Whitepaper · v1.4

Pasiv: putting hardware you already own to work

Revised 26 September 2026 (Pasiv 0.5.5) · pasiv.network

01The problem

Consumer mining has an experience problem, not a hardware problem. Modern consumer machines — Apple Silicon in particular — are genuinely competitive at CPU-friendly proof-of-work like RandomX. What stops people is everything around the mining:

• Complexity. Real miners are command-line tools with JSON configs, pool URLs, TLS ports, and per-algorithm flags. That's a hobbyist's weekend, not a product.
• Distrust. The space is crowded with bundled adware, hidden dev fees, custodial dashboards that hold your coins, and "miners" that are simply malware. A reasonable person defaults to no.
• Choice paralysis. Which coin? Which pool? When it changes weekly, the honest answer is a moving target no casual user will track.

Fixing this is a design problem: make the trustworthy path the easy path.

02Design principles

• Three taps. Download, connect a wallet or paste a payout address, press start. No accounts, no config files, no command line.
• Non-custodial, structurally. Pools pay your address directly. Pasiv has no wallet, holds no balances, and never asks for keys — there is nothing to trust us with.
• Consent-first. Mining is off until you press start, every capability is opt-in, and stop always means stop. Nothing launches itself.
• Honest economics. One fee, stated everywhere it matters, that mechanically cannot tick while you're paused — with a local ledger and a public fee address you can check on its pool.
• Quiet by default. A menu-bar and system-tray app that respects thermals and battery, not a dashboard that wants your attention. Click the icon to open it, right-click for the menu; inside are three tabs — Status, Wallets, Settings.

03Architecture

Pasiv is a native desktop app built on Tauri 2 — a Rust core with a lightweight webview UI. The core is organized around a few load-bearing pieces:

• Supervisor. A single state machine (Idle → Starting → Mining ⇄ Paused, Error) owns the mining lifecycle. The UI, the tray icon, and the fee meter all read the same state — what you see is what is running.
• Open core, consumed like a dependency. The pieces of a miner you would otherwise take on faith — the fee engine, the coin and pool roster, the payout-address validators, the mining state machine, and the whole pasivd daemon — live in the public pasiv-core crate (GPL-3.0). The desktop app doesn't mirror that code; it links the crate, pinned to an exact revision recorded in the build. The code you can read is the code the shipped binary runs.
• Engine adapters. Mining engines sit behind a common interface. Today that is XMRig (the industry-standard RandomX miner, sandboxed as a sidecar process) for Monero, and a GPU adapter (Pasiv's own signed build of the open-source CPPminer engine, for Pearl on NVIDIA Turing-or-newer cards) built for the Windows/Linux releases. New engines slot in without touching the rest of the app.
• Sidecar provenance. Neither miner binary lives in our repository. XMRig is fetched at build time from its authors' official release and verified before anything is bundled: against the checksums they publish in a GPG-signed file, then against a SHA-256 pinned in our repo for both the archive and the extracted binary. The Pearl engine is ours: built by our CI from a pinned commit of the open-source CPPminer, with every runtime statically linked, signed with Pasiv's own certificate, published on our releases repository and pinned by SHA-256 the same way. Any mismatch stops the build or the download. We stopped shipping a third-party GPU miner in 0.6.11 because an unsigned one is quarantined by Windows Defender on sight and refused by Smart App Control — a problem no amount of signing Pasiv could fix.
• Hardware detection. The app inspects your CPU and GPU up front and shows only what your machine can actually run — no dead toggles, no pretending a laptop is a rig.
• Governor. Thermal and battery guardrails throttle or pause mining so the app stays a good citizen on the machine it lives on.
• Built-in diagnostics. A one-pass doctor (Settings → Diagnostics, or pasiv --doctor / pasivd doctor from a terminal) checks the hardware, every payout address's shape, pool reachability, the price feeds, and what failed last — the same checks the app runs itself, surfaced so a support answer is one screenshot, not a log hunt.
• Data-driven coin roster. Coins are registry entries (ticker, algorithm, pool, address format validator), so new coins ship as app updates — no re-architecture per coin.
• Signed auto-updates. Releases are signed — Developer ID-signed and notarized on macOS, Authenticode-signed on Windows; the built-in updater verifies release signatures on-device before installing. The release manifest is public — the website's download buttons read the same file the updater does.

