Rerun

Rerun is an accountability layer for AI agent actions, built on 0G.

The problem: AI "guard" agents already decide whether an on-chain action is safe, but nobody makes them pay when they are wrong. A guard can wave through a bad action and face no consequence. Rerun turns that verdict into something with money behind it.

How it works, in three beats:

1. Attest — a guard posts "this action is safe" and puts down a stake, binding the exact check it ran.
2. Challenge — within a challenge window, anyone re-runs that deterministic check. If the guard's claim disagrees with the re-run, the challenger takes the stake.
3. Settle — if the window closes unchallenged, the honest guard reclaims its stake.

The key idea: the stake is bound to a deterministic, re-runnable check, not to the model's opinion. The agent proposes; the check decides. You never re-run the LLM — you re-run the check — so "anyone can verify" works even though AI is nondeterministic. A wrong "safe" verdict costs real money, and the payout to the challenger IS the enforcement.

Built on 0G: • 0G Chain — the Rerun contract (Solidity/Foundry) settles the stake, challenge, and payout. Deployed live on 0G Galileo testnet (chain 16602) at 0x8f22025fCa35de84Ff302aCa8bB9Da3B210f5334. • 0G Storage — the guard publishes the exact check to 0G Storage and binds its root on-chain. A challenger fetches it back across multiple nodes, bytes verified, without trusting the guard. A database is a promise; a storage commitment is verifiable. • 0G Compute — when the check is an AI judgment, the guard's verdict comes from a sealed inference on 0G Compute (qwen2.5-omni-7b), paid per call on-chain.

Remove 0G and there is nothing to enforce a wrong verdict. Built solo at ETHGlobal Lisbon.

Stack: Solidity + Foundry for the contract, Node.js + ethers.js for the example guard/challenger agents, and three 0G primitives wired together.

Contract (0G Chain): Rerun.sol implements attest → challenge → settle. An Attestation stores the target, value, the guard's claimed verdict, the stake, a challenge deadline, and a checkRoot (the 0G Storage root of the exact check). Settlement follows checks-effects-interactions — stake is zeroed before any payout — so there's no reentrancy on the seized funds. Tests in Foundry cover both paths: an honest attestation that holds and settles, and a bad action that slips through and pays the challenger. Both green.

0G Storage: the guard serializes the check (a JSON policy) and uploads it via the 0G Storage TS SDK (Indexer + MemData). The returned root is bound on-chain as checkRoot. The challenger downloads the check straight back from Storage across multiple node locations, verifies the Merkle proof, and re-runs it — so it never trusts the guard's copy.

0G Compute: for AI-judgment checks, the guard's verdict is a sealed inference. I create a broker with createZGComputeNetworkBroker, fund a ledger, and call a TEE provider (qwen2.5-omni-7b) via the OpenAI-style chat endpoint with per-request signed headers; the fee settles on-chain. The model reads the policy and returns SAFE/UNSAFE.

Hacky bits worth flagging: (1) 0G Galileo's real chain ID is 16602, not what some docs say — and its gas mechanism rejects the default EIP-1559 tip, so i deploy with--legacy and a fixed gas_price in foundry.toml. (2) The Storage SDK's upload() returns an object, not a string, so the root must be unwrapped from .rootHash. (3) The Storage download refuses to overwrite an existing file, so the agent deletes any stale copy first — which also makes the whole demo idempotent and re-runnable for graders. (4) ethers is pinned to 6.13.1 to satisfy the Storage SDK's peer requirement.

The TEE attestation verification (processResponse) doesn't return a valid signature on the current testnet providers, so i made that step best-effort rather than faking it — the inference itself runs and settles.