Pick an attack on a wire transfer and watch execution refuse. The digests are computed in your own browser. Then take the record it hands you and check the second signature against a published key, again in your own browser.
What the demo does not do. It proves the instruction did not change in custody. It does not prove the answer was right or that any model was honest. The second signer is a separate key, a separate clock and a separate log operated by Hive, so it is not an outside party and the service reports that itself. It signs Ed25519, which is not post quantum. The operator side signs ML-DSA-65 under NIST FIPS 204. The second signer's log does not survive a redeploy today, and it says so too. Patent pending.
ChimeCore, Jade, Archimedes, and human-overseen AI already decide and act on members' money. This page proposes one addition: an independent, signed receipt for each action, so what the control plane did is provable to a member, a bank partner, or an examiner. Every demo on this page runs here, in your browser. Member data stays. Only the proof crosses.
The proof is in the provenance. It does not judge.
Each surface below is something Chime has publicly described running. The receipt does not change how the surface works. It attaches independent proof that the action happened the way the control plane said, without moving the member data underneath.
As Jade moves from reactive tools to proactive financial management, each member-facing action carries a signed receipt binding the consent, transparency, and human-safeguard trace Chime already promises.
Chime's AI-powered disputes platform cut average resolution time from ~42 minutes to under 20. Every dispute resolves into a signed, examiner-ready packet a network or examiner can re-verify offline.
AI fraud detection and risk-scoring helped cut fraud losses 29% since 2022, with final enforcement under established rules and human oversight. Each intervention gets a signed receipt of what was checked and why.
ChimeCore can move money, extend credit, and stop unwanted charges with member permission. A receipt proves the ledger action ran under the stated policy, exportable to a bank partner.
Archimedes ships product with AI agents doing the majority of development: 84% of March code was AI-developed, up from 29% four months earlier. Agent actions can carry receipts of what ran, under which control.
Transaction records flow from Galileo over SFTP through a modern data-warehouse stack, with data-quality checks that fail the job on error. A receipt proves each check ran on which inputs.
Prepared for Chime as a proposed architecture. Figures are public and source-linked in the evidence section below, and should be re-verified before external use.
Left of the line is everything inside the Chime and bank-partner boundary. Right of the line is a bank partner, an examiner, or the member. Watch what actually crosses.
Every square that crosses is a receipt, not a record. The count of member bytes that crossed is always zero. That is the whole design.
Sliders are yours to set. This is arithmetic on numbers you enter, not a forecast, a quote, or a claim about Chime's real volumes.
Whatever you put in those sliders, the last number is always zero. Proof bytes scale with actions; member data moved does not scale at all.
This widget builds a real signed receipt for a Chime dispute action, verifies it in your browser, lets you tamper with a byte and watch the check fail, re-verifies from pasted JSON, and re-checks a published 5,000-frame routine soak. The signing engine is bundled and served from this same domain. Open your network tab: after load, it makes zero outbound calls except the two same-origin JSON fetches it names.
In-browser · offline The offline verifier never leaves this page except to fetch its own sample and bench file from this domain.
Every click prints the recomputed hash next to the stored hash, one line per layer. A changed byte reads FAIL in the same output; a clean receipt reads PASS. Success is labelled, never color alone. There is no server round-trip. The same engine ships as an offline command-line kit that is byte-identical to what runs here.
This is different from the offline verifier by design. It drives the real Hive receipt primitives in a Chime-shaped sequence: relay a signed dispute event, group it into a proof vector (R3Pv), run a Protected Flow assessment under a bank policy pack, and export a signed evidence bundle. No account, no key, no payment beyond the calls you trigger. No funds move and Hive never calls a Chime or Galileo API.
Network state: unknown This leaves your browser and hits receipts.thehiveryiq.com. If the call is blocked by CORS or offline, the widget runs a truthful local cryptographic fallback and labels it clearly. It does not fake a live success.
The Chime-shaped payload carries a dispute event kind and reason only, never a real member. Curl the same sequence yourself:
Plain English. Each part closes a gap a self-written log leaves open. These are the four Filings under InkFrame v1, the same four the verifier above exercises.
Organized around the Chime surfaces this page names. Everything under Running now is live today (the verifier and live workflow above exercise it). Everything under Expansion offerings is a surface Hive could stand up with Chime, not a service running yet.
