Pick an attack on a wire transfer and watch execution refuse. The digests are computed in your own browser. Then take the record it hands you and check the second signature against a published key, again in your own browser.
The demo checks bounded instruction integrity, not answer correctness or model honesty. The countersigner uses Ed25519 and is Hive-operated, independent:false. On 2026-09-05 its health declaration reported /var/hive and log_durable:true; recovery was not tested. Operator PQ claims depend on the exact endpoint and verified output, not the countersignature. Patent pending.
AmpliHive proposes customer-side receipts binding prompt_hash, response_sha256, tenant_did, and partner_id=fireworks. A partner label in a signed payload is an assertion, not proof of Fireworks participation. ML-DSA-65 availability is endpoint-specific; every-response production PQ signing and customer integration are not established here. Proposed commercial rate: $0.06 per 1M signed calls, with a negotiated partner cut. Evidence can support regulated workflows but does not establish compliance. See capability and acceptance scope.
FIPS 204 names the ML-DSA algorithm standard, not a procurement approval or module certification. Separate Modal health self-declares ML-DSA-65 at afir-1.2.13; no current production output-signature acceptance is established here.
partner_id=fireworks is bound INSIDE the signed payload. Flip a byte and the signature breaks. Revenue share is a SQL query against signed certs, not a quarterly reconciliation call.
Your customer’s Fireworks key never leaves their network. They install one npm or pip package. Their LLM call stays exactly where it is. AmpliHive returns a cert.
The proposed customer-side design signs output after inference. Previously reported figures are ~6ms p95 round-trip overhead plus ~60ms ML-DSA-65 signing. These figures are unverified for the current endpoint, deployed revision, workload and measurement date; they are not a latency guarantee or evidence of compliance. Off-path operation must be demonstrated in the customer integration.
partner_id=fireworks. Revenue share is provable, not promised.Customer keeps their Fireworks API key. Customer keeps their data path. AmpliHive returns a cert. The cert says “signed for tenant X, attributed to Fireworks.”
import Fireworks from "fireworks-ai"; import { AmpliHive } from "@hivery/amplihive"; const fw = new Fireworks({ apiKey: process.env.FIREWORKS_API_KEY }); const hive = new AmpliHive({ tenantDid: "did:hive:acme", apiKey: process.env.AMPLIHIVE_API_KEY, partnerId: "fireworks", // bound into the signed cert }); const llm = await fw.chat.completions.create({ model: "accounts/fireworks/models/llama-v3p1-70b-instruct", messages: [{ role: "user", content: prompt }], }); const text = llm.choices[0].message.content; const cert = await hive.sign({ prompt, response: text }); console.log(cert.certificate.payload.partner_id); // "fireworks" console.log(cert.certificate.alg); // "ML-DSA-65"
This widget requests a certificate from the configured backend using partner_id: "fireworks". Inspect the returned algorithm and run the service check; a valid service result is not independently accepted issuer trust or proof of a Fireworks customer integration. Tamper rejection must be observed, not assumed from the label.
partner_id=fireworks is bound inside the signed payload, so attribution is a query against signed records rather than a quarterly reconciliation call. Price and split are set in the pilot, once we both know what the workload actually looks like.A provider is the only party that can see batch occupancy, cache epochs and the sampler. These three receipts turn each of those into a record a customer can check without being given the serving internals. They are newer than the work above and they are the operator side of the same question.
Two identical requests at temperature zero can come back different, and the usual answer is that nothing changed. This receipt fixes a divergence bound by digest before the first measured request is sent, then records the accumulator width, the reduction split count and the reduction order at each batch occupancy level it measured. If the outputs moved across levels, the receipt says so and says by how much. If they held, that is a valid receipt too. Either way the number is on the record before anyone argues about it.
What it does not do. It does not say which answer was right, does not name a defect in any vendor, and does not observe the provider batch from outside the serving path. The occupancy levels it records are the ones the issuer controlled.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
A reused cache block from an older build is the quietest way to serve a stale answer. This receipt makes the build epoch an input to the block key, so a block written under one build cannot be read under another by accident. Every reused block is checked against the epoch resident in memory at admission, and a mismatch is unmapped and recomputed before decode passes its prefix. The record lets you recompute block residency age and the cross epoch read count instead of taking a dashboard's word for it.
What it does not do. It does not say the cached answer was correct, does not inspect the contents of any block, and does not reveal any prompt or prefix. It proves only that the epoch binding held at admission.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
When sampling is stochastic, the party asking for the output has no way to check the draw. This receipt turns that around. Every stochastic token is selected from a keystream the requesting party committed first, and the record lets you recompute the keystream positions the sampler consumed and the interval membership residual at each emitted position. If a position is missing or already consumed, the decoder halts rather than redrawing. A halt is a recorded outcome, not a retry.
What it does not do. It does not judge the quality of the output, does not prove the model was the right one, and does not reveal the committed secret. It proves only that each stochastic selection came from the committed keystream at the position claimed.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Nothing has run yet. Click Run it and the answer below comes back from the verifier, not from this page.
Every run above posts a verified request body from this domain to the open verify route and prints what came back. The example receipts are signed with published example keys, so verify reports key_trust example_registry. That is on purpose. Nothing on this page is a production issuance, a customer record, or an endorsement. Patent Pending.
Each link opens that entry in the canon implementation explorer, where its schema, mint route, open verify route, auth requirement and implementation state are stated. The state shown here is read from the same registry file the explorer renders from, so the two cannot drift apart. Nothing here implies a customer, a deployment or an endorsement.