Model Receipts: universal model-call proof

Signed proof for every AI model call.

Prompt through Hive to a model. Get the response plus a signed, verifiable receipt for the call path. The receipt captures which provider and model answered, a hash of the prompt, a hash of the response, the per-phase timing, and an Ed25519 signature that verifies against did:hive:hivemorph. Six direct providers are live today: Anthropic Claude, OpenAI GPT, xAI Grok and Google Gemini as first-party custody, Mistral and DeepInfra as direct inference infrastructure, plus Claude, Gemini, Grok, GPT and DeepSeek routed via OpenRouter; the adapter layer is built to target many more. This lab is where signed model calls and model receipt verification fit into Hive's wider proof layer.

What a model receipt attests

A model receipt proves the model-call route: the provider and model, the prompt hash, the response hash, the timing, the signature, and the verification result. It does not attest that the model output is correct. "Universal" describes the architecture. Adapters are registered per provider and model, not a claim that every provider is wired today. Live now: Anthropic Claude, OpenAI GPT, xAI Grok and Google Gemini on first-party direct custody, Mistral Leanstral plus a set of registered DeepInfra OpenAI-compatible models on direct infrastructure, and Claude, Gemini, Grok, GPT and DeepSeek routed via OpenRouter. We list exactly which DeepInfra models are wired. This is not a claim of access to DeepInfra's entire catalog. The rest of this page is explicit about what is live versus what is on the roadmap.

The flow

Route in. Response and receipt out.

1 · Route
A SmartAgent selects a registered provider / model adapter for the prompt.
2 · Call
The provider is called live. Round-trip latency is measured, not estimated.
3 · Hash
Prompt and response are SHA-256 hashed. The receipt binds content by hash.
4 · Sign
Run metadata is canonicalized and Ed25519-signed into one receipt.
5 · Verify
The receipt verifies against the issuer key. It's offline-checkable, ok.
Live today

Mistral Leanstrallive

The first wired adapter is Mistral Leanstral 1.5 (labs-leanstral-1-5). It is called live on the backend, and every call is receipted and verified. The worked example walks one full run end to end.

End-to-end (latest run)
~690ms
One live run, dominated by the provider round-trip. Not a benchmark average, the widget below pulls the current number.
Hive receipt overhead
sub-ms
canonicalize + hash + sign + verify combined ran under a millisecond in the recorded run.
Verification
ok
Ed25519 signature verified against did:hive:hivemorph via /v1/receipt/verify.

See the full run, hashes, and signature on the Leanstral receipt example.

Live status

Run it against the live backendlive

These controls call receipts.thehiveryiq.com directly from your browser. Each button does real work: list the registered adapters, receipt a live Leanstral run, or run a SmartMorph route comparison. If a fetch fails, the last-known verified values below still stand on their own, and copyable curl commands are provided further down.

GET /adapters  ·  GET /leanstral-demo  ·  SmartMorph route
Idle, auto-loading live status…
Registered adapters
...
Live run status
pending
Provider · model
...
Run ID
...
Receipt ID
...
Verification
pending
Algorithm · issuer
...
Response SHA-256
...
Timing (ms)
...
Backend commit
...
Response preview (model output, not a verified answer)
...
Last known verified runrecorded 2026-07-04
Status
ok · true
Provider · model
mistral · labs-leanstral-1-5
Verification
verified · ok against did:hive:hivemorph
Timing (ms)
provider_call 708.51 · canonicalize 0.034 · hash 0.004 · sign 0.114 · verify 0.136 · total 708.80
Response SHA-256
ff11617efb0ffc3c51bf292ca701cef6bf0658104cbe5b55d28fb59ef8d6ad4f
Backend commit
afb99469edca
Provider roadmap

What is live, what is ready to wire, what is next.

Adapters are registered per (provider, model). Live today: direct first-party adapters for Anthropic Claude, OpenAI GPT, xAI Grok and Google Gemini, direct infrastructure adapters for Mistral Leanstral and a registered set of DeepInfra OpenAI-compatible models, plus routed adapters via OpenRouter for Claude, Gemini, Grok, GPT and DeepSeek. The "Run live adapter check" button above reflects the current backend state.

Live today: direct first-party custody

Live · verified

Called on each provider's own first-party API, not a routed hop, so the receipt attests direct first-party provider custody plus the selected model id, prompt/response hashes, timing and signature. It does not attest output correctness.

Anthropic · Claude (Haiku 4.5, Sonnet 4.5) OpenAI · GPT (4o mini, 4.1 mini, 4o) xAI · Grok 4.20 Reasoning Google · Gemini 2.5 Flash Google · Gemini 2.5 Pro

Gemini 2.5 Flash is the demo-clean hero: first-party call, signed, verified, non-empty response. Gemini 2.5 Pro is receipt-path live and verified too, but on the short demo prompt it can spend its budget on internal reasoning and return no visible text, so the live check honestly marks it receipt-ok / empty-content rather than demo-clean. Both prove first-party custody + model id; neither attests output correctness.

Live today: Mistral · direct infrastructure

Live · verified

Wired, called live on the provider's own inference endpoint, and receipted on every call.

