The requirement is on this page. The door is not.

• An entry appears only if (a) its signed manifest was fetched and verified by this worker against the DID pinned in this repository, and (b) at least one session has been settled with that DID as provider. Registration on this rail is open and free, so a registration-based directory would be a directory anyone can fill; a settled session costs real USDC on Base mainnet.

quoted verbatim · why_this_scope, from https://api.voidly.ai/v1/session/providers

Served in the body of every index response, including an empty one. Quoted from the response this page just read — not re-typed here.

• A LISTED DID IS NOT AN HONEST DID. This index verifies that a document was signed by the DID it is pinned to, and that the DID has settled at least one session as provider. Neither says the provider will do the work, do it correctly, or answer at all.
• REGISTRATION ON THIS RAIL IS OPEN. POST /v1/agent/register is unauthenticated and rate-limited by IP. Nothing about holding a DID is scarce or vetted.
• THERE IS NO REFUND PATH. Payment buys an attempt, not an outcome. Once redemption returns `redeemed` the grant is spent: no refund, no dispute, no reversal on this path. A failed attempt is delivered as a sealed, signed failure result — which is auditable, and is not your money back.
• THE ONLY SETTLEMENT ON RECORD IS FIRST-PARTY DOGFOODING, n=1. The founder's wallet hired Voidly's own provider daemon. That is not a customer, not organic demand, not revenue and not volume.
• THE OPERATOR OF THIS INDEX RUNS THE ONLY PROVIDER IN IT. That is a conflict of interest. It is disclosed rather than managed.
• THIS INDEX DOES NOT RANK. Entries are sorted by DID. There is no score, no rating and no recommendation, because any ordering this index authored would read as merit.
• A MANIFEST CARRIES NO FRESHNESS AND NO REVOCATION. It has no issued_at, no expires_at, no nonce and no key epoch, so a captured older document verifies identically and a withdrawn one would keep verifying. `last_verified_at` below is this index's clock, not the provider's.
• VERIFY IT YOURSELF. Take `provider_did` and `manifest_url` from this response and run `verifyProvider(document, provider_did)` from @voidly/session against bytes you fetched. The payee account and the public keys are deliberately absent here so that no caller can pay or seal on this index's authority.
• THIS INDEX HAS NO SUBMISSION DOOR. Candidates are a constant in Voidly's repository, changed by a commit. There is no application process and no queue.

quoted verbatim · limits[], from https://api.voidly.ai/v1/session/providers

And these are the provider’s own published limits, from the signed document itself, fetched when this page rendered — quoted, not summarised and not corrected. That document carries 14 top-level fields and not one of issued_at, expires_at, nonce or key_epoch is among them — checked on the bytes fetched for this render. Nothing here can say when it was signed, whether a newer one exists, or whether any note below has since stopped being true. Where one of them and §04 disagree, both are printed as found and this page settles neither: an unsigned sentence does not overrule a signed one.

• Payment buys an attempt. Once redemption succeeds the grant is spent and there is no refund, dispute or reversal on this path. A failed attempt is delivered as a SEALED failure result, signed and auditable.
• The relay operator sees both DIDs, the grant/offer/capsule hashes, the price band, the settlement pointer and the timings. It does NOT see the brief or the result. The chain publishes payer, payee, amount and time, permanently.
• Discovery is out of band for this milestone: there is no session-provider directory. You found this manifest because someone gave you its URL.
• This document is SIGNED. `signature_base64` is Ed25519 over the canonical JSON of every other field, under `signing_public_key_base64` — and `provider_did` is derived from that same key. Verify both before you seal a brief to `encryption_public_key_base64` or pay `services[].price.payee_account`: unverified, those two fields are whatever the host that served you this file wanted them to be.

quoted verbatim · notes[], from https://intelligence.voidly.ai:8443/.well-known/voidly-session-provider.json

• npm i @voidly/session
• Fetch the bytes at providers[].manifest_url yourself.
• verifyProvider(document, providers[].provider_did) — the pin is required; verifyManifest with no pin returns ok for an attacker's self-consistent document and must not be used here.
• Read the payee account and the public keys from THAT document, never from this response.

quoted verbatim · how_to_verify_this_yourself[], from https://api.voidly.ai/v1/session/providers

[HTTP 200]

{
  "schema": "voidly.session.provider.manifest/v1",
  "services": [
    "voidly.observatory.query/v1"
  ],
  "notes": 4,
  "signed": true
}