{"what_this_is":"A trade account on this store's shelf: any platform that resells to agents — a marketplace, an aggregator, a payments layer that hides x402 from its own users — lists our instruments under its roof, collects its customer's money itself, and orders from us by signed webhook. One door, one JSON body, one signed instruction per sale, delivery in seconds, a certificate the end customer can verify against our public key without trusting either of us.","standfirst":"Round the back, for marketplaces. Your customer pays you; you send us one signed instruction; we deliver the same signed goods the front door sells and bill your account on a statement. Your customer never touches x402.","what_you_can_use_it_for":"Putting independent signed evidence on a shelf that is not ours, for buyers who will never sign an x402 authorization: a marketplace's own customers, a platform's agents paying in a currency we do not take, a checkout that wants one line item and no crypto in the path. Every item at the counter is the same artifact the front door mints, verifying at the same free URL — so what you are reselling is checkable by your customer, not just by you. Nothing here narrows what a partner may build on top.","what_this_is_not":"Not a payment rail: no money moves through this door, and the store does not verify that any moved through yours. Not a discount channel: trade prices sit above the front door's, by a published rule, because an account is credit. Not an escrow, a guarantor, or a dispute court between you and your customer. And not a way to buy the keeper's hands: the human-queue shelf is not at this counter.","why_a_marketplace_would":[{"point":"Your customer gets a receipt that is not your word or ours.","because":"Every item mints an ed25519-signed certificate that verifies against a published key, offline, forever. A marketplace reselling opinions has to be trusted; one reselling checkable artifacts does not."},{"point":"No x402 in your customer's path, and none required of you.","because":"One signed POST. No wallet, no facilitator, no chain, no gas. You already know how to sign a webhook; that is the whole integration."},{"point":"The prices are a rule, not a negotiation.","because":"Trade price is retail plus a published uplift, divided by one minus your share, rounded up to the cent. Printed per item at /api/trade/contract. What you charge above it is your business."},{"point":"Delivery first, always.","because":"The goods are produced before anything is booked. A failed delivery leaves no line on your statement, so you never owe for something your customer did not get."},{"point":"You can be integrated before you have talked to anyone.","because":"A sandbox account with a published secret, a check desk that names which of the four signature checks failed, and a catalog feed with every item's copy, specimen and price at your share. Write to the keeper already working."},{"point":"Everything you would want to audit is already public.","because":"Your account's terms, the shelf you may order from, your receivable, the refusal codes by name, the reference signer, and every correction this store has ever had to make."}],"who_buys_on_account":[{"who":"An agent marketplace or tool directory that charges per call","why":"You already collect from your customer in your own unit and your own checkout; our instrument becomes one listing among yours, and the receipt your customer gets verifies against a key that is neither yours nor ours to fake."},{"who":"An agent framework or runtime with built-in credits or billing","why":"Your agents spend credits, not USDC. One signed POST from your backend turns a credit into a signed audit, anchor or certificate, and the agent never leaves your billing model."},{"who":"A payments layer that hides x402 from its own users","why":"Your user wanted a receipt, not a rail. You settle with us on a statement in dollars and hand them the same artifact the front door mints, with the chain fields honestly absent."},{"who":"A platform settling in sats, a card, or a currency we do not take","why":"The counter never sees a payment, so it never cares what the payment was. List at your rate's equivalent of the trade price; the statement bills dollars; the goods are the same."