The four Filings under InkFrame v1 are the fastest path in. Hive Proof Architecture is broader. This is the whole map, kept on this page: each primitive, the Chime surface it fits, what it does now, and what it could do next.
| Hive primitive | Chime surface | State | What it does |
|---|---|---|---|
| InkFrame v1 | All surfaces | Running now | The signed receipt frame: content-addressed roots plus a hybrid Ed25519 + ML-DSA-65 signature. The verifier above builds and checks one. |
| Proof Pre-Fill | Jade · ChimeCore | Running now | Filing A. The receipt is attached at the moment of the action, so it adds no delay to a member's flow. |
| InkFrame Non-Mutation | Galileo · disputes | Running now | Filing B. One changed byte fails the check. This is the tamper test in the verifier. |
| Disclosure-Free Replay | Galileo · fraud | Running now | Filing C. Reconstruct the route from fingerprints alone, with no raw member text. |
| Arrival Countersignature | Fraud · Archimedes | Running now | Filing D. The gateway countersigns on arrival, so what ran is what was cleared. |
| Receipt Relay | ChimeCore · disputes | Running now | Signs an event into a portable receipt. Step 1 of the live workflow above. |
| R3Pv proof vector | Disputes · fraud | Running now | Groups signed receipts into one signed vector: verification, policy, healing, routing, and permitted next action. |
| Protected Flow | Fraud · ChimeCore | Running now | Turns the vector into a signed decision (permit, hold, recover, escalate) under a policy pack, with a meter quote. No funds move. |
| Evidence Export | Disputes · Reg E | Running now | Bundles the vector, assessment, receipts, and pubkeys into a signed bundle an examiner re-verifies offline. |
| Carnac™ | Archimedes · Jade | Running now | Sizes how much proof an action deserves. It does not judge. |
| CarnacPrompt™ | Jade | Running now | Fingerprints the prompt as a one-way SHA-256, never the words. |
| Carnac Gateway™ | Archimedes | Running now | The gateway that countersigns agent and model traffic on arrival. |
| SmartAgent route proof | Fraud · Archimedes | Expansion | Proof for multi-step agent behavior across a route. |
| Protected Flow Fleets | Fraud | Expansion | Fleet-scale protected-flow decisions across many concurrent reviews. |
| AFiR-Stream | Galileo | Expansion | Streaming receipt proof for high-volume pipeline batches. |
| OriginProof | Galileo | Expansion | Origin attestation for RDF batches and data-quality checks. |
| PPR · SRPR | ChimeCore · bank partners | Expansion | Payment and settlement provenance receipts for money movement. |
| Sovereign Receipt Registry | Bank partners · Reg E | Expansion | Jurisdiction-held or partner-held receipt registry. |
| Provable Machines | Archimedes | Expansion | Build-time control-execution receipts for the software factory. |
Running now surfaces are exercised by the verifier and live workflow on this page. Expansion surfaces are options to weigh with counsel and Chime's compliance function; none is a live service today.
These are Chime's own words, public as of July 2026. Hive draws no conclusion about Chime beyond what these state, and does not imply Chime is a customer, partner, or endorser.
Is there room, beside ChimeCore and the AI Chime already runs, for an independent proof service that signs each action and never moves the member data underneath? Not instead of anything Chime built. A neutral layer that makes the control plane provable to a member, a bank partner, and an examiner.
These receipts add a per action limit check and a separate review of supplied actions across a defined period, without moving the member data described here. They run in production today. The examples below are verified live against them.
For a member money action, this receipt compares one declared action with the limits in the authority receipt presented for it. It tests the amount, currency, timing, and scope against an authority signed before the action was authorized. The service recomputes the result, so the record does not depend on a caller's assertion. A bank partner, examiner, or risk team can inspect the narrow check without receiving the member transaction or dispute file. It fits the boundary described on this page because the receipt can carry proof of the comparison rather than member data.
What it does not do. It does not prove that a member or cardholder granted the delegation, that the declared agent is genuine, that a network authorized or settled the action, that value was delivered, or that a person read shown terms. It is not payment authorization and contains no cardholder credential; no card network, issuer, or regulator currently recognises it as authentication data, compelling evidence, or a liability shift; it cannot deny, resolve, adjudicate, or affect a dispute, limit rights under Regulation E, Regulation Z, or an equivalent rule, assess period totals or velocity, or prove that the supplied authority was still unrevoked.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
This receipt examines a supplied group of action conformance receipts for one member authority over a stated period. It checks that every receipt refers to the same authority, falls inside the window, uses the same currency, and does not duplicate another receipt. The service recomputes the total amount and count in minor units against the stated cumulative limit. That gives bank partners, risk, and compliance a defined view of the actions supplied for a daily or monthly control. It keeps a rolled up check distinct from the per action check, which has a different job.
What it does not do. It cannot know that the supplied group includes every member action, so a within limit result describes the submitted receipts only and not all activity under that authority. It does no currency conversion, is not payment authorization, does not shift card network liability, and does not limit any right under Regulation E, Regulation Z, or an equivalent rule.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Every run above posts a verified request body from this domain to the open verify route and prints what came back. The example receipts are signed with published example keys, so verify reports key_trust example_registry. That is on purpose. Nothing on this page is a production issuance, a customer record, or an endorsement. Patent Pending.
Each link opens that entry in the canon implementation explorer, where its schema, mint route, open verify route, auth requirement and implementation state are stated. The state shown here is read from the same registry file the explorer renders from, so the two cannot drift apart. Nothing here implies a customer, a deployment or an endorsement.