PQ-SmSH turns "everything is depth — depth is everything" into a cryptographic contract. You commit a max depth band, a max token count, and an allowed tool set, signed with ML-DSA-65. The provider returns a counter-attestation of the actual path taken, also ML-DSA-65 signed. Over-band declarations are refused at the server. Both receipts verify offline. Patent Pending · Filed 2026-05-08
Base price is $0.0030 per 1,000 tokens. The band multiplies it. A buyer asking for D0 retrieval pays 0.05x. A buyer authorizing D4 frontier pays 10x. The provider cannot silently take the deeper, more expensive path — the server checks the declared band against the buyer's signed ceiling and refuses to attest if it exceeds.
Pick a buyer ceiling. Pick what the provider actually did. The page calls the live endpoints — bind, attest, verify — and shows you the hybrid Ed25519 + ML-DSA-65 receipt. Try a deeper provider band than the buyer signed for and watch the server refuse.
The attest endpoint runs five checks before producing a counter-signature. Any single failure returns HTTP 409 with the violation list. No partial signature, no co-sign, no audit trail of a fake compliance event.
If the provider declares anything that exceeds the buyer's signed bind, the server returns HTTP 409 with the explicit violations. There is no receipt to forge — the operator never produces one.
A retrieval query is 200x cheaper than a frontier run. PQ-SmSH gives the buyer the contractual right to refuse to be billed for depth they did not authorize.
The price table is hashed into the bind. The provider cannot retroactively swap to a more expensive table — the bind would no longer verify.
PQ-SmSH binds depth. HAHS binds hire-time scope. SHOD binds the six payment gates. Three layers, one envelope, one verifier. Patent Pending · Filed 2026-05-08