Skip to main content

Metering and Attribution

Every line behind an account of activity has a hash-chained record behind it. Metering in System9 is not a billing black box. It is an attributed, tamper- evident ledger, and at the edge each device signs its own usage so a cell can tell when a device under-reports.

Attributed consumption​

Usage metering answers "what did it actually consume, attributable to whom?" Records roll up along the full topology and organizational hierarchy, cell, node, org, region, zone, workspace, clean room, cost centre, agent, entity, service, operation type, rate card, so consumption can be attributed per workspace, per agent, and per cell.

Two rules are load-bearing:

  • Charged units are not currency. A charged compute unit is distinct from a currency cost-of-goods figure; the two are never summed.
  • The edge is observed, not billed. Edge and local operations are recorded with zero charged units by decision. They are metered for visibility and governance, not billed as core consumption.

Infrastructure count itself is not a meter: cells, nodes, and service groups do not cost anything, so splitting an estate across many cells for residency or resilience costs nothing, only the work does.

Hash-chained and gap-aware​

Metering records are hash-chained per cell with a per-record HMAC and a signed chain head, plus periodic checkpoints. The head is verifiable off-cell by a party holding only the public key. Rollback and replay are defended directly: each reported bundle carries its signed head (position and last hash), and a receiver refuses a chain that moved backward or that reports the same position with a different hash, the comparison is atomic with the write. A detected chain gap feeds the enforcement ladder rather than being ignored. Cross-cell reporting runs through a designated proxy node, and peer bundles are authenticated twice, a per-peer HMAC and an Ed25519 signature from the node's converged identity key.

Device-signed metering at the edge​

At the Edge Agent, each inference appends a device-signed, hash-chained usage record to a cross-process spool. Each record links to the previous by hash and is signed with the enrolled device key, so any post-signing edit is detectable by re-hashing and by walking the chain. The spool is drained on heartbeat, fail-closed: a spool that does not chain-verify cannot be shipped as billing, nothing is dropped, and records stay spooled for retry until the cell acknowledges them.

The cell runs the verify half: because the device produces its own usage numbers, the interesting failure is a device that reports less than it did. The cell re-derives each record's canonical hash byte-for-byte, checks the device signature, and checks chain continuity, anti-evasion that lets a cell detect a device under-reporting its own usage. Producer and verifier live on different runtimes, so their byte-identical canonicalization is pinned as a two-runtime parity contract.

Offline estates emit signed metering bundles that are verified on import rather than trusted because they arrived.

Double-entry settlement (the exchange)​

Separately from consumption metering, the Data Exchange keeps a signed, hash-chained double-entry ledger. On every metered read it books a buyer debit against a seller credit, a credit to the seller of the revenue share, a debit to the buyer of the gross, with the difference retained, so the ledger can never go one-sided, and a tampered value on either side breaks both gates. Accrual is idempotent on the event id, so a replay does not double-count.