Canon implementation explorer

Every canon primitive, and exactly how far it is built.

This page is generated from registry data, not from copy. Each card names one primitive or system, what it proves, what it explicitly does not prove, and the implementation state recorded for it in hive-verifier-api/PRODUCTION_MANIFEST.json or in a recorded live probe. Deployment state is only ever read from those artifacts. A benchmark appears only where the entry is recorded as deployed, and concept work is never labelled operational.

90typed receipt contracts, each with a schema, a mint route and an open verify route
90of those are recorded as deployed in the production manifest
0of those are code complete with no deployment record, so they are never called live
16external operational services and offline reference implementations, counted separately
13product or composite systems that issue nothing and are never counted as contracts
0filing gated private item, named only so the total cannot drift
119entries on this page in total
103entries carry a link to at least one partner or use case page
3integration mapping, documentation over existing primitives, counted as a mapping and never as a primitive

Machine readable source of truth for everything below: /canon/registry/hive-canon-registry.json. Partner pages link into it by the stable anchors shown on each card, and it can be regenerated from the production manifest with python3 scripts/generate_canon_registry.py.

Not sure which one you need? Describe what you do and what you are looking for and the selector returns the matching primitives with the deploy path for each. To see the canon ranked by revenue pool, speed to the first dollar and who owns the budget, open the tiered solution view.

Want to run one instead of reading about it? Run a receipt yourself. Those windows post a real example to the open verify route and show you the answer, including the failures. No account, no key, nothing to install.

How to read a card

Ranking is deterministic. An exact canonical type or anchor match outranks a name match, which outranks a partner page match, which outranks a use case tag, which outranks a hit in the proof boundary text. A token of four characters or fewer must match on a word boundary, so a short fragment cannot drag an unrelated primitive up the list. Ties break on operational state first, then on kind of entry, then on anchor, so the same query always produces the same order. Entries that score zero stay on the page, ranked last, because a zero score describes the query rather than the primitive.

Typed receipt contract

A canonical receipt type in the unified typed receipts service, with its own JSON Schema, a token gated mint route, an open verify route and its own tests. These are the only entries that count as receipt contracts.

External operational service

A running service outside the typed receipts codebase, or an offline reference implementation in this repository. Real, but not part of the typed contract count, because its source and deployment live elsewhere.

Product or composite system

A suite, wrapper, dashboard, visualization or glossary layered over other entries. No endpoint and no receipt type of its own. Never counted.

Filing gated private work

Work that exists privately and is deliberately not disclosed publicly until a provisional filing is confirmed. Named here only so the count cannot drift. No schema, no routes, no example, no benchmark.

Implementation states in use

Only the states marked operational below describe something that answered a real request. Everything else is code, a page, or a plan.

External service, live probe on record

A host outside this codebase answered a non mutating probe in a recorded audit session. Operational for that host only, not for this repository.

Deployed in production

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

Composite, no endpoint of its own

A wrapper over other entries. No route, no schema, no receipt type.

Concept extension only

A proposed extension of another entry. No code, schema or endpoint.

External service, claimed, not re probed

A live claim rests on an earlier audit and no current pass reached the host. Re probe before depending on it.

Glossary only

Definitional content. Not a primitive.

Offline reference implementation

Runnable code with no hosted route. Verifiable locally, not a service.

Visualization only

A drawing of other primitives' receipts. Issues nothing.

Integration mappings

Named integration shapes, bound field by field to primitives that already exist. A mapping is documentation, not a primitive: it adds nothing to any count, and it links to the entries it relies on by their permanent anchors so a partner page can point at either the mapping or a single field's primitive.

Circle Gateway ERC-1271 authorization, with an independent Hive receipt beside it

Circle Gateway supports ERC-1271, so a smart contract, a smart wallet or an application can reach a unified USDC balance while its own existing authorization logic keeps making the decision, with no delegate accounts and with expanded crosschain access. The contract's ERC-1271 validation result and Circle's Gateway attestation stay authoritative. Hive sits beside that flow as an independent third party and signs a receipt that records what was authorized, on what declared policy version, and what actually materialized.

Where Hive sits

Hive is a third party witness to the flow. It does not evaluate, gate, replace or change any authorization policy, it does not hold or move funds, it does not sign on behalf of any wallet, and it is never in the authorization path. Emission is out of band, so nothing in the payment path waits on a receipt.

Secrets boundary

No secret crosses the boundary. Private keys, seeds, session material, raw call data and raw request bodies are never sent, held or stored. Addresses, chain identifiers, public references and digests are the only inputs, and every digest is caller computed.

Why no new primitive was created

No new canonical primitive was created for ERC-1271, and source analysis of the existing contracts found no unfilled proof boundary that would justify one. Signature validation by a contract is an authorization fact, which authority.delegation already binds as issuer, subject, scope and constraints. Fixing what must be proven before transmission is proof.demand. Pre commitment of a declared intent is hivebound.envelope. Recording that the application's own gates were evaluated before the action is imprimatur.clearance. Requested against materialized chain is exactly the declared against observed split in divergence.record. The lifecycle across chains is proof.transition with a fixed size export in proof.transition.portable. The end state is effect.closure. A new type would duplicate these boundaries rather than fill a gap, so the mapping reuses them.

Bound fieldWhat it recordsCanon entries
chain_idThe chain identifier the authorization is scoped to and the chain the balance is requested on.hivebound-envelopeauthority-delegation
gateway_or_smart_wallet_addressThe Gateway wallet contract or smart wallet address acting as the subject of the authorization.authority-delegationhivebound-envelope
erc1271_validation_contractThe address of the contract whose isValidSignature result the flow relies on.authority-delegationimprimatur
authorization_policy_version_or_digestThe version string or canonical digest of the authorization logic in force, as the application declares it. Hive records the declared value and never interprets or alters the policy.imprimaturauthority-delegation
signed_intent_digestThe digest of the intent that was signed, fixed before transmission. The digest travels, the intent body does not.stiprynhivebound-envelope
requested_chain_and_materialized_chainThe chain requested and the chain the balance actually materialized on, carried as separate declared and observed values so any difference stays visible.multi-source-divergenceproof-transition
circle_gateway_attestation_referenceCircle's own Gateway attestation reference or its digest, preserved as an admitted input rather than restated as a Hive claim.proof-transitioneffect-closure
amount_and_assetThe USDC amount and asset identifier as declared and as observed.effect-closuresettlement-feed
policy_decisionThe allow or deny the application's own authorization logic returned, recorded as an outcome of that logic.imprimaturauthority-delegation
execution_transactionThe execution transaction reference on the materialized chain.effect-closureproof-transition
effect_closureCompletion status and idempotency key bound to the observed outcome and its evidence digests.effect-closurer3pv
settlement_reference_valuesWhere a settlement value is what the flow is measured against, that value can be independently signed rather than taken on trust. Supported where a feed exists.settlement-feedmulti-source-divergence
portable_exportA fixed size export of the whole lifecycle for a counterparty, auditor or insurer to check offline.proof-transition-portableprotected-flow
weakest_verified_boundaryThe weakest verified boundary across the receipt group for one flow, stated rather than implied. Available through the external Protected Flow and R3Pv service where that service is in use.r3pvprotected-flow

Sources. Circle Gateway product page: Already cited on the Circle partner page. Circle Gateway developer documentation: Official documentation for the unified USDC balance, non custodial Gateway Wallet contracts and sub second mint on a destination chain. ERC-1271 standard: The signature validation standard itself. Announcement provenance: The August 4, 2026 ERC-1271 announcement reached this work as material shared privately with the team. That is not a public citation and is not presented as one; the public Circle links above are what this mapping cites.

Circle Gateway support for ERC-1271, noted August 4, 2026.

Submission provenance, expressed as an existing pre-commitment plus an existing authority chain

A filer wants to prove what it submitted to a venue or a regulator, that the submitted artifact was fixed before transmission rather than reconstructed afterwards, and that the person or system that submitted it was entitled to. That is a real and frequently asked question. It is answered in full by two contracts that already exist and are already deployed.

Where Hive sits

hivebound.envelope fixes the submitted artifact before it leaves the filer, so a later copy cannot be substituted for the one actually sent. authority.delegation binds who was entitled to submit it, under what scope, and with what constraints. Composing the two produces exactly the submission provenance claim, with no gap left over.

Secrets boundary

No secret crosses the boundary. The submitted content itself need never be transmitted to Hive, only its digest, which the filer computes.

Why no new primitive was created

No new canonical primitive was created for submission provenance, and a source level review of the deployed contracts found no unfilled proof boundary that would justify one. A primitive is only warranted when an existing contract cannot express the claim. Here two can, together, exactly. Registering a third name for their composition would inflate the canon without adding a single provable fact, which the honesty rules of this registry forbid.

Bound fieldWhat it recordsCanon entries
submitted_artifact_sha256The digest of the artifact as it stood at the moment of transmission, computed by the filer. Fixing it before it leaves is what stops a later copy being substituted for the one actually sent.hivebound-envelopestipryn
submitter_identityThe person, system or service account that transmitted the artifact, bound as the subject of a delegation rather than asserted in a log line.authority-delegation
submission_scopeWhat that submitter was entitled to submit, to which venue, and under what constraints and expiry.authority-delegationimprimatur
destination_venueThe venue or regulator the artifact was transmitted to, recorded as part of the pre-commitment so the destination cannot be restated afterwards.hivebound-envelope
transmission_order_and_timeWhere the submission sat in an ordered sequence, and between which two externally supplied times it must have occurred. Needed when a filing deadline rather than the content is what is disputed.sequence-attestation

Sources.

Issuer event attestation, deliberately not registered until its public anchor exists

An issuer event attestation would let an issuer sign a corporate action or a disclosure event in a form any third party could check against a public, append only record that the issuer does not control. The signing half of that is straightforward and Hive already has it. The public anchor half is the part that carries the value, because an append only log the issuer controls proves considerably less than one it does not.

Where Hive sits

Today an issuer event can already be signed and ordered using sequence.attestation, which brackets it between a public blockchain block and an RFC 3161 timestamp from an authority outside Hive. That is a genuine external anchor and it is live. What is not live is a public transparency log with independently observable inclusion proofs; ct.thehiveryiq.com does not resolve and the receipt accumulator currently reports leaf_count 0 with no public witness.

Secrets boundary

No secret crosses the boundary. Event digests and public references only.

Why no new primitive was created

No primitive is registered for issuer event attestation, and this is a deliberate hold rather than an oversight. Registering it now would mean publishing a name whose distinguishing half, the independently witnessed public log, cannot yet be delivered. The honest position is that the ordering and external time bracket are available today through sequence.attestation, and that this entry is revisited when the transparency log is publicly reachable and serving real inclusion proofs.

Bound fieldWhat it recordsCanon entries
issuer_event_sha256The digest of the corporate action or disclosure event as the issuer fixed it.hivebound-envelope
issuer_identity_and_authorityWhich issuer signed, and under what delegated scope the signer acted on the issuer's behalf.authority-delegation
event_order_and_external_bracketThe order of the event relative to related events, bracketed between a public blockchain block and an RFC 3161 timestamp from an authority outside Hive. This is the part that is live today.sequence-attestation
public_inclusion_proofAn independently observable proof that the event was included in an append only log the issuer does not control. This is the part that is not live. The transparency log is not publicly reachable and the accumulator reports no leaves, which is why no primitive is registered here.sequence-attestation
later_correction_or_withdrawalA subsequent restatement or withdrawal of the event, bound to the original rather than replacing it silently.supersession-receipteffect-closure

Sources.

All 119 entries

Typed receipt contracts, external operational services, product and composite systems, and filing gated work are separated so nothing is counted twice and no total drifts. Anchors are permanent: a partner page can link straight to /canon/#sigr-chain and land on that card.

Typed receipt contract, 90 entries

Scoped Absence Assertion

Typed receipt contract Deployed in production
#absence-scope
What it proves

Scoped Absence Assertion receipt. Saying a document

What it does not prove

does not contain something is only meaningful if you say where you looked, what you looked for, with what engine, and at what threshold, so all of that is inside the signed body, bounded to one box in the pixel space of a committed render profile. The service recomputes the predicate digest over the canonical predicate and its version. A party that evaluates the same box at a different threshold gets an off threshold indeterminate result rather than a result that contradicts the assertion. It does not run the search; negative_independently_reproduced_by_service is fixed to false, and the assertion is scoped to the committed box and never to the whole document.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['absence.scope']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeabsence.scope
Mint route/mint/absence-scope
Open verify route/verify/absence-scope no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/afir-ocr/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • negative_independently_reproduced_by_service is pinned to False
  • assertion_scoped_to_committed_box is pinned to True
  • predicate_digest_recomputed is pinned to string
  • predicate_digest_recomputes is pinned to boolean
  • box_area_pixels is pinned to integer
  • search_precedes_this_receipt is pinned to boolean
  • negative_asserted is pinned to boolean
Example requestPOST https://thehiveryiq.com/v1/mint/absence-scope
curl -sS -X POST https://thehiveryiq.com/v1/mint/absence-scope -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"assertion_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "render_profile_digest_sha256": "<64 hex chars, sha256 of your evidence>", "page_index": "<see schema>", "box_x": "<see schema>", "box_y": "<see schema>", "box_width": "<see schema>", "box_height": "<see schema>", "predicate_kind": "<see schema>", "predicate_canonical_form": "<see schema>", "predicate_version": "<see schema>", "predicate_digest_sha256": "<64 hex chars, sha256 of your evidence>", "extraction_engine_ref": "<see schema>", "model_version_commitment_sha256": "<64 hex chars, sha256 of your evidence>", "detection_threshold": "<see schema>", "threshold_scale_ref": "<see schema>", "searched_at": "<see schema>", "result": "<see schema>"}'

{
  "assertion_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "render_profile_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "page_index": "<see schema>",
  "box_x": "<see schema>",
  "box_y": "<see schema>",
  "box_width": "<see schema>",
  "box_height": "<see schema>",
  "predicate_kind": "<see schema>",
  "predicate_canonical_form": "<see schema>",
  "predicate_version": "<see schema>",
  "predicate_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "extraction_engine_ref": "<see schema>",
  "model_version_commitment_sha256": "<64 hex chars, sha256 of your evidence>",
  "detection_threshold": "<see schema>",
  "threshold_scale_ref": "<see schema>",
  "searched_at": "<see schema>",
  "result": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.763 msmint p50
3.113 msmint p95
1.953 msverify p50
2.216 msverify p95
200iterations
2281artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Admission Binding Receipt

Typed receipt contract Deployed in production
#admission-binding
What it proves

This receipt attests only that a supplied admission credential and one supplied conduct receipt yield byte identical subject commitments under one disclosed binding salt that the admission credential already commits to, and that the extracted conduct instant is at or after the stated admission instant and within the signed maximum separation.

What it does not prove

It does not attest that the admission credential is validly issued, that any admitting party is entitled to admit, that either identifier is true, that the subject is a person or entity of any asserted kind, that the conduct occurred, or that the conduct is authorized. It does not decide authenticity beyond the checked signatures and stated verification class, completeness of records, actual knowledge, intent, fault, fraud, contractual effect, legal effect, regulatory effect, eligibility, title, responsibility, liability, or any dispute. It does not authorize admission, access, conduct, a transaction, credential presentation, disclosure, or reliance by any party. It does not establish that either source artifact is complete, exclusive, current, unrevoked, unaltered before receipt, or truthful. It cannot decide whether an absent conduct receipt exists, whether another admission credential exists, whether the admitting party relied on the credential, whether the conduct service observed all conduct, or whether any party knew of the other artifact.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['admission.binding']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeadmission.binding
Mint routeno mint route
Open verify route/verify/admission-binding no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/authority-line/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/admission-binding.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/admission-binding
curl -sS -X POST https://thehiveryiq.com/v1/verify/admission-binding -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

{
  "receipt": "<a receipt of this type>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
4.866 msmint p50
8.7 msmint p95
3.765 msverify p50
4.342 msverify p95
200iterations
2906artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

AFiR-OCR DocProof

Typed receipt contract Deployed in production
#afir-ocr-docproof
What it proves

AFiR-OCR DocProof receipt. Scoped to extraction provenance only: what an OCR engine read, from where, and under what confidence metadata.

What it does not prove

It does not attest that the extracted value is correct, and it does not share AFIR fragment routing infrastructure; shares_afir_route_backend is fixed to false because this contract has no dependency on the afir.route Modal backend.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['afir.ocr.docproof']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Source disagreement on record

canon-46-independent-review.md finding 1.1 held this contract off every public surface until a provisional filing was confirmed. The provisional was filed on 14 August 2026 and is recorded in PATENT_PROVISIONAL_2026-08-14_AFIR_OCR_INSTRUMENTS.md at the repository root, so the hold is released. This row now carries the same schema URL, routes, example request and benchmark as every other public contract. Patent pending.

Canonical typeafir.ocr.docproof
Mint route/mint/afir-ocr-docproof
Open verify route/verify/afir-ocr-docproof no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/afir-ocr/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • shares_afir_route_backend is pinned to False
  • extraction_correctness_proven is pinned to False
Example requestPOST https://thehiveryiq.com/v1/mint/afir-ocr-docproof
curl -sS -X POST https://thehiveryiq.com/v1/mint/afir-ocr-docproof -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"document_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"}'

{
  "document_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.511 msmint p50
2.888 msmint p95
1.798 msverify p50
2.202 msverify p95
200iterations
1020artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

AFiR-S3 (Agentic Receipts)

Typed receipt contract Deployed in production
#afir-s3
What it proves

AFiR-S3 agentic receipt. Attests that a segment_id, a caller declared lifecycle stage, and a caller held storage-reference digest were recorded and signed at recorded_at.

What it does not prove

It does not attest that the referenced tool scope, action, or reward attribution actually executed as declared; that determination remains with whatever system originated the underlying agent trajectory.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['afir.s3']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeafir.s3
Mint route/mint/afir-s3
Open verify route/verify/afir-s3 no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/agents/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • canon_anchor_fixed is pinned to True
Example requestPOST https://thehiveryiq.com/v1/mint/afir-s3
curl -sS -X POST https://thehiveryiq.com/v1/mint/afir-s3 -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"segment_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "lifecycle_stage": "<see schema>"}'

{
  "segment_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "lifecycle_stage": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.515 msmint p50
2.911 msmint p95
1.762 msverify p50
2.186 msverify p95
200iterations
991artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

AFiR-Stream

Typed receipt contract Deployed in production
#afir-stream
What it proves

AFiR-Stream receipt. Attests that a stream_session_id and a caller held audio segment digest were recorded and signed at recorded_at, using Ed25519 today.

What it does not prove

It does not attest that post quantum signing covers this stream; pq_enabled is fixed to false because this deployment signs with Ed25519, not a post quantum algorithm, and that must never be caller overridable.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['afir.stream']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeafir.stream
Mint route/mint/afir-stream
Open verify route/verify/afir-stream no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/afir-stream/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • pq_enabled is pinned to False
  • algorithm_in_use is pinned to Ed25519
Example requestPOST https://thehiveryiq.com/v1/mint/afir-stream
curl -sS -X POST https://thehiveryiq.com/v1/mint/afir-stream -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"stream_session_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"}'

{
  "stream_session_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.487 msmint p50
2.858 msmint p95
1.747 msverify p50
1.993 msverify p95
200iterations
991artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Analysis Replay Receipt

Typed receipt contract Deployed in production
#analysis-replay
What it proves

This receipt attests only that a lock manifest signed before data access, an execution record chained to that lock manifest, and a column access manifest signed by the attested runtime satisfy the stated deterministic replay procedure for the named reported outputs. It establishes only that the reported output commitments are the ones produced by the committed script hash, parameter commitment, and environment measurement over the committed dataset snapshot root, and that the runtime recorded no read of any embargoed column at or before the lock instant.

