{"upl":"UPL-TECH-26-875258-EN","title":"DEMI Vault Gate v0.2.1 – private Vault for registered Main Files (built and tested, not deployed)","author":"Skydle","publisher":"UplitAU Pty Ltd","environment":"real","payment_verified":true,"tier":"starter","payment":"eth","payment_ref":"0xb3aa2a985fa481d87d84ada35ef9c8208d6a2d79441e7d0852dacc926ee8a651","amount_aud":"9.01","timestamp":"2026-11-02T23:27:24.942Z","registered_at":"2026-11-02T23:27:25.248Z","language":"en","file_name":"DEMI_Vault_Gate_v0_2_1.js","file_sha256":"a4790b9d9c364712c7e3de0dbd08db1b4c6f15a2fb05ed3f92cd819316b0ae80","extract_sha256":"6ad057a4efcbc8e902d60a37111566d437452a11c74569a52efa696773d8c058","derived_from":"UPL-TECH-26-667079-EN","description":null,"demi_core":{"core_statement":"DEMI Vault Gate v0.2.1 is a Cloudflare Worker providing private, fingerprint-gated storage for registered files, ensuring only Registry-known files enter, only owner-authorised links exit, and an AI assistant handles delivery without ever holding owner or Vault keys.","propositions":"T1: Separate Cloudflare Worker serves as the Vault Gate, operating independently from the main Registry | T2: Storage bucket demi-main-files holds registered files; a second bucket demi-private is intentionally network-isolated | T3: File ingestion requires SHA-256 fingerprint match against the DEMI record's main file or any listed alternate file; non-matching files are refused and nothing is stored | T4: Four permit levels per record — Closed (fingerprint public only), Private (owner-made links only), On request (owner decides per request), Open | T5: Egress is link-based only; links are owner-created, time-limited, revocable, and fully logged with timestamp and registry code | T6: Owner page generates links and a ready-to-send message; Claude emails it from the owner's account | T7: Claude never holds owner keys or Vault keys | T8: Recipients can independently verify file authenticity by comparing its SHA-256 fingerprint against the Registry","constraints":"Platform: Cloudflare Workers. Storage: bucket demi-main-files (active), bucket demi-private (no web connectivity by design). Ingestion rule: SHA-256 fingerprint must match main file or a file explicitly listed in the corresponding DEMI record — no exceptions. Permit system is per-record and must be enforced at both ingestion and egress. All links must carry expiry; revocation must be supported. Every action must be logged with timestamp and registry code. AI (Claude) operates only on owner-page output; it must not be granted access to owner keys or Vault keys. v0.2.1 is built and tested but not deployed. No selling or payment integration exists in this version.","mechanisms":"T1: Verify Worker is isolated from Registry codebase and deploys independently | T2: Confirm demi-main-files accepts uploads; confirm demi-private has no public or Worker-accessible route | T3: Submit a file with a correct SHA-256 — confirm storage; submit a non-matching file — confirm refusal and zero storage side-effects | T4: For each permit level, attempt access via each allowed and disallowed path and confirm correct allow/deny behaviour | T5: Generate a link, let it expire, attempt access — confirm denial; revoke an active link, attempt access — confirm denial; check log for timestamp and registry code after each action | T6: Simulate owner page flow — confirm link and message are produced; confirm Claude sends email without receiving keys | T7: Audit Claude integration points for absence of key parameters or storage credentials | T8: Hash a delivered file independently and compare to Registry record — confirm match","boundaries":"Out of scope for v0.2.1: deployment to production, payment or commerce functionality, any selling workflow. demi-private bucket is intentionally excluded from all web access and has no defined use case in this version. Planned but not built: v0.3 adds Lemon Squeezy payment integration without altering the Vault Gate design. OPEN: behaviour under Open permit level is named but not described in detail — it is unclear whether Open permits unauthenticated direct download or still requires a link. No detail given on link expiry duration options, log storage location, or how 'On request' notifications reach the owner."},"core_withheld":false,"core_publication_basis":"Self-registration: UplitAU registering its own work from its own wallet. The author is known to the Registry operator because they are the same party; the Ethereum payment itself identifies no one.","costs":{"claude_aud":null,"openai_aud":null,"service_aud":null,"total_aud":null},"landing_page":"https://demicapsule.com/registry/UPL-TECH-26-875258-EN/index.html","visibility":"listed","product":"capsule","core_requested":true,"provenance_manifest":{"scheme":"DEMI-Provenance-Manifest/1","algorithm":"SHA-256","computed":"in the author's browser","files_listed":2,"files":[{"name":"Vault_Deploy_Steps_v0_2_1.md","size_bytes":2781,"sha256":"f62b2ce9558794b4652da2cf310b9232d2d7dfab2fa6e81d4e4d8a465821d028"},{"name":"Vault_v0_2_1_Build_2026-11-03.md","size_bytes":1604,"sha256":"e7b9fdbdc49450c6cefbebcdb2ef978a9a4146a8dd156f5a05e45f796b98ff55"}],"note":"These files were fingerprinted by the registrant and were never uploaded. The registration time applies to each fingerprint: a fingerprint cannot be produced without the file it describes. This record does not establish authorship or ownership of the files named."},"activation_reference":"DEMI:1042:UPL-TECH-26-875258-EN:X","ai_fetchable":true,"amount_eth":0.002634,"payment_value_aud":9.01,"payment_rate_aud_per_eth":3419,"payment_rate_source":"etherscan ethprice","core_sha256":"91268cf8e2ea4dad617c3e723f4dc6300e54388d57c37f0caf759f070325681c","core_status":"formed","anchor_tx":"0xdb5e892fa2ec6f3d898050038cdbffc4e49229c446a3674eb40c3bab276c6aa5","anchor_submitted_at":"2026-11-02T23:27:27.697Z","anchor":{"status":"confirmed","tx_hash":"0xdb5e892fa2ec6f3d898050038cdbffc4e49229c446a3674eb40c3bab276c6aa5","etherscan_url":"https://etherscan.io/tx/0xdb5e892fa2ec6f3d898050038cdbffc4e49229c446a3674eb40c3bab276c6aa5","block_number":26330378,"block_time_utc":"2026-11-02T23:27:35.000Z","submitted_at":"2026-11-02T23:27:27.697Z","digest":"6ac8e56c2a9dd20913e4185f4c3ea87b5e783037f892ed09b97981a0df50adf5","snapshot_url":"https://demicapsule.com/registry/anchor/6ac8e56c2a9dd20913e4185f4c3ea87b5e783037f892ed09b97981a0df50adf5.json"}}