Meter Witness · meter.witness

A bill is a number somebody else computed.

This is the receipt that says the number came from a calibrated instrument and the arithmetic holds. The calibration manifest is committed before the measurement window opens, not at bill time. You send register readings and interval digests, and we recompute the quantity from the register deltas as integer arithmetic.

30 of 30 local checks pass

This instrument ships with this release. The 30 checks above are the local smoke suite, run in process against a throwaway key with no network calls.

The fight this ends

When you dispute a bill you're arguing about a row in someone else's database. The reading that produced it is gone, the firmware that produced the reading is gone, and the calibration settings are a maintenance note.

So the dispute becomes a question of whose spreadsheet to believe, and the side holding the meter usually wins by default. Credits get issued on estimates because nobody can reconstruct the chain.

This receipt moves the fight to arithmetic. Either the reported energy equals the disclosed register delta or it doesn't, and either the intervals are contiguous or they aren't.

Here is the shape

01

Calibrate first, then measure

A calibration authority signs a manifest committing the salted meter_commitment, the device_key_commitment, the firmware_commitment, the coefficients commitment, and a validity interval. It's signed before the window opens.

02

The meter signs each interval

Each record carries opens, closes, a register_commitment, reported_energy_milliwatt_hours, event_flags, a previous_record_hash, and a device signature from the secure element the manifest names.

03

Recompute the total

The verifier rederives interval energy from the cumulative register delta, checks each record_hash and previous hash link, and folds the batch_inclusion_path to the published batch_root.

What holds it together

The arithmetic is integer arithmetic on register deltas, so there's no rounding argument to have. REGISTER_DELTA_RECOMPUTES_ENERGY refuses a reported quantity that doesn't equal the delta the openings disclose.

Change an interval and the contiguity check refuses. INTERVAL_DURATION_BOUND, TIMESTAMP_MONOTONIC, and PREVIOUS_HASH_CHAIN together mean a gap, an overlap, or a swapped record stops the verifier at a named gate.

Recalibrate after the fact and the binding refuses. MANIFEST_VALID_AT_INTERVAL checks the manifest validity interval contains the interval bounds under the declared drift allowance, and RECALIBRATION_CHAIN_LINKS ties a new manifest to the one it replaced.

FRESHNESS_NONCE_PRECEDES_SIGNATURE matters when you're the one asking. The nonce commitment has to exist before the records were signed, so a meter can't answer today's challenge with last month's cached record.

Verify one yourself

Verify is open. The register values stay yours: you open only the readings needed for the interval in dispute.

curl -sS -X POST https://thehiveryiq.com/v1/verify/meter-witness \
  -H 'content-type: application/json' \
  -d @witness.json

disclosure holds the openings. REGISTER_VALUE_NON_LEAKAGE refuses a disclosure wider than the disputed record needs.

{
  "receipt": {
    "key_id": "did:hive:collector-key", "algorithm": "Ed25519",
    "signed_body": {
      "receipt_type": "meter.witness",
      "witness_id": "site-4471-interval-dispute",
      "meter": { "meter_commitment": "...", "device_key_commitment": "...", "firmware_commitment": "..." },
      "calibration": { "manifest_id": "...", "coefficients_commitment": "...", "drift_allowance_seconds": 60 },
      "freshness": { "challenge_id": "...", "nonce_commitment": "..." },
      "metering": { "energy_unit": "mWh", "nominal_interval_seconds": 1800 },
      "records": [
        { "record_index": 0, "opens": { "utc": "2030-04-01T00:00:00Z" },
          "closes": { "utc": "2030-04-01T00:30:00Z" },
          "register_commitment": "...", "reported_energy_milliwatt_hours": 412000,
          "event_flags": [], "previous_record_hash": "...", "record_hash": "...",
          "device_signature_b64u": "...", "batch_leaf_index": 0, "batch_inclusion_path": ["..."] }
      ],
      "batch": { "batch_root": "...", "tree_size": 48 },
      "dispute": { "disputed_record_index": 0, "query_class": "interval_energy" }
    }
  },
  "calibration_manifest": { "signed_body": { "receipt_type": "meter.calibration" } },
  "meter_salt_hex": "...",
  "disclosure": {
    "meter_id": "...", "firmware_hash_sha256": "...", "freshness_nonce_hex": "...",
    "register_openings": [ { "record_index": 0, "cumulative_register_milliwatt_hours": 918412000 } ]
  }
}