What it does not prove

It does not establish that the underlying records are authentic, complete, representative, or correctly collected, that the locked analysis plan was well designed, adequately powered, or free of defect, that the planned outputs commitment was specific enough to exclude any result, or that the analysis script computes what its authors intended. It does not establish that the attested runtime, the data custodian, or the analyst is honest, competent, or uncompromised, and it does not establish that no analysis was performed outside the recorded execution. This receipt decides no contractual, statutory, regulatory, evidentiary, scientific, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no submission, publication, approval, payment, sanction, denial, or remedy.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['analysis.replay']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeanalysis.replay
Mint route/mint/analysis-replay
Open verify route/verify/analysis-replay no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/analysis-replay/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/analysis-replay.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/analysis-replay
curl -sS -X POST https://thehiveryiq.com/v1/verify/analysis-replay -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, none shown

No benchmark is shown for this entry because none was measured against a verified deployment.

Multi-provider assembly receipt

Typed receipt contract Deployed in production
#assembly-receipt
What it proves

This receipt attests that the recorded contribution set in signed_body, applied in the stated order when assembly_policy.order_matters is true, recomputes to the committed Merkle root or equivalent commitment and to final_output_sha256, and, when assembly_policy.expected_contributors is present, that the contribution set contains exactly that set of contributors with no omission, duplication, or unexpected contributor.

What it does not prove

It does not attest that any individual contribution is correct, that any named provider or model actually performed the work claimed, or that the final output is fit for any purpose.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['assembly.receipt']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeassembly.receipt
Mint route/mint/assembly
Open verify route/verify/assembly no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/model-receipts/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/proof-instruments.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/assembly
curl -sS -X POST https://thehiveryiq.com/v1/verify/assembly -H 'content-type: application/json' -d @canon/examples/assembly-receipt-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.58 msmint p50
4.928 msmint p95
1.858 msverify p50
2.083 msverify p95
200iterations
2315artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Authority Carriage Receipt

Typed receipt contract Deployed in production
#authority-carriage
What it proves

Authority Carriage receipt. Attests that the scope commitment enforced by the named enforcement point at admission equals the scope commitment named in the record of the effect, that the record was written at or after the admission decision, and that the enforcement point and the record point are distinct commitments.

What it does not prove

It does not attest that the effect itself was correct, that the admitted scope was the right scope to grant, or that any system outside the supplied admission envelope and the supplied record digest was inspected.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['authority.carriage']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeauthority.carriage
Mint route/mint/authority-carriage
Open verify route/verify/authority-carriage no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/authority-line/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/authority-carriage.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/authority-carriage
curl -sS -X POST https://thehiveryiq.com/v1/verify/authority-carriage -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
4.408 msmint p50
4.84 msmint p95
3.771 msverify p50
4.235 msverify p95
200iterations
2339artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Delegated authority chain

Typed receipt contract Deployed in production
#authority-delegation
What it proves

This receipt attests that this delegation link's scope, constraints, validity window, and depth do not exceed what its named parent link grants, and that its own issuer signed it inside its own validity window.

What it does not prove

It does not attest that any action later taken under this authority was itself proper. Chain verification checks revocation only against revocation_snapshot.revoked_delegation_ids as recorded on the links actually supplied in the chain; it does not attest that those snapshots are current at the time a chain is checked, and it cannot see a revocation issued after the snapshot's checked_at or a revocation recorded only in a registry the caller did not supply as part of the chain.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['authority.delegation']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeauthority.delegation
Mint route/mint/delegation-link
Open verify route/verify/delegation-link no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/agents/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/proof-instruments.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/delegation-link
curl -sS -X POST https://thehiveryiq.com/v1/verify/delegation-link -H 'content-type: application/json' -d @canon/examples/delegated-authority-v1.example.child.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.438 msmint p50
2.722 msmint p95
3.855 msverify p50
7.451 msverify p95
200iterations
1585artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Granter Qualification Receipt

Typed receipt contract Deployed in production
#authority-qualification
What it proves

This receipt attests only that a named grant, a named entitlement source held by the granting party, and a named qualification record satisfy the stated deterministic containment and ordering procedure over disclosed commitments.

What it does not prove

It does not establish that the entitlement source is genuine, accurate, current, lawfully obtained, or sufficient under any contract, mandate, charter, licence, regulation, or statute. It does not establish that the qualifier is competent, diligent, independent in fact, or free of conflict. A qualification of qualified does not make the grant valid, enforceable, or binding, does not ratify the grant, and does not authorize the grantee to act. A qualification of unqualified does not make the grant void, does not establish fault, breach, negligence, or bad faith, and does not allocate risk, responsibility, liability, loss, or remedy. This receipt decides no contractual, statutory, regulatory, evidentiary, or legal consequence, and it authorizes no action, payment, sanction, denial, or remedy.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['authority.qualification']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeauthority.qualification
Mint routeno mint route
Open verify route/verify/authority-qualification no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/authority-line/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/authority-qualification.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/authority-qualification
curl -sS -X POST https://thehiveryiq.com/v1/verify/authority-qualification -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

{
  "receipt": "<a receipt of this type>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
6.512 msmint p50
9.129 msmint p95
5.675 msverify p50
6.362 msverify p95
200iterations
4162artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Authority Revocation Receipt

Typed receipt contract Deployed in production
#authority-revocation
What it proves

This receipt attests only that a named action, a named revocation, and a precommitted propagation bound satisfy the stated deterministic temporal classification procedure.

What it does not prove

It does not establish that the revocation is authorized, delivered, valid, enforceable, or effective as a matter of contract or law. It does not establish that the action is authorized, unauthorized, excused, ratified, wrongful, binding, or ineffective. A class of within_propagation_bound does not excuse the action and does not allocate risk, fault, responsibility, liability, loss, or remedy. Notification evidence records only the stated evidence class and does not establish that an actor receives, reads, understands, or has actual knowledge of revocation. This receipt does not decide any contractual, statutory, regulatory, evidentiary, or legal consequence, and it does not authorize any action, payment, sanction, denial, or remedy.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['authority.revocation']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeauthority.revocation
Mint routeno mint route
Open verify route/verify/authority-revocation no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/authority-line/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/authority-revocation.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/authority-revocation
curl -sS -X POST https://thehiveryiq.com/v1/verify/authority-revocation -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

{
  "receipt": "<a receipt of this type>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
2.741 msmint p50
3.069 msmint p95
1.967 msverify p50
2.372 msverify p95
200iterations
2599artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Authorization Decision Receipt

Typed receipt contract Deployed in production
#authorization-decision
What it proves

This receipt attests only that a named observer recomputed the stated authorization decision from the supplied confidential evidence at the stated instant.

What it does not prove

It does not attest that the underlying goods or services were delivered, that the cardholder intended the purchase, that the merchant is legitimate, that funds settled, that the issuer honored the decision, or that any party outside the named observer agrees with the finding.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['authorization.decision']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeauthorization.decision
Mint routeno mint route
Open verify route/verify/authorization-decision no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/amex/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/authorization-decision.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/authorization-decision
curl -sS -X POST https://thehiveryiq.com/v1/verify/authorization-decision -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

{
  "receipt": "<a receipt of this type>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
2.759 msmint p50
3.184 msmint p95
1.965 msverify p50
2.278 msverify p95
200iterations
2128artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Table Binding Uncertainty

Typed receipt contract Deployed in production
#binding-uncertainty
What it proves

Table Binding Uncertainty receipt. A number lifted out of a table can be read perfectly and still be wrong, because the header it was attached to was guessed, so this receipt carries cell commitments, the header edges that give those cells meaning with a confidence on each edge, and the reading order, and it reports an uncertain binding separately from and at the same time as the value. The service confirms every edge points at a cell that is present, confirms the reading order is a permutation of the committed cells, and counts the edges whose confidence falls below the committed threshold.

What it does not prove

It does not read the table and does not attest that any cell value or any header attachment is correct; table_read_by_service is fixed to false.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['binding.uncertainty']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typebinding.uncertainty
Mint route/mint/binding-uncertainty
Open verify route/verify/binding-uncertainty no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/afir-ocr/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • table_read_by_service is pinned to False
  • value_verdict_independent_of_binding_verdict is pinned to True
  • cell_count is pinned to integer
  • edge_count is pinned to integer
  • every_edge_resolves_to_a_committed_cell is pinned to boolean
  • reading_order_is_a_permutation_of_cells is pinned to boolean
  • uncertain_binding_edge_count is pinned to integer
  • binding_uncertain is pinned to boolean
Example requestPOST https://thehiveryiq.com/v1/mint/binding-uncertainty
curl -sS -X POST https://thehiveryiq.com/v1/mint/binding-uncertainty -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"table_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "render_profile_digest_sha256": "<64 hex chars, sha256 of your evidence>", "cells": "<see schema>", "binding_edges": "<see schema>", "reading_order": "<see schema>", "uncertainty_threshold": "<see schema>"}'

{
  "table_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "render_profile_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "cells": "<see schema>",
  "binding_edges": "<see schema>",
  "reading_order": "<see schema>",
  "uncertainty_threshold": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.747 msmint p50
3.166 msmint p95
2.02 msverify p50
2.319 msverify p95
200iterations
2875artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Bonded Performance Attestation (attestation leg)

Typed receipt contract Deployed in production
#bpa-attestation
What it proves

Bonded Performance Attestation binds a performance budget declared before the measurement window to a distribution measured inside that window and to a signed response binding for the measured response set or observation manifest. It is evidence suitable for a parametric threshold.

What it does not prove

It does not create or confirm insurance coverage, does not establish that any claim is payable, and does not attest that the output was correct.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['perf.attestation']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeperf.attestation
Mint route/mint/bpa/attestation
Open verify route/verify/perf-attestation no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/typed-receipts.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/bpa/attestation
curl -sS -X POST https://thehiveryiq.com/v1/verify/perf-attestation -H 'content-type: application/json' -d @canon/examples/perf-attestation-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
6.425 msmint p50
6.991 msmint p95
1.878 msverify p50
4.208 msverify p95
200iterations
1684artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Bonded Performance Attestation (budget leg)

Typed receipt contract Deployed in production
#bpa-budget
What it proves

This receipt records a performance budget declared before its measurement window opens.

What it does not prove

It does not assert that the budget was met, does not create or confirm insurance coverage, and does not attest that any output was correct.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['perf.budget']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeperf.budget
Mint route/mint/bpa/budget
Open verify route/verify/perf-budget no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/typed-receipts.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/bpa/budget
curl -sS -X POST https://thehiveryiq.com/v1/verify/perf-budget -H 'content-type: application/json' -d @canon/examples/perf-budget-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.446 msmint p50
2.819 msmint p95
1.793 msverify p50
2.185 msverify p95
200iterations
1020artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Capability Exercise Receipt

Typed receipt contract Deployed in production
#capability-exercise
What it proves

This receipt attests only that a named exerciser, independent of the named provider by a recomputed control set comparison, committed a challenge set and a declared expectation for each challenge before the named capability was first contacted, then invoked that capability at the named URL through the stated invocation class at an instant placed against a declared external time reference with a declared drift bound, and that the per challenge outcomes, the detection rate, and the conformance verdict recorded here were recomputed by this service from the committed challenge set and the observed outputs rather than supplied by the caller.

What it does not prove

It does not attest that the capability is accurate, effective, or fit for any purpose. It does not attest that any marking scheme is robust. It does not attest that the provider complies with any law, regulation, or standard. It does not attest that the capability was available at any instant other than the one recorded. It does not attest that a different exerciser, network path, or challenge set would produce the same outputs. It does not attest that the provider's published claim is true or false beyond the declared expectation tested here. It does not attest that no equivalent capability exists anywhere else. It does not decide whether any content was generated by any system.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['capability.exercise']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typecapability.exercise
Mint routeno mint route
Open verify route/verify/capability-exercise no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/capability-exercise/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/capability-exercise.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/capability-exercise
curl -sS -X POST https://thehiveryiq.com/v1/verify/capability-exercise -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

{
  "receipt": "<a receipt of this type>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
8.781 msmint p50
9.712 msmint p95
4.979 msverify p50
5.339 msverify p95
200iterations
17326artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Capture Commitment Receipt

Typed receipt contract Deployed in production
#capture-commitment
What it proves

This receipt fixes what was committed, not what was heard. The recording was never transmitted to the recorder and the recorder never decoded it, so nothing here asserts that the committed digests belong to any particular sound, speaker, event, or file on disk. What is fixed is this: at the stated instant a holder committed a container digest, a decoded digest, and an ordered per second commitment chain over a recording of the stated length, under a secret salt whose commitment is published here. Anyone later holding the recording can recompute all three and show they match, and anyone holding a clip can show it sits at an exact position in that chain with nothing inserted, removed, or reordered around it. No digest here survives a re encode of the audio, and this receipt makes no claim that it does.

What it does not prove

It is not a detector, not a watermark, not an identification of a voice, and not a statement that the recording is authentic, consented, human, or machine made.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['capture.commitment']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typecapture.commitment
Mint route/mint/capture-commitment
Open verify route/verify/capture-commitment no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/capture-commitment/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/capture-commitment.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/capture-commitment
curl -sS -X POST https://thehiveryiq.com/v1/verify/capture-commitment -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.871 msmint p50
5.739 msmint p95
1.977 msverify p50
2.324 msverify p95
200iterations
2613artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Causal Path Receipt

Typed receipt contract Deployed in production
#causal-path
What it proves

This receipt attests that a named sequence of receipts forms a digest continuous chain from one origin receipt to one terminus receipt with no unreceipted gap between them, that each step's declared input digest equals the prior step's declared output digest, that the recorded times do not run backwards, and that the continuity finding was recomputed by this service rather than supplied by the caller. Digest continuity is not causation.

What it does not prove

This receipt does not attest that the origin caused the terminus, that the terminus caused the claimed effect, that the claimed effect occurred at all, or that any harm was suffered by anyone, and this service never receives the description of the claimed effect. It does not attest that the chain presented is the only chain, that no parallel or intervening cause existed outside it, or that the steps chosen are the ones a court, regulator, or investigator would consider relevant. It establishes no legal liability and is not an expert opinion on causation.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['causal.path']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typecausal.path
Mint route/mint/causal/path
Open verify route/verify/causal-path no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/model-receipts/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/causal-path.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/causal/path
curl -sS -X POST https://thehiveryiq.com/v1/verify/causal-path -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
8.167 msmint p50
9.649 msmint p95
7.654 msverify p50
8.861 msverify p95
200iterations
2447artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Conduct Record Receipt

Typed receipt contract Deployed in production
#conduct-record
What it proves

This receipt attests only that a named observer verified the supplied fault attribution receipts, counted the ones that name one keyed operator pseudonym inside a committed window, and reported those counts by outcome class with no bucket below the stated floor.

What it does not prove

It does not attest that the supplied set is complete, that any omitted outcome does not exist, that the operator is well or badly run, that the record predicts anything, or that any registration, pricing, or admission decision is justified by it. It discloses no operator identity, no counterparty, and no amount.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['conduct.record']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeconduct.record
Mint routeno mint route
Open verify route/verify/conduct-record no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/amex/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/conduct-record.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/conduct-record
curl -sS -X POST https://thehiveryiq.com/v1/verify/conduct-record -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

{
  "receipt": "<a receipt of this type>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
57.454 msmint p50
61.784 msmint p95
29.35 msverify p50
31.023 msverify p95
200iterations
1828artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Control Replay Receipt

Typed receipt contract Deployed in production
#control-replay
What it proves

This receipt attests only that a set of signed control cycle records, an attested control software build measurement, and a disclosed set of cycle input and actuator openings satisfy the stated deterministic replay and ordering procedure over the named disputed window. A verdict of certified_build_in_control means only that, for every opened cycle, the certified build supplied to the verifier reproduced the committed actuator output digest from the committed cycle inputs, that each input commitment instant preceded its output commitment instant within the declared drift allowance, and that the cycle chain and index sequence were unbroken across the window. A verdict of replay_not_evaluated means the verifier did not hold the certified build and therefore concluded nothing whatever about whether the certified build produced the disclosed actuator commands.

What it does not prove

This receipt does not establish that the sensor and command inputs committed at capture time reflected physical reality, so it does not exclude spoofing, jamming, or a faulty sensor upstream of the commitment. It does not establish that the certified build was correct, safe, adequate, or fit for the conditions it encountered, and it does not establish that a certified build that was in control behaved reasonably. It does not establish that the secure element that produced the build measurement and the cycle signatures was uncompromised at or before the first cycle of the window. It does not establish that the disclosed window is the operationally relevant window, that undisclosed cycles are unremarkable, or that any actuator command caused any outcome. This receipt decides no contractual, statutory, regulatory, evidentiary, certification, airworthiness, roadworthiness, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no action, payment, sanction, denial, grounding, or remedy.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['control.replay']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typecontrol.replay
Mint route/mint/control-replay
Open verify route/verify/control-replay no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/control-replay/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/control-replay.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/control-replay
curl -sS -X POST https://thehiveryiq.com/v1/verify/control-replay -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, none shown

No benchmark is shown for this entry because none was measured against a verified deployment.

Corpus Commitment Receipt

Typed receipt contract Deployed in production
#corpus-commitment
What it proves

This receipt attests only that one queried work, normalized under the pinned normalization schema version, is present at or absent from the position that work occupies in a sparse Merkle accumulator whose root the trainer signed before the weights commitment for the named model run, and that the disclosed witness recomputes to that root. A verdict of in_corpus means only that the item commitment for the queried work sits under the committed root. A verdict of not_in_corpus means only that the position for the queried work is empty under that same committed root. Neither verdict establishes that the committed corpus is the only data the model was trained on, that the trainer did not train on a second uncommitted corpus, that the item count is truthful about works never committed, that any work was used lawfully or unlawfully, that any licence, permission, exception, or exhaustion applies, or that the normalization schema captures every form in which a work may appear.

What it does not prove

It does not establish authorship, ownership, originality, or subsistence of any right in the queried work, and it says nothing about any work other than the one queried. This receipt decides no contractual, statutory, regulatory, evidentiary, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no action, payment, sanction, denial, or remedy.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['corpus.commitment']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typecorpus.commitment
Mint route/mint/corpus-commitment
Open verify route/verify/corpus-commitment no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/corpus-commitment/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/corpus-commitment.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/corpus-commitment
curl -sS -X POST https://thehiveryiq.com/v1/verify/corpus-commitment -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, none shown

No benchmark is shown for this entry because none was measured against a verified deployment.

Decision Provenance Binding

Typed receipt contract Deployed in production
#decision-provenance
What it proves

Decision Provenance Binding receipt. A value read off a document usually gets normalized, enriched, aggregated, and scored before anything is decided on it, so this receipt binds the value as read to the value the decision actually relied on, with every step in between carrying the digest it consumed, the digest it emitted, the transform that ran, and the key of the actor that ran it. The service confirms the chain links, reports the first place it breaks, and where per step value commitments are supplied it reports the step at which the value first changed.

What it does not prove

It does not re-execute the pipeline and does not attest that the decision was correct or lawful; steps_reexecuted_by_service is fixed to false.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['decision.provenance']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typedecision.provenance
Mint route/mint/decision-provenance
Open verify route/verify/decision-provenance no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/afir-ocr/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • steps_reexecuted_by_service is pinned to False
  • decision_correctness_proven is pinned to False
  • step_count is pinned to integer
  • step_index_contiguous is pinned to boolean
  • step_chain_linked is pinned to boolean
  • first_chain_break_step_index is pinned to integer
  • value_changed_between_read_and_reliance is pinned to boolean
  • value_first_changed_at_step_index is pinned to integer
  • human_override_step_count is pinned to integer
Example requestPOST https://thehiveryiq.com/v1/mint/decision-provenance
curl -sS -X POST https://thehiveryiq.com/v1/mint/decision-provenance -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"decision_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "reading_attestation_ref": "<see schema>", "field_path": "<see schema>", "value_as_read_commitment_sha256": "<64 hex chars, sha256 of your evidence>", "steps": "<see schema>", "value_as_relied_upon_commitment_sha256": "<64 hex chars, sha256 of your evidence>", "decision_record_digest_sha256": "<64 hex chars, sha256 of your evidence>", "decision_adverse": "<see schema>", "decided_at": "<see schema>"}'

{
  "decision_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "reading_attestation_ref": "<see schema>",
  "field_path": "<see schema>",
  "value_as_read_commitment_sha256": "<64 hex chars, sha256 of your evidence>",
  "steps": "<see schema>",
  "value_as_relied_upon_commitment_sha256": "<64 hex chars, sha256 of your evidence>",
  "decision_record_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "decision_adverse": "<see schema>",
  "decided_at": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.739 msmint p50
6.703 msmint p95
1.948 msverify p50
2.254 msverify p95
200iterations
3466artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Delegation Attenuation Receipt

Typed receipt contract Deployed in production
#delegation-attenuation
What it proves

This receipt attests only that the supplied delegation links and supplied action assertion satisfy the stated mechanical attenuation comparisons at verification.