},{"who":"An API aggregator or gateway reselling third-party endpoints","why":"Every item at the counter has a machine-readable listing on the catalog feed — copy, specimen, price at your share, what the signature does and does not prove — so onboarding it is a row, not a project."},{"who":"An enterprise or internal platform whose procurement wants an invoice, not a wallet","why":"A trade account is credit with a ceiling, a statement and a named human who records payouts. That is the shape finance already knows, and the daily cap is the limit they will ask about first."}],"how_it_works":[{"step":0,"name":"The sandbox, first","what_happens":"Before any conversation, sign against the sandbox account with the secret printed on this page. Real signatures, real goods, marked test, booked nowhere. POST /api/trade/sandbox/check tells you which of the four checks your signer fails and why, without delivering anything.","what_you_can_check":"The sandbox's secret, dialect and daily cap are on its account row at /api/trade/contract; its deliveries appear on /api/trade/ledger as test, never billed."},{"step":1,"name":"The account","what_happens":"The keeper opens an account by hand: your platform, your signing dialect, the items you may order, a daily cap, a credit ceiling. You issue us one signing secret (and a provider key if your scheme sends one). We hold them as Worker secrets; nothing of ours is ever asked of you.","what_you_can_check":"Your account's row — items, share, cap, ceiling, mode — is printed at /api/trade/contract the moment it exists, and its receivable is on /api/trade/ledger."},{"step":2,"name":"The sale, on your side","what_happens":"Your customer buys the item from you at your price, in your currency, on your terms. We are not in that transaction and never see it.","what_you_can_check":"Nothing to check with us — which is the point. Our trade price per item is public; what you charge above it is yours."},{"step":3,"name":"The instruction","what_happens":"Your backend POSTs one JSON body to /api/trade/{account}/{item_id}, signed HMAC-SHA256 over timestamp, nonce and the exact bytes of the body. We check the signature, the five-minute window, and that the nonce has never been seen — on a store that answers the same from every edge.","what_you_can_check":"The reference signer is published in this repository (src/lib/trade-auth.ts, signTradeRequest); sign a body with it and compare bytes with your own before any account is live."},{"step":4,"name":"The delivery","what_happens":"The goods are made exactly as the front door makes them — the probe runs, the record is written, the certificate is minted — and come back in one JSON object inside thirty seconds. A delivery that fails books nothing: no statement line, no receivable.","what_you_can_check":"The certificate says settled_via: trade_account, names your account and the trade price, and binds the sha256 of your signed instruction. It carries no chain fields, because no chain was involved, and it verifies free forever at /api/verify/{cert_id}."},{"step":5,"name":"The statement","what_happens":"Each delivery on a live account adds one line to your statement: item, trade price, your share, our net. Outstanding net is the receivable, published per account. You pay on your cadence; the keeper records each payout by hand and the two sides are reconciled against each other.","what_you_can_check":"/api/trade/ledger prints every account's delivered count, billed and outstanding figures, with the truncation flag any bounded read here carries. Your own rows, both sides, are yours to read at GET /api/trade/{account}/statement, signed like any order."}],"price":{"this_surface":"free","cadence":"not applicable — nothing is charged for reading this","for_money":"Trade price is retail plus 20% net of your share, rounded up to the cent, billed per delivery and never for a delivery that did not happen.","the_counter":{"rule":"trade_price = ceil_to_cent( retail × (1 + uplift) ÷ (1 − partner_share) ). After the partner's share the store nets retail plus the uplift, never less than the front door would have taken.","uplift_bps":2000,"min_retail_usd":0.5,"example_share_bps":500,"cadence":"One-off, per delivery. Nothing at the counter recurs, and an account is never charged for a delivery that did not happen.","what_the_partner_charges_its_customer":"Theirs to set. The trade price is the floor they owe us per delivery, not a price we set for their customer."