Receipt

Verified

✓ checkpoint
○ checkpoint history
○ anchored · resolver-asserted

$1.5136

SELF-DEBITS ONLY

Window: Oct 5 · 23:42–23:43 UTC1 min 4 s · closes after 1 min idle
Covers: 14 governed calls
Models: claude-haiku-4-5 · claude-opus-5-5
Provider: anthropic

Details

Claim

charged to this agent key between 2026-10-05T23:42:34.784Z and 2026-10-05T23:43:39.168Z — $1.5136

SELF-DEBITS ONLY

window — LEDGER TIME2026-10-05T23:42:34.784Z → 2026-10-05T23:43:39.168Z1791243754784362770 → 1791243819168970499 nsthe ledger's own timestamps bounding this window, to the millisecond (integer division). They define the window; windowStart also feeds this receipt's ID.idle threshold 1 min · 60000000000 ns

SPEC ut1 · SCOPE cluster

Proven

✓Signeded25519 · mint-2026-09-14
✓Chained#84,711 · e950c058a933…
✓Checkpointedtree 38 · seg-84675-7c237d11b9a348289fbfeaf764290a16
○Historyunavailable
earned by: a COMPLETE segment-checkpoint history is served and walks clean — registered genesis → head, one checkpoint per segment, signed lineage — and contains this receipt's own checkpoint.
○Anchoredpending
earned by: Rekor anchor evidence validates offline against a pinned log key, on top of the complete verified history (the ladder is cumulative).
the anchor binding at this rung is ASSERTED BY THE RESOLVER and, today, independently checkable by no one: no normative binding is defined between a transparency-log entry and this checkpoint's signed payload, so no consumer — this page, the offline CLI, or a third party — can confirm the binding for itself. What is missing is the binding, not merely published evidence. Until that rule exists, this rung reports the resolver's claim and is not verified anchoring.

this level does NOT prove whole-chain linear consistency, anchor-sequence continuity, or external immutability — a checkpoint signer could sign a fork.

Invoice

postures are ATTESTED ENUMS, not verifier-established facts: the verifier checks enum validity and internal agreement — it CANNOT confirm them, because both are defined over per-constituent facts the projection deliberately does not carry.

Charged to this agent key · delegated work bills to the delegate

amount scopeSELF-DEBITS ONLY

this amount is DIRECT, self-account spend: it is built ONLY from debits charged to the receipt subject. Delegated spend is OUT OF SCOPE — work this subject caused a delegate to perform was charged to that delegate and is not counted in the figure above.

usage posturePROVIDER-METERED

EVERY constituent was priced from provider-reported usage — never understates the ledger-POSTed charges to this agent key in this window.

pricing postureEXACT

every leg was priced from the published table at its committed version.

transfer-set root — the recomputable digest of the pair list — recomputed by verification step 8 (the check ledger's DERIVATIONS row), from the pairs this receipt lists.

window-transfers root — 28 ledger transfers0441634de0f4…commits every ledger transfer of this agent key's account inside the window — charges, voided holds and credits alike — in ledger order. It is a COMMITMENT: checkable by someone with ledger access, never recomputed from this receipt, so this page never marks it passed.

mintedAt — MINTER-ASSERTED2026-10-06T00:13:17.675Zthe only minter-asserted clock claim.

startedAt / endedAt — CHAIN-COMMITTED2026-10-05T23:42:36.258Z → 2026-10-05T23:43:39.222Zchain timestamps of the first and last settlement in this window — clock CLAIMS on the audit chain's clock, not the ledger's. They are not the window, and no order between the two clocks is checked.

Transfers14

Pricingexact · 2026-10-05

Total15,136 ut

this receipt is the operator's SIGNED claim that it covers every charge to this agent key in the window. Without ledger access no one — this page included — can check that nothing is missing; what the signature buys is that the claim cannot later be changed or denied.