What it does not prove

It does not attest that the root authority is valid, that a grantor is entitled to delegate, that the supplied chain is complete or exclusive, that any linked credential is the one an acceptor uses, that an action occurs, that the action is authorized, lawful, effective, enforceable, paid, settled, or accepted, that any party has knowledge or notice, that a category name is revealed, or that any person bears responsibility, loss, harm, fault, or liability. It cannot decide whether authority exists outside the supplied chain, whether a missing link exists, whether an action is proper, or whether an external rule permits it.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['delegation.attenuation']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typedelegation.attenuation
Mint routeno mint route
Open verify route/verify/delegation-attenuation no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/authority-line/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/delegation-attenuation.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/delegation-attenuation
curl -sS -X POST https://thehiveryiq.com/v1/verify/delegation-attenuation -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

{
  "receipt": "<a receipt of this type>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
6.553 msmint p50
8.408 msmint p95
5.543 msverify p50
6.579 msverify p95
200iterations
3108artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Determinism Class Declaration

Typed receipt contract Deployed in production
#determinism-class
What it proves

Determinism Class Declaration receipt. A pipeline declares itself deterministic, seeded stochastic, or declared nondeterministic, and the service recomputes whether that declaration is internally consistent with what else is in the body: a seeded stochastic pipeline has to carry a seed commitment, and a declared nondeterministic pipeline has to enumerate what makes it nondeterministic. A pipeline that declares itself nondeterministic gets a not replayable as declared result later on, which is a stated limit and never an adverse finding.

What it does not prove

It does not re-execute the pipeline; replay_executed_by_service is fixed to false.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['determinism.class']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typedeterminism.class
Mint route/mint/determinism-class
Open verify route/verify/determinism-class no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/afir-ocr/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • replay_executed_by_service is pinned to False
  • declaration_internally_consistent is pinned to boolean
  • nondeterminism_source_count is pinned to integer
  • replay_permitted_by_declaration is pinned to boolean
  • replay_window_ordered is pinned to boolean
  • library_digest_count is pinned to integer
Example requestPOST https://thehiveryiq.com/v1/mint/determinism-class
curl -sS -X POST https://thehiveryiq.com/v1/mint/determinism-class -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"pipeline_instance_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "determinism_class": "<see schema>", "replay_window_from": "<see schema>", "replay_window_to": "<see schema>", "replay_environment_runtime_ref": "<see schema>", "replay_environment_accelerator_class": "<see schema>", "replay_environment_library_digests": "<see schema>", "declaring_key_id": "<see schema>"}'

{
  "pipeline_instance_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "determinism_class": "<see schema>",
  "replay_window_from": "<see schema>",
  "replay_window_to": "<see schema>",
  "replay_environment_runtime_ref": "<see schema>",
  "replay_environment_accelerator_class": "<see schema>",
  "replay_environment_library_digests": "<see schema>",
  "declaring_key_id": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.629 msmint p50
2.974 msmint p95
1.875 msverify p50
2.271 msverify p95
200iterations
1969artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Directory State Receipt

Typed receipt contract Deployed in production
#directory-state
What it proves

This receipt attests only that a named observer retrieved a named directory at a named URL at an instant placed against a declared external time reference with a declared drift bound, that the retrieved content hashed to the stated content digest, that the stated set of key identifiers was present with their stated per key commitments, and that the presence or absence of one queried key identifier was recomputed by this service from the committed content rather than supplied by the caller.

What it does not prove

It does not attest that the directory content is correct. It does not attest that the publisher is entitled to publish it. It does not attest that any key in it is validly issued or under the custody of any party. It does not attest that a key absent from it does not exist elsewhere. It does not attest that the observer saw the same content another observer would have seen at the same instant. It does not attest that any signature made under any key was authorised. It does not decide whether any message should have been blocked.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['directory.state']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typedirectory.state
Mint routeno mint route
Open verify route/verify/directory-state no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/agentic-payments/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/directory-state.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/directory-state
curl -sS -X POST https://thehiveryiq.com/v1/verify/directory-state -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

{
  "receipt": "<a receipt of this type>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
3.024 msmint p50
6.455 msmint p95
2.079 msverify p50
2.514 msverify p95
200iterations
3131artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Disclosure-Free Replay

Typed receipt contract Deployed in production
#disclosure-free-replay
What it proves

Disclosure-Free Replay typed facade receipt. Attests that a replay_id, a source_receipt_ref, and a disclosed field allowlist were recorded and signed at recorded_at, and that fields_outside_allowlist_leaked recomputes exactly from a caller supplied leaked_field_count.

What it does not prove

It does not itself inspect the replayed payload; a caller must independently diff the replayed fields against disclosed_field_allowlist and report the count truthfully, this receipt only records and signs that count.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['replay.disclosurefree']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typereplay.disclosurefree
Mint route/mint/replay-disclosurefree
Open verify route/verify/replay-disclosurefree no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/carnac-live-ink/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • fields_outside_allowlist_leaked is pinned to boolean
Example requestPOST https://thehiveryiq.com/v1/mint/replay-disclosurefree
curl -sS -X POST https://thehiveryiq.com/v1/mint/replay-disclosurefree -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"replay_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "source_receipt_ref": "<see schema>", "disclosed_field_allowlist": "<see schema>", "leaked_field_count": "<see schema>"}'

{
  "replay_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "source_receipt_ref": "<see schema>",
  "disclosed_field_allowlist": "<see schema>",
  "leaked_field_count": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.522 msmint p50
2.932 msmint p95
1.902 msverify p50
2.181 msverify p95
200iterations
1227artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Diurnal Bond

Typed receipt contract Deployed in production
#diurnal-bond
What it proves

Diurnal Bond receipt. Attests that a regime_id and a caller held evidence digest were recorded and signed at recorded_at, and that the crypto envelope itself is live.

What it does not prove

It does not attest that any on-call or paging system actually escalated an attestation threshold; oncall_paging_integration is fixed to pending_design_partner because no such integration exists in this repository.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['usap.diurnal']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeusap.diurnal
Mint route/mint/usap-diurnal
Open verify route/verify/usap-diurnal no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/diurnal-bond/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • crypto_core_status is pinned to live
  • oncall_paging_integration is pinned to pending_design_partner
Example requestPOST https://thehiveryiq.com/v1/mint/usap-diurnal
curl -sS -X POST https://thehiveryiq.com/v1/mint/usap-diurnal -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"regime_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"}'

{
  "regime_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.403 msmint p50
2.66 msmint p95
1.844 msverify p50
2.161 msverify p95
200iterations
1025artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Reader Divergence Attestation

Typed receipt contract Deployed in production
#divergence-attestation
What it proves

Reader Divergence Attestation receipt. Several independent readers of the same document field disagree more often than a single reported value admits, so this receipt carries every reader commitment, the versioned selection rule with its declared deterministic tie break, and the commitment to the value that was reported. The service recomputes the rule digest, runs the committed rule over the committed commitments, and reports whether the value that was reported is the value the rule selects.

What it does not prove

It does not read the document, does not decide which reader is right, and does not attest that any reader value is correct; readers_executed_by_service is fixed to false because the service only ever sees commitments.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['divergence.attestation']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typedivergence.attestation
Mint route/mint/divergence-attestation
Open verify route/verify/divergence-attestation no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/afir-ocr/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • readers_executed_by_service is pinned to False
  • reader_correctness_proven is pinned to False
  • reader_count is pinned to integer
  • distinct_value_count is pinned to integer
  • agreement_set_size is pinned to integer
  • divergence_set_size is pinned to integer
  • rule_digest_recomputed is pinned to string
  • rule_selected_commitment_sha256 is pinned to string
  • tie_broken_deterministically is pinned to boolean
  • selection_consistent_with_reported_value is pinned to boolean
Example requestPOST https://thehiveryiq.com/v1/mint/divergence-attestation
curl -sS -X POST https://thehiveryiq.com/v1/mint/divergence-attestation -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"attestation_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "field_name": "<see schema>", "readers": "<see schema>", "selection_rule": "<see schema>", "reported_value_commitment_sha256": "<64 hex chars, sha256 of your evidence>", "divergence_class_enumeration_version": "<see schema>"}'

{
  "attestation_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "field_name": "<see schema>",
  "readers": "<see schema>",
  "selection_rule": "<see schema>",
  "reported_value_commitment_sha256": "<64 hex chars, sha256 of your evidence>",
  "divergence_class_enumeration_version": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.739 msmint p50
3.098 msmint p95
2.041 msverify p50
2.272 msverify p95
200iterations
3204artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Effect closure receipt

Typed receipt contract Deployed in production
#effect-closure
What it proves

This receipt attests that the closure named in signed_body closes the named authorization under the stated idempotency_key with the stated status, opened_at, and closed_at.

What it does not prove

It does not attest that the evidence digests it names are themselves accurate, and it does not attest that the underlying effect was fit for any purpose.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['effect.closure']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeeffect.closure
Mint route/mint/effect-closure
Open verify route/verify/effect-closure no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/agents/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/proof-instruments.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/effect-closure
curl -sS -X POST https://thehiveryiq.com/v1/verify/effect-closure -H 'content-type: application/json' -d @canon/examples/effect-closure-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.416 msmint p50
2.811 msmint p95
1.934 msverify p50
2.173 msverify p95
200iterations
1154artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Effect Quiescence Receipt

Typed receipt contract Deployed in production
#effect-quiescence
What it proves

This receipt attests only that a named authority, a channel roster committed before the interval opened, and a set of per channel continuity anchors satisfy the stated deterministic absence procedure over the named closed interval. A verdict of quiescent means only that no effect was admitted on the committed channels within the covered interval as reported by the anchoring parties.

What it does not prove

It does not establish that the roster enumerates every channel through which an effect could occur, that the anchoring parties are complete, honest, or diligent, or that no effect occurred outside the committed roster, outside the covered interval, or through an unreported path. It does not establish that any authority was suspended, revoked, exhausted, dormant, or unused as a matter of contract or law, and it does not establish quiescence of intent, capability, or obligation. A verdict of effect_observed does not establish that the effect was unauthorized, wrongful, or in breach. This receipt decides no contractual, statutory, regulatory, evidentiary, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no action, payment, sanction, denial, or remedy.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['effect.quiescence']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeeffect.quiescence
Mint routeno mint route
Open verify route/verify/effect-quiescence no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/authority-line/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/effect-quiescence.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/effect-quiescence
curl -sS -X POST https://thehiveryiq.com/v1/verify/effect-quiescence -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

{
  "receipt": "<a receipt of this type>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
4.644 msmint p50
5.343 msmint p95
3.93 msverify p50
7.041 msverify p95
200iterations
4241artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Egress Bond

Typed receipt contract Deployed in production
#egress-bond
What it proves

Egress Bond receipt. Attests that an egress_manifest_id and a caller held evidence digest were recorded and signed at recorded_at, and that the crypto envelope itself is live.

What it does not prove

It does not attest that any semantic classifier or egress gateway actually measured or bounded the declared volume or semantic class; semantic_classifier_integration is fixed to not_proven because no such classifier or gateway exists in this repository.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['usap.egress']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeusap.egress
Mint route/mint/usap-egress
Open verify route/verify/usap-egress no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/egress-bond/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • crypto_core_status is pinned to live
  • semantic_classifier_integration is pinned to not_proven
Example requestPOST https://thehiveryiq.com/v1/mint/usap-egress
curl -sS -X POST https://thehiveryiq.com/v1/mint/usap-egress -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"egress_manifest_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"}'

{
  "egress_manifest_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.508 msmint p50
4.956 msmint p95
1.838 msverify p50
2.078 msverify p95
200iterations
1084artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Erasure Receipt

Typed receipt contract Deployed in production
#erasure-receipt
What it proves

This receipt attests only that one salted object identifier commitment recomputes as a member of a signed pre deletion active set root, recomputes as a non member of a post deletion root over the same disclosed witness path, carries a signed data encryption key destruction record bound to that same commitment, and carries a signed replica manifest whose per replica destruction attestations cover the replica class set recorded at ingestion, all under the stated deterministic procedure and ordering allowances.

What it does not prove

It does not establish that the active set enumerated every copy of the object that ever existed, that the replica manifest enumerates every replica, backup, snapshot, cache, or export that held it, or that no offline or hidden copy was taken before the deletion. It does not establish that the object was ever admitted to the active set in the first place, that the reported destruction methods rendered any storage medium unrecoverable, or that the key and replica custodians are complete, honest, or diligent. It does not establish erasure of derived data, aggregates, embeddings, logs, or backups outside the manifest, and it decides no contractual, statutory, regulatory, evidentiary, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no action, payment, sanction, denial, or remedy.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['erasure.receipt']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeerasure.receipt
Mint route/mint/erasure-receipt
Open verify route/verify/erasure-receipt no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/erasure-receipt/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/erasure-receipt.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/erasure-receipt
curl -sS -X POST https://thehiveryiq.com/v1/verify/erasure-receipt -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, none shown

No benchmark is shown for this entry because none was measured against a verified deployment.

Evaluation Administration Receipt

Typed receipt contract Deployed in production
#eval-administration
What it proves

This receipt attests that a named evaluation administration arrangement was recorded alongside one specific evaluation attestation, that the test set digest was committed at or before the point the subject was told what the test set contained and at or before the evaluation window opened, and that the independence class was recomputed by this service from the declared relationship and separation of duties rather than supplied by the caller. The declared relationship, the declared separation of duties, and the identity of the administrator are recorded as asserted and are not independently verified here.

What it does not prove

This receipt does not contain, restate, or attest to any evaluation score or result. It does not attest that the test set was appropriate, that its items were representative, that the subject did not obtain the items by another route, that the evaluation method was adequate, or that the administrator was competent. It is not an accreditation, a certification, or an audit opinion, and no standards body, regulator, or insurer currently recognises it as one.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['eval.administration']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeeval.administration
Mint route/mint/eval/administration
Open verify route/verify/eval-administration no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/model-receipts/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/eval-administration.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/eval/administration
curl -sS -X POST https://thehiveryiq.com/v1/verify/eval-administration -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
6.343 msmint p50
8.823 msmint p95
3.759 msverify p50
4.176 msverify p95
200iterations
2283artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

EvAR

Typed receipt contract Deployed in production
#evar
What it proves

This receipt attests to the integrity of the evaluation record in signed_body.

What it does not prove

It does not attest that the evaluated system is correct, that the evaluation method is adequate, or that any certificate or accreditation is valid. A contamination_check status of passed records that the declared check ran and returned clean, and is not proof that the dataset is free of contamination.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['eval.attestation']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeeval.attestation
Mint route/mint/evar
Open verify route/verify/evar no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/model-receipts/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/typed-receipts.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/evar
curl -sS -X POST https://thehiveryiq.com/v1/verify/evar -H 'content-type: application/json' -d @canon/examples/evar-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.581 msmint p50
2.894 msmint p95
1.74 msverify p50
1.927 msverify p95
200iterations
1691artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Fault Attribution Receipt

Typed receipt contract Deployed in production
#fault-attribution
What it proves

This receipt attests only that a named observer recomputed which precommitted constraints the supplied observations violated, and which parties had made those precommitments before the loss instant.

What it does not prove

It does not attest that the loss occurred, that the observations are complete, that any party acted with intent, that any legal duty was breached, or that any amount is owed.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['fault.attribution']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typefault.attribution
Mint routeno mint route
Open verify route/verify/fault-attribution no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/amex/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/fault-attribution.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/fault-attribution
curl -sS -X POST https://thehiveryiq.com/v1/verify/fault-attribution -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

{
  "receipt": "<a receipt of this type>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
2.966 msmint p50
3.32 msmint p95
2.158 msverify p50
2.479 msverify p95
200iterations
1753artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Forensic Rail

Typed receipt contract Deployed in production
#forensic-rail
What it proves

Forensic Rail receipt. Attests that a credential_id and a caller held evidence digest were recorded and signed at recorded_at, and that the crypto envelope itself is live.

What it does not prove

It does not attest that any ISAC style consortium actually issued the credential, or that a deterministic inference stack actually produced the analysis; isac_consortium_integration and deterministic_inference_stack are fixed to not_proven because no such consortium or stack exists in this repository.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['usap.forensic']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeusap.forensic
Mint route/mint/usap-forensic
Open verify route/verify/usap-forensic no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/forensic-rail/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • crypto_core_status is pinned to live
  • isac_consortium_integration is pinned to not_proven
  • deterministic_inference_stack is pinned to not_proven
Example requestPOST https://thehiveryiq.com/v1/mint/usap-forensic
curl -sS -X POST https://thehiveryiq.com/v1/mint/usap-forensic -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"credential_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"}'

{
  "credential_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.545 msmint p50
5.049 msmint p95
1.805 msverify p50
2.042 msverify p95
200iterations
1164artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Foretoken (streamed proof, sealed ending)

Typed receipt contract Deployed in production
#foretoken
What it proves

This receipt attests that pre_commitment was fixed at committed_at, before or at first_content_at, and that chain.final_chain_sha256 and chain.emitted_unit_count, when present, were computed by the signer at mint time from the caller's ordered per-unit digest evidence, folded onto pre_commitment.chain_init_sha256 under the declared algorithm, never accepted as caller-declared values, sealed at termination.sealed_at under the declared termination.kind.

What it does not prove

It does not read, judge, or attest to the quality of the streamed content, it does not require a trusted execution environment, and it cannot be produced after the fact against content that already existed, because the pre_commitment necessarily predates the content it covers. This receipt alone does not let an independent verifier replay the fold, because the per-unit evidence is never stored in it; a party later given the same ordered per-unit digest list by the producer's own records can independently recompute the fold against chain.evidence_sha256 and chain.final_chain_sha256, and a truncated, extended, edited, or reordered unit list will not reproduce either value. A run with a pre_commitment and no terminal attestation is not silent by design; the absence itself indicates the stream never reached a sealed ending.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['stream.attestation']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typestream.attestation
Mint route/mint/stream-attestation
Open verify route/verify/stream-attestation no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/foretoken/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/proof-instruments-2.test.mjs test/deployment.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/stream-attestation
curl -sS -X POST https://thehiveryiq.com/v1/verify/stream-attestation -H 'content-type: application/json' -d @canon/examples/stream-attestation-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.584 msmint p50
5.759 msmint p95
1.806 msverify p50
2.215 msverify p95
200iterations
2496artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

HiveBound Envelope (typed facade)

Typed receipt contract Deployed in production
#hivebound-envelope
What it proves

HiveBound Envelope typed facade receipt. Attests that a binding_id, a bound_entity_ref, and a caller held binding-policy evidence digest were recorded and signed at recorded_at, and that binding_conformant recomputes exactly from a caller supplied policy_digest_match flag.

What it does not prove

It does not itself re-implement HiveBound pre-commitment envelope validation; the original hivebound envelope schema and its own POST /verify route remain the authority for that shape, this typed contract is a canonical-registry facade over the same binding concept for the unified typed-receipts API.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['hivebound.envelope']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Source disagreement on record

canon-46-independent-review.md finding 1.2 reports that GET /schema/hivebound.envelope is intercepted by a legacy handler and returns the older HiveBound pre commitment envelope schema instead of this contract's schema. Read the schema from the published .well-known URL, not from that route, until the collision is resolved.

