Certified third-party receipts
Every receipt on this page is signed by Hive as an independent third party and is verifiable offline against one published key. The mark is a visible signal that the proof came from outside the stack, and you can display it on your own site.
Every sub-step of a routed inference is cryptographically signed before the output moves, so the work can be verified after the fact. Reference measurements on our test setup: signed model first token median 112ms (p90 145ms), perceived first byte median 59ms. Your latency depends on your models, hardware, and routing. Patent pending.
Same cryptographic receipt either way: ML-DSA-65 (NIST FIPS 204) + Ed25519, checkable offline or by URL. The only question is whether AFiR runs the inference, or simply attests inference you ran yourself.
Send a prompt to /v1/afir/run. AFiR fragments, routes, and signs every sub-step before the output moves. Fastest path to faster, cheaper, signed inference.
Already running your own model on your own stack? Hand us {input, output} at /v1/afir/sign. There's zero routing and zero model change. The output just becomes signed inference.
Type any question below. Watch AFIR fragment, route, and attest in parallel, side by side with standard inference.
Every AFIR response bundles a tamper-evident receipt containing signed attestations for each fragment and a Merkle root over the full response tree.
Most attestation stops at the final output. AFiR signs each link in the chain of custody. That means the retrieved context, the tool calls, the cross-agent handoffs, the model identity, and the cache it read, all with one crypto-agile primitive family. Nothing in the pipeline moves unsigned.
Every primitive above can be reached three ways. Pick the one that fits how you run inference. All three sign with the same real ML-DSA-65 key and verify against the same public key.
POST your fragments to any hive-typed-signer.onrender.com/sigr/… endpoint and get a signed receipt back. Every endpoint has a free /verify counterpart. No account, no key, no card. This is the fastest way to prove a single receipt.
Best for: trying a primitive, verifying someone else's receipt, low-volume signing.
Get a key in minutes at onboard, then POST to /v1/afir/run. AFiR fragments, routes across models, and signs every sub-step before the answer moves. It's metered and uncapped, so you pay for exactly what you sign.
Best for: production agents that want faster, cheaper, fully-signed inference end to end.
Already running your own model on your own stack? Hand us {input, output} at /v1/afir/sign. There's zero routing and zero model change. Your existing output becomes signed inference.
SideCar details → Best for: teams that can't change their inference path but need the signed record.
AFiR signs the whole output. AFiR-S signs the fragments that carry liability. That's the tool calls, the PII, the dollar figures, the decisions, and it binds an absence proof over everything it deliberately left unsigned. One ML-DSA-65 signature covers a Merkle bundle of the selected spans, so signing cost stays O(1) no matter how many spans there are.
AFiR-S signs. It does not infer. It is a read-only notary over output Hive did not generate. The choice of what to sign, and what not to, is itself on the record.
Selected spans are hashed into a Merkle bundle and committed under a single ML-DSA-65 (NIST FIPS 204) signature. Per-span signing was measured roughly 10× slower. The single-bundle commitment is the inventive core. hash_alg: sha-256 at the edge.
Every non-material span is hashed and bound into the same signature as an absence record. A verifier can prove a fragment was deliberately left unsigned. You cannot quietly drop or alter what was not selected.
The exact policy, presets and custom rules alike, is committed inside the bundle as policy_version. Verification is fully offline: no callback, no Hive API key required to confirm what was signed and why.
Default policy auto-selects tool calls and PII. Add a custom rule like INV-\d{6} to sign only invoice IDs. Everything else is recorded absent in the same signature.
AFiR-S signs what matters with one signature. AFiR-ARSC decides how fast each fragment must settle, as a live function of its attested risk and the measured system load. The highest-risk fragments on a RAG platform are the retrieval-grounding events: which sources the model actually read, and whether the answer is bound to a cited source. ARSC signs those first and inline, on the critical path, so the citation guarantee is finalized before the answer ships. Every other fragment is hashed into an aggregation tree and settled by one off-path signature and one batched anchor.