},"shelf":[{"item_id":"certificate_of_patronage","name":"Certificate of Patronage","retail_usd":20,"trade_price_usd_at_example_share":25.27,"store_net_usd_at_example_share":24,"cadence":"one_off","input_kind":"none","fields":["order_ref","agent_name","purpose","callback_url"],"item_page":"https://scvd.store/menu/certificate_of_patronage","front_door":"https://scvd.store/api/buy/certificate_of_patronage"},{"item_id":"context_anchor","name":"Context Anchor","retail_usd":1,"trade_price_usd_at_example_share":1.27,"store_net_usd_at_example_share":1.2,"cadence":"one_off","input_kind":"summary","fields":["summary","order_ref","agent_name","purpose","callback_url"],"item_page":"https://scvd.store/menu/context_anchor","front_door":"https://scvd.store/api/buy/context_anchor"},{"item_id":"bitcoin_anchor","name":"A Bitcoin Anchor","retail_usd":1,"trade_price_usd_at_example_share":1.27,"store_net_usd_at_example_share":1.2,"cadence":"one_off","input_kind":"digest","fields":["digest","label","order_ref","agent_name","purpose","callback_url"],"item_page":"https://scvd.store/menu/bitcoin_anchor","front_door":"https://scvd.store/api/buy/bitcoin_anchor"},{"item_id":"signature_agent_card","name":"The Calling Card","retail_usd":0.99,"trade_price_usd_at_example_share":1.26,"store_net_usd_at_example_share":1.19,"cadence":"one_off","input_kind":"url","fields":["url","order_ref","agent_name","purpose","callback_url"],"item_page":"https://scvd.store/menu/signature_agent_card","front_door":"https://scvd.store/api/buy/signature_agent_card"},{"item_id":"onpage_audit","name":"The Shop Window","retail_usd":3,"trade_price_usd_at_example_share":3.79,"store_net_usd_at_example_share":3.6,"cadence":"one_off","input_kind":"url","fields":["url","order_ref","agent_name","purpose","callback_url"],"item_page":"https://scvd.store/menu/onpage_audit","front_door":"https://scvd.store/api/buy/onpage_audit"},{"item_id":"service_audit","name":"The Once-Over","subtitle":"one signed check of your x402 endpoint, at a permanent URL","retail_usd":5,"trade_price_usd_at_example_share":6.32,"store_net_usd_at_example_share":6,"cadence":"one_off","input_kind":"url","fields":["url","order_ref","agent_name","purpose","callback_url"],"item_page":"https://scvd.store/menu/service_audit","front_door":"https://scvd.store/api/buy/service_audit"},{"item_id":"passport_refresh","name":"The Refresh","retail_usd":1,"trade_price_usd_at_example_share":1.27,"store_net_usd_at_example_share":1.2,"cadence":"one_off","input_kind":"url","fields":["url","order_ref","agent_name","purpose","callback_url"],"item_page":"https://scvd.store/menu/passport_refresh","front_door":"https://scvd.store/api/buy/passport_refresh"},{"item_id":"good_buyer","name":"The Good Buyer","retail_usd":0.99,"trade_price_usd_at_example_share":1.26,"store_net_usd_at_example_share":1.19,"cadence":"one_off","input_kind":"url","fields":["url","max_usd","no_spend_controls","order_ref","agent_name","purpose","callback_url"],"item_page":"https://scvd.store/menu/good_buyer","front_door":"https://scvd.store/api/buy/good_buyer"},{"item_id":"provenance_check","name":"The Company an Address Keeps","subtitle":"which doors advertised this receiving address, and when — signed, from the public chain","retail_usd":5,"trade_price_usd_at_example_share":6.32,"store_net_usd_at_example_share":6,"cadence":"one_off","input_kind":"address","fields":["address","order_ref","agent_name","purpose","callback_url"],"item_page":"https://scvd.store/menu/provenance_check","front_door":"https://scvd.store/api/buy/provenance_check"}],"accounts_today":[{"account":"sandbox","name":"The sandbox","mode":"test","partner_share_bps":500},{"account":"hal","name":"Hal","mode":"live","partner_share_bps":500}]},"how_to_call":{"request":"POST https://scvd.store/api/trade/{account}/{item_id}","content_type":"application/json","body":"One