Canonical typehivebound.envelope
Mint route/mint/hivebound-envelope
Open verify route/verify/hivebound-envelope no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/hivebound/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • binding_conformant is pinned to boolean
Example requestPOST https://thehiveryiq.com/v1/mint/hivebound-envelope
curl -sS -X POST https://thehiveryiq.com/v1/mint/hivebound-envelope -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"binding_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "bound_entity_ref": "<see schema>", "policy_digest_match": "<see schema>"}'

{
  "binding_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "bound_entity_ref": "<see schema>",
  "policy_digest_match": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.615 msmint p50
5.533 msmint p95
1.739 msverify p50
1.964 msverify p95
200iterations
1241artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

HiveSeal QPuF

Typed receipt contract Deployed in production
#hiveseal-qpuf
What it proves

HiveSeal Quantum Physically Unclonable Function receipt. Attests that a puf_challenge_id and a caller held challenge-response digest were recorded and signed at recorded_at.

What it does not prove

It does not attest that any physical hardware root of trust exists; qrng_source_kind and puf_source_kind are fixed to simulated because this deployment holds no physical PUF or quantum random number generator, and that must never silently become hardware.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['hiveseal.qpuf']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typehiveseal.qpuf
Mint route/mint/hiveseal-qpuf
Open verify route/verify/hiveseal-qpuf no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/hiveseal/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • qrng_source_kind is pinned to simulated
  • puf_source_kind is pinned to simulated
Example requestPOST https://thehiveryiq.com/v1/mint/hiveseal-qpuf
curl -sS -X POST https://thehiveryiq.com/v1/mint/hiveseal-qpuf -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"puf_challenge_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"}'

{
  "puf_challenge_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.532 msmint p50
2.914 msmint p95
1.751 msverify p50
2.047 msverify p95
200iterations
1070artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Howler

Typed receipt contract Deployed in production
#howler-sae
What it proves

Howler receipt. Attests that a probe_id and a caller held evidence digest were recorded and signed at recorded_at, and that the crypto envelope itself is live.

What it does not prove

It does not attest that a sparse autoencoder probe was actually wired into a live reasoning loop, or that any drift, capability, or contamination signal was actually detected; sae_wired_to_live_reasoning_loop is fixed to false because no design partner run exists yet.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['usap.howler']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeusap.howler
Mint route/mint/usap-howler
Open verify route/verify/usap-howler no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/howler/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • crypto_core_status is pinned to live
  • sae_wired_to_live_reasoning_loop is pinned to False
Example requestPOST https://thehiveryiq.com/v1/mint/usap-howler
curl -sS -X POST https://thehiveryiq.com/v1/mint/usap-howler -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"probe_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"}'

{
  "probe_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.374 msmint p50
2.714 msmint p95
1.725 msverify p50
2.013 msverify p95
200iterations
1057artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Hive Verifiable Voting System

Typed receipt contract Deployed in production
#hvvs
What it proves

Hive Verifiable Voting System receipt. Attests that a ballot_id, an election_ref, and a caller held vote-commitment digest were recorded and signed at recorded_at.

What it does not prove

It does not attest that any operational voting or election-verification system exists; system_operational is fixed to false because no such system is built or deployed, and no election authority endorsement is claimed.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['voting.verifiable']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typevoting.verifiable
Mint route/mint/voting-verifiable
Open verify route/verify/voting-verifiable no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/voting/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • system_operational is pinned to False
Example requestPOST https://thehiveryiq.com/v1/mint/voting-verifiable
curl -sS -X POST https://thehiveryiq.com/v1/mint/voting-verifiable -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"ballot_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "election_ref": "<see schema>"}'

{
  "ballot_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "election_ref": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.457 msmint p50
2.856 msmint p95
1.794 msverify p50
2.202 msverify p95
200iterations
1017artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Imprimatur (pre-attestation clearance primitive)

Typed receipt contract Deployed in production
#imprimatur
What it proves

This receipt attests that the four named pre-conditions in signed_body were evaluated and combined exactly as recorded, that precond_root recomputes from those four leaves, that outcome was computed from the leaves rather than supplied by the caller, and that the clearance was read at or before expires_at.

What it does not prove

It does not attest that any pre-condition's underlying evidence digest is itself accurate, does not assert that the cleared inference is lawful, and does not attest that any inference which follows actually ran as cleared. A separate Hive receipt for the executed inference is required to check whether the executed model matched request_ref.model_ref.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['imprimatur.clearance']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeimprimatur.clearance
Mint route/mint/imprimatur-clearance
Open verify route/verify/imprimatur-clearance no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/imprimatur/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/sigr-imprimatur.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/imprimatur-clearance
curl -sS -X POST https://thehiveryiq.com/v1/verify/imprimatur-clearance -H 'content-type: application/json' -d @canon/examples/imprimatur-clearance-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.685 msmint p50
3.175 msmint p95
2.084 msverify p50
2.306 msverify p95
200iterations
2052artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

InkFrame Non-Mutation

Typed receipt contract Deployed in production
#inkframe-non-mutation
What it proves

InkFrame Non-Mutation typed facade receipt. Attests that a frame_id, a pre-state digest, and a post-state digest were recorded and signed at recorded_at, and that mutated recomputes exactly as false only when the two digests are equal; any digest mismatch fails this receipt rather than being silently accepted. This is a thin unified-API facade over the InkFrame verb family hosted externally under Hive Receipt;

What it does not prove

it does not independently reach or depend on that external host, and mutated_externally_confirmed stays false because no cross-check against the external InkFrame service occurred.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['inkframe.nonmutation']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeinkframe.nonmutation
Mint route/mint/inkframe-nonmutation
Open verify route/verify/inkframe-nonmutation no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/carnac-live-ink/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • mutated is pinned to boolean
  • mutated_externally_confirmed is pinned to False
Example requestPOST https://thehiveryiq.com/v1/mint/inkframe-nonmutation
curl -sS -X POST https://thehiveryiq.com/v1/mint/inkframe-nonmutation -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"frame_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "pre_state_sha256": "<64 hex chars, sha256 of your evidence>", "post_state_sha256": "<64 hex chars, sha256 of your evidence>"}'

{
  "frame_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "pre_state_sha256": "<64 hex chars, sha256 of your evidence>",
  "post_state_sha256": "<64 hex chars, sha256 of your evidence>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.495 msmint p50
2.906 msmint p95
1.917 msverify p50
4.208 msverify p95
200iterations
1398artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Intent Affirmation Receipt

Typed receipt contract Deployed in production
#intent-affirmation
What it proves

This receipt attests only that the digest of the artifact presented for affirmation equals the digest of the artifact transmitted as the authenticated intent, and that the affirmation instant falls strictly between the presentation instant and the transmission instant, with all three instants placed against a declared external time reference and drift bound.

What it does not prove

It does not attest that a human was present, that anyone read, understood, or agreed to anything, that the presented summary is a faithful summary of what any person said, that the affirmation was freely given, or that the presented artifact was rendered legibly. The channel and the time reference are recorded as declared and are not verified here.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['intent.affirmation']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeintent.affirmation
Mint routeno mint route
Open verify route/verify/intent-affirmation no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/amex/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/intent-affirmation.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/intent-affirmation
curl -sS -X POST https://thehiveryiq.com/v1/verify/intent-affirmation -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

{
  "receipt": "<a receipt of this type>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
2.681 msmint p50
3.106 msmint p95
1.941 msverify p50
2.21 msverify p95
200iterations
2133artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Intent Verifiability Receipt

Typed receipt contract Deployed in production
#intent-verifiability
What it proves

This receipt attests only that a named observer recomputed a verifiability class from the declared predicate kinds of one committed intent, against a classification ruleset whose digest was committed at or before the intent was fixed.

What it does not prove

It does not attest that the intent was reasonable, that the Card Member understood it, that the declared predicate kinds are complete or honestly declared, that the predicates are the ones a court or regulator would consider material, that any claim is payable or deniable, or that any party is entitled to rely on the class. This service does not read the intent text and never receives it.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['intent.verifiability']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeintent.verifiability
Mint routeno mint route
Open verify route/verify/intent-verifiability no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/amex/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/intent-verifiability.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/intent-verifiability
curl -sS -X POST https://thehiveryiq.com/v1/verify/intent-verifiability -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

{
  "receipt": "<a receipt of this type>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
2.931 msmint p50
5.446 msmint p95
2.036 msverify p50
2.388 msverify p95
200iterations
1929artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Knowledge Timestamp Receipt

Typed receipt contract Deployed in production
#knowledge-timestamp
What it proves

This receipt attests only that a named detecting system, running a digest pinned software build and a digest pinned rule version, committed the digest of a detection artifact at an instant supplied by a named external time anchor with a declared drift bound, at a stated position in a named append only hash chained sequence, with no human approval in its mint path. It bounds the latest instant at which that system can later be said to have first held the committed artifact, and

What it does not prove

it does not establish the earliest such instant. It does not attest that the detection was correct, that the committed artifact described a real condition, or that any condition existed at all, and it does not decide whether any response was reasonable, timely, adequate, or complete. It does not decide whether any materiality, significance, or de minimis assessment was right, it makes no such assessment, and it does not determine that any reporting obligation applies, that any deadline was met or missed, or that any rule, regulation, contract, or duty was complied with or breached. It does not identify any affected system, person, account, or asset, it does not disclose the content of the committed artifact, it does not authorise, require, or excuse any notification, escalation, disclosure, remediation, or enforcement action, and it fixes the timeline to which those judgments are applied and nothing more.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['knowledge.timestamp']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeknowledge.timestamp
Mint route/mint/knowledge/timestamp
Open verify route/verify/knowledge-timestamp no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/knowledge-timestamp/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/knowledge-timestamp.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/knowledge/timestamp
curl -sS -X POST https://thehiveryiq.com/v1/verify/knowledge-timestamp -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.709 msmint p50
5.662 msmint p95
2.122 msverify p50
2.55 msverify p95
200iterations
3401artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Ledger Parity Receipt

Typed receipt contract Deployed in production
#ledger-parity
What it proves

This receipt attests that two named records, each observed at a named cursor and at a named instant, and each committed by a distinct registered attestor key to a keyed digest computed over the same declared list of fields, produced the comparison outcome that this service recomputed from those two committed digests and those two instants against the declared window tolerance.

What it does not prove

It does not disclose any position, balance, holder identity, or account identifier. It does not attest that either committed digest is a correct digest of the record it names, because confirming that requires read access which this receipt does not confer. It does not decide which record is correct when the two records diverge, assigns no fault to either operator, does not decide whether the underlying settlement, transfer, or register update was proper, and does not effect or reverse any settlement. A window_exceeded outcome records only that the two observations were too far apart for the comparison to be decisive.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['ledger.parity']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeledger.parity
Mint route/mint/ledger/parity
Open verify route/verify/ledger-parity no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/ledger-parity/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/ledger-parity.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/ledger/parity
curl -sS -X POST https://thehiveryiq.com/v1/verify/ledger-parity -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
7.353 msmint p50
8.476 msmint p95
5.294 msverify p50
6.087 msverify p95
200iterations
3299artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Cumulative Mandate Receipt

Typed receipt contract Deployed in production
#mandate-aggregate
What it proves

This receipt attests that the supplied set of mandate conformance receipts all reference the same delegated authority, all fall inside the stated window, share one currency, contain no duplicate, and that their cumulative total and count were recomputed by this service in integer minor units and compared against the stated cumulative constraint.

What it does not prove

This service cannot know whether the supplied set is complete. A transaction that was never presented here does not appear in these totals, so a within cumulative outcome is a statement about the receipts supplied and not a statement about everything the mandate holder spent. It performs no currency conversion, is not a payment authorisation, shifts no liability under any card network rule, and does not limit any right a consumer holds under Regulation E, Regulation Z, or any equivalent rule.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['mandate.aggregate']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typemandate.aggregate
Mint route/mint/mandate/aggregate
Open verify route/verify/mandate-aggregate no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/agents/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/mandate-aggregate.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/mandate/aggregate
curl -sS -X POST https://thehiveryiq.com/v1/verify/mandate-aggregate -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
6.624 msmint p50
7.643 msmint p95
6.078 msverify p50
6.959 msverify p95
200iterations
2043artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Mandate Conformance Receipt

Typed receipt contract Deployed in production
#mandate-conformance
What it proves

This receipt attests that the named transaction's amount, currency, timing and scope were compared against the constraints of one specific delegated authority receipt that was signed before the transaction was authorised, and that the outcome was recomputed by this service from that comparison rather than supplied by the caller.

What it does not prove

It does not attest that the cardholder granted the delegation, that the declared agent identity is genuine, that the transaction was authorised or settled by any network, that goods or services were delivered, or that the displayed terms digest corresponds to anything a person actually read. It is not a payment authorisation and carries no cardholder credential. No card network, issuer, or regulator currently recognises this receipt as authentication data, as compelling evidence, or as a liability shift, and it does not create one. It does not deny, resolve, adjudicate or affect any dispute, and it does not limit any right a consumer holds under Regulation E, Regulation Z, or any equivalent rule. This receipt evaluates one transaction against a per transaction constraint and does not evaluate cumulative spend, transaction velocity, or any aggregate limit across multiple transactions under the same mandate, so a series of individually conforming transactions may still exceed a spending intent this receipt cannot see. It evaluates the delegated authority receipt as supplied and inherits that receipt's revocation limitation, so it does not attest that the mandate was still unrevoked at the moment the transaction was authorised.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['mandate.conformance']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typemandate.conformance
Mint route/mint/mandate/conformance
Open verify route/verify/mandate-conformance no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/agents/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/parametric-and-mandate.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/mandate/conformance
curl -sS -X POST https://thehiveryiq.com/v1/verify/mandate-conformance -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
6.509 msmint p50
7.32 msmint p95
4.011 msverify p50
6.952 msverify p95
200iterations
2980artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Cross Acceptor Receipt

Typed receipt contract Deployed in production
#mandate-crossacceptor
What it proves

This receipt attests only that the issuing service, for the declared authority grouping and accounting window, receives the contribution and coverage evidence it describes, verifies the stated keyed pseudonym derivations under a committed window salt, recomputes the stated distinct acceptor count, dispersion class, commitments, cumulative relation, and coverage class, and signs that limited result.

What it does not prove

It does not attest that every action under the authority reaches the issuing service, that every acceptor reports, that a nonreporting acceptor is inactive, that the declared expected acceptor population is complete, that any acceptors are legally or institutionally unrelated, or that any pseudonym reveals an acceptor identity. It does not disclose the window salt, acceptor identities, contribution multiset, checked action count, exact dispersion ratio, cumulative constraint, or accumulated amount. It is not an authorization control and does not prevent, block, reverse, delay, ratify, or validate an underlying action. It does not decide whether an action, authority, constraint, report, acceptor, or actor is valid, authorized, proper, compliant, enforceable, or lawful. It does not deny, resolve, adjudicate, or affect any dispute or right.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['mandate.crossacceptor']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typemandate.crossacceptor
Mint routeno mint route
Open verify route/verify/cross-acceptor no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/authority-line/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/cross-acceptor.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/cross-acceptor
curl -sS -X POST https://thehiveryiq.com/v1/verify/cross-acceptor -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

{
  "receipt": "<a receipt of this type>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
3.03 msmint p50
3.363 msmint p95
2.095 msverify p50
2.305 msverify p95
200iterations
2841artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Mandate Cross Reference Receipt

Typed receipt contract Deployed in production
#mandate-crossreference
What it proves

This receipt attests only that two committed artifacts, each attested by a distinct registered attestor key, each declaring one cross reference field name and one keyed digest of that field value under a window salt committed before either artifact was presented, met or failed the declared equality relation, and that the equality outcome was recomputed by this service from the two commitments rather than supplied by the caller.

What it does not prove

It does not attest that either artifact is genuine, complete, or unaltered before commitment. It does not attest that either attestor is entitled to hold the artifact it committed. It does not attest that the transaction occurred, was authorised, settled, or was proper. It does not attest that the cross reference field is the right field for any purpose. A mismatch outcome does not mean that either side is wrong, and this receipt allocates no fault. It discloses neither artifact, neither field value, nor the salt.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['mandate.crossreference']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typemandate.crossreference
Mint routeno mint route
Open verify route/verify/mandate-crossreference no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/agentic-payments/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/mandate-crossreference.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/mandate-crossreference
curl -sS -X POST https://thehiveryiq.com/v1/verify/mandate-crossreference -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

{
  "receipt": "<a receipt of this type>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
6.333 msmint p50
6.819 msmint p95
5.519 msverify p50
6.021 msverify p95
200iterations
3044artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Meter Witness Receipt

Typed receipt contract Deployed in production
#meter-witness
What it proves

This receipt attests only that a calibration manifest signed by a named calibration authority, a set of interval records signed by the meter secure element whose public key that manifest names, a freshness nonce commitment established before those records were signed, and a collector batch root satisfy the stated deterministic metering procedure over the named intervals. A valid result means only that the reported interval energy equals the disclosed cumulative register delta, that each record hash, previous hash link, and batch inclusion path recompute, and that the manifest validity interval contains the interval bounds under the declared drift allowance.

What it does not prove

It does not establish that the meter measured the physical world correctly, that no physical tampering occurred without raising an event flag, that the firmware named by the manifest was honest when it was manufactured, or that the calibration authority signed a truthful manifest. It does not establish ownership of the site, the identity of the consumer, the source of the energy, or entitlement to any certificate, credit, payment, or settlement. This receipt decides no contractual, statutory, regulatory, evidentiary, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no action, payment, sanction, denial, or remedy.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['meter.witness']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typemeter.witness
Mint route/mint/meter-witness
Open verify route/verify/meter-witness no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/meter-witness/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/meter-witness.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/meter-witness
curl -sS -X POST https://thehiveryiq.com/v1/verify/meter-witness -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, none shown

No benchmark is shown for this entry because none was measured against a verified deployment.

Multi Source Divergence Detection (MSDD)

Typed receipt contract Deployed in production
#multi-source-divergence
What it proves

This receipt attests that assertion and observation, when both present, are each bound to response_sha256, that comparison_state correctly reflects whether assertion.value_sha256 equals observation.value_sha256 or that no observation was bound, and that assertion.basis is always relayed while observation.basis, when present, is always observed.

What it does not prove

It does not attest that the asserted value is true, does not attest that the observed value is true, does not merge or reconcile the two values into one figure, and does not identify the cause of a divergence when one is present. It requires no access to the provider's execution environment, no access to the observer's collection environment, and no trusted execution environment.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['divergence.record']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typedivergence.record
Mint route/mint/divergence-record
Open verify route/verify/divergence-record no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/proof-instruments-2.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/divergence-record
curl -sS -X POST https://thehiveryiq.com/v1/verify/divergence-record -H 'content-type: application/json' -d @canon/examples/divergence-record-v1.example.agreement.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.575 msmint p50
2.908 msmint p95
1.825 msverify p50
2.027 msverify p95
200iterations
1649artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Raster Origin Assertion

Typed receipt contract Deployed in production
#origin-raster
What it proves

Raster Origin Assertion receipt. Whether a region of a page was captured from a physical document or rendered by software is now a real question, so this receipt carries the origin class per region, the detector and version that produced it, the signals it relied on, its score with a named scale, and the ordered lineage of render profiles applied to that region, all signed by a named asserting key. Two verdict fields are fixed and the caller can never set them: the origin class is an assertion, and the origin is not forensically proven.