A pass returns valid true and the ordered gates array. A refusal names the gate and the reason, which is the line you put in a dispute packet.

What gets checked

The verifier runs every gate in order and stops at the first failure, then tells you which one stopped it. A later gate never reads a field an earlier gate already showed to be untrustworthy.

Every gate the verifier runs, in order (21 gates)
Gate
SCHEMA
ISSUER_KEY_MATCH
ENVELOPE_SIGNATURE
SALT_PRECOMMITMENT
CALIBRATION_MANIFEST_SIGNATURE
MANIFEST_ENVELOPE_BINDING
DEVICE_KEY_MATCHES_MANIFEST
FIRMWARE_HASH_MATCHES_MANIFEST
RECALIBRATION_CHAIN_LINKS
MANIFEST_VALID_AT_INTERVAL
FRESHNESS_NONCE_PRECEDES_SIGNATURE
TIMESTAMP_MONOTONIC
INTERVAL_DURATION_BOUND
RECORD_HASH_RECOMPUTE
INTERVAL_RECORD_SIGNATURE
PREVIOUS_HASH_CHAIN
BATCH_ROOT_INCLUSION_RECOMPUTE
EVENT_FLAGS_CLEAR
REGISTER_VALUE_NON_LEAKAGE
REGISTER_DELTA_RECOMPUTES_ENERGY
BOUNDARY_CONSTANT

Field names come from the published schema: https://thehiveryiq.com/.well-known/schemas/meter-witness-v1.json. It ships with this release alongside the routes below, and the developer docs carry the schema catalog.

What this receipt does not say

This is the honesty boundary carried inside every meter.witness receipt, verbatim from the signed body.

This receipt attests only that a calibration manifest signed by a named calibration authority, a set of interval records signed by the meter secure element whose public key that manifest names, a freshness nonce commitment established before those records were signed, and a collector batch root satisfy the stated deterministic metering procedure over the named intervals. A valid result means only that the reported interval energy equals the disclosed cumulative register delta, that each record hash, previous hash link, and batch inclusion path recompute, and that the manifest validity interval contains the interval bounds under the declared drift allowance. It does not establish that the meter measured the physical world correctly, that no physical tampering occurred without raising an event flag, that the firmware named by the manifest was honest when it was manufactured, or that the calibration authority signed a truthful manifest. It does not establish ownership of the site, the identity of the consumer, the source of the energy, or entitlement to any certificate, credit, payment, or settlement. This receipt decides no contractual, statutory, regulatory, evidentiary, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no action, payment, sanction, denial, or remedy.

Hive never holds the underlying data

Hive never receives the corpus, the deleted object, the raw meter data, the analysis inputs, or the control inputs. Every value is a commitment the holder computed locally, and all this service can do is recompute the arithmetic between those commitments and refuse when it does not hold.

Endpoints

RouteWhat it does
POST /v1/mint/meter-witnessIssue a witness over records and commitments you hold. Needs Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed without it.
POST /v1/verify/meter-witnessRecompute the register delta, the record chain, and the batch inclusion. Open, no auth.

Where this sits

If you want the commercial version of this rather than the field list, we run metering checks on contingency and take a share of what you recover.

The other four instruments in this release: corpus commitment, erasure receipt, analysis replay, control replay. For the receipt that fixes a recording instead of a computation, see capture commitment. For the written papers, see papers.

Patent pending. Hive Civilization, The Hivery, Inc.