docs / verification
Verified means signed and plausible.
Not proof. Usage comes from files on your own machine, and no provider publishes per-person token totals for a subscription account. Nobody can prove what you burned. What we can do is make faking it expensive and obvious.
Trust levels
Every day of usage carries one of three. When a day is made of several rows, the weakest one wins.
- verified
Signed by a bound device, carries a receipt stream, and passed every check. Counts in full on leaderboards, mints at full rate, settles markets.
- reported
Signed by a bound device, no receipt stream we can lean on. Agents whose transcripts have no per-message identifiers we can read land here, and so does a day carrying more receipts than its tokens account for. It counts on leaderboards with the badge attached, and mints at half.
- quarantined
Failed a check, with the reasons attached. Out of leaderboards, out of the mint, and out of market resolution until an admin reviews it. Approving a day only ever adds credits: a day already minted is never clawed back.
Receipt streams
A receipt stream is a sorted list of unique hashes identifying the messages or billed turns behind a day's usage. The collector reads these identifiers from Claude Code, Codex, and Grok, hashes them, and sends the hashes. No content, no prompts, no file names.
Two things fall out of that:
- Deduplication. Two machines reading the same transcripts, a laptop and a desktop over a synced folder, produce the same hashes, so the day is counted once.
- Coherence. The number of receipts and the tokens attributed to them have to fit each other. A day with enormous totals and a handful of receipts does not, and is quarantined. Surplus receipts are the harmless direction — more receipts than the tokens account for moves no ranking, since boards rank cost and tokens — so that row drops to reported instead of taking the day down with it.
The checks
Deliberately loose. A false quarantine costs a real builder their day; a missed one costs play money.
- Negative counts
- A token count or a cost below zero is not a mistake we round away.
- Future day
- A day that has not happened yet, or one that has not had time to produce that many tokens.
- Output rate
- Output tokens per elapsed second, capped per model. 1000 by default, 2000 for the small fast ones.
- Output to input
- Output tokens may exceed total input, fresh plus cached, by at most four times.
- Cache ratio
- Cache reads may exceed cache writes by at most four hundred times within a day.
- Daily cost
- A ceiling per provider, sized against the largest known plan tier. 3000 USD by default.
- Backfill window
- A device may amend the two days before its own watermark. Older days do not move.
- Receipt coherence
- Each receipt stands for a message or billed turn, so tokens per receipt has to be believable.
What this does not give you
A determined person can still fabricate a coherent stream. We know. Two things keep that from mattering much: the stakes are play money with no way in or out, and your community can see your board. If a number looks wrong to the people who know you, it probably is.
The reasoning behind all of this is in ADR 0003. What a trust level is worth in credits is on the credits page.