What it does not prove

It does not inspect the raster and does not attest that any region is authentic; detector_executed_by_service is fixed to false.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['origin.raster']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeorigin.raster
Mint route/mint/origin-raster
Open verify route/verify/origin-raster no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/afir-ocr/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • origin_class_is_an_assertion is pinned to True
  • origin_forensically_proven is pinned to False
  • detector_executed_by_service is pinned to False
  • subject_count is pinned to integer
  • captured_subject_count is pinned to integer
  • synthetic_render_subject_count is pinned to integer
  • mixed_subject_count is pinned to integer
  • undetermined_subject_count is pinned to integer
  • every_subject_carries_a_named_detector is pinned to boolean
Example requestPOST https://thehiveryiq.com/v1/mint/origin-raster
curl -sS -X POST https://thehiveryiq.com/v1/mint/origin-raster -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"raster_assertion_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "render_profile_digest_sha256": "<64 hex chars, sha256 of your evidence>", "asserting_key_id": "<see schema>", "subjects": "<see schema>"}'

{
  "raster_assertion_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "render_profile_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "asserting_key_id": "<see schema>",
  "subjects": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.635 msmint p50
2.998 msmint p95
1.983 msverify p50
2.265 msverify p95
200iterations
2454artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

OriginProof

Typed receipt contract Deployed in production
#originproof
What it proves

OriginProof, Human-Origin Attestation, receipt. Attests that an asset_id and a caller held production-conditions evidence digest were recorded and signed at recorded_at.

What it does not prove

It attests only the conditions of production (credential clearance, session integrity, declared tool or model use scope) that the caller declared, never that the output itself was provably human. This receipt is distinct from media.origin, which attests media content origin and rights evidence, not human production conditions; they must never be merged or aliased.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['origin.proof']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeorigin.proof
Mint route/mint/origin-proof
Open verify route/verify/origin-proof no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/originproof/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • matches_media_origin_family is pinned to False
  • human_output_provable is pinned to False
Example requestPOST https://thehiveryiq.com/v1/mint/origin-proof
curl -sS -X POST https://thehiveryiq.com/v1/mint/origin-proof -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"asset_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "origin_claim_type": "<see schema>"}'

{
  "asset_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "origin_claim_type": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.566 msmint p50
2.893 msmint p95
1.803 msverify p50
2.224 msverify p95
200iterations
1212artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Parametric Trigger Receipt

Typed receipt contract Deployed in production
#parametric-trigger
What it proves

This receipt attests that a named parametric condition was evaluated against one specific Bonded Performance Attestation, that the policy terms digest was committed at or before the governing budget was declared and the budget was declared at or before its measurement window opened, and that trigger_state was recomputed by this service from the referenced attestation rather than supplied by the caller.

What it does not prove

It does not create, confirm, price, underwrite, or interpret any insurance policy, and this service never receives the policy terms. It does not establish that any claim is payable, does not effect or authorise any payment, and does not attest that the measured outputs were correct or that any loss occurred. The measuring party is recorded as declared and is not verified here. Whether this trigger state entitles any party to payment is determined solely by the parties' own contract.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['parametric.trigger']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeparametric.trigger
Mint route/mint/parametric/trigger
Open verify route/verify/parametric-trigger no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/parametric-and-mandate.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/parametric/trigger
curl -sS -X POST https://thehiveryiq.com/v1/verify/parametric-trigger -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
10.486 msmint p50
11.378 msmint p95
5.862 msverify p50
6.92 msverify p95
200iterations
2020artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Provenance-Bonded Sandbox

Typed receipt contract Deployed in production
#pbs
What it proves

Provenance-Bonded Sandbox receipt. Attests that a sandbox_id and a caller held evidence digest were recorded and signed at recorded_at, and that the crypto envelope itself is live.

What it does not prove

It does not attest that any kernel or eBPF hook actually enforced the declared sandbox boundary, or that runtime drift was actually detected; ebpf_integration_status is fixed to not_proven because no such integration exists in this repository.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['usap.pbs']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeusap.pbs
Mint route/mint/usap-pbs
Open verify route/verify/usap-pbs no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • crypto_core_status is pinned to live
  • ebpf_integration_status is pinned to not_proven
Example requestPOST https://thehiveryiq.com/v1/mint/usap-pbs
curl -sS -X POST https://thehiveryiq.com/v1/mint/usap-pbs -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"sandbox_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"}'

{
  "sandbox_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.498 msmint p50
2.768 msmint p95
1.89 msverify p50
2.095 msverify p95
200iterations
1049artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Perimeter Bond

Typed receipt contract Deployed in production
#perimeter-bond
What it proves

Perimeter Bond receipt. Attests that a perimeter_id and a caller held evidence digest were recorded and signed at recorded_at, and that the crypto envelope itself is live.

What it does not prove

It does not attest that any eBPF stack actually enforced the declared perimeter, or that an outbound attempt was actually intercepted; ebpf_stack_integration is fixed to pending_design_partner because no such integration exists in this repository.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['usap.perimeter']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeusap.perimeter
Mint route/mint/usap-perimeter
Open verify route/verify/usap-perimeter no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/perimeter-bond/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • crypto_core_status is pinned to live
  • ebpf_stack_integration is pinned to pending_design_partner
Example requestPOST https://thehiveryiq.com/v1/mint/usap-perimeter
curl -sS -X POST https://thehiveryiq.com/v1/mint/usap-perimeter -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"perimeter_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"}'

{
  "perimeter_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.499 msmint p50
4.947 msmint p95
1.806 msverify p50
2.113 msverify p95
200iterations
1071artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Portfolio Exposure Receipt

Typed receipt contract Deployed in production
#portfolio-exposure
What it proves

This receipt attests that concentration counts and share ratios were recomputed by this service over a set of opaque commitments supplied for one book as of a stated time, that no group smaller than five members was reported, and that this service received no insured identity, no dependency name, and no policy term.

What it does not prove

It does not attest that the commitments are correct, that they were computed honestly, that the book is complete, or that any member is insured at all. Because the commitments are opaque to this service by design, this service cannot detect a member that was omitted, duplicated, or mis committed. It does not measure, price, or opine on risk, does not constitute an actuarial analysis, a capital adequacy assessment, or a reinsurance recommendation, and it does not attest that a concentration reported here would produce a correlated loss.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['portfolio.exposure']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeportfolio.exposure
Mint route/mint/portfolio/exposure
Open verify route/verify/portfolio-exposure no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/agents/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/portfolio-exposure.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/portfolio/exposure
curl -sS -X POST https://thehiveryiq.com/v1/verify/portfolio-exposure -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.525 msmint p50
2.914 msmint p95
1.803 msverify p50
2.192 msverify p95
200iterations
2385artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

PPR Wearable

Typed receipt contract Deployed in production
#ppr
What it proves

Physiological Provenance Receipt for wearable sensor data. Attests that a record_id, a metric_type, and a caller held metric-value digest were recorded and signed at recorded_at.

What it does not prove

It does not attest that any wearable device was actually attested at the hardware level; device_attestation_status is fixed to not_proven because no device attestation integration exists in this repository.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['ppr.wearable']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeppr.wearable
Mint route/mint/ppr-wearable
Open verify route/verify/ppr-wearable no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/ppr-wearables/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • device_attestation_status is pinned to not_proven
Example requestPOST https://thehiveryiq.com/v1/mint/ppr-wearable
curl -sS -X POST https://thehiveryiq.com/v1/mint/ppr-wearable -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"record_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "metric_type": "<see schema>"}'

{
  "record_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "metric_type": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.496 msmint p50
2.882 msmint p95
1.795 msverify p50
2.056 msverify p95
200iterations
1021artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Proof Pre-Fill

Typed receipt contract Deployed in production
#proof-pre-fill
What it proves

Proof Pre-Fill receipt. Attests that a prefill_id, a template_ref, and a caller held prefilled-fields digest were recorded and signed at recorded_at, and that template_conformance recomputes exactly from a caller supplied template_digest_match flag.

What it does not prove

It does not attest that the template itself is fit for purpose, or that the prefilled values are factually correct.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['proof.prefill']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeproof.prefill
Mint route/mint/proof-prefill
Open verify route/verify/proof-prefill no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/carnac-live-ink/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • template_conformance is pinned to boolean
Example requestPOST https://thehiveryiq.com/v1/mint/proof-prefill
curl -sS -X POST https://thehiveryiq.com/v1/mint/proof-prefill -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"prefill_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "template_ref": "<see schema>", "template_digest_match": "<see schema>"}'

{
  "prefill_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "template_ref": "<see schema>",
  "template_digest_match": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.465 msmint p50
2.866 msmint p95
1.73 msverify p50
1.962 msverify p95
200iterations
1020artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Proof state transition container

Typed receipt contract Deployed in production
#proof-transition
What it proves

This receipt attests that the recorded transition sequence in signed_body is exactly what the predeclared transition table would produce from the named admissible input receipts, applied in the stated order, and that each input's issuer_key_id and admitted_role were declared in issuer_registry at the time this run was minted. Schema level and portable proof verification check the digest bindings only. Full verification additionally requires the caller to supply the actual input receipt envelopes and cryptographically verifies each one through the trust resolver before accepting it.

What it does not prove

This receipt does not attest that the transition table encodes correct business logic, that an input receipt not supplied for full verification is itself valid, or that any downstream effect named by effect_gate actually occurred. It also does not attest that issuer_registry is the complete or current set of issuers trusted outside this run, only the set this run declares itself bound to.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['proof.transition']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeproof.transition
Mint route/mint/proof-transition
Open verify route/verify/proof-transition no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/verify/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/proof-instruments.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/proof-transition
curl -sS -X POST https://thehiveryiq.com/v1/verify/proof-transition -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.777 msmint p50
3.453 msmint p95
1.949 msverify p50
2.234 msverify p95
200iterations
2666artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Portable transition proof

Typed receipt contract Deployed in production
#proof-transition-portable
What it proves

This receipt attests that the exporting signer named in key_id asserts the workflow_id, table_sha256, registry_sha256, final_state, effect_gate_sha256, input_count, and input_commitment bound here for the run named by run_id, exported from the full proof.transition container named by source_receipt_id and source_payload_sha256. Portable verification authenticates this signed assertion and its internal bindings only.

What it does not prove

It does not independently replay the omitted constituent inputs, does not verify the source container's own signature, and does not attest that the source container itself still exists or still verifies. A verifier who needs that replay must obtain and verify the full proof.transition container separately.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['proof.transition.portable']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeproof.transition.portable
Mint routeno mint route
Open verify route/verify/proof-transition-portable no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/verify/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/proof-instruments.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/proof-transition-portable
curl -sS -X POST https://thehiveryiq.com/v1/verify/proof-transition-portable -H 'content-type: application/json' -d @canon/examples/proof-transition-portable-v1.example.json

{
  "receipt": "<contents of /canon/examples/proof-transition-portable-v1.example.json>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
0.638 msmint p50
0.802 msmint p95
1.853 msverify p50
2.141 msverify p95
200iterations
1777artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Recovery Determination Receipt

Typed receipt contract Deployed in production
#recovery-determination
What it proves

This receipt attests only that a named observer recomputed a settlement position between two named parties from one named fault attribution outcome and a precommitted allocation table whose digest was committed before the loss instant.

What it does not prove

It does not attest that any amount is owed, that any party will pay, that the allocation table is enforceable, or that any contract exists between the named parties. Whether the recomputed position entitles anyone to payment is decided solely by the parties' own agreement.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['recovery.determination']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typerecovery.determination
Mint routeno mint route
Open verify route/verify/recovery-determination no auth
Auth requirementNo mint route exists for this type; it is produced as an export. Verify is open and unauthenticated.
Integration page/amex/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/recovery-determination.test.mjs
Example requestPOST https://thehiveryiq.com/v1/verify/recovery-determination
curl -sS -X POST https://thehiveryiq.com/v1/verify/recovery-determination -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

{
  "receipt": "<a receipt of this type>"
}

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against.

Benchmark, measured
7.166 msmint p50
7.957 msmint p95
4.093 msverify p50
4.647 msverify p95
200iterations
2134artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Refusal Ledger

Typed receipt contract Deployed in production
#refusal-ledger
What it proves

Refusal Ledger receipt. Attests that a refusal_event_id and a caller held evidence digest were recorded and signed at recorded_at, and that the crypto envelope itself is live.

What it does not prove

It does not attest that any policy engine actually authorized the mutation, or that a zk envelope bond circuit checked it; policy_engine_status and zk_envelope_bond_status are fixed to not_proven because no such engine or circuit exists in this repository.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['usap.refusal']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeusap.refusal
Mint route/mint/usap-refusal
Open verify route/verify/usap-refusal no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/refusal-ledger/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • crypto_core_status is pinned to live
  • policy_engine_status is pinned to not_proven
  • zk_envelope_bond_status is pinned to not_proven
Example requestPOST https://thehiveryiq.com/v1/mint/usap-refusal
curl -sS -X POST https://thehiveryiq.com/v1/mint/usap-refusal -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"refusal_event_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"}'

{
  "refusal_event_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.605 msmint p50
2.874 msmint p95
1.746 msverify p50
2.039 msverify p95
200iterations
1113artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Render Profile Commitment

Typed receipt contract Deployed in production
#render-profile
What it proves

Render Profile Commitment receipt. Pixel coordinates only mean something against the settings that produced the pixels, so this receipt commits the resolution, color space, bit depth, page box selection, and rotation together, and the service recomputes the profile digest over a canonical form of exactly those fields. A declared digest that

What it does not prove

does not recompute fails the receipt. It does not render the page and does not confirm that any raster was produced under this profile; raster_reproduced_by_service is fixed to false because the service never receives the page.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['render.profile']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typerender.profile
Mint route/mint/render-profile
Open verify route/verify/render-profile no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/afir-ocr/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • raster_reproduced_by_service is pinned to False
  • profile_digest_recomputed is pinned to string
  • profile_digest_recomputes is pinned to boolean
Example requestPOST https://thehiveryiq.com/v1/mint/render-profile
curl -sS -X POST https://thehiveryiq.com/v1/mint/render-profile -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"profile_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "resolution_dpi": "<see schema>", "color_space": "<see schema>", "bit_depth": "<see schema>", "page_box": "<see schema>", "rotation_degrees": "<see schema>", "profile_digest_sha256": "<64 hex chars, sha256 of your evidence>"}'

{
  "profile_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "resolution_dpi": "<see schema>",
  "color_space": "<see schema>",
  "bit_depth": "<see schema>",
  "page_box": "<see schema>",
  "rotation_degrees": "<see schema>",
  "profile_digest_sha256": "<64 hex chars, sha256 of your evidence>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.61 msmint p50
3.028 msmint p95
1.934 msverify p50
2.19 msverify p95
200iterations
1491artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Proof-driven routing receipt

Typed receipt contract Deployed in production
#routing-receipt
What it proves

This receipt attests that route_policy.policy_sha256 recomputes canonically from route_policy.policy, that route_policy.declared_at

What it does not prove

does not follow decision_window.opens_at, and that selected_route_id is exactly what route_policy.selection_rule and route_policy.policy would produce from the candidates array as scored against evidence_sha256 for each candidate, inside decision_window. It does not attest that the policy is well designed, that any candidate score reflects real world quality, or that the evidence snapshot behind evidence_sha256 was collected honestly.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['routing.receipt']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typerouting.receipt
Mint route/mint/routing
Open verify route/verify/routing no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/model-receipts/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/proof-instruments.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/routing
curl -sS -X POST https://thehiveryiq.com/v1/verify/routing -H 'content-type: application/json' -d @canon/examples/routing-receipt-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.441 msmint p50
2.732 msmint p95
1.768 msverify p50
1.972 msverify p95
200iterations
1704artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Signed Royalty-Provenance Receipt

Typed receipt contract Deployed in production
#royalty-provenance
What it proves

Signed Royalty-Provenance Receipt. Attests that a work_id, a rights_holder_ref, and a caller held royalty-event digest were recorded and signed at recorded_at, and that rights_chain_verified recomputes exactly from a caller supplied delegation_receipt_supplied flag.

What it does not prove

It does not itself verify a rights chain cryptographically; a caller wanting a cryptographically checked chain must separately supply and verify an authority.delegation receipt, this contract only records whether one was supplied.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['royalty.provenance']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeroyalty.provenance
Mint route/mint/royalty-provenance
Open verify route/verify/royalty-provenance no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/model-receipts/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • rights_chain_verified is pinned to boolean
Example requestPOST https://thehiveryiq.com/v1/mint/royalty-provenance
curl -sS -X POST https://thehiveryiq.com/v1/mint/royalty-provenance -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"work_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "rights_holder_ref": "<see schema>", "delegation_receipt_supplied": "<see schema>"}'

{
  "work_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "rights_holder_ref": "<see schema>",
  "delegation_receipt_supplied": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.517 msmint p50
2.904 msmint p95
1.737 msverify p50
3.496 msverify p95
200iterations
1170artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

S2S (Silicon-to-Signature)

Typed receipt contract Deployed in production
#s2s
What it proves

S2S, Silicon-to-Signature, receipt. Attests that an inference_id and a caller held GPU-session evidence digest were recorded and signed at recorded_at.

What it does not prove

It does not attest that a real NVIDIA GPU hardware attestation (for example nvtrust) chain was actually checked; gpu_hardware_attestation_status is fixed to not_proven because no such hardware attestation integration exists in this repository. S2S is Silicon-to-Signature, not a speech or voice primitive, and is a distinct canonical type from afir.stream.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['s2s.signature']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical types2s.signature
Mint route/mint/s2s-signature
Open verify route/verify/s2s-signature no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/s2s/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • crypto_core_status is pinned to live
  • gpu_hardware_attestation_status is pinned to not_proven
Example requestPOST https://thehiveryiq.com/v1/mint/s2s-signature
curl -sS -X POST https://thehiveryiq.com/v1/mint/s2s-signature -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"inference_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"}'

{
  "inference_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.524 msmint p50
2.866 msmint p95
1.805 msverify p50
2.066 msverify p95
200iterations
1155artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Screening Attestation Receipt

Typed receipt contract Deployed in production
#screening-attestation
What it proves

This receipt attests that a named screening engine, at a named ruleset version bound by a ruleset digest, evaluated a keyed commitment to a counterparty identifier against one named primary reference list at a named version bound by a digest over that version's contents, together with any named supplemental lists at their own named versions and digests, at a screening instant placed against a declared external time reference with a declared drift bound, and recorded the stated verdict under a recomputed signing authority requirement together with a declared validity period measured from that screening instant.

What it does not prove

It does not attest that the reference list itself is complete, accurate, current as published, or free of omission, and it does not attest that the publisher of that list acted correctly. It does not decide whether the counterparty is in fact a sanctioned, restricted or prohibited party, a false negative produced by an honest screening against a correctly bound list version remains a false negative that this receipt does not detect, does not correct and does not disclose, and no gate here detects an engine that reports a clear verdict where its own matching computation produced a match. It does not assess whether the screening program as a whole is adequate, whether the ruleset thresholds are appropriately calibrated, whether the set of lists screened is the correct set for any obligation, or whether the declared validity period is short enough for any purpose. It does not identify the counterparty, does not disclose any list record, does not disclose any match score, and does not confirm that the commitment key or the window salt has remained under the custody of any particular party. It does not authorize, block, freeze, reverse or settle any transaction, does not admit or reject any counterparty, does not constitute a report or notification to any authority, does not constitute legal, regulatory or compliance advice, and whether any obligation is satisfied by the screening it records is determined solely by the applicable law and by the parties' own arrangements.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['screening.attestation']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typescreening.attestation
Mint route/mint/screening/attestation
Open verify route/verify/screening-attestation no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/screening-attestation/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/screening-attestation.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/screening/attestation
curl -sS -X POST https://thehiveryiq.com/v1/verify/screening-attestation -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
5.699 msmint p50
6.54 msmint p95
3.822 msverify p50
4.634 msverify p95
200iterations
4237artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Sequence Attestation (SA), event order bracketed by external time

Typed receipt contract Deployed in production
#sequence-attestation
What it proves

This receipt attests that the recorded events fold to sequence_root in exactly the recorded order, that when a lower bound is present the named public block hash was folded into that root so the root cannot have been constructed before that block existed, that when an upper bound is present the RFC 3161 token's message imprint equals sequence_root so an authority outside Hive held that root at the stated time, and that anchor_state and bracket recompute from the bounds actually present.