Download the signed receipt (its exact bytes)

usertrust-verify does not read cluster receipts yet, so there is no offline command to run for this one: the check ledger below is the resolver's verification, and these bytes are exactly what an offline verifier will check.

check ledger

the verdict is a function of these results, and this page shows the function's inputs — not just its output.

every verification step and named online check, with its four-valued result
check	result	meaning
check: SCHEMA	result: PASSED	meaning: strict schema + canonicalization validation of the signed receipt bytes.
check: EVENT	result: PASSED	meaning: the mint event's hash recomputes, and §4's nine equalities hold.
check: REGISTRY (LOCATOR)	result: PASSED	meaning: step 3: the signed document's receiptId equals the ID it ARRIVED under — this URL — and RECOMPUTES from the chain, the account handle and the window start. A cluster receipt's ID is derived from what it signs, never issued in advance.
check: SIGNATURE	result: PASSED	meaning: the mint signature verifies under a key with role mint, in a permitting state, bound to this minter kind.
check: INCLUSION	result: PASSED	meaning: the Merkle inclusion path reconstructs the checkpoint's signed root.
check: CHECKPOINT	result: PASSED	meaning: the checkpoint is v2 and its signature verifies under a checkpoint-role key inside this chain's pinned rotation lineage.
check: SEMANTICS	result: PASSED	meaning: the cluster rules (account handle, window bounds, idle threshold, skipped-window list), §2's presence/exclusion rules, the spend bounds, and POSTURE ENUM VALIDITY — postures are ATTESTED ENUMS, not verifier-established facts: the verifier checks enum validity and internal agreement — it CANNOT confirm them, because both are defined over per-constituent facts the projection deliberately does not carry.
check: DERIVATIONS	result: PASSED	meaning: transferSetRoot recomputed over the ≤ 32-pair transferSet, and windowsRoot over a complete (≤ 16) skipped-window list. Nothing to recompute → notApplicable, and each root stays a commitment; windowTransfersRoot is always one. amountUsd is never stored and never compared.
check: EXTENSIONS	result: N/A	meaning: the step-9 summary. UPGRADE-ONLY: it can raise the rung and can never demote the base verdict.neither a pass nor a failure; it NARROWS the verdict and MUST be reported.
check: REGISTRY BINDING	result: PASSED	meaning: step 3(b), ONLINE: the registry's binding for this receiptId resolves to THIS receipt's event.hash. Failed only on a positive contradiction — a binding to a different event.
check: PREDECESSOR LINKAGE	result: N/A	meaning: previousReceiptId names this agent key's previous minted receipt: exactly one, closed at least one idle threshold before this window began, with no receipt of the key in between. notApplicable when none is named and the key has no earlier receipt.neither a pass nor a failure; it NARROWS the verdict and MUST be reported.
check: CHECKPOINT HISTORY	result: UNAVAILABLE	meaning: extension: the served segment-checkpoint history walks clean and contains this receipt's checkpoint. Earns the history rung; can never demote the base verdict.the input exists but could not be obtained right now. The verdict is the OFFLINE verdict, with this check's status reported beside it — unreachability never degrades a receipt that verifies offline.
check: ANCHOR EVIDENCE	result: N/A	meaning: extension: Rekor evidence validates against the AUDITOR'S pinned log key. When this check passes, the resolver asserts the anchored rung from it; no normative binding is defined, so a pass is not independently verified anchoring. Upgrade-only: can never demote the base verdict. S3 Object Lock probes are not this check's input.neither a pass nor a failure; it NARROWS the verdict and MUST be reported.

verified under trust snapshot usertools-proxy@sha256:da6f3af16067fa722e06f9d1a396c3c2f8cfcd6a898a19902e56440b06e4ce8d

verify against your artifact

charged to this agent key between 2026-10-05T23:42:34.784Z and 2026-10-05T23:43:39.168Z — $1.5136

SELF-DEBITS ONLY

this page never renders "this artifact is verified"; it renders WHAT this receipt attests and leaves the reader to compare.

NO ARTIFACT TO COMPARE: a cluster receipt attests one agent key's charges over one ledger window, and nothing about any commit, PR, or issue that happens to cite it.
PROMOTION: consumers MUST NOT treat it as artifact attestation, and a promotion gate MUST NOT accept it (the gate requires kind === "commit").
COMPLETENESS: this receipt is the operator's SIGNED claim that it covers every charge to this agent key in the window. Without ledger access no one — this page included — can check that nothing is missing; what the signature buys is that the claim cannot later be changed or denied.