The clause
molefang-zdr-v1
Provider must not retain prompts, context packets, outputs, embeddings, or derived training data. Provider must publish a signed attestation whenever retention terms or policy version changes. Provider must disclose subcontractors that can access request content. Provider must permit immediate eligibility revocation and refund of unspent reserves after a material change.
Provider must not retain prompts, context packets, outputs, embeddings, or derived training data. Provider must publish a signed attestation whenever retention terms or policy version changes. Provider must disclose subcontractors that can access request content. Provider must permit immediate eligibility revocation and refund of unspent reserves after a material change.
Signed manifest
The canonical attestation includes provider identity, endpoint, model, policy version, policy SHA, key ID, and signing time. The provider signs it with Ed25519. Mole Fang pins the key fingerprint on first acceptance and checks the hot path from memory.
Reports
A report freezes the connector for the reporting session, records review state, and prevents new calls. An operator can blacklist the provider. Invalid signature or policy mismatch blocks the provider globally before a call is dispatched.
Refund state
Each call reserves credits with the local ledger. Failed gates release the reserve. A material manifest change marks unspent reserves refundable. V1 records this state; Stripe Connect settlement and live refunds are deferred.
See marketplace policy model