What it does not prove

It does not attest that any event is true, that any event set is complete, or that the producing system's own observed times are honest. It does not itself validate the timestamp authority's certificate chain; the complete token is carried in the receipt so an independent verifier can check that chain against the authority's published root.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['sequence.attestation']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typesequence.attestation
Mint route/mint/sequence-attestation
Open verify route/verify/sequence-attestation no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/partners/ice-proof/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/sequence-attestation.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/sequence-attestation
curl -sS -X POST https://thehiveryiq.com/v1/verify/sequence-attestation -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.54 msmint p50
2.997 msmint p95
2.012 msverify p50
4.792 msverify p95
200iterations
1965artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Hive Settlement Feed

Typed receipt contract Deployed in production
#settlement-feed
What it proves

Hive Settlement Feed receipt. Attests that a settlement_id, a feed_source_ref, and a caller held settlement-amount digest were recorded and signed at recorded_at.

What it does not prove

It does not attest that this is a settlement-specific surface distinct from a generic signer call; distinct_from_generic_signer is fixed to false pending an explicit product decision, and no regulated market endorsement or accuracy claim is made.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['settlement.feed']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typesettlement.feed
Mint route/mint/settlement-feed
Open verify route/verify/settlement-feed no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/settlement-feed/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • distinct_from_generic_signer is pinned to False
Example requestPOST https://thehiveryiq.com/v1/mint/settlement-feed
curl -sS -X POST https://thehiveryiq.com/v1/mint/settlement-feed -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"settlement_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "feed_source_ref": "<see schema>"}'

{
  "settlement_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "feed_source_ref": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.563 msmint p50
5.788 msmint p95
1.807 msverify p50
2.204 msverify p95
200iterations
1057artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

SiGR Bill (signed inference cost or billing receipt)

Typed receipt contract Deployed in production
#sigr-bill
What it proves

This receipt attests that total_micro_usd recomputes exactly from the recorded input_tokens, output_tokens, price_input_micro_usd_per_1k, and price_output_micro_usd_per_1k.

What it does not prove

It does not attest that the token counts are accurate, that the unit prices reflect any published or contractual price list, or that the underlying inference request actually ran.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['sigr.bill']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typesigr.bill
Mint route/mint/sigr-bill
Open verify route/verify/sigr-bill no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/sigr/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/sigr-family.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/sigr-bill
curl -sS -X POST https://thehiveryiq.com/v1/verify/sigr-bill -H 'content-type: application/json' -d @canon/examples/sigr-bill-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.721 msmint p50
2.998 msmint p95
2.073 msverify p50
2.474 msverify p95
200iterations
987artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

SiGR Bond (signed SLA bond and measurement receipt)

Typed receipt contract Deployed in production
#sigr-bond
What it proves

This receipt attests that breached and penalty_micro_usd recompute exactly from the recorded bond terms and the recorded measurement.

What it does not prove

It does not attest that the measurement was collected honestly, that the bond terms are commercially reasonable, or that any penalty is legally owed.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['sigr.bond']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typesigr.bond
Mint route/mint/sigr-bond
Open verify route/verify/sigr-bond no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/sigr/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/sigr-family.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/sigr-bond
curl -sS -X POST https://thehiveryiq.com/v1/verify/sigr-bond -H 'content-type: application/json' -d @canon/examples/sigr-bond-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.679 msmint p50
2.977 msmint p95
1.956 msverify p50
2.118 msverify p95
200iterations
1006artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

SiGR CacheSign (KV cache prefix signing at write time)

Typed receipt contract Deployed in production
#sigr-cachesign
What it proves

This receipt attests that prefix_sha256 and token_span were sealed at sealed_at for the named model_id, and, when parent_ref is present, that this entry extends the exact prior sealed entry it names.

What it does not prove

It does not attest that the cached content is correct, was computed deterministically, or was actually reused by any later inference.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['sigr.cachesign']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typesigr.cachesign
Mint route/mint/sigr-cachesign
Open verify route/verify/sigr-cachesign no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/sigr/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/sigr-family.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/sigr-cachesign
curl -sS -X POST https://thehiveryiq.com/v1/verify/sigr-cachesign -H 'content-type: application/json' -d @canon/examples/sigr-cachesign-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.548 msmint p50
2.86 msmint p95
1.715 msverify p50
2.044 msverify p95
200iterations
962artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

SiGR Chain (SiGR family flagship, a step sealed signed agent run)

Typed receipt contract Deployed in production
#sigr-chain
What it proves

This receipt attests that the steps array recorded in signed_body, hashed in order, recomputes to chain_root, and that the sequence was sealed at sealed_at with no step dropped, reordered, or altered afterward.

What it does not prove

It does not attest that any step's content is accurate, that a tool_call step actually executed against the named tool, or that the agent's final answer is correct or fit for any purpose.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['sigr.chain']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typesigr.chain
Mint route/mint/sigr-chain
Open verify route/verify/sigr-chain no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/sigr/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/sigr-imprimatur.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/sigr-chain
curl -sS -X POST https://thehiveryiq.com/v1/verify/sigr-chain -H 'content-type: application/json' -d @canon/examples/sigr-chain-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.674 msmint p50
3.095 msmint p95
2.008 msverify p50
2.232 msverify p95
200iterations
1507artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

SiGR Consensus (signed multi-model panel receipt)

Typed receipt contract Deployed in production
#sigr-consensus
What it proves

This receipt attests that winner_seq and agreement_bp recompute exactly from the recorded members array under the declared method.

What it does not prove

It does not attest that any member output is correct, that the scoring method is well designed, or that the panel membership recorded here is complete.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['sigr.consensus']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typesigr.consensus
Mint route/mint/sigr-consensus
Open verify route/verify/sigr-consensus no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/sigr/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/sigr-family.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/sigr-consensus
curl -sS -X POST https://thehiveryiq.com/v1/verify/sigr-consensus -H 'content-type: application/json' -d @canon/examples/sigr-consensus-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.728 msmint p50
5.543 msmint p95
2.104 msverify p50
2.177 msverify p95
200iterations
1251artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

SiGR GCA (grounding claims attestation)

Typed receipt contract Deployed in production
#sigr-gca
What it proves

This receipt attests that claims_root and grounded_count recompute exactly from the recorded claims array, and that a claim with support_sha256 null carries support_strength_bp of 0. It proves that each claim carries the recorded support reference and strength.

What it does not prove

It does not prove that any claim is factually true, that the named support passage actually supports the claim it is attached to, or that the grounding method itself is sound.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['sigr.gca']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typesigr.gca
Mint route/mint/sigr-gca
Open verify route/verify/sigr-gca no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/sigr/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/sigr-family.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/sigr-gca
curl -sS -X POST https://thehiveryiq.com/v1/verify/sigr-gca -H 'content-type: application/json' -d @canon/examples/sigr-gca-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.546 msmint p50
2.814 msmint p95
2.117 msverify p50
2.241 msverify p95
200iterations
1480artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

SiGR GiTM (cross-signal anomaly flag)

Typed receipt contract Deployed in production
#sigr-gitm
What it proves

This receipt attests that triggered recomputes exactly from the five named boolean signals and trigger_bp. It asserts provenance_anomaly_pattern_observed only.

What it does not prove

It does not assert that anything is factually wrong, does not assert malicious intent, and does not assert that the underlying content is false or true.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['sigr.gitm']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typesigr.gitm
Mint route/mint/sigr-gitm
Open verify route/verify/sigr-gitm no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/sigr/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/sigr-family.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/sigr-gitm
curl -sS -X POST https://thehiveryiq.com/v1/verify/sigr-gitm -H 'content-type: application/json' -d @canon/examples/sigr-gitm-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.525 msmint p50
2.799 msmint p95
2.07 msverify p50
4.04 msverify p95
200iterations
1031artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

SiGR Manifest (streaming model manifest attestation, TEE-less)

Typed receipt contract Deployed in production
#sigr-manifest
What it proves

This receipt attests that manifest_sha256 recomputes exactly from the recorded model_id, weights_sha3, config_hash, and endpoint, at issued_at.

What it does not prove

It does not attest that the named endpoint is currently serving these weights, that the weights are free of vulnerabilities or backdoors, or that config_hash describes a safe or correct configuration.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['sigr.manifest']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typesigr.manifest
Mint route/mint/sigr-manifest
Open verify route/verify/sigr-manifest no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/sigr/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/sigr-family.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/sigr-manifest
curl -sS -X POST https://thehiveryiq.com/v1/verify/sigr-manifest -H 'content-type: application/json' -d @canon/examples/sigr-manifest-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.446 msmint p50
2.786 msmint p95
1.918 msverify p50
2.088 msverify p95
200iterations
1164artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

SiGR MiR (model identity and relineage)

Typed receipt contract Deployed in production
#sigr-mir
What it proves

This receipt attests that lineage_root recomputes exactly from the recorded steps array, and that identity_flicker recomputes exactly from steps and expected_model. It asserts served_model_identity_and_lineage only.

What it does not prove

It does not assert that any step's outputs are correct, safe, or fit for any purpose, and does not assert that weights_sha3 or config_hash describe a vulnerability free model.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['sigr.mir']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typesigr.mir
Mint route/mint/sigr-mir
Open verify route/verify/sigr-mir no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/model-receipts/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/sigr-family.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/sigr-mir
curl -sS -X POST https://thehiveryiq.com/v1/verify/sigr-mir -H 'content-type: application/json' -d @canon/examples/sigr-mir-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.513 msmint p50
2.859 msmint p95
1.927 msverify p50
2.123 msverify p95
200iterations
1546artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Sovereign AI Receipt Registry

Typed receipt contract Deployed in production
#sovereign-receipt-registry
What it proves

Sovereign AI Receipt Registry receipt. Attests that a registry_entry_id, a jurisdiction_ref, and a caller held registered-receipts digest were recorded and signed at recorded_at.

What it does not prove

It does not attest to any actual jurisdictional or governmental authority relationship; jurisdictional_authority_confirmed is fixed to false because no such relationship is confirmed in this repository.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['receipt.registry.sovereign']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typereceipt.registry.sovereign
Mint route/mint/receipt-registry-sovereign
Open verify route/verify/receipt-registry-sovereign no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/hivesovereign/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • jurisdictional_authority_confirmed is pinned to False
Example requestPOST https://thehiveryiq.com/v1/mint/receipt-registry-sovereign
curl -sS -X POST https://thehiveryiq.com/v1/mint/receipt-registry-sovereign -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"registry_entry_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "jurisdiction_ref": "<see schema>"}'

{
  "registry_entry_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "jurisdiction_ref": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.475 msmint p50
2.87 msmint p95
1.781 msverify p50
2.157 msverify p95
200iterations
1074artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Staged Preprocessing Chain

Typed receipt contract Deployed in production
#stage-replay
What it proves

Staged Preprocessing Chain receipt. A document preprocessing chain is recorded stage by stage with contiguous order values, the parameters each stage applied, the digest of the raster it emitted, and the key of the party that operated it, so a disagreement about the output can be narrowed to one stage and one operator instead of the whole pipeline. When the caller supplies observed stage output digests, the service reports the lowest ordered stage where the observed digest first differs from the digest that was committed. A stage carrying no operator signature is reported as incomplete stage custody, which is a different finding from a difference between digests.

What it does not prove

It does not re-execute any stage; stages_reexecuted_by_service is fixed to false because the service never receives the rasters.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['stage.replay']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typestage.replay
Mint route/mint/stage-replay
Open verify route/verify/stage-replay no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/afir-ocr/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • stages_reexecuted_by_service is pinned to False
  • stage_count is pinned to integer
  • stage_order_contiguous is pinned to boolean
  • incomplete_stage_custody is pinned to boolean
  • observed_stage_count is pinned to integer
  • first_divergent_stage_order is pinned to integer
  • divergence_localized_to_one_stage is pinned to boolean
  • chain_terminates_at_declared_output is pinned to boolean
Example requestPOST https://thehiveryiq.com/v1/mint/stage-replay
curl -sS -X POST https://thehiveryiq.com/v1/mint/stage-replay -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"chain_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "render_profile_digest_sha256": "<64 hex chars, sha256 of your evidence>", "determinism_class_ref": "<see schema>", "input_raster_digest_sha256": "<64 hex chars, sha256 of your evidence>", "output_raster_digest_sha256": "<64 hex chars, sha256 of your evidence>", "stages": "<see schema>"}'

{
  "chain_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "render_profile_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "determinism_class_ref": "<see schema>",
  "input_raster_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "output_raster_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "stages": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.813 msmint p50
6.131 msmint p95
1.957 msverify p50
2.283 msverify p95
200iterations
3740artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Stipryn (pre-submission proof-level binding)

Typed receipt contract Deployed in production
#stipryn
What it proves

This receipt attests that anchored_regions and its required_proof_level values were bound at declared_at, before the request identified by request_digest was transmitted, and that regions_sha256 recomputes canonically from anchored_regions.

What it does not prove

It does not attest that the request content is good, true, or complete, it does not alter or transmit the request, it does not attest that any downstream response met the required proof level, and it does not require the receiving party's cooperation to exist. The party bearing the consequence of the request retains full control of the request; this receipt only fixes, in advance, the evidentiary bar that response will later be measured against.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['proof.demand']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeproof.demand
Mint route/mint/proof-demand
Open verify route/verify/proof-demand no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/stipryn/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/proof-instruments-2.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/proof-demand
curl -sS -X POST https://thehiveryiq.com/v1/verify/proof-demand -H 'content-type: application/json' -d @canon/examples/proof-demand-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.519 msmint p50
2.874 msmint p95
1.819 msverify p50
2.228 msverify p95
200iterations
1880artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Structural Lateration

Typed receipt contract Deployed in production
#structural-lateration
What it proves

Structural Lateration receipt. Attests that a structure_id, a caller declared lateration_method, and an input digest set were recorded and signed at recorded_at, and that method_reproducible recomputes exactly from a caller supplied recomputed_digest_match flag.

What it does not prove

It does not itself independently re-run the lateration computation; a caller wanting independent recomputation must supply the same input_digest_set to their own implementation and compare.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['structural.lateration']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typestructural.lateration
Mint route/mint/structural-lateration
Open verify route/verify/structural-lateration no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/lateration/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • method_reproducible is pinned to boolean
Example requestPOST https://thehiveryiq.com/v1/mint/structural-lateration
curl -sS -X POST https://thehiveryiq.com/v1/mint/structural-lateration -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"structure_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "lateration_method": "<see schema>", "recomputed_digest_match": "<see schema>"}'

{
  "structure_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "lateration_method": "<see schema>",
  "recomputed_digest_match": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.494 msmint p50
2.868 msmint p95
1.779 msverify p50
2.164 msverify p95
200iterations
1135artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Submission Attestation Receipt

Typed receipt contract Deployed in production
#submission-attestation
What it proves

Submission Attestation receipt. Attests that a set of self reported figures was fixed and signed at the recorded submission instant, before the window those figures describe opened, and that every figure carries a declared basis class.

What it does not prove

It does not attest that any figure is accurate, that the window later matched the figures, or that anything measured the figures, and when clock.anchor_class is issuer_clock_only the submission instant rests on the issuing service clock with no external time anchor.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['submission.attestation']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typesubmission.attestation
Mint route/mint/submission-attestation
Open verify route/verify/submission-attestation no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/authority-line/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/submission-attestation.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/submission-attestation
curl -sS -X POST https://thehiveryiq.com/v1/verify/submission-attestation -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.686 msmint p50
3.002 msmint p95
2.033 msverify p50
3.867 msverify p95
200iterations
2476artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Correction and supersession receipt

Typed receipt contract Deployed in production
#supersession-receipt
What it proves

This receipt attests that the named replacement corrects the receipts named in supersedes as of effective_at, for the reason and scope stated in signed_body.

What it does not prove

It does not attest that the replacement content is itself correct, and it does not alter the superseded receipts, which remain independently verifiable exactly as originally signed.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['supersession.receipt']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typesupersession.receipt
Mint route/mint/supersession
Open verify route/verify/supersession no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/verify/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/proof-instruments.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/supersession
curl -sS -X POST https://thehiveryiq.com/v1/verify/supersession -H 'content-type: application/json' -d @canon/examples/supersession-receipt-v1.example.json

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
2.476 msmint p50
4.953 msmint p95
1.812 msverify p50
2.218 msverify p95
200iterations
1301artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Issue-Time Tolerance Bond

Typed receipt contract Deployed in production
#tolerance-bond
What it proves

Issue-Time Tolerance Bond receipt. The maximum permitted distance, the metric that measures it, and the instant it was fixed are all inside the signed body, so the tolerance that governs a later comparison is settled before that comparison happens and a verifier cannot substitute a bound of its own. When the caller supplies an observed digest and an observed distance, the service recomputes the comparison outcome from the signed tolerance and reports it.

What it does not prove

It does not render the page, reproduce the committed render profile, or measure the distance itself; profile_reproduced_by_service and distance_measured_by_service are fixed to false because the service never receives the raster, and a party that cannot reproduce the committed profile gets an indeterminate outcome for that scope rather than an adverse one.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['tolerance.bond']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typetolerance.bond
Mint route/mint/tolerance-bond
Open verify route/verify/tolerance-bond no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/afir-ocr/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • verifier_supplied_bound_refused is pinned to True
  • profile_reproduced_by_service is pinned to False
  • distance_measured_by_service is pinned to False
  • comparison_outcome is pinned to string
  • tolerance_fixed_before_this_receipt is pinned to boolean
  • tolerance_denominated_in_declared_units is pinned to boolean
Example requestPOST https://thehiveryiq.com/v1/mint/tolerance-bond
curl -sS -X POST https://thehiveryiq.com/v1/mint/tolerance-bond -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"bond_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "render_profile_digest_sha256": "<64 hex chars, sha256 of your evidence>", "scope_ref": "<see schema>", "committed_digest_sha256": "<64 hex chars, sha256 of your evidence>", "metric_id": "<see schema>", "metric_version": "<see schema>", "metric_units": "<see schema>", "max_permitted_distance": "<see schema>", "distance_fixed_at": "<see schema>"}'

{
  "bond_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "render_profile_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "scope_ref": "<see schema>",
  "committed_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "metric_id": "<see schema>",
  "metric_version": "<see schema>",
  "metric_units": "<see schema>",
  "max_permitted_distance": "<see schema>",
  "distance_fixed_at": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.619 msmint p50
2.997 msmint p95
1.883 msverify p50
2.28 msverify p95
200iterations
2186artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Transparency Checkpoint Receipt

Typed receipt contract Deployed in production
#transparency-checkpoint
What it proves

This receipt fixes the shape of a log at one instant, not the meaning of what is in it. The witness holds no log and received no receipt bodies. What it received was an ordered list of digests, and it recomputed from them: the root, one full audit path for a named leaf, and, when a predecessor root was declared, both the prefix root and the RFC 6962 consistency proof between the two sizes. So this receipt states that the declared root really is the root of exactly those digests in exactly that order, that the named leaf really sits at the named index under it, and that the earlier root really is a prefix of this one. It also states that a public timestamp authority signed this root, with the imprint inside the token equal to the root and the token signature checked against the certificate the token carries.

What it does not prove

It does not chain that certificate to any trust anchor, so a relying party pins the authorities it accepts and reads the signer subject, issuer, and serial reported here to do it. It does not claim the leaves are Hive receipts, that the log is complete, that no second log exists, or that anything outside the supplied list ever happened. Nothing here is a claim about the content behind a digest.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json receipts['transparency.checkpoint']: deployed true, production_ready_for_canon true, unit_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typetransparency.checkpoint
Mint route/mint/transparency-checkpoint
Open verify route/verify/transparency-checkpoint no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open and unauthenticated.
Integration page/transparency-log/
Sourcehive-verifier-api/src/typed/ plus hive-verifier-api/server.js
Teststest/transparency-checkpoint.test.mjs
Example requestPOST https://thehiveryiq.com/v1/mint/transparency-checkpoint
curl -sS -X POST https://thehiveryiq.com/v1/verify/transparency-checkpoint -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

The open verify route needs no credentials, so this is the fastest honest check. Mint fails closed with 401 when the token is missing or wrong.