04Coins & engines

Pasiv mines two coins, deliberately: Monero on the CPU and Pearl on the GPU, both at once, each the coin that part of a consumer machine earns most on. The default route mines both on unMineable's pool, which converts what you mine to USDT and pays your own address (BNB Smart Chain or TRON) once a day from 1.5 USDT. Since 0.6.10 you may choose BTC instead — USDT is the fast, spendable payout; BTC is for holding — paid to your own Bitcoin address once the balance reaches unMineable's BTC minimum (0.00075 BTC on 15 October 2026, read live from the pool), which the app shows, with an estimate of the wait at your machine's own rate, before you choose. Installs from before 0.5.0 that pay a coin address directly keep that direct route until their owner chooses to switch — nobody is moved. On Apple Silicon there is a third lane that is not mining at all: Idle Compute (beta) serves private AI inference through a third-party Darkbloom provider the user installs, because an M-series chip is a mediocre miner and a genuinely good inference server. It is opt-in, off by default, and Darkbloom pays the user directly — Pasiv takes no fee on it and never reads the earnings, only the work done.

On the direct route, each coin pays out through an established public pool (MoneroOcean for Monero; LuckyPool for Pearl) straight to the address you pasted. Pools charge their own fee, typically around 1%, under their own published terms. The roster is this short on purpose: a coin earns a place only if a consumer machine can mine it competitively, on pools with direct address payouts, and on our own measurements these two out-earn the alternatives on their hardware by a wide margin — Pearl by more than tenfold against the long-established GPU coins on the same card. The hardware gate is equally deliberate: the GPU lane is built around what Pasiv has verified on real hardware, which today means NVIDIA Turing or newer. AMD Radeon RX 6000, 7000 and 9000 cards with 4 GB or more can mine Pearl since 0.5.0, labelled beta precisely because we have not yet verified them on AMD hardware of our own. Older AMD cards and pre-Turing NVIDIA are listed by the bundled miner but stay gated off.

One consequence of the pool-only design worth stating outright: no coin ever runs a local node or downloads a blockchain to your machine. Every engine speaks stratum to its pool and nothing else — there is no node software in the app, no sync, and no chain data on your disk, for either coin. The working data mining does need (the RandomX dataset, GPU DAGs) is built in RAM or VRAM on start and vanishes on stop. A candidate coin whose only viable path is solo mining against a local node fails the roster bar for exactly this reason.

05One coin per lane

The question no casual miner wants to babysit is which coin should this machine be on right now? Pasiv's answer is to make it not a question. Each part of your hardware has one coin: the CPU mines Monero, the GPU mines Pearl, and the two lanes run at the same time. (A Mac may instead opt into Idle Compute; mining and inference compete for the same memory, so on most Macs that is a choice, not an addition.) There is no coin picker to get wrong and no switching to watch.

What the app does show is the live estimate for each lane, computed from public, key-free data — CoinGecko prices and pool-published network stats — against your machine's measured hashrate:

That figure is on screen before you press start and while you mine, so a laptop that will earn pocket change is told so up front, and a machine whose GPU can't run the Pearl engine simply isn't offered a GPU lane. Prefer to be paid in the coin itself rather than USDT? Pick that in Wallets and Pasiv stays put.

06Economics: the 4% that only ticks while you earn

Pasiv's fee is 4% — taken as time-sliced mining and only while you are actively earning. On the unMineable route (the default from 0.5.0) it applies to every coin you mine; on the direct route, which installs from before 0.5.0 keep until they switch, it applies to Monero only. No ads, no subscription on the free tier, no cut of your payouts beyond the 4%.

Other parties take a cut of mining too. They are listed here because they affect what lands in your wallet, and you should hear about them from us rather than find them yourself. One line — the referral — reaches Pasiv, and it is listed for exactly that reason:

On the XMRig line: Pasiv ships the stock XMRig binary, which carries a 1% developer donation floor. Rebuilding it without the donation is permitted by its licence, and we built one — then decided not to ship it, for reasons set out in §08. XMRig keeps its 1%, and we say so here and in the app rather than describing it as removed.

