Six rays leave as sealed objects. The dashed ray is a fetch: it reaches the ledger, is priced, and has no seal of its own. Each sealed receipt is a compact JWS. The header says how it was signed and which kid; the payload says what happened. Check the signature before you believe the story.
Session
The receipt that comes with the seat.
You ask for it when a run is finished. It is one signed total: how many crossings, what they cost on the pipe, and when the run started and ended. Reading it does not bill. The name of the run is not in the receipt, so a stranger who holds it cannot open your session.
A hit
The same request, served again.
The pipe writes this when it recognises the exact request and answers without calling the lab. A second identical prompt, or a retry that did not change a byte, is the ordinary case. You pay the hit price. The words are not in the receipt.
A miss
The first time those bytes go to the lab.
The pipe writes this when it has to call the model. Nothing was replayed. If a later identical request is served from the pipe, the two receipts pair, and you can see what the second one did not have to buy.
A call out
A request you sent to some other service.
Your app registers a service and sends a call through the pipe. The receipt is written when that call finishes, whether the other side answered or failed. An order id or a number plate in the address is not copied into it. You pay per call.
Custody
What was done to a record the system holds.
Metrecept writes this when it keeps a record, looks at one, changes one, or deletes one. It does not say who the person is. It says what was done, and it points at the previous note, so a deletion does not quietly erase the history.
The month
The organisation’s month, closed.
Someone in the organisation asks for the month. If anything crossed, the pipe signs one total for the whole organisation, not for the slice on the screen. The first close of that month costs ten cents. Asking again does not.
A fetch
A page with a price, and no signature of its own.
You ask the pipe to fetch an address. The site’s rules are read first, and the address is checked before anything leaves. The fetch is written on the ledger and billed per page. It is not one of the signed kinds.
What each one costs.
The session is included. The others run from a miss at 0.1125p to a month at 7.5p.
The month
7.5ponce, when the month is closed
Custody
0.75peach note
A hit
0.45pper thousand tokens
A fetch
2pper page
A call out
0.45pper call
A miss
0.1125pper thousand tokens
Session
Included with the seat. Asking for it does not bill.
0p
What a receipt can prove.
One row per kind. The kind says what the receipt proves.
Kind
What it proves
Sessionsession
A tagged run closed into one checkable object, pulled with GET /v1/sessions/{id}, with the id itself never inside. Inspecting it does not bill.
Cache HITcache_hit
Proof of an exact replay served by the pipe: the model, the tokens not bought again, the pipe cost, the serving plane, and the request digest.
Cache MISScache_miss
Proof of the fill that followed: zero tokens replayed, the miss rate as pipe cost, the same request digest a later hit will share.
Web fetchweb_fetch
A governed, ledgered crossing per URL. Robots, PII and SSRF checks run before anything reaches the model. No fetch-kind JWS exists.
API callapi_call
Proof of one completed third-party GET through the pipe, 200 or 500. The request digest covers service, path and query, never the raw path.
Custodycustody
A signed, chained note that this system retained, accessed, amended, or deleted something. Digests only; deletion is a tombstone.
Statementstatement
The UTC month, closed for the whole org: totals, pipe rent and an explicitly estimated-avoided figure. The blob you keep after the hot copy ages out.
How it is signed.
Ed25519 is the signature on every live receipt, and anyone can check it against the published key.
Signature
Status
What that means
Ed25519
Live
The signature on every receipt today. It checks against the published key. The name has to match, and the signature has to be intact.
A shared secret
Out
A stranger could not check it, so it is not a receipt.
The session receipt stays with the seat. The other crossings are priced on the card.
A hit, a miss, a fetch, a call out, a custody note, and the month are priced. The session is not. The clock leaf is the hour the receipt was placed in. That hour is published, and its Merkle root is anchored to Bitcoin through OpenTimestamps.
Directory + kid
The public forever-link is the directory and the kid. Session, statement and custody stay seated.
Receipts minted on the live pipe, checked in this browser against the published key. The clock leaf is the hour the signature was placed in. That hour is published, and its Merkle root is anchored to Bitcoin through OpenTimestamps.
session
Session
Free, included
0p is the price of the object. The recorded spend is what the run inside it recorded.
Signed · Verified · Ed25519, live key
Entered in the public clock · hour 20261022T18Z · committed
The hour's Merkle root is anchored to Bitcoin through OpenTimestamps. The stamp sits on that hour. It is not a second signature on the receipt.
Inspect the public proof
{
"kind": "bitcoin_stamp",
"slot": "20261013T22Z",
"status": "bitcoin",
"txid": "531fcf78fc38f110ee9a342964a04895fb5c70a70c432027f1e2e904b7b1ca9a",
"block_height": 971318,
"explorer": "https://mempool.space/tx/531fcf78fc38f110ee9a342964a04895fb5c70a70c432027f1e2e904b7b1ca9a",
"note": "The hour's Merkle root is anchored to Bitcoin through OpenTimestamps. The stamp sits on that hour. It is not a second signature on the receipt."
}
We use storage that is strictly necessary to sign you in and run checkout. With your consent we also count anonymous page visits. Privacy