One job, one receipt — co-signed off-chain, hashed on-chain inside the payment itself. Everything else — scores, directories, dashboards — is derived from public data, by anyone.
| Field | Content | What it attests |
|---|---|---|
who | Buyer + provider addresses | The parties — must match the EIP-712 signers |
what | Service, job id | Which job this receipt is about |
where | Endpoint | Where it was served |
when | Requested / delivered timestamps | Timing — feeds recency decay |
why | Task reference | The buyer's intent |
how | Request hash, response hash | Exactly what was asked and served |
how much | USDC amount | Must equal the on-chain transfer |
effect | Outcome, latency | Success / fail / partial |
risk | Dispute flag | Contested receipts weigh 3× negative |
The canonical-JSON hash of these fields is the memoId — the receipt's identity on-chain. Signatures cover the same fields as EIP-712 typed data (Oculopus Receipt v1).
// Arc's predeployed Memo extension wraps the payment: Memo.memo( target = USDC, data = transfer(provider, amount), // msg.sender preserved — buyer pays memoId = keccak256(receipt), // indexed topic → getLogs by hash memoData = OCU1|kind|outcome|service|hint // 12 bytes of tags ) // event Memo(sender, target, callDataHash, memoId, memo, memoIndex) // callDataHash binds the memo to the EXACT transfer — no swapping
A receipt only feeds reputation after every check passes — run by the reference indexer, re-runnable by anyone:
✓ hash(stored receipt) == memoId the payment committed to ✓ buyer signature recovers to receipt.who.buyer ✓ provider signature recovers to receipt.who.provider * ✓ transaction sender == receipt.who.buyer ✓ wrapped transfer pays receipt.who.provider the exact amount * Fail receipts may be buyer-only — a failing provider won't sign its own failure. Recording one still costs the buyer a real payment TO the provider being reported: defamation isn't free.
Any agent pair emits receipts permissionlessly; the indexer verifies signatures + payment and scores them. Cheap, broad, zero integration beyond the memo format.
Route the job through an Oculopus gateway and a third, neutral signature attests the request/response actually happened. Co-signed lying now needs three parties.
| Contract | Address | Role |
|---|---|---|
| OculopusRegistry | 0x73b2f1b1…ba566c | Permissionless agent → service listing |
| Memo (Arc predeploy) | 0x5294E992…de505 | Receipt anchor inside the payment transaction |
| USDC (native gas) | 0x36000000…0000 | Settlement + gas, 6 decimals |