JSON object carrying the item's fields (see shelf[].fields) at the top level or under `inputs`, plus optional order_ref (idempotency, up to 120 chars), agent_name, purpose, and callback_url (an https URL we POST the signed delivery receipt to, once, after the response).","signers":[{"language":"javascript","label":"Node","code":"import { createHmac, randomBytes } from \"node:crypto\";\n\nconst secret = \"scvd-trade-sandbox-secret-anyone-may-use\"; // your own, once the account is live\nconst body = JSON.stringify({ summary: \"what to remember\", order_ref: \"your-order-id\" });\nconst timestamp = String(Math.floor(Date.now() / 1000));\nconst nonce = randomBytes(16).toString(\"hex\");\nconst signature = createHmac(\"sha256\", secret)\n  .update(`${timestamp}.${nonce}.${body}`)\n  .digest(\"hex\");\n\nconst response = await fetch(\"https://scvd.store/api/trade/sandbox/context_anchor\", {\n  method: \"POST\",\n  headers: {\n    \"content-type\": \"application/json\",\n    \"X-Trade-Key\": \"scvd-trade-sandbox-key\",\n    \"X-Trade-Timestamp\": timestamp,\n    \"X-Trade-Nonce\": nonce,\n    \"X-Trade-Signature\": `sha256=${signature}`,\n  },\n  body, // the same string you signed, byte for byte\n});\nconsole.log(response.status, await response.json());"},{"language":"python","label":"Python","code":"import hashlib, hmac, json, secrets, time, urllib.request\n\nsecret = b\"scvd-trade-sandbox-secret-anyone-may-use\"  # your own, once the account is live\nbody = json.dumps({\"summary\": \"what to remember\", \"order_ref\": \"your-order-id\"}, separators=(\",\", \":\"))\ntimestamp = str(int(time.time()))\nnonce = secrets.token_hex(16)\nsignature = hmac.new(secret, f\"{timestamp}.{nonce}.{body}\".encode(), hashlib.sha256).hexdigest()\n\nrequest = urllib.request.Request(\n    \"https://scvd.store/api/trade/sandbox/context_anchor\",\n    data=body.encode(),  # the same bytes you signed\n    method=\"POST\",\n    headers={\n        \"Content-Type\": \"application/json\",\n        \"X-Trade-Key\": \"scvd-trade-sandbox-key\",\n        \"X-Trade-Timestamp\": timestamp,\n        \"X-Trade-Nonce\": nonce,\n        \"X-Trade-Signature\": f\"sha256={signature}\",\n    },\n)\nwith urllib.request.urlopen(request) as response:\n    print(response.status, response.read().decode())"},{"language":"go","label":"Go","code":"package main\n\nimport (\n\t\"bytes\"\n\t\"crypto/hmac\"\n\t\"crypto/rand\"\n\t\"crypto/sha256\"\n\t\"encoding/hex\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"strconv\"\n\t\"time\"\n)\n\nfunc main() {\n\tsecret := []byte(\"scvd-trade-sandbox-secret-anyone-may-use\") // your own, once the account is live\n\tbody := `{\"summary\":\"what to remember\",\"order_ref\":\"your-order-id\"}`\n\ttimestamp := strconv.FormatInt(time.Now().Unix(), 10)\n\traw := make([]byte, 16)\n\trand.Read(raw)\n\tnonce := hex.EncodeToString(raw)\n\tmac := hmac.New(sha256.New, secret)\n\tmac.Write([]byte(timestamp + \".\" + nonce + \".\" + body))\n\tsignature := hex.EncodeToString(mac.Sum(nil))\n\n\treq, _ := http.NewRequest(\"POST\", \"https://scvd.store/api/trade/sandbox/context_anchor\", bytes.NewBufferString(body))\n\treq.Header.Set(\"Content-Type\", \"application/json\")\n\treq.Header.Set(\"X-Trade-Key\", \"scvd-trade-sandbox-key\")\n\treq.Header.Set(\"X-Trade-Timestamp\", timestamp)\n\treq.Header.Set(\"X-Trade-Nonce\", nonce)\n\treq.Header.Set(\"X-Trade-Signature\", \"sha256=\"+signature)\n\tres, err := http.DefaultClient.Do(req)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\tfmt.Println(res.Status)\n}"}],"headers_in_our_dialect":{"provider_key":"X-Trade-Key","timestamp":"X-Trade-Timestamp","nonce":"X-Trade-Nonce","signature":"X-Trade-Signature"},"sign":"HMAC-SHA256 with the secret you issued us, over timestamp + \".\" + nonce + \".