{"upl":"UPL-TECH-26-233982-EN","title":"ChatGPT Review Statement on DEMI Vault v0.3 plan (no web address in the title)","author":"Skydle","publisher":"UplitAU Pty Ltd","environment":"real","payment_verified":true,"tier":"starter","payment":"eth","payment_ref":"0x543fbd68e6ee39184c2b262e5898acc8fc21ff17d3d70b185c83e3393d0a1ad8","amount_aud":"9.10","timestamp":"2026-11-04T05:24:36.547Z","registered_at":"2026-11-04T05:31:02.397Z","language":"en","file_name":"ChatGPT_Review_Statement_Vault_v0_3_2026-11-04.md","file_sha256":"353567b04f35cafac7e167894ee041d64461866087461470bfe39309e9ed6420","extract_sha256":"72ec4107dbf03ad5acf89b8d526faa1cf16056edd19146c3ba6b61df47bf3200","derived_from":"UPL-TECH-26-276575-EN","description":null,"demi_core":{"core_statement":"DEMI Vault v0.3 addresses accidental publication, access control gaps, inconsistent error states, and eventual-consistency revocation found in v0.2.1 by introducing confirmed-private defaults, email-code login, three-state fingerprint sorting, and deferred Durable Object one-use links.","propositions":"T1: New files default to Private; owner must confirm before any file moves to a public shelf. | T2: Email-code login via Cloudflare Access gates all owner pages and owner API endpoints; workers.dev address must be disabled or protected. | T3: My Vault page exposes four shelves: Free downloads, For sale, Request access, Private. | T4: Owner 'Download to my PC' button available from Vault page. | T5: Folder-drop fingerprint check produces exactly three outcomes: Matched / Not registered (Register this) / Could not check. | T6: 'Continue with AI' offers two modes: discuss ideas from public package; review original with permission and fingerprint check. | T7: One-use links require a Durable Object (deferred); sales via Lemon Squeezy shown pending until tested. | T8: OAuth-protected Vault tool for Claude and ChatGPT plugins to be identical. | T9: registry.demicapsule.com must be tested for ChatGPT reader accessibility; if readable, that address replaces workers.dev in AI packages.","constraints":"Cloudflare Access required for owner authentication; workers.dev bypass must be eliminated. KV store is eventually consistent: revocation propagation latency up to ~1 minute; strict one-use links cannot rely on KV alone. Fingerprint hash-and-refuse already implemented in v0.2.1 deposit(). v0.3 sequenced simplicity-first for single owner, architected to extend to multiple owners. Lemon Squeezy integration blocked until tested. AI package changes (registry.demicapsule.com address) blocked until after review freeze. demi-proxy must be updated to route registry.demicapsule.com before the address is printed in packages.","mechanisms":"T1: Verify default Privacy flag on upload; simulate publish flow and confirm prompt appears before shelf change. | T2: Attempt unauthenticated access to owner API and workers.dev address; both must reject. | T3: Render Vault page with files in each shelf state; assert all four categories display correctly. | T4: Trigger Download button; confirm file received on client matches stored bytes. | T5: Drop folder containing a matched file, an unregistered file, and a network-failure case; assert each returns its designated label. | T6: Invoke both AI modes; mode 1 must not expose original bytes; mode 2 must pass fingerprint check before granting access. | T7: Confirm Durable Object one-use link is absent from v0.3 build; assert placeholder or pending indicator shown. | T8: Run identical OAuth flow against both plugin endpoints; diff responses. | T9: Send GET to registry.demicapsule.com from ChatGPT retrieval context; assert HTTP 200 and readable body.","boundaries":"Out of scope for v0.3: Durable Object one-use links, Lemon Squeezy payment processing, OAuth plugin endpoints for Claude and ChatGPT, AI package address update. Not built yet: multi-owner architecture (designed for but not implemented). The workers.dev address is a known gap carried from v0.2.1. 'Air-gapped' description of demi-private was incorrect in source material; demi-private is a restricted archive on the same infrastructure. OPEN: Whether registry.demicapsule.com is currently readable by ChatGPT's retrieval tool is unconfirmed and must be tested before any package update."},"core_withheld":false,"core_publication_basis":"Self-registration: UplitAU registering its own work from its own wallet. The author is known to the Registry operator because they are the same party; the Ethereum payment itself identifies no one.","costs":{"claude_aud":null,"openai_aud":null,"service_aud":null,"total_aud":null},"landing_page":"https://registry.demicapsule.com/registry/UPL-TECH-26-233982-EN/index.html","visibility":"listed","product":"capsule","core_requested":true,"provenance_manifest":{"scheme":"DEMI-Provenance-Manifest/1","algorithm":"SHA-256","computed":"in the author's browser","files_listed":1,"files":[{"name":"Vault_v0_3_Plan_after_ChatGPT_Review_2026-11-04.md","size_bytes":2221,"sha256":"6ee69e79cd2f1b7e81bcc251a2c11c748933c7abcc55dede8853c331ee57a284"}],"note":"These files were fingerprinted by the registrant and were never uploaded. The registration time applies to each fingerprint: a fingerprint cannot be produced without the file it describes. This record does not establish authorship or ownership of the files named."},"activation_reference":"DEMI:1042:UPL-TECH-26-233982-EN:4","ai_fetchable":true,"amount_eth":0.002629,"payment_value_aud":9.1,"payment_rate_aud_per_eth":3462,"payment_rate_source":"etherscan ethprice","core_sha256":"554fedd1b45e7185d5cd7f5cf7de37cfb647f7445f3f6c8a841c6e5a4dcf70ea","core_status":"formed","anchor_tx":"0xe801efcd4f81d7f2cff1dd9450f8ba9f5dc152a7b9ae45ce23882a39730dbcc8","anchor_submitted_at":"2026-11-04T05:31:08.577Z","anchor":{"status":"confirmed","tx_hash":"0xe801efcd4f81d7f2cff1dd9450f8ba9f5dc152a7b9ae45ce23882a39730dbcc8","etherscan_url":"https://etherscan.io/tx/0xe801efcd4f81d7f2cff1dd9450f8ba9f5dc152a7b9ae45ce23882a39730dbcc8","block_number":26339372,"block_time_utc":"2026-11-04T05:31:11.000Z","submitted_at":"2026-11-04T05:31:08.577Z","digest":"c30bf5050ba8c1e9ec18d87899b46a79f764b622a78b247cda729812c5ce6f11","snapshot_url":"https://registry.demicapsule.com/registry/anchor/c30bf5050ba8c1e9ec18d87899b46a79f764b622a78b247cda729812c5ce6f11.json"}}