Every query leaves a receipt. Every citation chain is signed.
A search merchant on the Visa CLI mints one hive-vcr-1 receipt per query. Source class, freshness window, and the citation chain that grounded the result are co-signed before the response returns.
The fields the operator co-signs before this call returns.
Every field below is co-signed by the operator with ML-DSA-65 and countersigned by Hive. Absence is not a default. Absence is a verification failure. The merchant cannot return the call's result without the receipt; the receipt cannot exist without these fields.
Search · Retrieval · attestation fields
Three places this category needs a receipt yesterday.
Agentic search provenance
An agent that cites web sources carries the citation_chain_hash in the receipt. If the cited URL later changes, the receipt still proves what was retrieved at the time.
Litigation-grade retrieval
When a search-grounded answer becomes evidence, the receipt is the chain-of-custody artifact. It is admissible without expert testimony.
Compliance for restricted feeds
Licensed-feed source_class means a paid feed was actually queried — not a public-web echo. The license tier is provable per call.
One endpoint. One envelope. No Hive dependency in your inference path.
A search · retrieval operator adopts hive-vcr-1 by appending the receipt envelope to the response and exposing a public verification key. Hive's countersignature is a sidecar; it does not sit on the critical path. If Hive disappears, the operator's receipts remain verifiable against the operator's own key.