# Sean-Claude Van Damme's General Store

Current checkout networks: Base, Polygon, Arbitrum, World, Solana.

> scvd.store is an evidence observatory for agentic commerce: independent verification of x402 endpoints, payments and receipts. Before an agent pays an x402 endpoint, we check that it can be paid. After it pays, we check the signed receipt. Over time we watch endpoints and publish a dated, signed corpus. Sellers use it to prove a door works; buyers use it before spending. Every artifact is signed, expires, and names what we did not see. Not escrow, not a rating, not a guarantee. Free instruments: a preflight check on any x402 door, a conformance desk for any issuer's signed offers and receipts — including our competitors' — a named defect vocabulary, and a Bitcoin-anchored corpus that appends weekly. Paid instruments: conformance audits, endpoint watches, settlement attestations, launch checks. Never a ranking, and never a verdict without its derivation and denominator beside it. Operated by Record Creative Co. LLC.
> Everything this store signs verifies free, forever, at
> `https://scvd.store/api/verify/{id}` — no account, no wallet, no rate limit,
> verifiable offline without asking us.
> Not an escrow, a guarantor, or a dispute court: those absorb the risk between payment and delivery and need a balance sheet. We observe that gap, sign what we saw, and publish it — including the gaps we count against ourselves.
> It is also a general store for autonomous agents, kept by a named human, paid in USDC over x402 on a network offered in the current payment quote. The cheapest thing on the shelf is $0.001.

Before you pay: preflight any x402 door, free at https://scvd.store/api/preflight/v1. After you pay: check any issuer's signed offer or receipt, free at https://scvd.store/conformance. Over time: read the dated, Bitcoin-anchored corpus, free at https://scvd.store/corpus.

The conformance desk explains itself in plain language at
https://scvd.store/conformance and now takes a pasted artifact in a form on that
page — declared to browser agents with WebMCP's `toolname` attributes,
and deliberately without `toolautosubmit`, so an agent may fill it and
a human presses submit; the corpus, the weekly signed record of the
x402 ecosystem, reads at https://scvd.store/corpus. That order is deliberate: the
infrastructure is the product, and the store personality below —
which is real, and stays — comes second.

Last checked by hand: 2026-09-11. Served: 2026-09-12.
Those are two different facts and we print both, because serving a
page is not the same as having verified what is on it.

https://scvd.store/llms-full.txt serves this SAME document, byte for byte — the
llmstxt.org convention reserves that path for the complete prose, and
ours has always been complete, so the alias exists to keep a crawler
that asks for it blindly from getting a 404. It is not a fuller copy
and this file will not pretend otherwise. https://scvd.store/agents.md is the
same store in the agents.md convention.

# Conformance and what a signature is worth

The free desk that checks any issuer's signed offers and receipts, the named defect vocabulary two instruments can compare notes in, and the honest limits of what a valid signature from us actually proves.

## What a signature from us is actually worth

https://scvd.store/attestation, per artifact class rather than in general: what
bytes the signature covers, who holds the key, and the one thing a
valid signature does NOT prove. Three trust models are named and
ordered weakest first — self-signed, custody-and-timestamp only, and
third-party observation — and the classes sitting on the weakest one
are labelled as sitting on the weakest one. The page also lists what
this store does not have: no hash-linked continuity chain over sold
artifacts (the store's own key history and ecosystem record ARE
chained and Bitcoin-anchored; the shelf is not), no offline
bundle format, no successor key, no threshold signing, no HSM, no
audit, no patent. It was written after an outside reader
checked the artifacts and called this a narrower, more honestly-scoped
system rather than a more capable one; that sentence is quoted on the
page in their words, because a store that publishes its corrections
does not get to rewrite an outside verdict into a kinder one.

What "verified" means here is published at https://scvd.store/criteria, and the
page came first (house rule: no badge ships before its criteria page
exists). A badge here is a dated observation on a thing against the
published check battery, never a score on an actor — and nothing
retires one: it ages, and re-observation is what answers "is this
still true." How many the store serves today is counted on that page,
derived from the router rather than typed into a sentence.

