PQ-SmSH turns how deep an AI model works into something you can put in writing and enforce. You set a max depth band, a max token count, and a list of tools the model is allowed to use, all signed with ML-DSA-65 (the government's post-quantum signature standard). The provider sends back signed proof of the actual path it took, also signed with ML-DSA-65. If it goes over the limit, the server won't sign it. Anyone can check both receipts on their own computer. Patent Pending · Filed 2026-05-08
The base price is $0.0030 per 1,000 tokens. The band changes how much you pay. A buyer asking for D0 retrieval pays 0.05x. A buyer signing off on D4 frontier pays 10x. A provider can't quietly switch to a deeper, pricier path. The server checks the declared band against what the buyer signed for and won't sign off if it goes over.
This calls Hive's live post-quantum self-test and shows you the real numbers it returns right now: ML-DSA-65 signing and verification, ML-KEM-768 key encapsulation, and the byte sizes and latency of each. It proves the PQ signing and key-encapsulation stack under PQ-SmSH is live and measurable today. It does not run the bind, attest, or ceiling-refusal flow below, that flow is shown as a worked example.
The band, buyer DID, model class, and provider fields above describe the worked example in the sections below. The button runs a live self-test of the underlying PQ signing stack, not a bind/attest call for these specific values.
The attest endpoint runs five checks before it signs anything back. If even one check fails, you get an HTTP 409 error with the list of what went wrong. There's no partial signature, no co-signing around it, and no fake compliance record left behind.
This is a worked example of the signed-ceiling flow: a buyer's depth-band limit, signed. It illustrates the envelope shape, not a live call.
If the provider claims anything that goes over what the buyer signed, the server sends back an HTTP 409 error and spells out exactly what went wrong. There's no receipt to fake here. Hive never produces one in the first place. Shown here as a worked example of the refusal response shape.
A retrieval query costs 200 times less than a frontier run. PQ-SmSH gives the buyer the right, in writing, to refuse a bill for depth they never agreed to.
The price table gets locked into the bind's fingerprint. A provider can't swap in a pricier table later. If they did, the bind would stop checking out.
PQ-SmSH locks in depth. HAHS locks in what an agent is hired to do. SHOD locks in the six payment checks. You get three layers, one envelope, and one way to check it all. Patent Pending · Filed 2026-05-08