dev.cocore.compute.receipt

{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "generationParams": {
      "description": "Sampling parameters committed to in a receipt. Integer-only because the canonical signing form forbids floats — temperature and top_p are carried as milliunits (value × 1000, e.g. temperature 0.7 -> 700).",
      "properties": {
        "maxTokens": {
          "description": "Max output tokens requested for this job.",
          "minimum": 0,
          "type": "integer"
        },
        "seed": {
          "description": "RNG seed, when the provider ran with a fixed seed (enables reproducibility claims).",
          "type": "integer"
        },
        "temperatureMilli": {
          "description": "Sampling temperature × 1000 (e.g. 0.7 -> 700). Omitted when the provider used the model default.",
          "minimum": 0,
          "type": "integer"
        },
        "topPMilli": {
          "description": "Nucleus sampling top_p × 1000 (e.g. 0.95 -> 950). Omitted when the provider used the model default.",
          "maximum": 1000,
          "minimum": 0,
          "type": "integer"
        }
      },
      "type": "object"
    },
    "main": {
      "key": "tid",
      "record": {
        "properties": {
          "attestation": {
            "description": "Strong-ref to a dev.cocore.compute.attestation record published by this provider. completedAt MUST fall within [attestedAt, expiresAt] of that attestation.",
            "ref": "com.atproto.repo.strongRef",
            "type": "ref"
          },
          "completedAt": {
            "format": "datetime",
            "type": "string"
          },
          "enclaveSignature": {
            "description": "Secure Enclave P-256 signature (DER) over a sorted-key canonical JSON of every other field in this record. Verified against the publicKey of the strong-reffed attestation. This binding survives PDS migration: the repo-commit signature changes when keys rotate, but the enclaveSignature does not.",
            "maxLength": 256,
            "type": "bytes"
          },
          "inputCommitment": {
            "description": "MUST equal job.inputCommitment.",
            "maxLength": 64,
            "minLength": 64,
            "type": "string"
          },
          "job": {
            "description": "Strong-ref to the requester's dev.cocore.compute.job record.",
            "ref": "com.atproto.repo.strongRef",
            "type": "ref"
          },
          "model": {
            "maxLength": 256,
            "type": "string"
          },
          "outputCipherCommitment": {
            "description": "Optional SHA-256 hex over the EXACT encrypted bytes delivered to the requester (the sealed reply). Lets a requester confirm the ciphertext they received is the one the provider's enclaveSignature commits to — defends against an intermediary swapping the delivered bytes. Covered by enclaveSignature like every other field.",
            "maxLength": 64,
            "minLength": 64,
            "type": "string"
          },
          "outputCipherURL": {
            "description": "Optional URL where the encrypted output lives.",
            "format": "uri",
            "type": "string"
          },
          "outputCommitment": {
            "description": "SHA-256 hex over the plaintext output bytes — the decrypted result the requester receives. (The earlier 'encrypted output' wording was a doc error; the provider has always committed to the plaintext, which is what a requester can verify after decrypting. Use outputCipherCommitment to commit to the encrypted bytes on the wire.)",
            "maxLength": 64,
            "minLength": 64,
            "type": "string"
          },
          "params": {
            "description": "Optional record of the sampling parameters the provider committed to for this job. Integer-only (canonical JSON forbids floats): temperature/top_p are carried as integer milliunits. Covered by enclaveSignature, so a requester can prove the provider claimed these settings.",
            "ref": "#generationParams",
            "type": "ref"
          },
          "price": {
            "description": "MUST be <= job.priceCeiling. Currency MUST match job.priceCeiling.currency.",
            "ref": "dev.cocore.compute.defs#money",
            "type": "ref"
          },
          "requester": {
            "description": "DID of the requester. Denormalized from the job record for indexer convenience; MUST equal the DID owning the job record.",
            "format": "did",
            "type": "string"
          },
          "startedAt": {
            "format": "datetime",
            "type": "string"
          },
          "tokens": {
            "ref": "dev.cocore.compute.defs#tokenCounts",
            "type": "ref"
          }
        },
        "required": [
          "job",
          "requester",
          "model",
          "inputCommitment",
          "outputCommitment",
          "tokens",
          "startedAt",
          "completedAt",
          "price",
          "attestation",
          "enclaveSignature"
        ],
        "type": "object"
      },
      "type": "record"
    }
  },
  "description": "A signed receipt of a single completed compute job. Published by the provider in its own repo. Strong-refs the requester's job and the active attestation. Carries an additional Secure-Enclave-bound signature so it remains verifiable across PDS migrations.",
  "id": "dev.cocore.compute.receipt",
  "lexicon": 1
}