> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mecone.trade/llms.txt
> Use this file to discover all available pages before exploring further.
# Signed Official Rounds
> Immutable, chain-independent settlement records, verifiable offline
Every five minutes, Mecone turns each of its eight official indices into a
**cryptographically signed official round**: an immutable, chain-independent
record you can verify offline with nothing but one pinned public value. This is
the transport-neutral layer underneath every delivery rail — the API below,
venue-native adapters, and on-chain feeds all carry the *same* signed round;
none of them can create or alter one.
**Two environments, one root of trust.** `production` is the settle-grade
chain; `staging` is for evaluation — do not settle real value against staging
rounds. Both verify against the **same** pinned root anchor below; the
environments are cryptographically separated by the signing domain.
| Environment | Base URL | Online keyset |
| ------------ | ----------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- |
| `production` | `https://oracle.mecone.trade` — fresh rounds token-gated; 24h-delayed rounds and verification plumbing open | `0xc9d9e532…acf7` |
| `staging` | `https://staging.oracle.mecone.trade` — token-gated (token provided during integration) | its own staging-ceremony keyset, served at `/v1/keysets/online` |
The `staging` environment runs the same pipeline for pre-release feeds and
partner onboarding (new indices graduate there first, production after
review — mirroring the exchange's live/soon split). Every staging endpoint
except `/v1/health` requires the access token.
## Access tiers (production)
| Tier | What it serves | Credential |
| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
| **Verification plumbing** — always open | `/v1/anchor`, `/v1/keysets/*`, `/v1/registry`, `/v1/kit/*`, health and liveness | none |
| **Delayed rounds** — open | `GET /v1/feeds/{SYMBOL}/rounds/delayed`: the latest round at least 24 hours old. For evaluation, backtesting, and integration development | none |
| **Fresh rounds** — licensed | `GET /v1/feeds/{SYMBOL}/rounds/latest`: the current settle-grade round | partner token (`mst_…`) as `Authorization: Bearer`, issued during onboarding |
A fresh-rounds read without a token (or with a revoked one) answers `401`.
A token may additionally be **scoped to specific feeds** at mint time (the
per-feed trial shape): a scoped token reading a fresh round outside its list
answers `403 feed not licensed`. The scope gates freshness only — the delayed
tier stays open to every token. Every token read is metered per token per
day; partners see their usage in the partner agreement reporting.
Verification never requires a token — the anchor, keysets, registry and
verifier kit stay open so a served round can always be checked without
trusting the service.
## The trust model — pin one address
The only thing you must obtain out-of-band is the **root anchor address**:
```
0x954686af5A7Cd1A872E8f25A41B934209A463907 (root anchor — production AND staging)
```
Everything else is served by the API and proven against that anchor: the root
key attests the online keyset, the keyset authorizes the round signer, and the
round id **is** the EIP-712 digest of the signed body (domain =
name + version + salt, deliberately no `chainId` — the same round verifies
anywhere). Signatures are canonical low-s secp256k1, one per round.
## Verify a live round in one minute
```sh theme={null}
BASE=https://oracle.mecone.trade
# the self-contained verifier is served by the service itself
curl -sO $BASE/v1/kit/verify_mecone_round.py
pip install eth-keys eth-abi "eth-hash[pycryptodome]"
python verify_mecone_round.py $BASE MGDP --environment production \
--pin 0x954686af5A7Cd1A872E8f25A41B934209A463907
```
```
VERIFIED MGDP = 2.1526727551754…
round 0x04d7ab29…
signer 0x1e00D35F… (authorized by root-attested keyset 0xc9d9e532…)
anchor 0x954686af… [matches your pin]
```
The kit is \~250 lines with no Mecone dependency — read it, fork it, or
reimplement it from the served material; nothing about verification requires
trusting this service.
## Endpoints
| Path | Serves |
| --------------------------------------- | -------------------------------------------------------------------------------------------- |
| `GET /v1/health` | signer address, round + cycle counts |
| `GET /v1/liveness` | the operational SLI — per-feed round age vs cadence; `200` while producing, `503` when stale |
| `GET /v1/anchor` | the pinned root anchor (public root of trust) |
| `GET /v1/keysets/online` | the root-attested online keyset bundle |
| `GET /v1/keysets/correction` | the root-attested correction keyset bundle |
| `GET /v1/registry` | the official-feeds registry snapshot rounds bind to |
| `GET /v1/feeds/{SYMBOL}/rounds/latest` | latest signed round: body + signature + round id — **partner token required** |
| `GET /v1/feeds/{SYMBOL}/rounds/delayed` | latest round at least 24 h old — open, no credential |
| `GET /v1/kit/verify_mecone_round.py` | the self-contained verifier above |
Symbols: `MGDP` `MCPI` `MUNEMP` `MOAI` `MANTH` `MH100` `MH200` `MB200`.
`MKRKN` was withdrawn on 27 July 2026: no new rounds are produced, and the
public index API excludes it (`index-not-found` there). This service retains
its final signed round, frozen at the withdrawal moment, for audit.
## What a round commits to
The signed body binds, among 25 fields: the feed identity
(`keccak256("mecone:official-feed::v1")` — venue tickers are never
identities), the exact int256 value at 18 decimals in **natural units** (no
billions scaling on this rail), six timestamps (`effectiveAt`, `sourceCutoff`,
`sourceAsOf`, `computedAt`, `signedAt`, `validUntil` — staleness is
`validUntilNs`, nothing else), the methodology + registry + source-policy
hashes, the input-snapshot digest, the previous round digest (per-feed hash
chain), and the authorizing keyset id. Corrections never overwrite: a
correction is a new signed round that names what it supersedes.
## Integrating
Poll `rounds/latest` (a round is fresh until its `validUntilNs`), or mirror the
verification into your own stack from the served material. For a settlement
integration, contact us — production keys, SLAs, and the correction-policy
paperwork live in the partner agreement.