MIZAN · architecture

One call before the payment. Nothing to trust after it.

A check reads a counted record and returns one signed answer. The answer travels with the payment and is verified offline by whoever settles it. Underneath sits a public ledger and proofs anyone can re-run.

How a MIZAN check fits into a paymentA paying agent asks MIZAN to check the party it will pay. MIZAN reads the public ledger and the proofs, and returns a signed answer. The answer rides with the payment, and the payee verifies it offline before settling.Paying agentasks before it pays,under its own ruleMIZAN checkGET /api/check/{payee}reads the record,applies the ruleSigned answerALLOW or REFUSErule hash · ledger stateexpiry · Ed25519Payee or facilitatorverifies offline withthe published key;settles only on ALLOW1 ask2 sign3 carryx402 · AP2 · ACP · headerPublic ledgerappend-only Merkle log (RFC 6962)every try counted before its outcomesigned head, stamped hourly by twooutside timestamp authoritiesProofsthe result proven with itscount inside; the methodstays private; verify anywherewith the offline verifierreads the counted recordreads the proof
How a MIZAN check fits into a paymentA paying agent asks MIZAN to check the party it will pay. MIZAN reads the public ledger and the proofs, and returns a signed answer. The answer rides with the payment, and the payee verifies it offline before settling.Paying agentasks before it pays,under its own ruleMIZAN checkGET /api/check/{payee}reads the record, applies the ruleSigned answerALLOW or REFUSE · rule hashledger state · expiry · Ed25519rides in x402 · AP2 · ACP · headerPayee or facilitatorverifies offline with the publishedkey; settles only on ALLOW1 ask2 sign3 carryPublic ledgerevery try counted before its outcomesigned head, stamped hourly bytwo outside timestamp authoritiesProofsthe result proven with its countinside; the method stays private;verify with the offline verifierthe check reads both, below

The path of one payment.

  • 1 · AskThe paying agent calls the check for the party it is about to pay, under its own rule. One HTTP call, or the same call over MCP or A2A.
  • 2 · ReadMIZAN reads that party’s counted record on the public ledger and the proof behind it, and applies the rule exactly.
  • 3 · SignOne answer, ALLOW or REFUSE, signed with Ed25519. It names the rule hash, the ledger state it read and when it expires. A refusal says what would change it.
  • 4 · CarryThe token rides with the payment in the protocol already in use: x402, AP2, ACP or an HTTP header.
  • 5 · Verify offlineThe payee or facilitator checks the signature, the key, the expiry, the payee and the rule. No call to MIZAN.
  • 6 · Settle or holdOnly an unexpired ALLOW, bound to this payee and this rule, settles. Everything else holds.

The record underneath.

The ledger

Append-only, signed, stamped.

A Merkle log in the RFC 6962 shape. Every try is an entry before its outcome exists. The head is signed and stamped every hour by two outside timestamp authorities, and consistency proofs show it only ever grew. Watch it live →

The proofs

The count inside the result.

A result is proven inside a zero-knowledge proof with its count bound in. Anyone re-runs it with the published verifier for macOS, Linux or Windows. The method never leaves its owner. Verify one →

The keys

One signing key, pinned once.

Published at a well-known address, with its successor pre-committed so it cannot be swapped silently. Keys and signing →

Go deeper: the verdict spec · carriage for every rail · try a check

Prove the claim. Never reveal the method.