docs / verification
Verified means signed and plausible.
Not proof. Usage comes from files on your own machine, and no provider publishes per-person token totals for a subscription account. Nobody can prove what you burned. What we can do is make faking it expensive and obvious.
Trust levels
Every day of usage carries one of three. When a day is made of several rows, the weakest one wins.
- verified
Signed by a bound device, carries a receipt stream, and passed every check. Counts in full on leaderboards, mints at full rate, settles markets.
- reported
Signed by a bound device, no receipt stream. Agents whose transcripts have no per-message identifiers we can read land here. It counts on leaderboards with the badge attached, and mints at half.
- quarantined
Failed a check, with the reasons attached. Out of leaderboards, out of the mint, and out of market resolution until an admin reviews it. Approving a day only ever adds credits: a day already minted is never clawed back.
Receipt streams
A receipt stream is the ordered list of hashes of the per-message identifiers behind a day's usage. Claude Code and Codex both give the collector an identifier per assistant message. We hash it and send the hashes, in order. No content, no prompts, no file names.
Two things fall out of that:
- Deduplication. Two machines reading the same transcripts, a laptop and a desktop over a synced folder, produce the same hashes, so the day is counted once.
- Coherence. The number of receipts and the tokens attributed to them have to fit each other. A day with enormous totals and a handful of receipts does not.
The checks
Deliberately loose. A false quarantine costs a real builder their day; a missed one costs play money.
- Negative counts
- A token count or a cost below zero is not a mistake we round away.
- Future day
- A day that has not happened yet, or one that has not had time to produce that many tokens.
- Output rate
- Output tokens per elapsed second, capped per model. 1000 by default, 2000 for the small fast ones.
- Output to input
- Output tokens may exceed total input, fresh plus cached, by at most four times.
- Cache ratio
- Cache reads may exceed cache writes by at most four hundred times within a day.
- Daily cost
- A ceiling per provider, sized against the largest known plan tier. 3000 USD by default.
- Backfill window
- A device may amend the two days before its own watermark. Older days do not move.
- Receipt coherence
- Each receipt stands for one assistant message, so tokens per receipt has to be believable.
What this does not give you
A determined person can still fabricate a coherent stream. We know. Two things keep that from mattering much: the stakes are play money with no way in or out, and your community can see your board. If a number looks wrong to the people who know you, it probably is.
The reasoning behind all of this is in ADR 0003. What a trust level is worth in credits is on the credits page.