Tersign Evidence

Run deterministic triage on an open dispute and record the result. Triage applies fixed rules, stated here, to the dispute record: R1 (duplicate_charge) looks up the receipts the ledger counter-signed for the same seller, payer and settlement transaction hash, reading the hash only in 0x-prefixed 64-hex-digit form and the payer only in 0x-prefixed 40-hex-digit form (either letter case), and lists at most 16 of those receipts, the earliest ones and the disputed one (on a settlement of more than 16 the rationale says "more than 16 receipts" and which are listed, and adjudicationInputs carries sameSettlementTruncated: true), and classifies the disputed receipt refund when an earlier one shares that hash and uphold otherwise; R2 (not_delivered, wrong_content) classifies the claim refund when the seller filed no evidence before the evidence deadline; anything else, including a duplicate_charge receipt without a settlement transaction hash or a payer in those forms, is marked escalated with no result, for an external venue the parties choose. R1 reads receipts from one seller to one payer that share one settlement transaction as one payment. The rules never read the content, kind or note of any evidence, or the claimant's statement; no discretion and no model are involved, and the same inputs always produce the same result and rationale. The result is a triage classification recorded as data: it is not an adjudication, award or legal conclusion, it decides no legal claim, and it binds no one unless the parties separately agree. Side effects: writes the result to the dispute record, signed by the ledger; a refund result also logs a PENDING refund entry against the receipt for the claimed amount (not counter-signed into the chain; no payment is checked and no money moves). Runs once: the first successful call closes the dispute to evidence, and every later call returns 409. This tool sends no API key, so a not_delivered or wrong_content dispute can be triaged only after it…

Fetch a dispute in full: its status, claim and evidence deadline, both sides' signed evidence references, and, once triage has run, the triage result (verdict: refund, uphold, or null when escalated), its rationale, the inputs the rules ran on, and the ledger signature over the result. Read-only — one network read, no key required, and safe to poll while a dispute is open.

Issue an x402 offer-receipt (EIP-712) plus a Tersign compliance record (returned as `compliance`; verify_compliance_record checks it) for a payment that has ALREADY settled; when a ledger is configured, the ledger counter-signs the receipt into your hash chain, while the compliance-fields record is not counter-signed and is bound to its receipt only by your own signature, which covers the receipt's digest. Use this for money that moved; use record_disclosure for a non-payment agent action. Recording only: it moves no money and executes no payment. Side effects: signs with your signing key (the one set in the Tersign plugin's settings in Claude Code, or the TERSIGN_* environment variables, else the one generated and kept locally on first run), and performs ONE network write to the ledger when a ledger URL, API key and seller id are set there too (without them it signs locally and returns an unchained artifact). Returns the signed receipt artifact, its keccak256 canonical digest, and — when chained — the ledger counter-signature and sequence number.

Open an objective dispute against a counter-signed receipt as the PAYER (the configured key must be the receipt payer). Reasons: not_delivered, wrong_content, duplicate_charge. Recording only: the ledger records your signed claim and opens an evidence window; it moves no money. The ledger opens a dispute only with room reserved in its dispute capacity for the claim, its triage and each party's first evidence item, the same on every plan; while that capacity is full it opens none (HTTP 503). adjudicate_dispute later runs deterministic triage on it, which classifies a duplicate_charge from the ledger's own receipts only when the disputed receipt carries a settlement transaction hash in 0x-prefixed 64-hex-digit form (either letter case), and escalates it otherwise; classifies an unanswered claim from the seller's silence; and marks anything else escalated, for an external venue the parties choose. Triage's duplicate_charge rule, R1, reads receipts from one seller to one payer that share one settlement transaction as one payment.

One-call disclosure evidence (EU AI Act Art 50 dialect): digests the disclosure text LOCALLY, signs an action record with your key, and the public ledger counter-signs it into your per-signer hash chain. It moves no money. No API key needed — the first call self-provisions a free signer-keyed account, except when your key is already registered to an API-key account (409) or the daily provisioning caps are reached (429; https://tersign.ai/pricing).

Log a refund against a receipt already on your chain, as the SELLER. The ledger stores it as a PENDING refund entry that references the original receipt digest; the entry is NOT counter-signed or appended to the hash chain, and it has no digest or sequence number of its own. Nothing is edited or deleted: the original receipt and its chain position stay exactly as they were. Requires a ledger URL, API key and seller id (the Tersign plugin's settings in Claude Code, or the TERSIGN_* environment variables) and performs one network write; errors if the original digest is not on your chain. This RECORDS a refund you have already made: it moves no money and executes no payment or refund. For a signed refund RECORD, build a compliance record with refundOf set to the original record digest (buildMinimalRecord in the SDK). Returns { id, status: "pending" }.

Submit signed evidence to an open dispute before its evidence deadline. Claimant evidence must be signed by the payer key; respondent evidence additionally requires the seller API key (the Tersign plugin's settings in Claude Code, or the TERSIGN_* environment variables). Each artifact is sent as its digest and kind, plus its time and note when given; its content never leaves your side. Triage (adjudicate_dispute) uses only whether each side filed, never the content, kind or note of what was filed; the evidence stays on the record for the parties and any external venue. It moves no money. Each party's first item on a dispute always fits the room reserved for it when the dispute opened; a later item is refused (HTTP 503) while the ledger's dispute capacity is full.

Verify ONE record type: the compliance record that issue_receipt returns beside a receipt (`compliance`: a ComplianceRecordV1 `record` plus its ComplianceAttestation `attestation`, EIP-712 domain "compliance-fields"), fully OFFLINE (no network, no API key, no account): recompute the record's canonical digest, check that the attestation's signed payload names that exact digest and the same receiptDigest as the record, and recover the address that signed the attestation. It does NOT verify the disclosure record record_disclosure returns: that is a different record type (an action record, EIP-712 domain "tersign action-record"), and passed here it fails with a digest mismatch that says nothing about tampering. Use verify_receipt for the payment receipt itself. Without expectedSigner the signer is UNAUTHENTICATED and valid:true proves internal consistency only — anyone can edit a record, recompute its digest and re-sign the attestation with their own key, and still get valid:true with a different signer. Pass expectedSigner, obtained out-of-band, to bind authorship. Returns { verdict, valid, signer, signerStatus: BOUND | UNAUTHENTICATED | MISMATCH, signerBound, testKey? (a PUBLISHED test key — anyone can sign as it), digest (the recomputed record digest), reason? }. Read verdict first.

Verify an x402 offer-receipt artifact, fully OFFLINE (no network, no API key, no account; checks no ledger or chain): recover the address whose key produced its EIP-712 signature over the six signed payload fields (version, network, resourceUrl, payer, issuedAt, transaction), and compute its canonical digest (the content address a ledger records it under). Recovery yields SOME address for any payload, so without expectedSigner the signer is UNAUTHENTICATED: valid:true then proves neither who signed nor that the receipt is unmodified — an edited receipt recovers a different address and still returns valid:true. Pass expectedSigner, the issuer's address obtained out-of-band, to bind it: valid:true then means the signed fields were signed by that key; a mismatch returns valid:false with the recovered signer so you can see who actually signed. Use this for a receipt (money); use verify_compliance_record for the compliance record issue_receipt returns beside a receipt. Returns { verdict, valid, signer, signerStatus: BOUND | UNAUTHENTICATED | MISMATCH, signerBound, testKey? (the signer is a PUBLISHED test key — anyone can sign as it), digest, unsignedFields? (present in the artifact but not covered by the signature), reason? }. Read verdict first.