The fee is time-sliced hashrate — the same mechanism as the dev fees experienced miners already accept, but with the books open. And since 2026-08-26, the ledger isn't the only thing that's open: the fee engine itself is open source — the address, the slice schedule, the ledger format, and the complete headless daemon that enforces them live in hash-rate/pasiv-core (GPL-3.0), pinned by tests anyone can run:

• For 4% of active mining time, shares are submitted to Pasiv's fee address instead of yours; the other 96% of the time they go to yours, untouched. On the unMineable route the fee address is Pasiv's treasury, bc1qv8nlkvhjelgp5d5lk79qjs6sdeq08w8vjxgz90, paid in BTC by the same pool (you are paid in USDT, or in BTC if you chose it); on the direct route the fee engine engages only on Monero.
• The slice shape depends on how the miner can switch. The CPU miner (XMRig) re-logs-in live, so its slice is 20 seconds in every 500. The GPU miner (the Pearl engine) can only switch by restarting, measured at about 19 seconds from restart to hashing, so its slice is 10 minutes in every 4 hours 10 minutes: the same 4%, with warm-up costing you under 0.3% instead of most of a short slice.
• The fee counter is driven by the same state machine that drives the UI, and it advances only in the Mining state. Idle, paused, starting, or errored time contributes zero — it is structurally impossible to charge a paused user.
• Enforcement is level-triggered, not fire-and-forget. Every tick, the desktop app and pasivd both read back from the miner's own local API which address it is actually mining to and reconcile that against what the slice schedule says it should be. A slice that fails to end — or anything else redirecting the miner — is corrected within one tick rather than trusted forever. If a slice repeatedly fails to swap back, mining stops rather than continue on the fee address — after three consecutive failures on the desktop — and a restart always respawns on your address. Both apps consume the same fee engine from the open crate and are held to it by a conformance test.
• Every slice is written to a local, append-only fee ledger shown in the app, next to the fee address itself — which is a compile-time constant. Changing it requires a new signed release with a changelog entry. The direct-route fee address is on Monero, a private chain, so a block explorer shows nothing for any address; it is public and its mining activity is visible on its pool. Full on-chain verification would need the fee wallet's view key — a published-view-key transparency page is on the roadmap.

There is nothing else: no ads, no subscription for personal use, no additional cut of your payouts. Pasiv Cloud — the opt-in fleet view and the Pasiv Companion phone app — shipped free, not as the per-rig paid tier earlier drafts of this document described. If that ever changes it will be announced before it does, never applied retroactively to something already free.

07Trust model

Pasiv's security posture starts from an assumption of zero earned trust — reasonable, given the neighborhood:

• The code that touches money is open source. The fee engine, the coin/pool roster, the payout validators, the mining state machine, and the entire pasivd daemon are public at github.com/hash-rate/pasiv-core — the parts of a miner you'd otherwise have to take on faith, readable and buildable instead. The desktop app consumes that repository as a pinned dependency — an exact revision recorded in the build — and every release since v0.4.39 has been built from it. The GUI apps, cloud, and signing stay proprietary: open core, stated plainly.
• Signed, notarized builds. macOS releases are Developer ID-signed and Apple-notarized; Windows releases are Authenticode-signed and timestamped; updates are signature-verified by the app before install.
• Headless installs verify too. pasivd binaries are minisign-signed with the same key the desktop updater already trusts. The one-line installer — served from pasiv.network, a separate origin from the binaries it fetches — pins that public key, checks the SHA-256 of everything it downloads, and always verifies the signature — installing minisign from the distro's own repositories if it's missing, and refusing to install at all rather than fall back to a weaker check.
• No custody, no keys. There is no wallet inside Pasiv, no place to enter a seed phrase, and nothing that can move your coins. Pools pay you directly.
• What leaves your machine, precisely. With Pasiv Cloud off — the default — nothing about your rig leaves the device except product events — anonymous unless you sign in — that you can disable. If you turn Cloud on to use the phone app, the machine publishes its state to your account: rig name, hardware summary, live hashrate, and which coin is active. It does not publish your payout addresses — those stay on the device and at your pool. (One disclosed exception, and only if you sign in: on the unMineable route your payout address — USDT or BTC — is stored on your account, so your headless pasivd nodes know where to pay you.) (An earlier build briefly included them in the status row, where nothing ever read them; that was fixed — the stored field was deleted server-side and every sender stopped, and the uplink is now test-enforced to carry no payout address. The full correction is in §08.) What is published is scoped to your account by row-level security, and turning Cloud off deletes the row.
• No account wall. Wallet sign-in exists as an optional convenience and proves address ownership by signature; skipping it costs you nothing.
• Optional telemetry, anonymous unless you sign in. A handful of product events (never wallet or payout addresses, never file contents), with autocapture and session recording disabled and an in-app off switch. A signed-in user is identified by an opaque id — a one-way hash of their account id — so their own devices count as one person (the desktop app from 0.5.0, the phone app from 1.0.18). See the privacy policy for the exhaustive list.

