Submit a bid · Grab the job · Sign the job

Evolution of The Robot Services Exchange

A technical history of the protocol, 2025-08-10 → 2026-09-17

The RSE is an open marketplace for robot labor. Demand posts a priced, expiring request. Supply calls POST /grab_job. An LLM scores whether the provider can do this job; both parties dual-sign completion. Settlement stays off-platform. This note reconstructs how that loop was built, from the git history of theservicesexchange (262 commits on main, ~176k insertions).

1. What did not change

The conserved quantity is the matching loop. From the first commit (87a45fa, 10 Aug 2025) the system is a Flask API plus a JSON object store: accounts, bids, jobs, tokens. There is no SQL database. Persistence moved onto DigitalOcean Spaces (S3-compatible JSON). The public website is for people posting bids; robots call rse-api.com. Dual-sign completion and a 15-minute grab cooldown are old. Reputation is a shrunk-toward-2.5 mean of stars, so a new provider is not indistinguishable from a 5-star veteran with n = 1.

What did change is the scarce resource that gates supply (the seat), the decision procedure that is the matching mind, and the surfaces around the loop (mobile app, cooperation APIs, Hyperion, a registrar instead of a chain).

2. Naming and identity of the protocol

The repository opened as the “Service Exchange (SEX) Protocol,” a general marketplace. Copy and code then specialized to robot labor: The RSE / The Robot Services Exchange. Registration grew a hard user_type ∈ {demand, supply} (Dec 2025). Demand is a username; supply’s public identity is intended to be a seat when one is assigned. The marketing host moved to therobotservicesexchange.com (11 Aug 2026); the API host rse-api.com did not.

3. Timeline of the machine

Dates from git log --format='%ad %h %s' on main. Intensity plot: commits per calendar month.

July 2026 is the mode: cooperation APIs, identity, mobile, privacy, and the investor model landed in one month. March is the NFT seat launch. April–May is a trough after soulbound seats. September 2026 is the registrar cutover and phrase-proof seats.

4. Seats: three security models

A seat is the scarce object that authorizes /grab_job (when the gate is on) and stamps supply identity on a job. It is not money. The 15-minute cooldown is per account today; the economic story is still “one successful grab per seat per window.” Three implementations were tried. They differ in who is the source of truth and what the client must prove.

The NFT era is the interesting negative result. The contract did what a chain is good at: a globally visible, non-custodial token id, with revoke/unrevoke as owner functions and a 15-minute in-process cache so grab did not pay an RPC on every call. Soulbound was a response to “seats as licenses, not speculative NFTs.” It made private transfer of title impossible without the contract owner, which is the same trust assumption as a registrar, plus RPC, wallets, and a non-transferable asset nobody could sell. On 14 Sep 2026 the chain code was deleted (~82k lines, mostly lockfile and artifacts). The 17 Sep issuance restored the 2025 object (number, owner, phrase) with a better proof:

secret = SHA-256( phrase ‖ "|" ‖ YYYY-MM-DD_UTC )  ∈ {today−1, today, today+1}

That is TOTP with period 86400 s and a ±1-step window. The phrase never crosses the wire. Owner string must match the book (case-insensitive). Founding allocation matches the old seats.dat split under real names: seats 1–1000 Dr. Aftab, 1001–11000 Amanda Jean. The grab gate remains off until SEAT_VERIFICATION_ENABLED is flipped.

5. The mind of The RSE

match_service_with_capabilities is the only place an LLM is allowed to decide who works. Treat it as a binary classifier C(job, caps) → {grab, skip} sitting in front of reputation and price sort. Four prompt regimes:

The domain short-circuit is the physically important part: it is a hard constraint, not a prompt suggestion. Live integration tests (34 cases) sit at 33/34; the remaining false positive is adjacent-domain (aerial survey). That is the current residual of the mind.

6. Architecture that actually shipped

Control plane: Flask + gunicorn on a single DigitalOcean droplet, nginx terminating TLS, floating IP. Data plane: JSON objects in Spaces, short in-process TTLs because workers do not share memory (account TTL 2 s; jobs 2 s). There is still no relational store. That is a deliberate constraint: every record is a document you can GET by id; indexes are extra JSON files (seats/_index.json).

July 2026 added structure without changing the Hamiltonian: demand parties, supply parties, campaigns (bulk demand → N jobs), agent bearer tokens under a parent account, an append-only activity log, and public portfolios. A taxi example shows the intended robot client: poll grab with a geohash whitelist, talk on the job channel, sign. Nearby applies geo-indistinguishability (Gaussian noise on published pins, σ by privacy dial, stable per entity × UTC day).

7. Product surfaces

8. Open questions (for this audience)

• When to flip the seat gate. Proof is implemented; enforcement is a boolean. Remote software remains a free band. Physical density is the scarce thing the 11k seats are for.
• Cooldown per seat vs per account. Many seats × many logins can still parallelize grabs. A per-seat last-grab timestamp is the natural next conserved quantity.
• Matching as a calibrated score. 0–10 is better than YES/NO, but it is not a probability. The residual FP is adjacent-domain. A confusion matrix over the 12 lexicons would be the next instrument.
• JSON-on-object-storage. Fine at current N. Seat index of 11k is ~500 kB. A billion seats (the 2035 planning story) is a different store.
• Chain as optional title layer later. The NFT experiment failed as the primary book. It could return as a mirror of the registrar, not the reverse.

Method. History reconstructed from git log on main at ffce9a4 (17 Sep 2026). Counts: 262 commits, Aug 2025–Sep 2026. Matching prompts quoted from handlers.py at the cited SHAs. Seat objects from seats.dat, RSESeat.sol, and seats.py. This is an engineering narrative, not an offering document.