Meter Witness · meter.witness
This is the receipt that says the number came from a calibrated instrument and the arithmetic holds. The calibration manifest is committed before the measurement window opens, not at bill time. You send register readings and interval digests, and we recompute the quantity from the register deltas as integer arithmetic.
30 of 30 local checks pass
This instrument ships with this release. The 30 checks above are the local smoke suite, run in process against a throwaway key with no network calls.
When you dispute a bill you're arguing about a row in someone else's database. The reading that produced it is gone, the firmware that produced the reading is gone, and the calibration settings are a maintenance note.
So the dispute becomes a question of whose spreadsheet to believe, and the side holding the meter usually wins by default. Credits get issued on estimates because nobody can reconstruct the chain.
This receipt moves the fight to arithmetic. Either the reported energy equals the disclosed register delta or it doesn't, and either the intervals are contiguous or they aren't.
A calibration authority signs a manifest committing the salted meter_commitment, the device_key_commitment, the firmware_commitment, the coefficients commitment, and a validity interval. It's signed before the window opens.
Each record carries opens, closes, a register_commitment, reported_energy_milliwatt_hours, event_flags, a previous_record_hash, and a device signature from the secure element the manifest names.
The verifier rederives interval energy from the cumulative register delta, checks each record_hash and previous hash link, and folds the batch_inclusion_path to the published batch_root.
The arithmetic is integer arithmetic on register deltas, so there's no rounding argument to have. REGISTER_DELTA_RECOMPUTES_ENERGY refuses a reported quantity that doesn't equal the delta the openings disclose.
Change an interval and the contiguity check refuses. INTERVAL_DURATION_BOUND, TIMESTAMP_MONOTONIC, and PREVIOUS_HASH_CHAIN together mean a gap, an overlap, or a swapped record stops the verifier at a named gate.
Recalibrate after the fact and the binding refuses. MANIFEST_VALID_AT_INTERVAL checks the manifest validity interval contains the interval bounds under the declared drift allowance, and RECALIBRATION_CHAIN_LINKS ties a new manifest to the one it replaced.
FRESHNESS_NONCE_PRECEDES_SIGNATURE matters when you're the one asking. The nonce commitment has to exist before the records were signed, so a meter can't answer today's challenge with last month's cached record.
Verify is open. The register values stay yours: you open only the readings needed for the interval in dispute.
curl -sS -X POST https://thehiveryiq.com/v1/verify/meter-witness \ -H 'content-type: application/json' \ -d @witness.json
disclosure holds the openings. REGISTER_VALUE_NON_LEAKAGE refuses a disclosure wider than the disputed record needs.
{
"receipt": {
"key_id": "did:hive:collector-key", "algorithm": "Ed25519",
"signed_body": {
"receipt_type": "meter.witness",
"witness_id": "site-4471-interval-dispute",
"meter": { "meter_commitment": "...", "device_key_commitment": "...", "firmware_commitment": "..." },
"calibration": { "manifest_id": "...", "coefficients_commitment": "...", "drift_allowance_seconds": 60 },
"freshness": { "challenge_id": "...", "nonce_commitment": "..." },
"metering": { "energy_unit": "mWh", "nominal_interval_seconds": 1800 },
"records": [
{ "record_index": 0, "opens": { "utc": "2030-04-01T00:00:00Z" },
"closes": { "utc": "2030-04-01T00:30:00Z" },
"register_commitment": "...", "reported_energy_milliwatt_hours": 412000,
"event_flags": [], "previous_record_hash": "...", "record_hash": "...",
"device_signature_b64u": "...", "batch_leaf_index": 0, "batch_inclusion_path": ["..."] }
],
"batch": { "batch_root": "...", "tree_size": 48 },
"dispute": { "disputed_record_index": 0, "query_class": "interval_energy" }
}
},
"calibration_manifest": { "signed_body": { "receipt_type": "meter.calibration" } },
"meter_salt_hex": "...",
"disclosure": {
"meter_id": "...", "firmware_hash_sha256": "...", "freshness_nonce_hex": "...",
"register_openings": [ { "record_index": 0, "cumulative_register_milliwatt_hours": 918412000 } ]
}
}
A pass returns valid true and the ordered gates array. A refusal names the gate and the reason, which is the line you put in a dispute packet.
The verifier runs every gate in order and stops at the first failure, then tells you which one stopped it. A later gate never reads a field an earlier gate already showed to be untrustworthy.
| Gate |
|---|
| SCHEMA |
| ISSUER_KEY_MATCH |
| ENVELOPE_SIGNATURE |
| SALT_PRECOMMITMENT |
| CALIBRATION_MANIFEST_SIGNATURE |
| MANIFEST_ENVELOPE_BINDING |
| DEVICE_KEY_MATCHES_MANIFEST |
| FIRMWARE_HASH_MATCHES_MANIFEST |
| RECALIBRATION_CHAIN_LINKS |
| MANIFEST_VALID_AT_INTERVAL |
| FRESHNESS_NONCE_PRECEDES_SIGNATURE |
| TIMESTAMP_MONOTONIC |
| INTERVAL_DURATION_BOUND |
| RECORD_HASH_RECOMPUTE |
| INTERVAL_RECORD_SIGNATURE |
| PREVIOUS_HASH_CHAIN |
| BATCH_ROOT_INCLUSION_RECOMPUTE |
| EVENT_FLAGS_CLEAR |
| REGISTER_VALUE_NON_LEAKAGE |
| REGISTER_DELTA_RECOMPUTES_ENERGY |
| BOUNDARY_CONSTANT |
Field names come from the published schema:
https://thehiveryiq.com/.well-known/schemas/meter-witness-v1.json. It ships with this release alongside the routes below, and the
developer docs carry the schema catalog.
This is the honesty boundary carried inside every
meter.witness receipt, verbatim from the signed body.
This receipt attests only that a calibration manifest signed by a named calibration authority, a set of interval records signed by the meter secure element whose public key that manifest names, a freshness nonce commitment established before those records were signed, and a collector batch root satisfy the stated deterministic metering procedure over the named intervals. A valid result means only that the reported interval energy equals the disclosed cumulative register delta, that each record hash, previous hash link, and batch inclusion path recompute, and that the manifest validity interval contains the interval bounds under the declared drift allowance. It does not establish that the meter measured the physical world correctly, that no physical tampering occurred without raising an event flag, that the firmware named by the manifest was honest when it was manufactured, or that the calibration authority signed a truthful manifest. It does not establish ownership of the site, the identity of the consumer, the source of the energy, or entitlement to any certificate, credit, payment, or settlement. This receipt decides no contractual, statutory, regulatory, evidentiary, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no action, payment, sanction, denial, or remedy.
Hive never receives the corpus, the deleted object, the raw meter data, the analysis inputs, or the control inputs. Every value is a commitment the holder computed locally, and all this service can do is recompute the arithmetic between those commitments and refuse when it does not hold.
| Route | What it does |
|---|---|
| POST /v1/mint/meter-witness | Issue a witness over records and commitments you hold. Needs Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed without it. |
| POST /v1/verify/meter-witness | Recompute the register delta, the record chain, and the batch inclusion. Open, no auth. |
If you want the commercial version of this rather than the field list, we run metering checks on contingency and take a share of what you recover.
The other four instruments in this release: corpus commitment, erasure receipt, analysis replay, control replay. For the receipt that fixes a recording instead of a computation, see capture commitment. For the written papers, see papers.
Patent pending. Hive Civilization, The Hivery, Inc.