Willustore — Provider Reward System
Willustore stores your data across a network of phones instead of one data center. This page tracks how we're building the system that rewards the phones doing the work — matching valuable data to reliable phones, and paying accordingly. All nine phases have shipped — the notes below say what each one actually does.
Six signals roll up into one reliability score (0–100). The biggest one rewards honesty, not just uptime.
A phone that promises 6 hours a day and delivers exactly 6 scores 100% on the biggest signal — same as one promising 24. Honest part-timers aren't punished for not being a data center.
Nine steps from the original hub to a fully paying network, in dependency order. All shipped.
Deleted the retired hub directory that no longer even compiled — 3,745 lines gone in one commit.
Keeping a permanent record of when each phone connects, how long it stays online, and how often it answers a search correctly.
Counting how often each stored chunk gets searched, with the score cooling off on its own if nobody asks for it again.
Each phone's history now rolls up into the single 0–100 trust score above. One signal — audit pass rate — is still a placeholder until Phase 5 builds real possession audits.
New uploads land on the right tier from day one, cold-data floor included. When data heats up later, it quietly picks up an extra copy on a gold phone — nothing gets deleted or moved, the old copy just becomes a spare.
Phones get spot-checked to prove they still hold what they claim — miss the check and it costs your score, fake an answer and you're out for good. Deleted data gets the same check: still have it after being told to delete it, that counts against you too. The deposit now exists as well: a slice of every payment is held back as a bond, and misbehaving costs part of it.
A phone that's simply switched off isn't fined. Being offline already costs you on the uptime signals; charging the bond too would be punishing one flat battery twice.
Each customer now has their own key, and every piece of stored data knows who it belongs to. Searches only ever return your own data — the phones answer with whatever they hold and have no idea who's asking, so the hub does the filtering.
Keys are stored the way passwords should be: we keep a fingerprint, not the key itself. Lose it and we can't recover it — only issue a new one.
A steady rate for every GB stored, ticking along whether or not anyone searches it, plus a bonus for serving a search — worth more when the data is popular. Both scale with your reliability score.
Pay rises smoothly with your score rather than jumping at the gold/silver/bronze lines. A phone one point below gold should lose a sliver of income, not a visible chunk of it.
When a phone leaves for good, the data it held gets a new home — and picks its new home by exactly the same rules a fresh upload would, so data that's become popular since it was stored moves up to gold phones on its own.
A phone gets a day's grace before it counts as gone. Without it, every phone that charges overnight would kick off a round of copying nobody needed.
One cleanup, not a phase — recorded here so the history isn't lost.
3,745 lines across four files, each with its own func main(). It didn't compile and wasn't part of the build.
Nothing imported it; the live hub runs from cmd/hub and internal/ at the repo root instead.
Removed in Phase 0.
Open questions from the design doc. Nothing is blocked on them any more — each one has a working default in place — but these are the defaults most worth a second opinion.
Bronze-tier phones earn very little at first — a new phone starts at half rate and needs a day before its own numbers even count. Welcome bonus, or a faster path to silver?
Losing the whole deposit for one offense pushes a bad actor to vanish and rejoin as "new" — once it's gone, leaving is free. So penalties are proportional: a failed check takes a slice you can earn back. Total forfeiture is kept for the one unambiguous case, a phone caught returning fabricated data, which is already permanent removal.
Someone acting as their own customer and provider could inflate their own payout — now genuinely possible, since customer accounts exist and searches pay the phones that answer them. What margin and detection threshold catch this?
With only 3 copies of each chunk, routing to nearby phones can fight placing data on the best-scoring ones. Which wins? Today reliability wins by default, because location isn't tracked at all yet.
The phases are done. These are the honest gaps behind them.
Balances are tracked correctly and grow as phones do the work, but there's no payment rail wired up — no transfer ever leaves the system. Connecting one is the next real piece of work.
Earnings are visible to the operator only. A phone proves it's a phone with a shared token, which doesn't identify whose phone it is — so there's no safe way yet to show an owner their own numbers.
The storage rate is paid against what each phone says it's holding. Lying is unprofitable rather than impossible: an inflated number still has to survive spot-checks on the data we know it was given, and those checks drive the multiplier on every payment.
Every rate on this page — the per-GB figure, the search bonus, the size of the bond — is a stand-in. The shape is right; the numbers need real pricing.