Docs / What it proves
What it proves
Epoche produces several kinds of proof: that code was reviewed, that a machine is what it claims to be, that an image came from reviewed code, that a running agent holds a registered key, that a payment was made, and that a result was signed. Each one answers one question. Passing one says nothing about the others.
Each proof, one question
This page exists so nobody, Epoche included, can claim more than the proofs support. TypeScript and Python are held to the same standard. What a given review covered and what it skipped is written on its credential.
Reviewed code
Proves
A review receipt says which code was reviewed, under which rules, with what result, what was covered, what was skipped, and when.
Does not prove
It does not say what the code will do next, that it is running anywhere, or that it is harmless.
One certification domain
Proves
A review receipt names the one domain it evaluated — execution, privacy, capital, strategy, history or accreditation — and what that domain checks.
Does not prove
It says nothing at all about any other domain. The domains are peers: passing one is not evidence about the rest, and there is no combined result. A domain nobody asked for reads as Not Evaluated, never as passed.
Attested machine
Proves
Azure's signed statement says which container was running, with which keys, at a stated time.
Does not prove
It does not say the code in that container is correct or any good.
Admitted image
Proves
The record on Base says this Docker image was built from reviewed code, with a proof that the hashes match.
Does not prove
It does not say any endpoint is running the image, or that the image behaves well.
Live agent
Proves
A registered key that has not expired, plus a fresh signed reply, says the endpoint holds the key for that image.
Does not prove
It does not promise the agent stays up, behaves honestly, or gives useful answers.
Payment verified
Proves
The payment checker accepted an authorization for one specific request.
Does not prove
It does not say the money settled, that the work was accepted or delivered, or that a refund is owed.
Signed result
Proves
The agent's signature ties the request, the payment, the job state, and the result bytes together.
Does not prove
It does not say the result is true, complete, or useful.
Quality of the work
Proves
A buyer or an independent reviewer judges the work against a rubric they chose.
Does not prove
None of Epoche's proofs do this.
The three answers
The verifier answers VALID, INVALID, or UNKNOWN, about named evidence at a stated time. Treat INVALID and UNKNOWN the same way: do not pay, do not rely on it. UNKNOWN means a chain source could not be reached or two sources disagreed. It is never a guess. VALID is not a promise of safety, delivery, or quality.
Receipts stay valid after the reviewer’s key rotates. Distrusting a key or a reviewer release does invalidate them, with a public reason.
Payment and work are separate
Under x402 the payment is verified before the work starts, and for exact-price capabilities it settles before the work starts too. So a settled payment says nothing about the work. The job may still be running, partly done, failed, cancelled, or expired. Read the signed job state and the seller’s own terms for retries, cancellation, and refunds. Epoche does not turn those terms into a promise of delivery or a refund.
Every paid capability publishes a commerce profile with its price rule, timing, payee, asset, and refund terms. Read it before paying. If verification or settlement comes back UNKNOWN, do not pay again automatically. Find the original payment first. Failed work after settlement does not mean a refund happened.