Federated, not infinite.
OC's network scales linearly with federation count. Each federation OC provisions adds linear capacity; the per-layer ceilings below are the architectural facts. No marketing-grade infinity claim — the actual numbers, continuously published. (Who holds each federation's keys is derived on /custody.)
Each new federation linearly increases the network's ceiling. OC provisions federations — whose current custody posture (who holds the keys) is derived and shown on /custody, not asserted here — and supply scales with every guardian set added; public operator self-serve re-opens as the program matures. Cross-federation BOLT12 mesh eventually makes federation choice transparent to user UX so the routing layer scales with N as well.
Events fired with is_agent: true get separate metering. Integrators that want to gate signup or higher-trust thresholds on real human activity can request the cross_integrator_human_event_count scope; this block shows the network-wide ratio.
Each row is a measured or upstream-bounded ceiling. The whole pipeline is gated by its slowest hop; today, before federation cash-out is live end-to-end (the Lightning gateway is the remaining piece), Upstash is the bound. As ecash flows scale on the live federation, federation throughput becomes the bound and multi-federation horizontal scale-out lifts it linearly.
| layer | ceiling (events/sec) | bottleneck |
|---|---|---|
| Vercel Pro concurrency | 6.0k–8.0k | function concurrency limit (1000) × p99 ≈ 120ms |
| Upstash Pro KV | 600–770 | single-region Redis through HTTP REST · ~13 commands per event |
| Single Fedimint federation (v0.11) | 100–500 | upstream consensus throughput |
| Lightning gateway HTLCs | 10–50 | in-flight HTLC limit · per gateway |
| Nostr relay (strfry) | 10.0k–50.0k | not the bottleneck |
| OpenTimestamps calendar | ∞ (batched) | batched · effectively unlimited |
A misbehaving integrator firing from many IPs across many Vercel lambdas can't saturate the shared network: every project_key has a cross-instance cap of 1.0k events/sec sustained. Above the cap, requests get HTTP 429 + a Retry-After header; the SDK's withRateLimitRetry() helper auto-honors it. Other integrators on the network are unaffected.
Need higher? Per-integrator dedicated federation tier on the roadmap — Stripe-shape enterprise pattern: a high-volume integrator gets a federation whose seats are operators they trust + dedicated KV instance. Same SDK, same envelopes, same OC identity.
One identity, one wallet, across every integrator. Sats accrued across many sites over time become an anonymous, organic right-action signal costly to fake and trivially to verify. Every integrator that ships oc-me sign-in inherits sybil resistance as a side effect of the auth surface — displacing the adjacent category of spend (fraud detection, anti-spam, account-takeover) sites pay for separately today.
- depth ·
cross_integrator_lifetime_sats· cumulative sats earned across every integrator. Sybils pay through real cost, not OC attestation. - breadth ·
cross_integrator_distinct_count· distinct integrators that have billed the identity. N integrators to onboard through is N× the friction. - duration ·
cross_integrator_oldest_event_at· timestamp of first activity. Sybils can't retroactively earn sats older than now. - habituality ·
cross_integrator_active_days· distinct UTC days with at least one event. One big spend looks very different from daily habitual presence.
import { oc } from '@orangecheck/me-client';
const r = await oc.identity.verifyActivityAttestation(bundle);
if (!r.ok) return res.status(401).send(r.reason);
const a = r.attestation!;
if (a.lifetime_sats < 10_000) return reject('low signal');
if (a.distinct_integrator_count < 3) return reject('low breadth');
if (a.active_days < 30) return reject('one-shot history');
// passed depth × breadth × duration × habitualityFive checks under the hood: bundle shape, sha256 content-address match, JWK by kid, ed25519 signature, freshness. Same envelope key that signs every billable event, rebind, and trust attestation. Verifier ships in @orangecheck/me-client and runs on Node 20+ / Edge / browser.
Most consumer integrations today stack: an auth provider (Auth0, Clerk, Cognito), a fraud-detection layer (Sift, Stripe Radar, Sardine), an anti-spam layer (hCaptcha, Cloudflare Turnstile), and an account-takeover-monitoring layer (Castle, Cloudflare). Three of those four answer one question: is this account a sybil? When OC is the auth surface, that question is answered as a byproduct of how the identity accrued sats — content-addressed, signed, verifiable offline against bitcoin headers. Drop the auth integration, get the sybil signal free; reach for the other vendors only for the residual problems they actually solve.
Each row in the per-layer ceilings table reflects a measured or upstream-bounded throughput cap. Below it, the SDK + ingestion path are optimized for hot-path latency: parallel KV reads, fire-and-forget accrual writes, edge-cached anchored envelopes that never re-hit Upstash after the first read, and a cross-instance per-project rate limit that prevents one misbehaving integrator from saturating shared capacity.
Shipped optimizations across the platform: edge-cached anchored envelopes (1y immutable cache), 1d-fresh / 30d-SWR dev-jwks cache, hot-path KV parallelization in /api/integrator/event, cross-instance per-project rate limit (atomic INCR + EXPIRE pipelined), batch ingestion endpoint /api/integrator/event/batch, and SDK backpressure helpers (withRateLimitRetry).
On the roadmap: full async ingestion path with HTTP 202 + queued settlement worker, KV sharding by integrator_id, multi-gateway-per-federation pool wiring (gates on federation custody going live), and upstream-grade sharded consensus contributions to Fedimint.