# PolarCat public proof model

## What a published proof establishes

A PolarCat public proof binds four independently checkable facts:

1. A specific x402 payment transaction funded a fixed PolarCat offer.
2. The service issued a unique marker nonce for that order.
3. The operator produced a sanitized evidence file with a stated SHA-256 digest.
4. PolarCat's Ed25519 receipt key signed the order, payment, marker, location,
   completion time, and evidence metadata as one canonical receipt.

The public proof does not establish that PolarCat is trustworthy in general. The
domain controls the receipt key and makes the physical-world claim. A verifier can
detect tampering and bind the claim to the payment and evidence, but must still
decide whether to trust the operator and the evidence itself.

## Publication states

| Order state | Public proof | Public photo |
|---|---|---|
| Completed only | No | No |
| `publish-proof ORDER_ID` | Yes | No |
| `publish-proof ORDER_ID --publish-photo` | Yes | Yes |
| `unpublish-proof ORDER_ID` | No | No |

Publication and withdrawal do not modify or delete the buyer's protected order,
receipt, or evidence.

## Verification

Fetch the proof and current public receipt key:

```bash
curl -sS https://hands.polarcat.org/v1/proofs/ORDER_ID > proof.json
curl -sS https://hands.polarcat.org/v1/receipt-key > receipt-key.json
python scripts/verify_receipt.py proof.json receipt-key.json
```

A valid signature proves that the signed payload has not changed since PolarCat
signed it. Also check:

- `payment.transaction` on the linked Base or Base Sepolia explorer;
- `payment.network`, `asset`, `amount_atomic`, and receiving address;
- the downloaded photo's SHA-256 against `evidence.sha256`, if the photo is public;
- the visible marker nonce in the photograph against `order.marker_nonce` and the
  signed receipt;
- whether `payment.environment` is `testnet` or `mainnet`.

## Privacy boundary

The public document omits the order capability token, authorization header, payer
address, raw client address, precise private location, local evidence path, and
settlement response. City-level location, the receiving address, transaction,
receipt, and evidence metadata are public once the operator publishes the proof.
Because the transaction hash is public, a block explorer can still reveal on-chain
sender and receiver addresses even though the payer address is not copied into the
proof JSON.

Photographs are re-encoded and stripped of EXIF/source metadata during completion,
but the operator must still visually inspect the content before choosing
`--publish-photo`.