SLA attestation and metering

Every paid service on Tenzro Network 1 is metered, and every provider is held to a service level it has attested. This page covers how a provider states its SLA, how the network checks it, how each kind of service is metered into a bill, and what happens when a provider falls short.

Metered, per-use settlement is the default

A buyer on Network 1 pays for what was delivered, in the unit it was delivered in. There is no flat subscription that bills whether or not the work happened.

Metering produces records signed by the provider's hardware-rooted key, so a bill can be traced to the machine that did the work. Those metered records also feed the compute price index.

Attesting an SLA

A provider states what it offers in a signed operator policy: availability, response deadlines, whether work runs inside an attested TEE, and the jurisdiction the hardware sits in. The policy is signed by the operator's key and published, so every buyer sees the same terms. See Operator policies.

Two rules follow from this:

• A provider is held to its own policy. The network checks delivery against the SLA the provider attested, not against a service level someone else chose for it.
• A provider is slashed only for a provable breach. A penalty needs evidence the chain can verify: a missed proof, a probe that went unanswered past its deadline, or a signed receipt that contradicts the policy.

Where an SLA requires confidential execution, the provider's TEE attestation is verified per vendor (Intel TDX, AMD SEV-SNP, AWS Nitro, NVIDIA confidential GPUs). Attestation is evidence that the work ran where the provider said; it is checked, not taken on trust. See TEE.

How the network checks an SLA

Availability probes

Validators probe AI and TEE providers for liveness. Each probe is addressed by a VRF output over the provider, the epoch and the round, so a provider cannot predict when it will be probed or answer in advance. The probe carries a deadline. A provider that answers in time has met that probe; one that does not has recorded a miss. Misses past the threshold slash the provider's bond.

Read the parameters a validator is applying, and any probes still awaiting an answer:

curl -s https://rpc.tenzro.xyz \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tenzro_slaGetParams","params":[]}'

curl -s https://rpc.tenzro.xyz \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tenzro_slaListOutstandingProbes","params":[]}'

tenzro_slaGetParams returns the miss threshold, the slash per threshold crossing and the validator's VRF public key.

Per-epoch proofs for rentals

A compute rental or compute claim settles one epoch at a time. In each epoch the provider submits an availability proof and the chain returns a verdict: settled, missed or closed. Billing follows that verdict. See Compute rental.

Proofs of retrievability for storage

Storage is held to a proof of retrievability in every epoch. The network samples shards of each object and the provider must return digests keyed to a fresh nonce, so a stale or fabricated answer fails. Only a passing answer charges the byte-epoch.

Bonded storage SLAs

Every storage deal is backed by the provider's bond. The same bond covers the provider's compute rentals and claims, and a new deal is refused if the bond cannot cover it on top of everything else the provider owes.

• A failed retrievability challenge is a miss: the renter is not charged and that epoch's slice stays in the renter's withdrawable deposit.
• Consecutive misses past the deal's threshold close the deal and refund the unearned remainder.
• Repeated misses slash the provider's bond, and the network re-replicates the object onto a healthy provider from its erasure-coded shards.

The meter only ever moves value between renter and provider. Slashing is a separate path, driven by the evidence the meter records. See Decentralised storage.

tenzro node storage open-deal --object-id <object_id> --renter 0xRENTER \
  --size-bytes <bytes> --total-epochs <n>
tenzro node storage charge-epoch --deal-id <deal_id>
tenzro node storage deal --deal-id <deal_id>

What a miss costs

Slashed stake is burned rather than paid to anyone, so no party profits from another's failure. A bond stays slashable while its withdrawal cools down, so a provider cannot leave ahead of a claim against work it already served. See Slashing.

Disputes

Most billing never needs a dispute, because the chain's verdict decides each epoch. Disputes cover the cases where two parties disagree about a signed record.

• Payment channels. Either party can submit the highest-nonce state the other signed. The settlement engine decides by nonce and signature validity. Inspect disputes with the CLI:

  bash

  tenzro dispute list-by-channel --channel-id <channel_id>
  tenzro dispute status <dispute_id>

• Tasks with escrow. A buyer can dispute a task; the escrow stays locked in its vault until the dispute is resolved, then releases to the provider or refunds the buyer.

• Receipts. A signed receipt that contradicts the provider's own policy is evidence for a slash.

Related

• Settlement for how metered amounts move.
• Trust and provenance for certification and ratings built on delivery records.
• The Machine Economy for the overview.