How we verify

Every number names the Qloo call that produced it. The verdict, audience, cities, price tier, target and reserve come from check.RULES (DEMAND_CHECK.md). Without a Qloo key the server answers "cannot decide" and nothing opens. A report is directional demand evidence, not a sales forecast; every Qloo figure is aggregate taste, not a prediction about one person.

A release needs the referee group's signature, which the program checks on chain. The group is a FROST 2-of-3 key: three separate hosts (this server, GitHub Actions, a third machine) each re-check the evidence; two must sign. A released or refunded order's account is closed, so the chain refuses a second release. Past the deadline anyone may send the refund. Fees: config/fees.yaml, taken only on money released on proof.

knos_pay test build FaMHCjzyUexFncZrmNyFQNz3gBdsLbhTLke7QBFykJY4 (devnet). Every receipt links its transactions.

The server fetches the page twice (public addresses only, no redirects, size and time limits) and refuses a page that changes. The referees sign one pin: knos.ideas.commit.review_evidence, the sha256 of the signed evidence structure, which includes the page's own sha256. The receipt shows both; the release carries the pin.

The server keeps only the passkey's public key. The passkey owns a LazorKit smart wallet on devnet (program FLb7fyAtkfA4TSa2uYcAT8QKHd2pkoMHgmqfnXFXo7ao); Solana's secp256r1 precompile checks each approval. A pre-order, a milestone's funding, a commitment to buy, a receivable's sale, an advance and its collection are each signed by the person's own passkey. The server only pays the fee and relays.

The journal is hash-chained; its Merkle root is anchored in a Memo transaction. Sibyl is the agents' working memory beside it: lexical search only, a 5 MiB free store, no tamper evidence and no sync, so the proofs stay on chain and in the journal.