## Named defect classes, so two instruments can compare notes

https://scvd.store/defects (and https://scvd.store/defects.json) publishes stable names for
the ways an x402 endpoint can be broken. Each class states what it
asserts, what would falsify a finding of it, and — the field that
actually matters — whether an UNPAID probe can see it at all.

That last one is the interop. This store's census sends one unpaid
GET; a paid walk settles real money and sees things a free probe
never can. A door clean to us and defective to a paying tester is not
a contradiction, it is two instruments measuring different things,
and the `detectable` field is how you tell which happened.

Every signed document and page carries a cite line (since 2026-09-04),
derived from its own fields: the issuer, what and which, when it was
observed, how it is signed and where the key is, and the URL whose
bytes are the thing cited. Quote it verbatim. The recorded doors, MPP
challenges and signed-artifact vectors this store tests itself against
are served at stable URLs with the sha256 of the bytes, unsigned and
said so: https://scvd.store/fixtures.json, then `https://scvd.store/fixtures/{set}/{name}.json`.

The second wire, read only (since 2026-09-04): a door that speaks the
Machine Payments Protocol answers 402 with WWW-Authenticate: Payment
and no PAYMENT-REQUIRED header. The free preflight reads that from the
same one GET: protocols_spoken says which wires the door speaks (x402,
mpp, both, neither), and the mpp block carries the MPP battery's own
named checks and advisories. The verdict keeps meaning x402-ready,
permanently — a door on the other wire reads not_ready there and that
is a fact about the wire, never a defect. This store's till does not
speak MPP; nothing here pays, verifies a credential or reads a
receipt. Rehearse the shape at https://scvd.store/api/practice/mpp-shape.

Every class also carries both halves of the remediation: what the
operator does to clear it and what the buyer does when a door shows
it. The free preflight report joins them to its own findings as
`remediation`, one row per failed check or raised advisory a class
explains, with the definition URL, so the next step is in the same
answer as the defect. Never part of the verdict.

## The notice desk, for an operator who found us in their log

https://scvd.store/notice explains the two calling cards this store sends —
`scvd-general-store` on the weekly unpaid census, `scvd-walkabout` on
a paid walk somebody bought — and points an operator at the record of
their own endpoint at `/notice/{their-hostname}`. Free, no account,
nothing to buy.

Per-host notices are deliberately unlisted: doors that failed a round
are counted in the public aggregates and named nowhere, so a page that
names one is reachable by its operator and linked from no index of
ours. Unlisted is not secret, and each page says so about itself.

Where another published instrument names the same observable property,
the mapping is stated with the path to check it and what would show it
wrong. Those mappings are our reading of somebody else's published
definitions on a date, never their endorsement.

Not a ranking, not a list of anybody: every class describes one
endpoint at one moment. CC BY 4.0 — take the names, that
is the point of publishing them.

## Verify anyone's receipt — signed verdicts, free

POST https://scvd.store/api/verify-receipt with any receipt or signed artifact
(ours or any issuer's, JSON) and get a SIGNED verdict: valid |
invalid | expired | insufficient_evidence | unsupported |
indeterminate. Every check is named with its outcome; what was NOT
checked (settlement, delivery, revocation, non-scvd key identity) is
stated on the verdict instead of implied — "unknown" and "bad" drive
different automated actions, so they are never collapsed. Stateless:
your document is verified and forgotten, bound to the verdict only by
sha256. The doc is the GET on the same URL; artifacts this store
minted also verify by id at `https://scvd.store/api/verify/{id}`.

## The rest of this store

This file is one section of the store's guide. The complete prose, every
section in one document, is at https://scvd.store/llms-full.txt. The index, with the
list of every door, is at https://scvd.store/llms.txt.

- https://scvd.store/developers/llms.txt — Building against this store
- https://scvd.store/corpus/llms.txt — The evidence: corpus, registry, passports
- https://scvd.store/menu/llms.txt — The shelf, the prices, and the money that flows back
- https://scvd.store/trust/llms.txt — Accountability: corrections, keys, wind-down