§ status

Operational, with the caveats.

Every subsystem the product depends on, with the operator name and the current state. Honest about which parts we run vs. which parts run on federation infrastructure vs. which parts run on external public goods.

loading slo…

running probes…

§ live probes · client-side

probing… · auto-refresh 60s

me.ochk.io · /api/health
liveness — running app + cookie parsing
—
pending
auth · /api/auth/me
401 with no cookie is correct; 5xx is not
—
pending
ochk.io · /.well-known/jwks.json
public Ed25519 JWK every consumer verifies against
—
pending
envelope · /api/envelope/[id]
404 for unknown id is correct; 5xx is not
—
pending
fee policy · /api/platform-fee-policy
PLATFORM_FEE_POLICY canonical record
—
pending
integrator config · /api/integrator-config
sample IntegratorPriceConfig list
—
pending

subsystem	operator	role	state
me.ochk.io · web	orangecheck	consumer marketing surface and authenticated app	operational
auth host · ochk.io auth host jwks · 1/1 reachable	orangecheck	oc_session JWT issuance and JWKS publication	operational
federation custody A federation is bound, but no payout rail is enabled, so nothing settles through it yet. BIP-322 self-custody is the live path today. See /custody for the derived posture.	guardian set (see /custody)	threshold-signing wallet for non-graduated users	forming
oc envelope signing	orangecheck	event envelope co-signature for billing reconciliation	operational
opentimestamps anchor opentimestamps calendars · 2/2 reachable	opentimestamps calendar federation	aggregated event-root anchoring to Bitcoin headers	operational
nostr relay set nostr relay set · 3/4 reachable (1 expected-unreachable from this runtime: relay.damus.io)	relay.ochk.io, damus, nos.lol, snort.social	public envelope republication	operational
lightning settlement A federation is bound, but no payout rail is enabled, so no sats move yet. Earnings accrue as a verifiable ledger credit and stay claimable. See /custody.	federation lightning gateway	cashback payouts	forming

machine-readable surfaces

Every health signal, metric, and economic aggregate this page consumes is also available as a stable public endpoint. Scrape these from your monitoring stack instead of polling the page.

/api/health/deep

JSON · per-subsystem health probes (KV, federation registry, platform account, treasury) with probe_ms timing. Drives the live cards above.

/api/metrics

Prometheus exposition · per-route counters + duration histograms, billable-event subtype counters, fee distribution histograms, webhook fan-out latency. Cached 10s.

/api/public/slo-summary

JSON · combined p50/p95/p99 latency + 5xx error rate + posture (healthy / degraded / incident). Drives the SLO banner above. Cached 30s.

/api/public/economics-summary

JSON · aggregate sat flow across federations + OC treasury balance + 30d/lifetime in/outflows. Drives /economics. Cached 5 min.

/api/federations

JSON · federation directory · status, threshold, charter hash, last attestation, oc_residual_bps. CORS open.

/api/audit/divergences

JSON · billing-engine self-check · every event re-verified against the integrator's published price config. Empty list is honest.

/recovery

Backup + DR runbook · what's reconstructible from public state, step-by-step recovery procedure, RPO ≤ 15 min · RTO ≤ 60 min commitments.

what "degraded" means here

We treat any externally-observable signal that contradicts the user promise as either "degraded" or "incident" — never "operational with caveats." If sat-earning events are published with delay, that's degraded. If they're not published at all, that's an incident.

Anchored events on Bitcoin headers and Nostr-published envelopes do not depend on this status page being up. Even during a full me.ochk.io outage, prior /me/earn entries continue to verify offline against the OC public JWK and Bitcoin block headers.

Subscribe to incident updates by following github.com/orangecheck/oc-me-web/issues for the "incident" label. Public post-mortems land in /changelog.