Commitment time is non-negotiable. Every fragment is signed before the model acts. Only the anchoring step is adaptive. A grounding event can never be demoted by load; load can only make more things settle fast, never make a grounding event settle slow.
Retrieval-grounding and value-moving actions are pinned to the immediate-finality tier. Under crushing load the controller widens the fast-settlement gate so more fragments rise, but a grounding event is never load-demoted. The choice cannot be gamed: the scoring policy is committed and signed at session start, so a high-risk fragment cannot be retroactively re-scored as low-risk to dodge fast settlement.
Retrieval→claim bindings and value-moving tool calls. Signed inline with ML-DSA-65 on the critical path, so the citation guarantee is finalized before the answer returns. Immediate finality.
PII, dollar figures, decisions. Hashed into the signed payload before act, then settled by one off-path aggregate signature and a batched on-chain anchor. Sign-before-act preserved; only anchoring deferred.
Re-ranking tie-breaks, formatting, and the absence proof over everything deliberately left unsigned. Committed by hash, rolled into a lazy batched root, anchored on a deferred schedule. Cheapest path, same chain of custody.
Tier is a live function of risk(f), the fragment's attested economic and epistemic risk, and load(t), measured from inflight signing depth. The elastic batch window W(t) shrinks under load so batches close sooner, and grows when idle so anchors are rarer and cheaper.
The scoring policy Π is committed and signed at session start and bound into every receipt as policy_hash + policy_sig. This is the anti-gaming control: a verifier recomputes the tier from the signed policy and confirms it matches what shipped.
A verifier with no Hive key checks the ML-DSA-65 signature, recomputes the tier from policy_hash + fragment, confirms grounding fragments are T1, and confirms each fragment is included under the anchored aggregate_root within its settlement_deadline.
"arsc": { "policy_hash": "<sha-256 of signed scoring policy Π>", "policy_sig": "<ML-DSA-65 over Π at session start>", "fragment_tier": "T1", "risk_score": 0.90, "load_at_capture": 0.20, "grounding_pinned": true, "settlement_deadline": "2026-06-19T00:00:00Z", "aggregate_root": "<merkle root of T2/T3 batch>", "super_batch_id": "<one anchor per N queries>" }
A served inference call pays two costs at the gate: a clearance check (governance, jurisdiction, policy) and the establish/compute cost. In a cold FIFO queue that call sits idle, then pays both when its turn comes. AFiR-Hayes converts the otherwise-wasted wait into completed work. It runs the call's own clearance during the wait, finds its structural-reuse match, and pre-warms its likely route. When a legitimate re-ordering window opens, whether a batch boundary, a routing decision, or a fault or caution period, the calls that are already ready take the open lane. Every advancement is signed and attributable to that call's own productive wait.
The hard discipline: the only variance AFiR-Hayes introduces touches a call's own readiness. It never delays, degrades, contends with, or alters another call. A call advances because it was ready, not because another was held back. That limitation is claimed deliberately, and it is what keeps Hive a provenance provider rather than a scheduler exploit.
It is not an accelerator. Hive does not speed up compute, own GPUs, or change the model. The electrons run at the hardware's speed.
It is not queue-gaming. It does not induce contention, manufacture stalls, or degrade other calls to advance its own. That would destroy provenance and is excluded by definition.
It is the legitimate use of a call's own idle wait to remove that call's overhead from the critical path, plus the right to take an open lane when the system's own rules re-order the queue.
| Load (utilization) | Baseline p50 | AFiR-Hayes p50 | Latency gain | Pre-clear hit rate |
|---|---|---|---|---|
| 0.50 | 99 ms | 93 ms | 5.9% | 82% |
| 0.70 | 141 ms | 105 ms | 25.6% | 83% |
| 0.85 | 221 ms | 137 ms | 37.9% | 85% |
| 0.95 | 673 ms | 162 ms | 76.0% | 86% |
Simulated over 5,000 calls through a single gate, sweeping load. The Hayes effect is isolated from Structural-Lateration's compute savings (a separate, additive claim) and charged for speculative work on abandoned calls. Pure pre-clearance is bounded by clearance's share of service time (about 12 to 18% here); gains above that come from ready calls advancing through congestion, never from making any single call's compute faster.