08What shipped since, and what's next

This section used to be a roadmap. Most of it has shipped, so it now says what exists — a roadmap that never converts into a changelog is marketing.

Shipped: Windows and Linux releases, including the GPU engine (Pearl) on supported NVIDIA hardware. One-line installers for macOS, Windows and Linux. Pasiv Cloud — an opt-in fleet view with a phone companion that can start, stop and update rigs. Headless nodes (pasivd) for servers and homelabs with no desktop. The open core — the fee engine, coin roster, payout validators, state machine and the whole pasivd daemon published at hash-rate/pasiv-core, with v0.4.39 the first release built from the open code at a pinned revision. And the fee address is published on the home page with a link to audit it on the pool, which the earlier draft listed as a future transparency page. In 0.5.0: USDT payouts by default, paid by unMineable's pool straight to your own address, and Pearl on AMD Radeon RX 6000, 7000 and 9000 cards, in beta. In 0.5.1: the Coins tab became Wallets. In 0.6.10: BTC as an optional payout beside USDT, for people who would rather hold Bitcoin, with its higher payout minimum and the expected wait shown before the choice.

Two items this section previously listed as future work have since shipped:

• Fee ledger parity on headless nodes. pasivd now writes the same append-only fee-ledger.jsonl the desktop does, in the same format, so a rack of screenless machines audits exactly like a laptop. A fee is only auditable if it is auditable everywhere it is charged; "we log it, except on the machines with no screen" was not a trust surface.
• Updating a fleet without touching it. A rig that is behind shows its version in the companion app and can be updated from there. An update installs a release we signed and can deliver nothing else — every package is verified against a key built into the app before anything is written to disk — and it still cannot change which coin a rig mines, its pool, or its payout address.

One correction, which matters more than an addition. Earlier versions of the app sent each machine's payout addresses to our servers as part of the opt-in Pasiv Cloud status row, while this document and our privacy policy both said payout addresses never reach us. Nothing ever read that field. Rather than soften the claim to match the behaviour, we changed the behaviour: the stored rows were deleted, every sender stopped, and the server now discards the field regardless of which version sends it. The claim is true again, and it is enforced in code rather than promised in prose. Since 0.5.0 it carries one disclosed exception, which applies only if you sign in: on the unMineable route your payout address (USDT, or BTC since 0.6.10) is stored on your account so your headless nodes can use it.

Next:

• A two-coin roster, held to. New coins are added only as they clear the bar: minable competitively on consumer hardware, honest economics, and measurably better than what their lane already earns. (Candidates that fail the bar are dropped, not shipped.)
• The companion app. It is live on Google Play; on iPhone it is available as a public TestFlight beta.
• New ways to earn — adjacent workloads (e.g. compute markets) are evaluated continuously and added only when one meets the same consent, custody, and honesty bar as mining. No timeline is promised until one does.

A promise we are withdrawing: XMRig's 1%

Earlier drafts of this document listed an XMRig build without the 1% developer donation as planned work. We built it, measured what it was worth, and decided not to ship it. Saying so plainly is the point of this section.

The build works — XMRig's licence permits it and its own source anticipates a zero donation. But that 1% is worth roughly 54 cents per machine per year at current rates, and none of it would come to us; removing it returns 54 cents a year to you. Against that, shipping our own compilation would cost the thing we currently rely on: Pasiv bundles the official, checksum-verified XMRig release, and a self-built binary means trusting our compilation instead of theirs. It would also carry no antivirus reputation on Windows — where miners are already flagged by policy — and commit us to re-patching and re-verifying a fork on every upstream release, with a stale miner as the failure mode.

So XMRig keeps its 1%, and we will keep saying so. The engine is XMRig; its developers take 1% for building the thing this product depends on, and we do not touch it. That reads better than the alternative because it is also true.

This document describes software, not an investment. Mining earnings depend on coin prices, network difficulty, your hardware, and electricity costs; they vary and can be zero. Nothing here is financial advice, and Pasiv makes no earnings guarantees. Coin names and pool names belong to their respective projects.