Envelopes

The envelope is the framework's per-compute receipt — on the same footing as the kernel and the clock. It is how computation becomes a record you can move. Credits are the fuel that goes in; the envelope is the signed thing that comes out. Every charged compute mints exactly one envelope: an atomic, signed, indivisible record of a real piece of work.

An envelope is not a ZEQ coin, and a compute does not mint ZEQ. Those are two different objects with two different units — see the overview for the map, and issuance for where ZEQ actually comes from.

Keep two words apart, and the rest of the economy follows:

Credit — the fuel

What a call costs to run, metered before it executes. You spend credits to compute. See credits & metering.

Envelope — the receipt

What the work mints: one signed, movable, indivisible record per compute, its face equal to what the compute cost. One compute, one envelope.

The face is the charge

An envelope isn't priced by a quote, and it isn't priced by a formula either. Its face value is the number of credits the compute was charged. Not a function of that number — the same number. Burn n, mint face n:

export function envelopeFaceCredits(chargedCredits: number): number {
  return Math.max(0, Math.floor(chargedCredits));
}

shared/api-core/src/lib/economyConfig.ts. One price, both ways. So a 2-operator chain charged 4 credits mints an envelope of face 4, and a 10-operator cross-domain chain charged 13 mints a face of 13. Nothing else enters.

There is no quality multiplier — and why it was removed

An earlier version of this page documented

V = \operatorname{round}\big(\text{cost} \times (1 + \text{quality})\big) \in [\text{cost},\ 2\,\text{cost}]

That is gone. It was 100% inflation per turn inside an earn-and-spend loop, with nobody cheating:

contribute a cost-8 job at good precision  ->  earn 16
spend 16                                   ->  receive two cost-8 jobs
contribute both                            ->  earn 32

Supply doubles every cycle, forever. As a quality incentive in an open system the multiplier is harmless; inside a loop it is a money printer, so it was retired.

Precision was not lost — it stopped being a multiplier. The measured precisionActual still travels on the envelope, and it is still what the mint gate refuses on when it exceeds ENVELOPE_PRECISION_BOUND = 0.001. A bad computation mints nothing. A good one mints exactly its cost. Quality decides whether you get an envelope, not how much money exists.

You can see the 1:1 in the aggregate: GET /api/tally/transparency on zeq.me reports envelopes_minted: 68853 against envelope_value_total: 274459 — a mean face of 3.99 credits, which is what a small operator chain costs. There is no 2× anywhere in the totals.

Compute does not mint ZEQ

Worth stating flatly, because the two used to be conflated on this page. A charged compute mints an envelope, denominated in credits. ZEQ is minted by the clock — one per Zeqond, by a single issuer, running whether or not anybody computes anything.

The two meet at distribution, not at the mint: each ~1-hour settlement window the issuer carves 5% to the treasury and pays the remaining 95% pro-rata to machines by the sealed compute duration they supplied. Contributing compute earns you a share of an already-issued ZEQ. It never creates one. The full arithmetic is on issuance.

Who owns it — the funding decides

The envelope is atomic: it is the whole receipt, never split. Split or merge it and the chain answers 409 not_divisible — divisibility belongs to the ZEQ coin, not here. Where it lands depends only on how the compute was funded.

Paid compute → you

The whole movable envelope mints to you. It's yours to keep, transfer, carry, or redeem.

Free compute → the Foundation

The whole envelope mints to the Foundation — the domain's commons. A try-budget compute (no hours on the account) buys results, not transferable value; a compute paid from your hours — the free hour included — mints to you.

Either way, the computing machine is stamped as the minter — and that stamp, together with the machine's Ed25519 signature and the seal on its audit chain, is the light proof: soulbound provenance of who did the work. The coin can move; the light proof never does. Hand an envelope to someone else and the record of who computed it still points, permanently, at your machine.

What an envelope carries

Every envelope is one immutable row on the machine's tally:

A deterministic id

An id and hash over the machine, the Zeqond, the result digest, and the operator chain — so identical work always names the same envelope.

Value & funding

Its value V, and the funding behind it — free-funded or paid-funded — so ownership is always reconcilable.

Minter & owner

The soulbound minter (who computed it) and the current owner (who holds it) — the same until the envelope is transferred.

Home origin

The chain that issued it, its sole serializer for life — the only chain permitted to reassign it.

Spend sequence

A strictly monotonic per-envelope counter, bumped under the same row lock as every ownership change, so the serializer's ordering is auditable.

An Ed25519 signature

Signed by the node key, with the compute's ZeqProof as its proof value — verifiable by anyone, offline.

What you can do with one

Prove

A portable, re-verifiable receipt that a specific compute happened, to a specific precision, at a specific Zeqond.

Transfer

Whole-envelope ownership moves with a single call — private by default, idempotent, audited on both chains. Only the home origin may reassign it.

Carry

Export it to a portable, PIN-locked bearer envelope that verifies itself offline and settles single-spend at home.

Burn back into compute

POST /api/tally/envelopes/burn converts envelopes to compute fuel (hours, users.fuel_plancks) at 1:1 par (BURN_RATE_BPS = 10000). A one-way valve: compute funded by burn-credits mints no new envelope, so value never loops back in. Batch of 1–100, all-or-nothing.