If the call's inputs and policy are known while it waits, its Imprimatur clearance check runs during the wait and is signed. At the gate, clearance cost is ~0 because it is already done.
If the call's structural shape matches a known shape, the Lateration match is found during the wait so reuse is an instant lookup. The most-likely-cleared Stream-Route path is warmed so the call commits the instant the window opens.
Pre-clearing a call that is later abandoned wastes that work. AFiR-Hayes exposes a budget knob: it pre-clears only when sufficient idle wait exists and abandon-probability is low, and it reports wasted-speculation in the receipt, so the cost is provable, not hidden.
AFiR-Hayes is an orchestration enhancement over primitives that already exist. It adds nothing to the signed-primitive family; it removes waiting from the critical path.
Every AFIR receipt carries an smsh field. It's a cryptographic seal over the exact reasoning state (system prompt, context window, policy snapshot, identity) that was active when each fragment was signed. Without it, you can prove the output was signed. With it, you can prove the reasoning that authorized it. AFIR ships three SMSH tiers.
Drop AFIR into any OpenAI-compatible workflow with a single base URL swap. Native endpoint also available.
Works with Anthropic, Google Gemini, Groq, Mistral, or any provider with an OpenAI-compatible /chat/completions endpoint. AFIR owns decomposition. You supply execution.
Pick the product that matches your compliance posture. Same API for all four, swap by changing one header. Metered per receipt. Mint a key and start in minutes.
These are list rates, the Build column. Every tier earns the same volume discount as you grow (Scale −10%, Platform −20%, Hyperscale −30%). See the full signature × volume matrix. Usage is metered and uncapped: no monthly minimum, no ceiling. You pay for exactly what you sign and verify.
High-volume commits, dedicated signing-key infrastructure, white-label receipts, on-premise Docker, and partner-resident deployment inside your perimeter are negotiated directly. Talk to Steve
Pick your current model and your AFIR tier models. The math uses real published rates. See exactly what you save, or don't.
Illustrative model. Rates from published pricing as of June 2026. Actual savings vary by prompt structure, cache hit rate, and tier spread. Attestation overhead is sub-1ms (0.99ms median, ML-DSA-65 NIST FIPS 204). Latency uses parallel DAG execution. Simple queries gate-bypass (single fragment, cheap model), and complex queries run in parallel waves. Critical path shown, not total sequential time.
Latency and cost reflect your selected model and complexity. Receipts and signing are fixed per tier.
Enter your Together, Fireworks, or custom provider numbers. See the signed-tier margin and latency gap side by side.
Open Inference Comparator →The objections engineers and legal teams raise. Answered with numbers, not marketing.
Latency reduction depends on query type. Simple queries bypass decomposition entirely (gate bypass) and complete in 352ms vs 1,692ms for a monolithic GPT-4.1 call, about 4.8x faster. Complex queries run fragments in parallel, and wall-clock time tracks the critical path, not total token count. In live benchmarks with the edge lane (Cloudflare Workers, signed at edge), signed model first token median is 112ms (p90 145ms, under 150ms). Everyone fast on the leaderboard is unsigned. We sign at that speed. Perceived first byte median 59ms. Cost: $0.000029/response, about 8x cheaper than Together ($0.000228), all signed. Cheaper models account for cost savings, and parallelism accounts for latency savings. These are separate gains. The tiered routing cuts the bill. The DAG execution cuts the latency.
