# How a Teppi grade is produced

Version 2026.09.2. What changed, and when, is at the end.

Every number here comes from a payment that settled and a response that was kept. Nothing on this
page has to be taken on anyone's word: the last section is how to recompute any of it yourself.

## What is measured, and what is not

Teppi pays for a capability at its listed price and records what came back. It does not ask
sellers anything, does not accept submitted results, and has no form through which a rating can
be entered.

Three tiers, and they are never mixed into one ranking:

| Tier | Evidence behind it | correctness | honesty |
|---|---|---|---|
| LIVENESS_VERIFIED | A free handshake. Nothing was bought. | null | null |
| DELIVERY_VERIFIED | Paid. The seller published no output schema, so only delivery can be checked. | null | measured |
| OUTCOME_VERIFIED | Paid, and the output was checked against what the seller published. | measured | measured |

On the free tier, correctness and honesty are the literal value null. They are never zero and
never imputed, because a handshake says an endpoint answered and nothing about what it answered
with. A composite computed over four components is not comparable to one computed over six, so
the tier appears beside every band, everywhere.

## One probe

A probe is one unpaid request followed by one paid request to the same endpoint.

1. The unpaid request. Teppi reads the 402 and the payment terms out of it.
2. The cheapest rail that can actually be paid is chosen, which is often not the one listed first.
3. A receipt is opened before any money moves, keyed on a hash of the payment payload.
4. The paid request goes out.
5. The full transcript is stored, content addressed, before anything is judged.
6. The chain is asked what the transaction moved. A seller naming a transaction need not name an
   amount, so the amount comes from the chain and not from the seller.
7. Only then is the response scored.

That order is the guarantee. If the verifier dies at step 7, what the seller sent still exists.

Probes are paid from wallets that are never published and never reused against the same seller
within 14 days. A wallet rests 90 minutes between any two probes, and probing pauses rather than
reuse a wallet once fewer than 5 are eligible. A seller that can recognise the prober can serve it
differently, and every grade taken after that would be worthless.

New capabilities are drawn for probing once a day for their first 30 days, and twice a week after
that. Times come from a Poisson process, so there is no timetable to serve differently.

A draw is not a probe. It becomes one only when a wallet is eligible under the rule above, and
sometimes none is, so the rate that settles runs below the rate that is drawn. Every scorecard
publishes the sample count behind it and the effective sample size behind each component, and
those are the numbers that say how much was actually checked.

## The six components

| Component | Weight | What it is |
|---|---|---|
| correctness | 0.35 | Did the output match what the seller said it would return |
| honesty | 0.25 | Was money taken for output that failed |
| schema_conformance | 0.15 | Did the response validate against the published schema |
| liveness | 0.15 | Did the endpoint answer at all |
| latency_p95 | 0.05 | The 95th percentile, against the median for its class |
| price_stability | 0.05 | Did the settled amount match the advertised one |

honesty is the one buyers most need warning about. It is 1 when the output passed, 1 when the
output failed and nothing was charged, and drops toward 0 as more of the advertised price was
taken for output that failed. Refusing a request costs a seller nothing here. Charging for a
refusal is what it measures.

## Why the published number is a lower bound

Thirty perfect samples should not outrank three hundred. Every component is published as the
lower end of a 95% confidence interval, never as the average.

Proportions use the Wilson interval. Latency and price stability are not proportions, one being a
quantile and the other a deviation, so those two use a bias-corrected bootstrap seeded from the
capability id and the window, which makes the figure reproducible rather than merely computed.
Each component carries its own method name, its point estimate, its lower bound and its effective
sample size.

Before any of that:

- Recent evidence counts for more, halving every 14 days.
- No single contributor may carry more than 10% of the weight behind a component. Anyone over
  that is scaled down.
- The top and bottom 5% are trimmed.
- A capability whose evidence is 25% or less diverse is flagged rather than quietly scored.

## Bands, and what UNRATED means

A composite of 0.90 or more is A, 0.80 is B, 0.65 is C, 0.45 is D, and anything below is F.

UNRATED is not a low grade. It means fewer than 30 samples, or a window shorter than 14 days, or
both. A capability with too little evidence is not scored, and it is never shown as F. Unknown
and bad are different facts and stay different everywhere.

Flags sit beside the band rather than replacing it, because a capability can be both genuinely
good and thinly evidenced at the same time.

## Reproducing any of it

Run the same probe yourself, from your own machine and your own wallet:

```
npx teppi-check <endpoint-url>
```

It needs nothing installed and sends the request the scheduled prober sends. A test runs both
against the same endpoint and fails if the bytes on the wire differ.

Every scorecard carries the settlement transaction, the hash of the request, the hash of the
response, the evidence hashes, the weights version, the bootstrap seed, and the id of the key it
was signed with. Fetch any of those hashes at `/v1/evidence/{hash}` and hash the bytes yourself:
the store is addressed by content, so the name is the proof. A hash from a probe that ran before
transcripts were kept answers 410 and says so, rather than answering as though it never existed. Fetch the key from `/.well-known/teppi-keys.json` and check the signature. The
canonicalisation is RFC 8785 and the algorithm is Ed25519, so a third party can reproduce the
signing input byte for byte.

If a scorecard names a key that document does not list, the signature cannot be checked and the
card should be treated as unverified.

## What Teppi does not do

- No seller can pay to change its grade, its rank, or whether it is routed to. A subscription
  buys coverage and never standing.
- No correctness or honesty number exists without a settled payment behind it. On a free
  handshake both are null, never zero and never inferred from anything.
- No grade of any tier comes from anyone telling us something. There is no review form and no
  endpoint that accepts a rating.
- No composite is published without its components, its tier and its sample count.
- Nothing is settled above the advertised price. The database refuses it.

## Corrections, and a seller's answer

The record only gains rows. A grade is never edited and never deleted, and a correction is a new
entry that says so.

A seller may answer any entry in the same format it was written, at
`POST /v1/counter-probe`, filing their own run and their own transcript. It is published beside
ours and labelled with whether they proved they hold the origin, which they do by publishing the
hash of their own evidence on it. It reaches no scoring path and moves no grade.

Teppi does not adjudicate between the two. A disagreement between two receipts belongs to whoever
is reading them.

## What changed on this page

A scorecard names the weights version and the verifier version it was produced under. This page
is a third thing that can change, so it carries its own version and says what moved.

### 2026.09.2

| Change | Reason |
|---|---|
| Says a draw becomes a probe only when a wallet is eligible, and that the settled rate is lower | The page said new capabilities are probed once a day, which described an intention as a fact. The rotation rule pauses rather than reuse a wallet, and measured against the record about two probes in five find none free |
| Points the reader at the sample count and effective sample size on the card | Those move with the real rate, so they stay true when a sentence about cadence would not |

### 2026.09.1

| Change | Reason |
|---|---|
| Says no *correctness or honesty* number exists without a settled payment, rather than no grade | As written it contradicted the free tier defined higher up the same page, which pays nothing and does publish a grade |
| Added this version and this section | A card cites this page by name. Without a version the page a reader fetches is today's, whatever their card was signed against |
| Cards signed before 2026-09-03 cite `teppi.xyz` | That host has never resolved. The page has always been served at `api.teppi.xyz`, which is what the manifest and the discovery files point at, and what cards signed after that date carry |

### 2026.08.1

| Change | Reason |
|---|---|
| First published | |