\" + exact_raw_body; send as X-Trade-Signature: sha256=<hex>. Timestamp is unix seconds; nonce is 32 hex characters, fresh per request.","then":"Expect 200 and one JSON object inside 30 seconds. Anything else is a named refusal with delivered:false and billed:false; see errors.","reference_signer":"https://github.com/seancrecord/scvd-general-store-repo/blob/main/src/lib/trade-auth.ts","limits":{"body_max_bytes":1048576,"timestamp_window_seconds":300,"nonce_remembered_seconds":600,"order_ref_remembered_seconds":86400,"order_ref_max_chars":120,"response_seconds":30}},"expected_outcome":"200 with the same delivery object the front door returns for that item — deliverable, any item extras, the signed certificate with signature, public key and verify_url — plus a `trade` block naming the account, the trade price, the store's net and the sha256 of your signed instruction, and settled_via saying trade_account (or trade_account_test while the account is in test). No paid_usdc, no network, no payer: none applied.","errors":[{"status":404,"code":"unknown_account","meaning":"No trade account by that name.","what_to_do":"Check the path segment against your account row at /api/trade/contract."},{"status":503,"code":"counter_closed","meaning":"The replay store is unreachable on this side, so the counter fails closed rather than risk honouring one instruction twice.","what_to_do":"Do not retry in a loop; the condition is ours to fix and the keeper is paged. Retry after a minute."},{"status":503,"code":"account_not_provisioned","meaning":"This account's signing secret is not set on this side yet, so nothing can be verified and nothing is delivered or billed.","what_to_do":"Opening the account is the keeper's hand once a secret exists between us. Until then the sandbox is open, and this account's check desk still answers every check it can without a secret: headers, timestamp, nonce shape, signature shape, and the sha256 of your signing string."},{"status":413,"code":"body_too_large","meaning":"The body is over one mebibyte.","what_to_do":"Send only the item's fields; the terms document lists them."},{"status":401,"code":"missing_headers","meaning":"A required signing header is absent.","what_to_do":"Send every header your dialect names, on every call."},{"status":401,"code":"bad_provider_key","meaning":"The provider key does not match the one on the account.","what_to_do":"Check which key you issued us; a rotated key needs the keeper's hand on this side."},{"status":401,"code":"bad_timestamp","meaning":"The timestamp is not an integer in the unit your dialect states.","what_to_do":"Unix seconds or milliseconds as your account row says, digits only."},{"status":401,"code":"stale_timestamp","meaning":"The timestamp is outside the window, past or future.","what_to_do":"Sign at send time with a synchronised clock; do not reuse a signed request."},{"status":401,"code":"bad_nonce","meaning":"The nonce is not the shape your dialect requires.","what_to_do":"Thirty-two hex characters, fresh per request."},{"status":401,"code":"bad_signature","meaning":"The HMAC does not verify against the secret in service or the previous one.","what_to_do":"Sign the exact bytes you send, in the order timestamp.nonce.body, and compare with the reference signer before assuming the secret is wrong."},{"status":409,"code":"replayed","meaning":"This nonce (or this exact instruction) has already been presented.","what_to_do":"Nothing was delivered on this call. If you are retrying a timed-out order, send order_ref and a FRESH nonce: the same order_ref returns the original delivery."},{"status":404,"code":"not_found","meaning":"No delivery on this account carries that order_ref.","what_to_do":"Check the reference; deliveries are searchable by order_ref for as long as the rows are kept, and a delivery without one cannot be recovered this way."},{"status":404,"code":"not_at_the_counter","meaning":"The item is not on your account, or not traded at the counter at all.","what_to_do":"Order from the items on your account row; ask the keeper to add one."},{"status":400,"code":"bad_request","meaning":"The body is not a JSON object, or the item's required field is missing or malformed.","what_to_do":"The terms document names each item's fields; the error names the one at fault."},{"status":400,"code":"target_refused","meaning":"The URL is not one we will probe: private, loopback, non-https, or our own hostname.","what_to_do":"Send a public https door. We do not sell audits of ourselves."