Benchmark, measured
65.036 msmint p50
65.341 msmint p95
2.595 msverify p50
3.289 msverify p95
3iterations
3414artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

Verdict Custody Declaration

Typed receipt contract Deployed in production
#verdict-custody
What it proves

Verdict Custody Declaration receipt. It names, inside the signed body, which fields of an issued receipt the issuing service computes and which fields the party requesting issuance may set, and the service recomputes whether those two sets overlap. An overlap is reported as a count and a boolean, so a claim that a verdict is service-held is checkable rather than asserted.

What it does not prove

It does not inspect any other receipt to confirm the declared split was actually enforced there; enforcement_confirmed_on_other_receipts is fixed to false because this receipt only carries the declaration.

Implementation state, from registry data

PRODUCTION_MANIFEST.json reports deployed true and production_ready_for_canon true for this type, from a live probe of the production URL.

hive-verifier-api/PRODUCTION_MANIFEST.json honesty_receipts['verdict.custody']: deployed true, production_ready_for_canon true, unit_tested true, adversarially_tested true, smoke_tested true, generated_at 2026-08-16T02:45:32.220Z from a live check of https://thehiveryiq.com/v1.

Canonical typeverdict.custody
Mint route/mint/verdict-custody
Open verify route/verify/verdict-custody no auth
Auth requirementMint requires Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed. Verify is open. Every verdict field is service computed and pinned by schema const, so a caller cannot request a stronger verdict.
Integration page/afir-ocr/
Sourcehive-verifier-api/src/typed/honesty-contracts-registry.js and hive-verifier-api/src/typed/honesty-contract.js
Testshive-verifier-api/test/honesty-contracts.test.mjs hive-verifier-api/test/honesty-evidence-registry.test.mjs
Verdict ceiling, service computed
  • enforcement_confirmed_on_other_receipts is pinned to False
  • service_computed_field_count is pinned to integer
  • caller_settable_field_count is pinned to integer
  • overlapping_field_count is pinned to integer
  • field_sets_disjoint is pinned to boolean
Example requestPOST https://thehiveryiq.com/v1/mint/verdict-custody
curl -sS -X POST https://thehiveryiq.com/v1/mint/verdict-custody -H 'content-type: application/json' -H "authorization: Bearer $HIVE_TYPED_MINT_TOKEN" -d '{"custody_id": "your-subject-id", "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>", "subject_receipt_type": "<see schema>", "service_computed_field_names": "<see schema>", "caller_settable_field_names": "<see schema>"}'

{
  "custody_id": "your-subject-id",
  "evidence_digest_sha256": "<64 hex chars, sha256 of your evidence>",
  "subject_receipt_type": "<see schema>",
  "service_computed_field_names": "<see schema>",
  "caller_settable_field_names": "<see schema>"
}

Mint fails closed with 401 when the token is missing or wrong and 503 when the signer is not configured.

Benchmark, measured
2.606 msmint p50
5.426 msmint p95
1.886 msverify p50
2.188 msverify p95
200iterations
1576artifact bytes

Local harness measurement on one machine and one Node version. It is a reproducible measurement of this code, not a production latency guarantee. Source hive-verifier-api/benchmarks/results-latest.json at commit fac87fd0059c, 2026-08-16T02:19:11.262Z.

External operational service, 16 entries

Attested Fragmented Inference Routing (AFIR)

External operational service External service, live probe on record
#afir
What it proves

Decomposes a model request into signed routable sub tasks, executes fragments concurrently and returns a verifiable commitment over the fragment set, signed with ML-DSA-65.

What it does not prove

It does not prove any provider executed a fragment faithfully beyond what the returned commitment covers, it has no test files in its own repository, and only one of its four Modal app names was confirmed reachable.

Implementation state, from registry data

A host outside this codebase answered a non mutating probe in a recorded audit session. Operational for that host only, not for this repository.

canon-repository-live-service-audit.md section 5: GET https://srotzin--afir-cern-afir-api.modal.run/health returned 200 reporting afir-1.2.13 with ML-DSA-65. Section 4 note 4 records that four Modal app names exist in one private repository and only afir-cern was confirmed live.

Canonical typeafir.route
Schema URLnone published
Mint routeno mint route
Open verify routeGET https://srotzin--afir-cern-afir-api.modal.run/health no auth
Auth requirementHealth read is open. Routing operations are gated by the Modal deployment, not by this repository.
Integration page/afir/
Sourceafir/modal_app.py and afir/afir_fm.py are committed in this repository; the deployed app also has a private srotzin/afir repository.
Example requestGET https://srotzin--afir-cern-afir-api.modal.run/health
{
  "method": "GET",
  "url": "https://srotzin--afir-cern-afir-api.modal.run/health",
  "auth": "none",
  "body": null,
  "note": "Version string should read afir-1.2.13 or later. Confirm before citing AFIR as live."
}

Version string should read afir-1.2.13 or later. Confirm before citing AFIR as live.

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

AmpliHive

External operational service External service, live probe on record
#amplihive
What it proves

That a prompt was compressed before it reached a model, by how much, and that the resulting call and its response were signed with ML-DSA-65 under a key the caller can check. It wraps an ordinary model call in a certified envelope, so a party who was not present can confirm what was actually sent, what came back, and that neither was edited afterwards.

What it does not prove

It does not prove the model's answer is correct, and it does not prove compression preserved meaning. Compression is measured on tokens, not on semantics, and a caller who needs semantic equivalence must establish that separately. The baseline leg of GET /v1/amplify/bench depends on an upstream provider call which returned HTTP 402 on the 2026-08-06 probe, so on that probe the token reduction figure is real and the paired response side comparison was not exercised. The backend is not vendored into this repository, so no repository level implementation state can be shown for it here.

Implementation state, from registry data

A host outside this codebase answered a non mutating probe in a recorded audit session. Operational for that host only, not for this repository.

Live probe of https://receipts.thehiveryiq.com on 2026-08-06. GET /v1/amplify/selftest returned 200. GET /openapi.json lists nine amplify paths: /v1/amplify/bench, /call, /corpus/append, /corpus/retrieve, /corpus/stats, /selftest, /sign, /verify, /wrap-receipt. GET /v1/amplify/bench returned a real measured run reporting prompt_tokens 41 before compression and 23 after, cert_alg ML-DSA-65 with a signature prefix present. GET /v1/amplify/corpus/stats returned total_rows 44 across 19 tenants at embed_dim 256.

Canonical typeamplify.certified_call
Schema URLnone published
Mint routePOST https://receipts.thehiveryiq.com/v1/amplify/sign
Open verify routePOST https://receipts.thehiveryiq.com/v1/amplify/verify no auth
Auth requirementGET /v1/amplify/selftest, /bench and /corpus/stats are open reads. Signing, calling and corpus append are gated by the service's own policy, not by this repository.
Integration page
Source
Example requestGET https://receipts.thehiveryiq.com/v1/amplify/selftest
{
  "method": "GET",
  "url": "https://receipts.thehiveryiq.com/v1/amplify/selftest"
}

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Carnac control plane and Arrival Countersignature

External operational service External service, live probe on record
#carnac
What it proves

Labels requests at origin and countersigns them at arrival by comparing the approved action tuple against the delivered action tuple. Deterministic classification with a seven response routing table.

What it does not prove

There is no public mint route by design, so no one outside the deployment can produce a Carnac countersignature. The reference core repository is private and unreadable from outside.

Implementation state, from registry data

A host outside this codebase answered a non mutating probe in a recorded audit session. Operational for that host only, not for this repository.

canon-source-of-truth-reconciliation.md section 4.4 records Carnac hosted live inside Hive Receipt as a proof demand and routing subsystem with deterministic classification and ML-DSA-65 sibling signatures; canon-repository-live-service-audit.md section 1 confirms the reference core repository carnac-core-private exists with no public endpoint by design.

Canonical typegateway.countersignature
Schema URLnone published
Mint routeno mint route
Open verify routeGET https://inkframe.thehiveryiq.com/health no auth
Auth requirementNo public mint route by design. Gateway operations are internal to the deployment.
Integration page/carnac/
SourcePrivate repository srotzin/carnac-core-private, plus the committed reference harness under carnac-gateway-core/ in this repository.
Example requestGET https://inkframe.thehiveryiq.com/health
{
  "method": "GET",
  "url": "https://inkframe.thehiveryiq.com/health",
  "auth": "none",
  "body": null,
  "note": "Carnac is hosted inside Hive Receipt. There is deliberately no public countersignature mint route."
}

Carnac is hosted inside Hive Receipt. There is deliberately no public countersignature mint route.

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

HAHS (hashes as histories)

External operational service External service, claimed, not re probed
#hahs
What it proves

Signs and verifies a contiguous hash chain of an entity's history against a live public key endpoint. A separate Lean 4 formal proof layer exists for the underlying claims.

What it does not prove

The runtime host was not re probed in either current audit pass, and the formal proof repository is not an operational endpoint. Formal proofs do not demonstrate that the deployed service behaves as proved.

Implementation state, from registry data

A live claim rests on an earlier audit and no current pass reached the host. Re probe before depending on it.

canon-source-of-truth-reconciliation.md section 4.5 records GET /v1/audit/pubkey live at hivetrust.hiveagentiq.com from a prior audit. canon-repository-live-service-audit.md sections 1 and 3.9 found no runtime service repository under this name; hive-trust-spec is a Lean 4 formal proof repository whose Lean Build CI passes, not an endpoint.

Canonical typeaudit.hashhistory
Schema URLnone published
Mint routeno mint route
Open verify routeGET https://hivetrust.hiveagentiq.com/v1/audit/pubkey no auth
Auth requirementPublic key read is open per the prior audit. Re probe before relying on it.
Integration page/canon/hahs/
SourceFormal layer: public repository srotzin/hive-trust-spec (Lean 4). No runtime service repository identified.
Example requestGET https://hivetrust.hiveagentiq.com/v1/audit/pubkey
{
  "method": "GET",
  "url": "https://hivetrust.hiveagentiq.com/v1/audit/pubkey",
  "auth": "none",
  "body": null,
  "note": "Not re probed in the current audit passes. Treat as claimed, not verified."
}

Not re probed in the current audit passes. Treat as claimed, not verified.

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Hive Passport

External operational service External service, live probe on record
#hive-passport
What it proves

Registry and manifest service with layers 1 to 4 active. It also carries its own zone based Imprimatur pre attestation gate, which is functionally distinct from the SiGR family imprimatur.clearance type.

What it does not prove

It has no working committed test infrastructure at the live commit, so no test evidence backs the deployed behaviour. Its Imprimatur gate is a third distinct meaning of that name and must not be conflated with the SiGR type or the concept page.

Implementation state, from registry data

A host outside this codebase answered a non mutating probe in a recorded audit session. Operational for that host only, not for this repository.

canon-repository-live-service-audit.md sections 3.5 and 5: GET https://passport.thehiveryiq.com/health and /v1/registry/manifest returned 200 with layers 1 to 4 active and layer 5 honestly reserved. Section 6 records that the repository's own npm test fails immediately because the declared tests directory does not exist.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeGET https://passport.thehiveryiq.com/v1/registry/manifest no auth
Auth requirementHealth and manifest reads are open. Registry writes are gated by the service.
Integration page/verify/
SourcePrivate repository srotzin/hive-passport. Not vendored into this repository.
Example requestGET https://passport.thehiveryiq.com/v1/registry/manifest
{
  "method": "GET",
  "url": "https://passport.thehiveryiq.com/v1/registry/manifest",
  "auth": "none",
  "body": null,
  "note": "Layer 5 reports reserved. Do not read reserved as active."
}

Layer 5 reports reserved. Do not read reserved as active.

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Hive Receipt (x402 and Base USDC settlement service)

External operational service External service, live probe on record
#hive-receipt
What it proves

Payment receipt and x402 settlement service for Spectral signed Base USDC receipts, on chain verification and MCP accessible receipt operations. It also hosts the live InkFrame verbs and the Carnac routing subsystem.

What it does not prove

It does not prove any customer volume, and it is a distinct host from the typed receipts API. Payment settlement is not a correctness claim about the work being paid for.

Implementation state, from registry data

A host outside this codebase answered a non mutating probe in a recorded audit session. Operational for that host only, not for this repository.

canon-repository-live-service-audit.md sections 3.3 and 5: GET https://inkframe.thehiveryiq.com/health returned 200, the live primitives smoke run was 9/9, hive-receipt.onrender.com serves the identical service, and the public srotzin/hive-receipt repository's own test run was 165 tests, 0 failed.

Canonical typereceipt.settlement
Schema URLnone published
Mint routePOST https://inkframe.thehiveryiq.com/v1/receipt/emit
Open verify routeGET https://inkframe.thehiveryiq.com/health no auth
Auth requirementHealth is open. Emission returns a real x402 payment_required challenge; x402 is the only payment rail.
Integration page/receipts/
SourcePublic repository srotzin/hive-receipt. Not vendored into this repository.
Example requestGET https://inkframe.thehiveryiq.com/v1/primitives/smoke
{
  "method": "GET",
  "url": "https://inkframe.thehiveryiq.com/v1/primitives/smoke",
  "auth": "none",
  "body": null,
  "note": "The live primitives smoke route reports its own pass count. It was 9/9 at the audited session."
}

The live primitives smoke route reports its own pass count. It was 9/9 at the audited session.

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

InkFrame v1

External operational service External service, live probe on record
#inkframe-v1
What it proves

Content addressed substrate for pre effect receipts: frame, prefill, cue edge, replay and countersign verbs over RFC 8785 JCS with SHA-256 and Ed25519 or ML-DSA-65.

What it does not prove

It is hosted inside Hive Receipt, not the typed receipts API, so its verbs must never be described as part of that API. Its source repository is private.

Implementation state, from registry data

A host outside this codebase answered a non mutating probe in a recorded audit session. Operational for that host only, not for this repository.

canon-repository-live-service-audit.md sections 3.3 and 3.9: the /v1/inkframe/* verbs are served live by hive-receipt at inkframe.thehiveryiq.com and the inkframe-core repository's own custom test runner passed 26/26 this session.

Canonical typeinkframe.v1
Schema URLnone published
Mint routePOST https://inkframe.thehiveryiq.com/v1/inkframe/frame
Open verify routeGET https://inkframe.thehiveryiq.com/health no auth
Auth requirementHealth and smoke reads are open. Frame writing is gated by the external service.
Integration page/carnac-live-ink/
SourcePrivate repository srotzin/inkframe-core. Not vendored into this repository.
Example requestGET https://inkframe.thehiveryiq.com/health
{
  "method": "GET",
  "url": "https://inkframe.thehiveryiq.com/health",
  "auth": "none",
  "body": null,
  "note": "InkFrame verbs live under /v1/inkframe/* on this host, not on the typed receipt service at thehiveryiq.com/v1."
}

InkFrame verbs live under /v1/inkframe/* on this host, not on the typed receipt service at thehiveryiq.com/v1.

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Hive MCP relay layer

External operational service External service, live probe on record
#mcp-relay-layer
What it proves

A set of MCP relay services that forward tool calls to the real signer and passport hosts. All seven hosted health endpoints answered 200 in this probe, and their local test and smoke suites pass, including live upstream round trips.

What it does not prove

A 200 on a health route proves the relay process is up and reachable at that host, not that every MCP tool call it forwards succeeds end to end, and not that any upstream primitive it calls is itself authenticated and production accepting. Probe the specific tool call you depend on before relying on it.

Implementation state, from registry data

A host outside this codebase answered a non mutating probe in a recorded audit session. Operational for that host only, not for this repository.

Re-probed live on 2026-08-04T21:07:00Z: GET returned 200 at https://hive-mcp-sigr.onrender.com/health, https://hive-mcp-spire.onrender.com/health, https://hive-mcp-imprimatur.onrender.com/health, https://hive-mcp-passport.onrender.com/health, https://hive-mcp-vault.onrender.com/health, https://hive-mcp-swap.onrender.com/health and https://hive-mcp-receipts.onrender.com/health, all seven of the current hive-mcp-* hosted relays. This supersedes the prior canon-repository-live-service-audit.md finding that five of six were unreachable. Local test and smoke runs for the relay repositories continue to pass, for example hive-mcp-sigr 20/20 and hive-mcp-spire 47/47.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeGET https://hive-mcp-<name>.onrender.com/health for name in sigr, spire, imprimatur, passport, vault, swap, receipts no auth
Auth requirementHealth reads are open on all seven relays. Tool calls follow the MCP transport of each relay.
Integration page/typed-signer/
SourcePublic repositories srotzin/hive-mcp-sigr, hive-mcp-spire, hive-mcp-imprimatur, hive-mcp-passport, hive-mcp-vault, hive-mcp-swap, hive-mcp-receipts.
Example requestGET https://hive-mcp-sigr.onrender.com/health
{
  "method": "GET",
  "url": "https://hive-mcp-sigr.onrender.com/health",
  "auth": "none",
  "body": null,
  "note": "All seven relays answered 200 on this probe. Re-probe the specific relay you depend on before a production integration, since this is a point in time health check, not a standing guarantee."
}

All seven relays answered 200 on this probe. Re-probe the specific relay you depend on before a production integration, since this is a point in time health check, not a standing guarantee.

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Media Origin Receipt (M.O.R.)

External operational service External service, live probe on record
#media-origin-receipt
What it proves

Signs media origin and rights evidence across human, AI, hybrid, unknown, insufficient evidence and disputed states, layered around C2PA. It records the origin evidence that was supplied.

What it does not prove

It does not decide truth from pixels, does not prove content is human made, and has no canonical schema file in this repository yet. It is a different primitive from origin.proof, which attests human production conditions.

Implementation state, from registry data

A host outside this codebase answered a non mutating probe in a recorded audit session. Operational for that host only, not for this repository.

canon-source-of-truth-reconciliation.md section 4.2: R1 layer live per the receipts.thehiveryiq.com status probe, with issue and verify routes present. No dedicated JSON Schema file is committed in this repository, which is an open authoring gap.

Canonical typemedia.origin
Schema URLnone published
Mint routePOST https://receipts.thehiveryiq.com/v1/receipt/emit
Open verify routePOST https://receipts.thehiveryiq.com/v1/receipt/verify no auth
Auth requirementEmission is gated by the external service and returns a real x402 payment_required challenge. Verification is open.
Integration page/media-origin-receipt/
SourceExternal service. Source lives in the private srotzin/hivemorph repository.
Example requestGET https://receipts.thehiveryiq.com/status
{
  "method": "GET",
  "url": "https://receipts.thehiveryiq.com/status",
  "auth": "none",
  "body": null,
  "note": "Confirm the R1 layer reports live before relying on the emit and verify routes. No canonical schema file exists in this repository for this type yet."
}

Confirm the R1 layer reports live before relying on the emit and verify routes. No canonical schema file exists in this repository for this type yet.

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Protected Flow

External operational service External service, live probe on record
#protected-flow
What it proves

Commercial action layer above R3Pv. Packages receipt emission, grouping, signed proof vectors, healing state and evidence export for recoverability aware flows. Layers R3 and R4 are live.

What it does not prove

It does not prove any customer deployment, and its backend source is not vendored into this repository. Fleet scale bulk operation is a wrapper concept, not a separately verified endpoint.

Implementation state, from registry data

A host outside this codebase answered a non mutating probe in a recorded audit session. Operational for that host only, not for this repository.

canon-source-of-truth-reconciliation.md section 4.2: R3 delegation envelopes and R4 tool firewall layers confirmed live on receipts.thehiveryiq.com during that session's status probe.

