# Caveat emptor

This is a learning register for hung editioned walks. It is not a payment-processor audit, not a wallet, and not a claim that the operator is hard to school.

If you are the kind of buyer who red-teams the cash register, do that. The work invited you. File issues against the protocol, not against the myth that a first public till is finished.

## What this instance claims
- `/` and `/live` are a catalog of hung works. They are not a checkout for whoever `LIVE` points at.
- Public names are titles. Paths (`e001`, `schooling`) are crate ids.
- The zip on disk was hashed and (if a key exists) signed **before** any unlock.
- While `SCORE3_SHOP=closed` or the invoice has no receive address, this hostname is a **drill**. No form. No wallet URI. POST unlock is 403. Do not pay.
- Unlock, when the shop is open, is supposed to require a Monero transaction proof for a published address and amount, or an explicit MOCK passphrase on a test box.
- A used proof is not supposed to release a second copy.
- `STATUS=SOLD` closes POST unlock (410). GET still shows the public hashes.
- Ghost is only a link. It does not hold the zip, the container, or the passphrase.
- Cooking (the age identity / VeraCrypt passphrase) is **not on this host**. A colocated pass file is an operator error and is not printed.

## What this instance does not claim
- Anonymity of the operator or of the VPS provider.
- That TLS on a rented box equals a sealed device.
- That MOCK mode is money. MOCK is theater with the lights on.
- That a missing `monero-wallet-cli` still “counts as verified.” PROOF without the binary **refuses**. It does not fake `check_tx_proof`.
- That a view key or spend key belongs on this host. They do not. A dummy wallet file, if present, exists only so the CLI process will start. It must not be a view-only of the edition mailbox.
- That Ghost is an authenticating voice. Compromise of Ghost is a forgery of the hang, not a theft of the walk. If Ghost and this register disagree, Ghost is lying — if you checked this register.

## Trust boundary (the part worth attacking)
```
[buyer wallet] --pays--> [published receive address]   # only when shop is open
[buyer] --txid + tx_proof--> [this process]
[this process] --monero-wallet-cli check_tx_proof--> [Good signature + matching amount]
[this process] --if valid--> [zip + ciphertext container from local disk]
[operator laptop] --holds--> [WALK.age.key / WALK.hc.pass]
```

Everything else (Ghost, Cloudflare in front of Ghost, the artist’s laptop) is out of band. Compromise of Ghost should not reveal the zip. Compromise of this host reveals the zip and any ciphertext left here; it should not reveal cooking or a spend key because none is here.

## Known schoolable gaps (v0)
1. **PROOF is only as good as the CLI + daemon on this box.** If `MODE=PROOF` and the binary is missing, unlock refuses — that is required. Shipping MOCK to the public hostname is still an own-goal.
2. **Single process, local JSON replay file.** Not durable across naive disk loss; not multi-node.
3. **No hardware-backed key.** minisign key, if used, is a file. Steal the box, steal the signer unless the key never lived here (sign offline, copy only the `.minisig`).
4. **QR/address HTML is trusted output of this app.** If you serve this behind a proxy that injects JS, that is your bug. While the shop is closed, no URI is emitted.
5. **Timing and rate limits are crude.** Proof-of-work they are not.
6. **Catalog plus `STATUS=SOLD` plus a used-proof set.** Quantity 1 is a social convention, not a blockchain mint.
7. **Release token in the success HTML.** Steal that response, steal the zip download. Cooking is not in that response.
8. **Ghost remains a semantic attack surface.** A captured staff session can hang a phony card. This register does not stop that. A signed catalog (minisign over title + root + zip sha + path) is the next door to brick.

## How to school it
- Swap the address in the page and see if a buyer would notice (fingerprint the address in `PUBLIC.json` and on the print).
- Replay a proof; expect 409.
- Hit a SOLD edition POST; expect 410.
- Hit a drill edition POST; expect 403.
- POST `/live/unlock`; expect 404.
- Hit `/{edition}/meta` and check the sha256 against the bytes you received. `cooking_on_this_host` should be false.
- Run `minisign -V` if a pubkey is published.
- Ask whether MOCK is disabled on the hostname you paid.
- Ask whether `check_tx_proof` is a real subprocess or a comment.
- Ask whether Ghost and `/live/meta` name the same root.

A clean attack writeup is more valuable to this project than a polite purchase.