You could build a proxy with a hash in a weekend. What takes longer: a correct DAG decomposition engine that preserves semantic dependency ordering across arbitrary prompts, an ML-DSA-65 (NIST FIPS 204) attestation chain at sub-1ms (0.99ms median) per-fragment overhead at inference latency scales, a Merkle completeness proof that binds input state, routing decisions, and output hashes into a single verifiable receipt, and a key-split architecture where your signing key never leaves your perimeter. The engineering surface is the DAG correctness guarantees and the attestation chain integrity, not the proxy layer. Build it and run it in production under audit. That's the actual weekend estimate.
Signing outputs at the final response layer is not new. What is patent-pending (filed June 2026) is the combination of fragment-level attestation across a routed DAG. Specifically, we attest each node before its output is consumed as input by a downstream node, so the chain of custody is continuous and not retrospective. Prior art signs the envelope. AFIR signs every edge in the dependency graph mid-execution. If you have specific prior art that covers per-node attestation within a runtime inference DAG with Merkle assembly proofs, file it against the application. That is the correct venue.
The signed receipt captures the exact input state, the routing decision, the full dependency graph, and the output hash at assembly time. If assembly produces an incorrect result, the receipt is forensic evidence of exactly which node produced which output under which routing decision. That is the point of the Merkle completeness proof. Liability follows the evidence: if the decomposition logic is wrong, that is traceable to the DAG construction step in the receipt, and if a model tier returns a defective fragment, that is attested at that node. Hive provides the receipt infrastructure and the routing logic, and the customer's signed key binds them to the input state they submitted. The receipt does not resolve liability by itself. It makes the facts unambiguous.
The key split architecture is designed for this constraint: the customer holds the ML-DSA-65 signing key on-premises, and Hive holds only the verification root. Inference fragments transit Hive's routing layer, but the signing authority never leaves the customer's perimeter. Hive cannot forge a receipt the customer did not authorize. If your legal requirement is that no inference payload leaves your network, AFIR is not the right fit in its current hosted form. If the requirement is that a third party cannot produce valid attested outputs without your authorization, the key split satisfies that. Bring the receipt architecture spec to your legal team against those two specific threat models.
The EU AI Act's current logging obligations for high-risk systems do not mandate per-fragment attestation or Merkle assembly proofs. AFIR's receipt format exceeds those requirements by design, not by regulatory necessity. The value here isn't compliance box-checking. It's that when a regulator, customer, or internal audit asks exactly what inputs produced exactly what output under exactly what model routing decision, you produce a cryptographically verifiable answer rather than reconstructed logs. Regulations are a floor, and your exposure in a dispute is the ceiling. The receipt is for the ceiling.
Audit logs record what your system observed. Receipts attest what the inference system executed. Your logs can be amended, retroactively structured, or missing entries due to pipeline failures. They're assertions your system makes about itself. An AFIR receipt is signed at execution time by a key you hold, binds the input hash, the routing graph, and the output hash into a Merkle structure, and cannot be back-filled without invalidating the signature. The distinction matters when a counterparty, whether a regulator, a plaintiff, or an enterprise customer, challenges whether a specific output came from a specific input under a specific model. A log entry is testimony. A receipt is evidence.
The receipt's verifiability depends on the ML-DSA-65 key pair, not on Hive's operational continuity. The customer holds the signing key, and the verification root is a public key that can be exported, archived, and verified offline with any standard FIPS 204-compliant implementation. If Hive ceases operations, existing receipts remain verifiable against the public key the customer already holds. No Hive infrastructure required. New receipt issuance would stop, but the forensic value of issued receipts does not decay. The escrow and key export procedures are documented in the enterprise agreement for exactly this scenario.
No fragments leave your infrastructure. No data touches our servers. You operate the container. We license the IP and hold the verification root.
Available to Hyperscaler tier customers. Submit your request and we will follow up with deployment specs, image delivery, and licensing terms.
One checkout. Your live key appears on screen the moment payment clears. No email round-trip, no waiting. Metered billing: you only pay for what you sign.