Canonical typeflow.protection
Schema URLnone published
Mint routeno mint route
Open verify routeGET https://receipts.thehiveryiq.com/status no auth
Auth requirementStatus read is open. Flow operations are gated by the external service.
Integration page/protected-flow-fleets/
SourceExternal service. Source lives in the private srotzin/hivemorph repository.
Example requestGET https://receipts.thehiveryiq.com/status
{
  "method": "GET",
  "url": "https://receipts.thehiveryiq.com/status",
  "auth": "none",
  "body": null,
  "note": "Read the layer table and confirm R3 and R4 report live before making any claim."
}

Read the layer table and confirm R3 and R4 report live before making any claim.

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Receipt Reduction and Recovery Proof Vector (R3Pv)

External operational service External service, live probe on record
#r3pv
What it proves

Reduces a group of signed receipts into a signed machine readable decision vector: proof state, recoverability, policy position, economic exposure and permitted next actions. Layers R1 to R9 are live.

What it does not prove

It does not prove the underlying business decision was correct, and layers R10 to R12 are roadmap and must never be presented as live. The backend source is not vendored into this repository, so this page cannot show a repository level implementation state for it.

Implementation state, from registry data

A host outside this codebase answered a non mutating probe in a recorded audit session. Operational for that host only, not for this repository.

canon-repository-live-service-audit.md section 5: GET https://receipts.thehiveryiq.com/status returned 200 with a commit SHA matching the cloned hivemorph HEAD; canon-source-of-truth-reconciliation.md section 4.2 confirms layers R1 to R9 live and R10 to R12 roadmap.

Canonical typereceipt.reduction
Schema URLnone published
Mint routeno mint route
Open verify routeGET https://receipts.thehiveryiq.com/status no auth
Auth requirementStatus read is open. Receipt emission through this host is gated by its own service policy, not by this repository.
Integration page/r3pv-benchmark/
SourceExternal service. Source lives in the private srotzin/hivemorph repository, not in this repository.
Example requestGET https://receipts.thehiveryiq.com/status
{
  "method": "GET",
  "url": "https://receipts.thehiveryiq.com/status",
  "auth": "none",
  "body": null,
  "note": "Non mutating status read. Layer states R1 to R9 live and R10 to R12 roadmap are reported by the service itself."
}

Non mutating status read. Layer states R1 to R9 live and R10 to R12 roadmap are reported by the service itself.

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

SHOD (six hop outbound discrimination)

External operational service External service, claimed, not re probed
#shod
What it proves

Fixed six hop outbound chain of custody discrimination receipt: six independent checks screen an outbound action before it leaves the boundary.

What it does not prove

Its live status was not re probed in either current audit pass and no source repository was identified for the runtime service.

Implementation state, from registry data

A live claim rests on an earlier audit and no current pass reached the host. Re probe before depending on it.

canon-source-of-truth-reconciliation.md section 4.5 carries the same not re probed caveat as SMSH. No probe of this host appears in canon-repository-live-service-audit.md section 5.

Canonical typediscrimination.sixhop
Schema URLnone published
Mint routeno mint route
Open verify routeno open verify route
Auth requirementUnknown until re probed. Do not quote an auth model for this service.
Integration page/canon/shod/
SourceExternal service. No source repository identified in the repository audit.
Example requestGET /canon/shod/
{
  "method": "GET",
  "url": "/canon/shod/",
  "auth": "none",
  "body": null,
  "note": "Read the site page. Re probe the host before treating SHOD as an operational dependency."
}

Read the site page. Re probe the host before treating SHOD as an operational dependency.

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

SMSH (sealed message state hash)

External operational service External service, claimed, not re probed
#smsh
What it proves

Seals a message state hash for later independent verification. The verifier library is real, public and tested.

What it does not prove

There is no standalone hosted service for it; the library is consumed as a dependency. Its hosted claim was not re probed in either current audit pass.

Implementation state, from registry data

A live claim rests on an earlier audit and no current pass reached the host. Re probe before depending on it.

canon-source-of-truth-reconciliation.md section 4.5 marks SMSH live claimed but explicitly not re probed, with independently_reprobed_this_session false. canon-repository-live-service-audit.md section 3.9 confirms the smsh-stamp-verifier library repository passed 69/69 vitest tests with 92.4 percent statement coverage and has no standalone host.

Canonical typemessage.sealedstate
Schema URLnone published
Mint routeno mint route
Open verify routeno open verify route
Auth requirementLibrary use requires no auth. No hosted route was verified in the current passes.
Integration page/canon/smsh/
SourcePublic repositories srotzin/smsh-stamp-verifier and srotzin/prov-absence.
Example requestGET /smsh/
{
  "method": "GET",
  "url": "/smsh/",
  "auth": "none",
  "body": null,
  "note": "Library first primitive. Read the site page, then use the public smsh-stamp-verifier library rather than assuming a hosted route."
}

Library first primitive. Read the site page, then use the public smsh-stamp-verifier library rather than assuming a hosted route.

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

SpectralZK v1

External operational service Offline reference implementation
#spectralzk
What it proves

Offline reference implementation of a Schnorr and Merkle zero knowledge proof scheme. Anyone can verify a sample proof locally with no network and no key material.

What it does not prove

There is no hosted verify route for it. It is a reference implementation, not a production service, and no benchmark of a hosted deployment exists.

Implementation state, from registry data

Runnable code with no hosted route. Verifiable locally, not a service.

canon-source-of-truth-reconciliation.md section 4.5: canon/spectralzk/spectralzk_v1.py is a 404 line runnable offline reference implementation with a committed schema at .well-known/schemas/spectralzk-v1.json.

Canonical typezk.spectral
Mint routepython3 canon/spectralzk/spectralzk_v1.py prove
Open verify routepython3 canon/spectralzk/spectralzk_v1.py verify sample-proof.json no auth
Auth requirementNone. It runs locally and offline.
Integration page/canon/spectralzk/
Sourcecanon/spectralzk/spectralzk_v1.py in this repository.
Example requestCLI python3 canon/spectralzk/spectralzk_v1.py verify canon/spectralzk/sample-proof.json
{
  "method": "CLI",
  "url": "python3 canon/spectralzk/spectralzk_v1.py verify canon/spectralzk/sample-proof.json",
  "auth": "none",
  "body": null,
  "note": "Offline verification. No hosted route exists and none should be implied."
}

Offline verification. No hosted route exists and none should be implied.

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Hive Typed Signer (SiGR and USAP crypto core)

External operational service External service, live probe on record
#typed-signer
What it proves

The shared ML-DSA-65 signing and verification core. It is a signing engine, not a receipt type.

What it does not prove

It is not itself a receipt contract and must never be counted as one. POST /v1/imprimatur/gate returned 404 on this host, so an Imprimatur clearance backend is not live here. Which host is canonical for which capability, this one or the typed receipt service at thehiveryiq.com/v1, is still not documented on the site.

Implementation state, from registry data

A host outside this codebase answered a non mutating probe in a recorded audit session. Operational for that host only, not for this repository.

canon-repository-live-service-audit.md sections 3.1 and 5: GET https://signer.thehiveryiq.com/ and /pubkey returned 200 with an ML-DSA-65 key matching hive-typed-signer.onrender.com byte for byte; the public source repository srotzin/hive-typed-signer exists and its own test run was 9 files, 0 failed.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeGET https://signer.thehiveryiq.com/pubkey no auth
Auth requirementPublic key and health reads are open. Signing operations are gated by the service.
Integration page/typed-signer/
SourcePublic repository srotzin/hive-typed-signer. Not vendored into this repository.
Example requestGET https://signer.thehiveryiq.com/pubkey
{
  "method": "GET",
  "url": "https://signer.thehiveryiq.com/pubkey",
  "auth": "none",
  "body": null,
  "note": "The returned ML-DSA-65 key should match hive-typed-signer.onrender.com exactly. A mismatch means one of the two hosts drifted."
}

The returned ML-DSA-65 key should match hive-typed-signer.onrender.com exactly. A mismatch means one of the two hosts drifted.

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

ViewKey selective disclosure

External operational service External service, claimed, not re probed
#viewkey
What it proves

Selective disclosure and compliance certificate layer over receipts, with priced verification routes, so a holder, a regulator and a counterparty each read their own slice of one signed record.

What it does not prove

Its live status rests on a prior audit only. No probe of hivetrust.hiveagentiq.com appears in the two current audit passes, so it must not be presented as freshly verified.

Implementation state, from registry data

A live claim rests on an earlier audit and no current pass reached the host. Re probe before depending on it.

canon-source-of-truth-reconciliation.md section 4.5 records a live priced API at hivetrust.hiveagentiq.com with per call USDC pricing, based on a prior audit. That host was not independently re probed in the reconciliation session or in canon-repository-live-service-audit.md section 5.

Canonical typeviewkey.disclosure
Schema URLnone published
Mint routePOST https://hivetrust.hiveagentiq.com/v1/viewkey/issue-certificate
Open verify routePOST https://hivetrust.hiveagentiq.com/v1/viewkey/verify-compliance no auth
Auth requirementPriced per call in USDC per the prior audit. Re probe before quoting a price or a route.
Integration page/canon/viewkey/
SourceExternal service. No source repository was identified in the repository audit.
Example requestGET https://hivetrust.hiveagentiq.com/
{
  "method": "GET",
  "url": "https://hivetrust.hiveagentiq.com/",
  "auth": "none",
  "body": null,
  "note": "Re probe this host before making any live claim. The two current audit passes did not reach it."
}

Re probe this host before making any live claim. The two current audit passes did not reach it.

Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Product or composite system, 13 entries

Canon tiered solution view

Product or composite system Composite, no endpoint of its own
#canon-tiers
What it proves

Nothing on its own. It ranks the canon by tier, revenue pool, speed to first dollar and who owns the budget, and it names the target companies recorded for each entry.

What it does not prove

Every figure on it is a recorded estimate with its source linked, not booked revenue, and any price shown is marked PROPOSED.

Implementation state, from registry data

A wrapper over other entries. No route, no schema, no receipt type.

Pages under canon/tiers/ in this repository, generated against /assets/canon-tiers.json. It renders curated tiering over existing entries and adds no endpoint and no receipt type.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeno open verify route
Auth requirementNot applicable.
Integration page/canon/tiers/
SourcePages under canon/tiers/ and assets/canon-tiers.json in this repository.
Example requestwithheld. nothing about this entry is disclosed publicly
Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Carnac Director

Product or composite system Composite, no endpoint of its own
#carnac-director
What it proves

Nothing on its own. You describe what you do and what you need, and it returns the registry entries that match, with the deploy path recorded for each one.

What it does not prove

It cannot mint or verify anything. The ranking is a deterministic client side score over registry text, not a decision about your deployment.

Implementation state, from registry data

A wrapper over other entries. No route, no schema, no receipt type.

Pages under carnac/director/ in this repository. The selector reads /assets/canon-tiers.json and /canon/registry/hive-canon-registry.json in the browser and ranks existing entries. It adds no endpoint and no receipt type.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeno open verify route
Auth requirementNot applicable. Nothing is sent anywhere, the match runs in your browser.
Integration page/carnac/director/
SourcePages under carnac/director/ in this repository.
Example requestwithheld. nothing about this entry is disclosed publicly
Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Carnac Gateway

Product or composite system Composite, no endpoint of its own
#carnac-gateway
What it proves

One integration point. You send inference through it once and it shows that the approved instruction is the instruction that arrived.

What it does not prove

It has no endpoint of its own and no public mint route. Nobody outside the deployment can produce a Carnac countersignature.

Implementation state, from registry data

A wrapper over other entries. No route, no schema, no receipt type.

Surface of the Carnac control plane entry, which canon-source-of-truth-reconciliation.md section 4.4 records as hosted live inside Hive Receipt as a proof demand and routing subsystem with no public mint route by design. This page is a product surface over that subsystem and has no endpoint of its own.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeno open verify route
Auth requirementNo public mint route by design. Gateway operations are internal to the deployment.
Integration page/carnac/gateway/
SourcePages under carnac/gateway/ in this repository. Reference harness under carnac-gateway-core/ in this repository, private core srotzin/carnac-core-private.
Example requestwithheld. nothing about this entry is disclosed publicly
Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Carnac Governance

Product or composite system Composite, no endpoint of its own
#carnac-governance
What it proves

Nothing on its own. It is the policy, escalation and audit surface over the receipts other entries emit, so your risk and compliance teams can see what was escalated and why.

What it does not prove

It has no endpoint and no receipt type of its own, and it is not a control that blocks an effect. The receipt is emitted by the instrument, not by this surface.

Implementation state, from registry data

A wrapper over other entries. No route, no schema, no receipt type.

Surface of the Carnac control plane entry, which canon-source-of-truth-reconciliation.md section 4.4 records as hosted live inside Hive Receipt as a proof demand and routing subsystem with no public mint route by design. This page is a product surface over that subsystem and has no endpoint of its own.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeno open verify route
Auth requirementNot applicable.
Integration page/carnac/governance/
SourcePages under carnac/governance/ in this repository.
Example requestwithheld. nothing about this entry is disclosed publicly
Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Hive Customer Console

Product or composite system Composite, no endpoint of its own
#hive-customer-console
What it proves

Nothing on its own. It aggregates other services' views.

What it does not prove

It has no API of its own, and the verifier repository it points engineers toward is a stub, not a working verifier.

Implementation state, from registry data

A wrapper over other entries. No route, no schema, no receipt type.

canon-source-of-truth-reconciliation.md section 4.6 found no console specific API. canon-repository-live-service-audit.md section 3.7 found that the public HAHS verifier repository it references, srotzin/hive-verifier, is an explicit placeholder stub with a declared test script but zero test files.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeno open verify route
Auth requirementNot applicable.
Integration page/app/
SourcePages under app/ in this repository. Referenced repository srotzin/hive-verifier is a placeholder stub.
Example requestwithheld. nothing about this entry is disclosed publicly
Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Hive Ledger

Product or composite system Composite, no endpoint of its own
#hive-ledger
What it proves

Nothing on its own. It presents ledger style views over other primitives' receipts.

What it does not prove

It issues no receipt type and has no endpoint of its own.

Implementation state, from registry data

A wrapper over other entries. No route, no schema, no receipt type.

canon-source-of-truth-reconciliation.md section 4.6: the page now exists on disk, resolving a prior broken link, but it remains a composite ledger surface rather than a receipt issuing primitive.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeno open verify route
Auth requirementNot applicable.
Integration page/hive-ledger/
SourcePages under hive-ledger/ in this repository.
Example requestwithheld. nothing about this entry is disclosed publicly
Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

MoR Segments (Media Origin Receipt segments of origin)

Product or composite system Concept extension only
#morso
What it proves

Nothing on its own. It is a proposed segment level check on top of a valid parent Media Origin Receipt.

What it does not prove

No code, schema or endpoint exists. If ever built it would be a child object of media.origin, never a new top level type.

Implementation state, from registry data

A proposed extension of another entry. No code, schema or endpoint.

canon-source-of-truth-reconciliation.md section 4.2: a segment level extension of Media Origin Receipt with no distinct code, schema or endpoint found.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeno open verify route
Auth requirementNot applicable.
Integration page/media-origin-receipt/
SourceNo implementation found.
Example requestwithheld. nothing about this entry is disclosed publicly
Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Proof Credit

Product or composite system Composite, no endpoint of its own
#proof-credit
What it proves

Nothing on its own. It converts other primitives' proof state into risk and underwriting signals.

What it does not prove

It is not a receipt type, has no endpoint, and no underwriting relationship or insurance outcome is proven anywhere.

Implementation state, from registry data

A wrapper over other entries. No route, no schema, no receipt type.

canon-source-of-truth-reconciliation.md section 4.6: positioned as proof state evidence for underwriting, consuming other primitives' receipts, not a new receipt type.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeno open verify route
Auth requirementNot applicable.
Integration page/proof-credit/
SourcePages under proof-credit/ in this repository.
Example requestwithheld. nothing about this entry is disclosed publicly
Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Protected Flow Fleets

Product or composite system Composite, no endpoint of its own
#protected-flow-fleets-composite
What it proves

Nothing beyond Protected Flow. It is an organizational wrapper for many flows.

What it does not prove

No bulk or fleet endpoint was confirmed, so it is not a separate primitive and must not be counted as one.

Implementation state, from registry data

A wrapper over other entries. No route, no schema, no receipt type.

canon-source-of-truth-reconciliation.md sections 4.2 and 4.6: an enterprise container organizing many Protected Flows, with no independent bulk endpoint confirmed. It collapses into Protected Flow.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeno open verify route
Auth requirementNot applicable. Inherits Protected Flow's model.
Integration page/protected-flow-fleets/
SourcePages under protected-flow-fleets/ in this repository.
Example requestwithheld. nothing about this entry is disclosed publicly
Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

Hive Provable Machines

Product or composite system Composite, no endpoint of its own
#provable-machines
What it proves

Nothing on its own. It applies existing primitives to robotics and machine autonomy.

What it does not prove

There is no machines specific endpoint, schema or receipt type. Robot deployments are not proven anywhere in this repository.

Implementation state, from registry data

A wrapper over other entries. No route, no schema, no receipt type.

canon-source-of-truth-reconciliation.md section 4.6: composes R3Pv and Protected Flow for the robotics and robot as a service vertical, with no distinct /v1/machines/* API surface confirmed.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeno open verify route
Auth requirementNot applicable. Use the underlying primitives' auth model.
Integration page/machines/
SourcePages under machines/ and robotics/ in this repository.
Example requestwithheld. nothing about this entry is disclosed publicly
Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

SmartAgent route graph

Product or composite system Visualization only
#smartagent-route-graph
What it proves

Nothing. It draws an agent moving across model, provider, tool, verification and payment stops.

What it does not prove

It issues no receipts, has no repository and has no route. Exclude it from every primitive count.

Implementation state, from registry data

A drawing of other primitives' receipts. Issues nothing.

canon-source-of-truth-reconciliation.md section 4.4 records it self describing as a visualization product, not a receipt issuing primitive. canon-repository-live-service-audit.md section 1 found no repository under SmartAgent or SmartMorphAgent and no live route.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeno open verify route
Auth requirementNot applicable.
Integration page/agents/
SourceNo repository found under SmartAgent or SmartMorphAgent.
Example requestwithheld. nothing about this entry is disclosed publicly
Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

SDU, SGU, SPU and SVU standard units

Product or composite system Glossary only
#standard-units-glossary
What it proves

Nothing. They define units of measure used when describing receipt volumes and workloads.

What it does not prove

They are definitional pages only and must be excluded permanently from any primitive count, even though they live under /canon/.

Implementation state, from registry data

Definitional content. Not a primitive.

canon-source-of-truth-reconciliation.md section 4.5: direct reads confirm these four pages are unit of measure glossary content, for example standard data units, not receipt issuing primitives.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeno open verify route
Auth requirementNot applicable.
Integration page/canon/sdu/
SourcePages under canon/sdu/, canon/sgu/, canon/spu/ and canon/svu/ in this repository.
Example requestwithheld. nothing about this entry is disclosed publicly
Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.

SiGR suite

Product or composite system Composite, no endpoint of its own
#xcalibur
What it proves

Nothing on its own. It is an umbrella suite name over seven sub brands.

What it does not prove

It is not a receipt type, has no independent endpoint, and must never be counted in a primitive total. Each sub leg would need its own mint and verify pair to count.

Implementation state, from registry data

A wrapper over other entries. No route, no schema, no receipt type.

canon-source-of-truth-reconciliation.md section 4.6: seven sub brands have pages on disk, MEMBRANE, PROOF and QUORUM self gate as private until they ship, and no independent backend endpoint was confirmed for ATTEST, DELTA, ECHO or VERIFY. canon-repository-live-service-audit.md section 1 found only a pre registration methodology repository, xcalibur-evaluation, not an implementation.

Canonical typenone. this entry issues no receipt type
Schema URLnone published
Mint routeno mint route
Open verify routeno open verify route
Auth requirementNot applicable. There is no endpoint.
Integration page/xcalibur/
SourcePages under xcalibur/ in this repository. Methodology repository srotzin/xcalibur-evaluation.
Example requestwithheld. nothing about this entry is disclosed publicly
Benchmark, none shown

No benchmark is shown because none was measured against a verified deployment of this entry in a recorded session.