Built on
One sealed price. The contract pays that line, or it pays nothing.
Meter enforces the stored line. It does not judge the work.
The parties choose the time, and the contract enforces stored time ≤ block time < deadline. The hijack runs use a toy testnet token (public mint). The medbf5c run uses Circle testnet USDC.
Reading the testnet receipt
Reading the testnet receipt
How a meter runs
Five steps. The line does not change after the first.
Step 01 of 05Running
Open. The buyer writes the line.
Recipient, amount, terms hash, and deadline are stored. The ceiling and the floor never leave the browser.
- On the meter
- One recipient, 48.00, one hash, one deadline.
- Cannot happen
- A later method that edits those four fields.
Same rule, this browser
Try the refusal
The sealed line is 48.00 to sable.testnet. This clock pays only while 400 ≤ time < 1000. Tap Before the time. The answer comes from app/lib/rule.mjs. Nothing on this page is a transaction.
Why the line is sealed
A changed instruction is common. A matching call is the hole.
These numbers are not Meter outcomes. They explain why a fixed recipient, amount, sentence, and time belong in the contract—not in the last message someone trusted.
$3.05BBusiness email compromise losses reported to the FBI in 2025, across 24,768 complaints.IC3 2025 report
- 74%Organisations hit by business email compromise in 2025. 76% saw attempted or actual payments fraud.AFP survey, January 2026
- 0.00Moved when the recorded run named other.testnet. The sealed line still paid 48.00.ERR_RECIPIENT
Receipts
The older runs, each on its own.
The hijack record is the list of calls.
Reading the payment record.
Previous build · Payment record
Every line of the recorded run.
Reading the lines from the receipt.
Previous build · Stored time
The clock is not the work.
On this build, install_agent rejects a revoked meter. The hijack account clears the counter and installs a new key.
Reading the time gate.
Against a transfer
A transfer, and this run.
- other.testnet, 48.00A transferPays the account named thenThis run0.00 ERR_RECIPIENT. Which means the wrong account was paid nothing.
- 47.00 instead of 48.00A transferThe caller picks a new figureThis run0.00 ERR_AMOUNT. Which means 47.00 did not replace 48.00.
- The terms line changedA transferA memo does not hold the moneyThis run0.00 ERR_EVIDENCE. Which means the rewritten sentence was paid nothing.
- Same key after deleteA transferA live key can sign againThis runRejected before a transaction. Which means a deleted key cannot spend.
- After the deadlineA transferThe balance sitsThis run48.00 back to the buyer. Which means the lock ended.
Previous build. The Intel quote was not checked. A matching signature pays as soon as the meter is funded. Deleting the key loses if that payment lands first.
Reading the signed release.
Who it is for
Two companies. One stored line.
- The buyerMarlow Studio will not pay a different account. other.testnet moved 0.00.
- The vendorSable Field is paid 48.00, or nothing. 47.00 does not replace the line.
- The person with the keyThey can repeat the public line immediately. They cannot edit it.
On testnet
Proof
Payment recordReading the receipt.
Signed releaseReading the receipt.
Time gateReading the receipt.
node chain/verify.mjs re-reads the recorded contracts, including the hijack. No key. The figures above are those files.
Limits
What this is not
- This is just a dashboard.
- The 0.00 row is a testnet transaction. The hash is on the run above.
- The page decides the payment.
- A Clears mark has no hash and moves nothing. A Paid figure is a receipt step with a hash. Editing browser storage cannot create one.
- The key can pay anyone.
- It can call release only. 0.50 NEAR, for gas. Five refusals delete it. Once the stored time has arrived, a delete loses if the payment lands first.
- The time proves the work.
- The stored time is a clock, not the field report. A deposit at or after the deadline is rejected. m718aa2 still keeps a late deposit.
- The signature checks the work.
- The model repeated a line this repo wrote. The Intel quote was not checked. A matching signature pays as soon as the meter is funded.
- This is Circle USDC on mainnet.
- Not on mainnet. The hijack runs use a toy testnet token (public mint), token.mtrfc658fd1.testnet. The medbf5c run uses Circle testnet USDC. Mainnet waits on an audit. The contract has no owner withdraw.
- A server holds the key.
- No Meter server holds a signer. The function-call key was deleted. The name in the sidebar is a tab id. The agent can be hijacked. Meter's claim is that a hijack does not move money.
Research
What the reports say, and what this run recorded.
These figures are not Meter outcomes. The proof is the hash, not the survey.
Files
Sources
- app/public/chain.json · the recorded run
- app/public/tee.json · the signed release · the Intel quote was not checked
- app/public/v2.json · the time gate · the time is not the work
- Marlow and Sable, ceiling 60.00 and floor 48.00, are example copy. They are not the chain balance.
FAQ
Questions judges ask first.
No. A Clears mark has no hash and moves nothing. Only a receipt step with a hash on testnet is a paid figure.
It can call release only. The recipient, amount, sentence, and time were sealed when the meter opened.
The stored time is a clock, not proof of work. At or after the deadline the contract rejects the release or returns the balance.
Not on mainnet. The hijack runs use a toy testnet token (public mint). The medbf5c run uses Circle testnet USDC. Mainnet waits on an audit.
No Meter server holds a key. The function-call key on the recorded run was deleted.
Open the book for the hash, or run node chain/verify.mjs from the repo root with no key.
No. It enforces one sealed line on testnet. Industry stats on the homepage link to /docs/evidence; the proof is a transaction hash, not a survey.
Yes. The agent decides when to submit the call and what to submit. The contract decides whether money moves.
ERR_NOT_YET counts toward the five. preview is a view and does not count. An honest agent should call preview first, then release once the window is open.
The recorded clerk is told that the invoice is the instruction, at temperature 0, with tool choice required. That is the naive prompt in inject.json. A hardened prompt that pays the header is stored beside it when that run exists. Neither prompt can change the sealed line.
Five refusals delete the key. The tokens stay in the meter. The buyer installs a new key with 1 yoctoNEAR. The recipient, amount, sentence, and window do not change.