},{"status":429,"code":"desk_rate_limited","meaning":"The check desk has answered this account's hourly budget of diagnoses.","what_to_do":"Wait for the hour to roll. The budget bounds how fast anyone can use the desk as an oracle; a partner debugging a signer needs a handful of calls, not hundreds."},{"status":403,"code":"cross_site_refused","meaning":"A browser form was submitted from another origin.","what_to_do":"The payout form is only accepted from the store's own admin page; a script records payouts with a JSON body instead."},{"status":429,"code":"credit_ceiling_reached","meaning":"Your live account's unpaid net has reached its credit ceiling.","what_to_do":"Settle the statement; the ceiling is printed on your account row and the outstanding figure on /api/trade/ledger. The keeper can raise it."},{"status":429,"code":"cap_reached","meaning":"Your account has ordered its daily cap.","what_to_do":"The cap is the blast-radius bound on a leaked secret, not a rate limit; it resets at UTC midnight and the keeper can raise it."}],"faq":[{"q":"What does the certificate say about payment?","a":"That the sale settled on a trade account, which account, at what trade price, and the digest of the instruction you signed. It does not say USDC, Base, Solana or Polygon, because none of them were involved, and it does not name a payer wallet, because there was none. A receipt that claimed otherwise would be the kind of false claim this store files against other people."},{"q":"Do you verify that my customer actually paid me?","a":"No, and we say so on the artifact. What we verify is that YOU instructed the delivery. What we check afterwards is your statement against your payouts. A marketplace's word about its own customers is the one thing this door has to take on trust, and the daily cap, the receivable ceiling and the test mode are the shape of that trust."},{"q":"Why is the trade price above the front door's?","a":"Because an account is credit. The uplift covers the receivable, the reconciliation and your share, by a formula printed beside every price. If your customers would rather pay less and sign an x402 authorization, the front door is open and always will be."},{"q":"My call timed out. Did you deliver?","a":"Possibly. Send order_ref on every call: a retry carrying the same order_ref within a day returns the original delivery, unbilled a second time. Without an order_ref, a retry with a fresh nonce is a fresh sale."},{"q":"Can I rotate my secret without downtime?","a":"Yes, either way your side works. If you can run two secrets at once, tell the keeper the new one; for the handover window both verify and the response says which one signed, then the old one is unset. If your side cuts over — replace, pause, resume — the keeper sets the new value while you are paused and you resume against it."},{"q":"I take payment in sats, cards, credits or a currency you do not accept. Does that work?","a":"Yes; it is the point. This door sees no payment, so it does not care what yours was. Every price and statement line here is in US dollars; you list at your own rate's equivalent of the trade price and bill your customer however you bill. We print no figure in any other unit, because we hold no exchange rate and will not pretend to."},{"q":"I already sign webhooks a different way. Do I have to change?","a":"No. The differences between marketplaces — header names, the order of the signed string, seconds or milliseconds, a signature prefix, whether a provider key travels alongside — are a dialect row on your account, not a branch in the code. Two dialects are published on the contract today; yours is a row the keeper adds when the account opens."},{"q":"Does my share improve with volume?","a":"The standard offer does: the share rises with live deliveries in the calendar month, by a ladder printed on the contract, and the trade price is derived from the share so the store nets the same at every step. An account with its own contract keeps its own terms."