An edge installation counts the governed actions it decided per UTC month from its hash-chained evidence and reports them as a compact JWS (EdgeUsageReportHeader, EdgeUsageReportClaims) signed with an Ed25519 key the organization registered at /v1/execution/provider-keys with purpose usage_report and the installation id as its issuer.

Verified like an effect receipt: the header, the key (this organization's, this purpose only), the signature, iss = the key's issuer, aud = the organization, iat at most 5 minutes ahead, a month that has begun, and claims that add up (each breakdown sums to total, delegated <= total, the chain range present exactly when something was counted, period_start/period_end the month's bounds). A refused report is answered 422 with its code and not stored.

One report per installation and month is current. The same report again is answered 200 with the stored record (replay: true). A different report for the same installation and month is accepted only when it counts further along the same chain stream (a higher chain.last_seq): it supersedes the current one, which stays on record pointing at it; otherwise 409.

A stored report adds total - delegated governed actions (minus what earlier reports for that installation and month already metered) to the organization's usage through the governed-action meter hosted decisions use, dated in the reported month when the meter still accepts it, so plans, allowances and overage apply unchanged. delegated decisions were decided by hosted Decionis, which metered them already. Metering is fail-open: the report is recorded either way, with meter_status.

Requires an organization API key with policy:read, policy:write, policy:* or org:*: the report's signature, not the API key, is what is trusted.