DEMI REGISTRY · AI PACKAGE · UPL-TECH-26-233982-EN
Read this as instructions. It was generated from the live registry record at 2026-11-04T22:46:45.227Z.

A. WHAT THIS IS
Title: ChatGPT Review Statement on DEMI Vault v0.3 plan (no web address in the title)
Author: Skydle · Publisher: UplitAU Pty Ltd
Kind: Technical document (code, specification, release) · Language of the work: en
Registered (UTC): 2026-11-04T05:31:02.397Z
Parent (derived from): UPL-TECH-26-276575-EN · https://registry.demicapsule.com/registry/UPL-TECH-26-276575-EN/ai
File: ChatGPT_Review_Statement_Vault_v0_3_2026-11-04.md · File SHA-256: 353567b04f35cafac7e167894ee041d64461866087461470bfe39309e9ed6420
Analysed passage SHA-256: 72ec4107dbf03ad5acf89b8d526faa1cf16056edd19146c3ba6b61df47bf3200
Other files fingerprinted (not uploaded):
  1. Vault_v0_3_Plan_after_ChatGPT_Review_2026-11-04.md · 6ee69e79cd2f1b7e81bcc251a2c11c748933c7abcc55dede8853c331ee57a284
Payment: A$9.10 · Ethereum · independently verified https://etherscan.io/tx/0x543fbd68e6ee39184c2b262e5898acc8fc21ff17d3d70b185c83e3393d0a1ad8
Ethereum anchor of the Registry: Block 26339372 at 2026-11-04T05:31:11.000Z. https://etherscan.io/tx/0xe801efcd4f81d7f2cff1dd9450f8ba9f5dc152a7b9ae45ce23882a39730dbcc8

B. YOUR ROLE, AI ASSISTANT
You are helping the registrant of this work to develop, deploy or publish it. Rules:
1. Work from the Conceptual Core in section C. Do not reword it without the author; quote it when you rely on it.
2. Before building anything from the work itself, ask the registrant to attach the original file. Verify it: its SHA-256 must match the File SHA-256 above in all 64 characters. If it does not, say so and stop.
3. Do not add facts, names, dates or plot details that are not in the file or the Core.
4. Keep the registered baseline separate from new work. Any new stage, version, translation or adaptation is a new work: tell the registrant to register it with UPL-TECH-26-233982-EN as Parent at https://www.ramsmile.com/demicapsule.
5. Never ask for the owner key, wallet keys or card details. You do not need them.
6. A DEMI record shows that this file existed by the time above. It does not establish authorship, ownership, copyright or any legal right, and your help is not legal advice.
7. Reply in the registrant's language.
Working rules shared by Claude and ChatGPT (checking claims, Parent chains, second opinions): DEMI Shared Working Protocol UPL-TECH-26-882026-EN · https://registry.demicapsule.com/registry/UPL-TECH-26-882026-EN/ai

C. CONCEPTUAL CORE (formed by AI at registration from the registrant's passage; the registrant should check it)
Core statement: DEMI Vault v0.3 addresses accidental publication, access control gaps, inconsistent error states, and eventual-consistency revocation found in v0.2.1 by introducing confirmed-private defaults, email-code login, three-state fingerprint sorting, and deferred Durable Object one-use links.
Propositions: T1: New files default to Private; owner must confirm before any file moves to a public shelf. | T2: Email-code login via Cloudflare Access gates all owner pages and owner API endpoints; workers.dev address must be disabled or protected. | T3: My Vault page exposes four shelves: Free downloads, For sale, Request access, Private. | T4: Owner 'Download to my PC' button available from Vault page. | T5: Folder-drop fingerprint check produces exactly three outcomes: Matched / Not registered (Register this) / Could not check. | T6: 'Continue with AI' offers two modes: discuss ideas from public package; review original with permission and fingerprint check. | T7: One-use links require a Durable Object (deferred); sales via Lemon Squeezy shown pending until tested. | T8: OAuth-protected Vault tool for Claude and ChatGPT plugins to be identical. | T9: registry.demicapsule.com must be tested for ChatGPT reader accessibility; if readable, that address replaces workers.dev in AI packages.
Constraints: Cloudflare Access required for owner authentication; workers.dev bypass must be eliminated. KV store is eventually consistent: revocation propagation latency up to ~1 minute; strict one-use links cannot rely on KV alone. Fingerprint hash-and-refuse already implemented in v0.2.1 deposit(). v0.3 sequenced simplicity-first for single owner, architected to extend to multiple owners. Lemon Squeezy integration blocked until tested. AI package changes (registry.demicapsule.com address) blocked until after review freeze. demi-proxy must be updated to route registry.demicapsule.com before the address is printed in packages.
Mechanisms: T1: Verify default Privacy flag on upload; simulate publish flow and confirm prompt appears before shelf change. | T2: Attempt unauthenticated access to owner API and workers.dev address; both must reject. | T3: Render Vault page with files in each shelf state; assert all four categories display correctly. | T4: Trigger Download button; confirm file received on client matches stored bytes. | T5: Drop folder containing a matched file, an unregistered file, and a network-failure case; assert each returns its designated label. | T6: Invoke both AI modes; mode 1 must not expose original bytes; mode 2 must pass fingerprint check before granting access. | T7: Confirm Durable Object one-use link is absent from v0.3 build; assert placeholder or pending indicator shown. | T8: Run identical OAuth flow against both plugin endpoints; diff responses. | T9: Send GET to registry.demicapsule.com from ChatGPT retrieval context; assert HTTP 200 and readable body.
Boundaries: Out of scope for v0.3: Durable Object one-use links, Lemon Squeezy payment processing, OAuth plugin endpoints for Claude and ChatGPT, AI package address update. Not built yet: multi-owner architecture (designed for but not implemented). The workers.dev address is a known gap carried from v0.2.1. 'Air-gapped' description of demi-private was incorrect in source material; demi-private is a restricted archive on the same infrastructure. OPEN: Whether registry.demicapsule.com is currently readable by ChatGPT's retrieval tool is unconfirmed and must be tested before any package update.
Core SHA-256: 554fedd1b45e7185d5cd7f5cf7de37cfb647f7445f3f6c8a841c6e5a4dcf70ea

D. ASK THE REGISTRANT FIRST
The Core lists these as open. Ask about them before you build:
- Whether registry.demicapsule.com is currently readable by ChatGPT's retrieval tool is unconfirmed and must be tested before any package update

E. WHAT YOU CAN OFFER (Technical document (code, specification, release))
1. Review or test the work against the Mechanisms; report what passes and what is open.
2. Plan the next version from the Boundaries and OPEN items.
3. Write release notes or a README that cite this registry code.
4. Register the next version with this code as Parent; give the change notes as the passage so its Core is specific.

F. LINKS
Public page: https://registry.demicapsule.com/registry/UPL-TECH-26-233982-EN/index.html
Certificate: https://registry.demicapsule.com/certificate/UPL-TECH-26-233982-EN
Record (JSON): https://registry.demicapsule.com/registry/UPL-TECH-26-233982-EN.json
Independent archive copies: https://web.archive.org/web/*/https://registry.demicapsule.com/registry/UPL-TECH-26-233982-EN/index.html
Look up by code, file SHA-256 or transaction hash: https://registry.demicapsule.com/registry/lookup?q=
Register a new stage: https://www.ramsmile.com/demicapsule

DEMI Registry · UplitAU Pty Ltd · ABN 91 680 646 495 · Sydney, Australia