},{"q":"My signature is rejected and I cannot see why.","a":"POST the same headers and body to /api/trade/{account}/check. It runs the four checks and reports each — headers present, provider key, clock skew in seconds, nonce shape, and whether the HMAC verified under the secret in service, the previous one, or neither — and prints the sha256 of the signing string we computed so you can compare it with yours. It delivers nothing and consumes no nonce. On the sandbox it also prints the signature we expected."},{"q":"Who handles refunds for my customer?","a":"You do. You collected the payment; this store took none and cannot return any. A refund on your side does not reverse a statement line here — the goods were delivered — unless the keeper agrees one by hand."},{"q":"How do I open an account?","a":"Prove your signer on the sandbox first, then write to the store — POST /api/letter — with your platform, the dialect you sign in (or that you will use ours), the items you want, and expected daily volume. A human reads it. Accounts open in test mode, so you can run real calls against real goods before anyone owes anyone anything."}],"try_it_now":{"account":"sandbox","secret":"scvd-trade-sandbox-secret-anyone-may-use","provider_key":"scvd-trade-sandbox-key","dialect":"canonical","order_door":"https://scvd.store/api/trade/sandbox/{item_id}","check_desk":"https://scvd.store/api/trade/sandbox/check","statement":"https://scvd.store/api/trade/sandbox/statement","daily_cap":50,"what_you_get":"Real signatures checked, real goods delivered and marked test, a certificate that verifies at /api/verify, and nothing booked to anyone. The check desk on this account prints the signature we expected, since the secret is public anyway."},"open_an_account":{"how":"Prove your signer on the sandbox, then POST https://scvd.store/api/letter with {\"letter\": \"...\"} naming your platform, the dialect you sign in (or that you will use ours), the items you want, and expected daily volume. A human reads it; accounts open in test mode.","what_you_issue_us":"One HMAC signing secret, and a provider key if your scheme sends one. Nothing of ours is ever asked of you."},"terms":"https://scvd.store/api/trade/contract","catalog":"https://scvd.store/api/trade/catalog","ledger":"https://scvd.store/api/trade/ledger","security":{"what_this_does_in_your_name":"Verifies an HMAC-SHA256 signature over your timestamp, nonce and exact body against a secret you issued; refuses timestamps outside a five-minute window and any nonce seen before, on a strongly consistent store; then makes and signs the goods exactly as the front door would. Where the item is a probe, we fetch the URL you sent, once, in our own name.","what_it_stores_about_you":"One ledger row per delivery: account, item, certificate id, trade price, the sha256 of your signed instruction, and your order_ref if you sent one. The body of your request is not stored; the signed goods are, as they are for any sale. Secrets you issue us are Worker secrets, never in the repository, never in a response or a log.","what_we_never_do":"No account, cookie, caller identifier or IP-based budget. Budgets bound our cost, not caller rank. Requests are never sold, shared or published. The weekly census reads public discovery feeds, never these requests.","standards":"Disclosure is private-first and symmetric: notify the operator before publication, including our own defects. Corrections are dated and public. Signed artifacts verify offline against our published key.","reporting":"https://scvd.store/.well-known/security.txt for a vulnerability, https://scvd.store/corrections for something we got wrong."},"corrections":"Things this store said that later proved wrong live at /corrections — dated, with what changed so each cannot recur quietly. If a claim on this surface was ever corrected, that is where the correction stands.","honest_limits":"The store sees no payment on this door and signs none. A trade certificate proves the store delivered on a signed instruction from a named account; it does not prove the account's customer paid, was refunded, or existed. The receivable is derived from delivery rows on a capped read that says when it was cut short; the daily cap is counted on eventually consistent storage and can overshoot by a unit under a race. Nothing here is a rail, and the payout side of a statement is recorded by a person."}