and a physically qualified operating system.
The intelligence plane runs a durable improvement loop:
Record → Analyze → Mutate → Prove → Audit → Gate → Enshrine
DBOS workflows make the process recoverable. Pydantic AI adapters produce typed proposals. Scientific memory keeps experiments content-addressed. Deterministic replay, holdouts, adversarial review, replication, shadow, and canary gates determine whether an idea earns promotion.
The sidecar API fails closed when its authentication token is absent. The desktop gives it a fresh independent token rather than the controller credential, so proposal-plane compromise does not inherit controller admission, enrollment, STOP, storage, or lease authority.
There is no per-change approval prompt inside an owner-defined autonomy envelope. Candidates that pass every deterministic threshold may request a signed, traffic-capped, epoch-fenced canary lease from the Rust Governor and automatic rollback. Authority-critical changes, path escapes, and any attempt to widen that envelope are automatically denied—not queued for an AI to approve itself.
The model cannot mint leases, enroll peers, edit the Governor, access signing keys or secrets, promote itself, authorize destructive tools, change financial policy, or bypass STOP. Missing or ambiguous evidence fails closed.
- Download the current Windows installer.
- Open the Rampage shortcut created on the Windows desktop.
- Choose Create my fabric on the main machine.
- On the laptop, choose Join my fabric and Find my fabric. It can wait while you move back to the main PC.
- On the main PC, choose Add machine. Confirm the same four digits and press Codes match—approve.
- Rampage securely enrolls and restarts the laptop automatically. Leave contribution limits on automatic or tune them. Press STOP whenever you want the node back.
If setup is ever interrupted, open Fix Rampage. A worker can return to pairing in two clicks; the owner can forget the stale identity before approving the replacement.
The nearby flow uses only the private LAN. If Windows asks, allow Rampage on private networks. The complete invite remains available under Advanced for segmented networks where local discovery is intentionally blocked. See Easy and secure pairing.
Closing the window keeps the governed fabric alive in the Windows system tray. Left-click the tray icon to restore it, or right-click for role status, Start with Windows, emergency stop, and an explicit Quit that releases the desktop-owned sidecars. Auto-start launches quietly into the tray.
The current binaries are unsigned release candidates. Verify the published SHA-256 checksums and expect Windows reputation warnings until ObtuseAI publishes an Authenticode-signed build.
Direct QUIC is automatic. If hard NAT or CGNAT blocks a useful direct path, the bundled
rampage-relay can be placed behind the owner's HTTPS endpoint. It admits only endpoint identities
in a fresh Governor-signed manifest, rate-limits every connection, and is launched automatically by
the desktop when rampage-relay.json exists in the runtime directory. See
Owner relay for the exact one-time setup and unavoidable public-reachability
boundary.
For a real local-model workload:
rampage generate qwen3:4b "Reply with RAMPAGE_OK" --gpu-memory-gb 4Or point an OpenAI, Anthropic, or OpenRouter-compatible client at the owner PC's loopback gateway. The API key is the local Rampage controller token; the desktop's Copy API setup button copies the compatible base URLs explicitly:
from openai import OpenAI
client = OpenAI(base_url="http://127.0.0.1:47831/v1", api_key="RAMPAGE_TOKEN")
reply = client.chat.completions.create(
model="qwen3:4b",
messages=[{"role": "user", "content": "Reply with RAMPAGE_OK"}],
)
print(reply.choices[0].message.content)GET /v1/models, non-streaming and SSE POST /v1/chat/completions, OpenRouter-style /api/v1
aliases, Anthropic POST /v1/messages, capability discovery, and explicit session cancel are
implemented. Unknown fields, unsupported modalities/tools, inconsistent model aliases, replayed
leases, stale epochs, oversized prompts, and unsigned terminal success all fail closed.
The desktop continuously displays the health score from GET /v1/diagnostics/self-scan.
GET /v1/workload-capabilities exposes what each verified live offer can actually execute; the
presence of a broad domain in the schema is not a claim that a backend is already shipped.
For useful pooled evaluation work:
rampage shard-plan "1,2,3" "4,5,6" "7,8,9"
rampage shard-run "1,2,3" "4,5,6" "7,8,9" --minimum-successes 3
rampage shard-status SET_IDEach argument is independently retryable. Rampage previews placement without mutation, admits the entire set or none of it, and reports every selected node, signed receipt, result, and threshold.
To prove sustained capacity rather than trusting an idle-core count:
rampage benchmark --cores-per-node 4 --iterations-per-core 5000000The result names every contributing node, its measured rate, signed receipt ID, aggregate rate, and effective scale over the fastest node. Older workers stay excluded until upgraded because they do not advertise the benchmark adapter.
Donated drives become explicit artifact capacity:
$artifact = rampage artifact-put .\dataset.bin | ConvertFrom-Json
rampage artifact-replicate $artifact.digest NODE_ID
rampage artifact-repair
rampage artifact-hash $artifact.digest| Surface | What it owns |
|---|---|
rampage-protocol |
Versioned resource, job, shard-set, model-session, mesh, lease, receipt, artifact, and evidence contracts |
rampage-policy |
The deterministic Governor, signatures, admission, fencing, STOP, and promotion gates |
rampage-controller |
Scheduling, recovery, atomic shard admission, local API, and mesh gateway |
rampage-agent |
Hardware discovery and allowlisted CPU/GPU/Ollama worker adapters |
rampage-edge |
Foreground-only mobile identity, enrollment, offers, bounded claims, and signed receipts |
rampage-mesh |
Rampage-owned Iroh/QUIC identities and bounded remote control frames |
rampage-relay |
Owner-hosted hard-NAT fallback with signed endpoint admission and resource limits |
rampage-storage |
Encrypted, chunked CAS; durable resumable sessions; authenticated finalize; protected durability state |
rampage-ledger |
Recoverable, paginated, hash-chained SQLite evidence |
apps/desktop |
Tauri/React spatial Fabric Arena and accessible Ops Grid |
apps/edge |
Native Android/iOS foreground contributor and live safety UI |
services/intelligence |
Durable proposal-only DBOS/Pydantic AI improvement workflows |
packages/sdk-* |
Token-aware TypeScript and Python integration surfaces |
Requirements: Rust 1.91+, Node.js with pnpm 11, Python 3.12+ with uv, and Windows build tooling
for the packaged release.
pnpm install
uv sync --project services/intelligence --extra dev
cargo test --workspace
pnpm check
uv run --project services/intelligence pytest services/intelligence/tests
./scripts/Test-Rampage.ps1
./scripts/Build-Rampage.ps1 -Profile release
./scripts/Smoke-RampageInstaller.ps1model-gateway-e2e.ps1 deterministically qualifies the gateway with a bounded fake loopback Ollama;
ollama-e2e.ps1 can additionally exercise a real installed model. Generated outputs, installers,
sidecar binaries, databases, keys, and logs are excluded from source control.
Rust dependencies are checked against a fail-closed, target-qualified
RustSec baseline: new vulnerabilities, warning drift, target
scope drift, and expired reviews fail CI. Linux packages remain candidate-only while the GTK3
glib unsoundness advisory is reachable.
Architecture · Mesh and enrollment · Edge policy · Operations · Backend admission gates · RustSec boundary · Model Fabric · Owner relay · Native distribution · Platform matrix · Security policy · Release evidence
Rampage 0.2 is designed for devices controlled by one owner or a deliberately trusted circle. It is not a public compute marketplace and does not permit anonymous stranger-to-stranger resource sharing.
The repository is publicly inspectable but proprietary—not open source. See LICENSE.