Mistral · Leanstral 1.5

Live today: DeepInfra · direct infrastructure

Live · configured

Registered DeepInfra models on the OpenAI-compatible chat surface. Each is configured on the backend and returns a real signed receipt on call. This is the set we have wired, not a claim of access to DeepInfra's full catalog. Some models produce clean demo text on a generic prompt; others need a model-appropriate prompt, so the live check labels each honestly.

moonshotai · Kimi-K2.7-Code zai-org · GLM-5.2 Qwen3-Coder-480B-A35B-Instruct-Turbo deepseek-ai · DeepSeek-V3.1-Terminus stepfun-ai · Step-3.7-Flash

Live today: routed via OpenRouter

Live · verifiedRouted

Reached through OpenRouter's OpenAI-compatible surface and receipted on every call. A routed receipt proves the Hive→OpenRouter call path and the selected model id, not first-party provider direct custody. Claude, GPT, Grok and Gemini all also have direct first-party rails above; the chips here are the routed hops, distinct from those first-party rails (this Grok 4.3 chip vs. first-party Grok 4.20; this Gemini 2.5 Flash chip vs. the first-party Google Gemini rail). A routed Gemini receipt proves the OpenRouter path, not Google first-party custody.

Anthropic · Claude Sonnet 4 Google · Gemini 2.5 Flash xAI · Grok 4.3 OpenAI · GPT-4o mini DeepSeek · Chat v3.1

Ready to wire: OpenAI-compatible

Compatible · not yet live

These providers expose an OpenAI-compatible chat API, which is the same shape the live adapters use. They can be registered without new receipt code, but none are wired or verified live yet.

Baseten Parasail Novita Hyperbolic SiliconFlow GMI Lightning AI Fal Telnyx

First-party direct adapters: next

Roadmap · premium custody

Anthropic Claude, OpenAI GPT, xAI Grok and Google Gemini are now live on first-party direct custody (rails above). What remains here is Manus: the account key is in hand, but Manus does not yet expose a usable first-party model-call API surface for a direct adapter, so no adapter is wired and nothing is claimed live. Listing it is a direction, not a capability claim. The receipt layer is provider-independent: the moment Manus ships a callable first-party surface and the adapter is configured, the same signed-receipt path applies with no change to the proof format.

Manus · agent platform (awaiting first-party API surface)
SmartAgent vs SmartMorphAgent

One receipts the route. The other receipts the change of route.

Live today

SmartAgent: receipts the selected path

Picks a model, calls it, and captures the call as one signed receipt.

  • Provider and model actually used
  • Prompt hash and response hash (SHA-256)
  • Per-phase timing of the call
  • Ed25519 signature + verification result
Live demo

SmartMorphAgent: receipts the change of route

Compares candidate model stops on observed signals, chooses a route by explicit rule, and receipts both the morph decision and each model call.

  • Re-routes on cost, latency, or capability
  • Re-routes on jurisdiction or payment / x402 availability
  • Distinguishes each model-call receipt from the morph-decision receipt
  • Signs the morph decision and each call
Honest status

With direct and routed providers live, Anthropic Claude, OpenAI GPT, xAI Grok and Google Gemini as direct first-party, Mistral and DeepInfra as direct infrastructure, plus Claude, Gemini, Grok, GPT and DeepSeek routed via OpenRouter, a SmartMorph route comparison is demonstrable today: the "Run SmartMorph route demo" button above runs live model calls (which can mix first-party, infrastructure and routed candidates), receipts each, and selects a route by explicit rule. The morph-decision receipt carries the selected custody path; when the selected stop is reached through OpenRouter it records a routed_via caveat, proving the routed call path and selected model id, not first-party custody. It is economic-routing capable / a demo decision. It compares live call signals and signs the choice; it does not record an economic or physical state transition. When an actual route change or x402 settlement occurs, each becomes its own receipted event.

For developers

Call it yourself

Read-only endpoints. Verification is free; the receipt round-trips the public /v1/receipt/verify. The demo-matrix and SmartMorph routes are additive. If the backend has not deployed them yet, the page falls back to /adapters + two live /run calls, so these still work.

Live demo: receipt a Leanstral call curl https://receipts.thehiveryiq.com/v1/model-receipts/leanstral-demo
List registered adapters (env var names only, no secrets) curl https://receipts.thehiveryiq.com/v1/model-receipts/adapters
Universal run: receipt a Mistral Leanstral call curl -X POST https://receipts.thehiveryiq.com/v1/model-receipts/run \ -H 'Content-Type: application/json' \ -d '{"provider":"mistral","model":"leanstral-1-5","prompt":"State the theorem add_comm for Nat."}'
Universal run: receipt a DeepInfra model call curl -X POST https://receipts.thehiveryiq.com/v1/model-receipts/run \ -H 'Content-Type: application/json' \ -d '{"provider":"deepinfra","model":"deepseek-ai/DeepSeek-V3.1-Terminus","prompt":"Reply with one short line: pick a route label for a low-latency code task."}'
SmartMorph route demo (additive, falls back to two /run calls if not yet deployed) curl https://receipts.thehiveryiq.com/v1/model-receipts/smartmorph-route-demo

Model facts: Mistral Leanstral 1.5: mistral.ai announcement and the model card on Hugging Face.

Private by design. Hive does not store your prompts. Every request is already receipted by a one-way SHA-256 fingerprint, not the words. Proof, not surveillance.