Signed Official Rounds

Every five minutes, Mecone turns each of its twelve official indices into a cryptographically signed official round: an immutable, chain-independent record you can verify offline with nothing but one pinned public value. This is the transport-neutral layer underneath every delivery rail — the API below, venue-native adapters, and on-chain feeds all carry the same signed round; none of them can create or alter one.

The five-minute heartbeat is the floor, not the ceiling: each feed carries a committed deviationThresholdBps in the registry, and a value that moves at least that far off the last committed round is signed immediately, off-schedule (the same heartbeat-plus-deviation model as Chainlink feeds). A feed is also rate-limited to one off-heartbeat round per commit window (cyclePolicy.deviationMinIntervalNs), and every commit resets the trigger’s baseline.

The settlement fixing (/v1/feeds/{SYMBOL}/fixings/latest)

A per-cycle round is a mark; a settlement reference is a fixing. On each hourly window close, each feed signs a fixing round: the median of its trailing twelve regular rounds (deviation rounds included), quorum nine. The median — not a mean — so no single pushed print drags it. The fixing’s input snapshot names its constituent round ids in window order, so anyone can recompute the median from public history and check the arithmetic — the fixing is a verifiable artifact, not a privileged computation. If a feed can’t reach quorum in the window (or the extended 90-minute fallback), no fixing is signed: the defined FAILED state is the documented absence plus the liveness flag, never a number we don’t have. Fixing rounds carry roundKind: 2 and chain on their own per-feed sequence, so the heartbeat chain and the fixing chain are each unbroken.

The staging environment runs the same pipeline for pre-release feeds and partner onboarding (new indices graduate there first, production after review — mirroring the exchange’s live/soon split). Every staging endpoint except /v1/health requires the access token.

Access tiers (production)

A fresh-rounds read without a token (or with a revoked one) answers 401. A token may additionally be scoped to specific feeds at mint time (the per-feed trial shape): a scoped token reading a fresh round outside its list answers 403 feed not licensed. The scope gates freshness only — the delayed tier stays open to every token. Every token read is metered per token per day; partners see their usage in the partner agreement reporting. Verification never requires a token — the anchor, keysets, registry and verifier kit stay open so a served round can always be checked without trusting the service.

The trust model — pin one address

The only thing you must obtain out-of-band is the root anchor address:

0x954686af5A7Cd1A872E8f25A41B934209A463907        (root anchor — production AND staging)

Everything else is served by the API and proven against that anchor: the root key attests the online keyset, the keyset authorizes the round signer, and the round id is the EIP-712 digest of the signed body (domain = name + version + salt, deliberately no chainId — the same round verifies anywhere). Signatures are canonical low-s secp256k1, one per round.

Verify a live round in one minute

BASE=https://oracle.mecone.trade
 
# the self-contained verifier is served by the service itself
curl -sO $BASE/v1/kit/verify_mecone_round.py
pip install eth-keys eth-abi "eth-hash[pycryptodome]"
 
python verify_mecone_round.py $BASE MGDP --environment production \
  --pin 0x954686af5A7Cd1A872E8f25A41B934209A463907

VERIFIED  MGDP = 2.1526727551754…
  round   0x04d7ab29…
  signer  0x1e00D35F… (authorized by root-attested keyset 0xc9d9e532…)
  anchor  0x954686af…  [matches your pin]

The kit is ~250 lines with no Mecone dependency — read it, fork it, or reimplement it from the served material; nothing about verification requires trusting this service.

Endpoints

The current registry can change while an existing round is still valid. Fetch the registry identified by the round’s officialRegistryHash, verify its content hash, and retain it with the signed evidence. A registry lookup never replaces signature, input-snapshot or expiry verification.

Every round commits to dispersion, not just a point: the input snapshot carries the live de-vigged source distribution with its p10/p50/p90 quantiles, so a risk engine can size haircuts from the crowd’s own spread rather than from a volatility assumption. The snapshot is served byte-verbatim because the signed inputSnapshotDigest covers the bytes — fetch it, recompute the hash, compare.

The stream (/v1/stream)

Polling sets the order in which consumers discover a round by their own poll phase; the stream removes that. On every commit, all subscribers receive the same frames in one flush. Frames carry a monotonic seq within a streamEpoch (the service boot); a changed epoch means resync from the snapshot, and a gap in seq means recover the missing rounds from the range read. Heartbeats every 30 s carry the last emitted seq, so gaps are detectable even in silence. A scoped partner token receives only its licensed feeds. Arrival time still varies with geography — the signed timestamps inside each round, not the transport, define validity.

Symbols: MGDP MCPI MUNEMP MOAI MANTH MH100 MH200 MB200 — and the four country stress indices (a 0–100 score in pts): MBRIV (Brazil), MMXIV (Mexico), MARGIV (Argentina), MCHNIV (China). The stress indices are signed and settlement-grade like the flagship eight; they are not yet on the Stork on-chain rail.

MKRKN was withdrawn on 27 July 2026: no new rounds are produced, and the public index API excludes it (index-not-found there). This service retains its final signed round, frozen at the withdrawal moment, for audit.

What a round commits to

The signed body binds, among 25 fields: the feed identity (keccak256("mecone:official-feed:<SYM>:v1") — venue tickers are never identities), the exact int256 value at 18 decimals in natural units (no billions scaling on this rail), six timestamps (effectiveAt, sourceCutoff, sourceAsOf, computedAt, signedAt, validUntil — staleness is validUntilNs, nothing else), the methodology + registry + source-policy hashes, the input-snapshot digest, the previous round digest (per-feed hash chain), and the authorizing keyset id. Corrections never overwrite: a correction is a new signed round that names what it supersedes.

Integrating

Subscribe to wss://oracle.mecone.trade/v1/stream for push delivery, or poll rounds/latest (a round is fresh until its validUntilNs) — the payloads are identical either way, and verification is the same offline against the pinned root anchor. For a settlement integration, contact us — production keys, SLAs, and the correction-policy paperwork live in the partner agreement.