Every tournament, one friend holds everyone's cash, forgets who paid, and someone swears they picked Argentina before kickoff. The Kitty deletes the treasurer — and the argument.
See how it's trustless ↓$ kitty create --match "Brazil vs Argentina" --buy-in 20 --kickoff +10m pot open — invite: pear://kitty/4hocdk8k4ubrx15ghs1u… ⇄ peer connected (2 live) — Hyperswarm, no signaling server kitty> stake ✓ Transaction Policy: ALLOW (cap respected) — pledged 20 USD₮ kitty> pick 2-1 pick sealed ⊘ b02c41… (salt never leaves this device) ⊘ kickoff — picks locked; 3 member logs witnessed ✗ cai · commit-pick · rejected: not witnessed before kickoff kitty> result 2-1 ✓ finalized by quorum (2 of 3) kitty> settle Σ paid 60 == Σ staked 60 ✓ · settled
A pot is an Autobase — every member writes to their own signed append-only log, and every device folds the same linearized history through the same deterministic reducer. There is nothing else. No backend to hack, no admin to bribe, no database to "correct".
A pot is a pear:// invite. Peers find each other on a Hyperswarm topic and a member admits your key — no accounts, no signup, no server.
Your buy-in is pledged from a WDK self-custodial wallet. A local Transaction Policy caps the stake — over the cap throws PolicyViolationError before any money exists.
You commit BLAKE2b(pick‖salt) — nobody can copy your pick, and you can't change it. At kickoff, members cross-witness each other's logs.
A back-dated pick appended after kickoff is caught by the witnessing rule and rejected live in the ledger — the append-only log makes tampering evidence, not argument.
After full-time, stakers vote the score; a strict majority finalizes. No fragile AI oracle — deliberately.
Every peer computes the identical split. Losers pay winners directly, wallet-to-wallet, gasless — money never sits with a middleman. Σ paid == Σ staked, always.
npm run verify:p2p boots three real peers on an in-process DHT, streams every connection and Autobase merge live, plays a full pot including a tampering attempt, and asserts every invariant. npm run bench reproduces these numbers on your machine:
Measured on an in-process DHT testnet (M-series macOS, Node 22) — the numbers isolate the stack from your ISP. PRD targets: connect < 3s, convergence < 1s.
Autobase multi-writer merge is why there's no server. Hypercore signed append-only logs are why picks are tamper-evident. Hyperswarm topics are why a pot is an instant room. Hyperbee is the indexed view; Protomux multiplexes membership pairing over the same encrypted stream. Without Pear: a server, a database, a websocket layer, and trust in whoever runs them.
Self-custodial accounts (keys never leave your device), gasless USD₮ transfers (fans never need a native token), Transaction Policies (an in-wallet responsible-play cap with simulate verdicts), unified multi-chain API. Without WDK: a custodial escrow, a gas faucet, and a server-side limits engine.
• Results are consensus-resolved, not oracle-proven — a colluding quorum could finalize a wrong score. Documented, not hidden.
• Settlement is a signed pledge + direct P2P payment — a loser refusing to pay is socially, not cryptographically, enforced (the upgrade path is a threshold escrow).
• @tetherto/wdk is beta (pinned at 1.0.0-beta.12, API verified from source).
Two terminals, sixty seconds, zero servers.