# Caveat emptor

This is a learning register for a small editioned walk. It is not a payment-processor audit, not a wallet, and not a claim that the operator is hard to school.

If you are the kind of buyer who red-teams the cash register, do that. The work invited you. File issues against the protocol, not against the myth that a first public till is finished.

## What this instance claims
- The zip on disk was hashed before any unlock.
- Unlock is supposed to require a Monero transaction proof for a published address and amount.
- A used proof is not supposed to release a second copy.
- `STATUS=SOLD` closes POST unlock (410). GET still shows the public hashes.
- Ghost is only a link. It does not hold the zip, the container, or the passphrase.
- The sealed container is fetchable by hash. The passphrase is not on this VPS, not on Ghost, and not in object storage.

## What this instance does not claim
- Anonymity of the operator or of the VPS provider.
- That TLS on a rented box equals a sealed device.
- That a missing verifier still “counts as verified.” Without the binary, unlock **refuses**. It does not fake success.
- That a view key or spend key belongs on this host. They do not.
- That the HTML cannot be replaced if the box is taken.

## Trust boundary
```
[buyer wallet] --pays--> [published receive address]
[buyer] --txid + tx_proof--> [this process on the VPS]
[this process] --check_tx_proof--> [Good signature + matching amount]
[this process] --if valid--> [colophon zip]
[sealed container] --lives in daylight, keyed elsewhere-->
```

Compromise of Ghost should not reveal the zip. Compromise of this host reveals the colophon and the receive address; it should not reveal a spend key, a view key, or the container passphrase, because none of those are here.

## Known schoolable gaps
1. **PROOF is only as good as the verifier on this box.** Missing binary: refuse. That is required.
2. **Single process, local JSON replay file.** Not durable across naive disk loss; not multi-node.
3. **No hardware-backed key.** Sign offline if a pubkey is published.
4. **Quantity 1 is a social convention plus a used-proof set and a SOLD file**, not a chain mint. The cap (24) is arithmetic on the print.
5. **The page can lie.** Fingerprint the address and the root on the print and in `PUBLIC.json`. If the page disagrees, the page is lying.

A clean attack writeup is more valuable to this project than a polite purchase.