Track record

What broke, when, who found it, how it was fixed. Monthly red-team results. Evidence-head watch protocol. Uptime samples that start empty and compound — not a fake 90-day 99.9%.

Surface updated 25 Sep 2026 · Public track record — incidents, monthly red-team cadence, evidence-head watch protocol, sampled uptime.

Incidents

Closed silently in a commit is not history. These are public.

2026-09-24-x402-header-paid · high · closed

x402 treated a payment header as paid

Found by. SCVD weekly crawl + internal red-team

How. A crawler (and then a red-team pass) posted Payment-Signature: not-a-real-payment to POST /v1/prefinality/evaluate. Presence of the header unlocked the paid route.

Broke. Paid x402 evaluate could return 200 as if facilitator verify had succeeded. A forged header was enough.

Fix. payment_verified() fail-closed. Header presence is never paid. Until facilitator verify is wired, every paid x402 call stays HTTP 402 — including non-empty X-Payment. Dev-only escape requires GATE_X402_ACCEPT_UNVERIFIED=1 AND GATE_DEV_MODE=1.

Closed 2026-09-24T23:18:01+00:00 · PR · still open: CDP facilitator verify+settle is wired in payment_verified(); unlock still needs CDP_API_KEY_ID/SECRET on Render and one real $0.002 USDC buyer settle on POST /v1/prefinality/evaluate. Forged headers must keep returning 402.

2026-09-24-spend-map-race · high · closed

Two tickets could spend the same job_id

Found by. internal red-team

How. Concurrent redeem of two bind tickets for one job_id could both pass before consumed_at was visible to the other writer.

Broke. Spend-map invariant 'one job_id, one spend' was not serialized.

Fix. consume_bind_ticket opens BEGIN IMMEDIATE, then rejects a second consumed ticket for the same job_id with reason job_already_spent.

Closed 2026-09-24T23:18:01+00:00 · PR · still open: Automated sqlite backup of /var/data/gate.db is still not shipped.

incidents.json

Red-team cadence

Monthly on the 24th. Results posted here each time. One pass is a moment. A published cadence is a state.

Next: 2026-10-24 · cadence monthly

2026-09-24 — x402 paid-route unlock, spend-map race, mouth fail-closed cases (FedNow / Nacha / CL7), buyer-surface demo smell.

Parked: Visa agentic chargebacks mouth — no agent-specific dispute spec in Visa §11

red-team.json

Evidence-head watch

Tree only grows. Root at size N must match merkle(leaves[:N]).

Zero independent watchers recorded. A second party running the watch script is what turns samples into checkable history. Invite: hello@velaru.xyz.

First-party (not independent): this repo's GitHub Action gate-watch.yml · every 15 minutes.

evidence-head.json · consistency · watch script · protocol JSON 

python3 gate/watch_evidence_head.py --url https://gate.velaru.xyz --cache /tmp/gate-head.json

Uptime samples

100.0% of 59 stored samples up

Percent of stored samples with health_ok. Not a contracted SLA.

uptime.json · /health

Three questions

What's the single failure mode that would take down every mouth at once?

One Flask process + one sqlite file on one Render disk + one deploy of gate-api. Mouths are routes on the same app, not isolated services. If the sqlite host, the Render service, DNS/TLS for gate.velaru.xyz, or a bad deploy of app.py dies, all mouths 404/5xx together. The receipt signing key is the other shared class: compromise does not take pages down; it makes every new receipt untrustworthy.

Category tested: False — Per-mouth cases were red-teamed. Shared-host / shared-key / shared-pipeline failure has not been chaos-tested as a category. No replica, no multi-region.

If a real customer signed tomorrow, what would actually break first?

Sqlite single-writer under concurrent redeem on one Render starter instance, with no automated backup of /var/data/gate.db. Bind Room redeem is the money path; a disk wipe or lock storm is the first honest break. Paid x402 now has a facilitator path but has not taken real USDC volume yet. One operator, no on-call rotation.

What's the cheapest thing that would make a skeptical buyer trust this in 30 seconds, that doesn't exist yet?

This page, filled in: named incidents with found/fixed/verify curls, plus an independent party caching evidence-head.json. Not a badge, not a fake customer. The missing 30-second signal was a public log a stranger can curl. Shipping it now. Second-party watch is invited, not claimed.

SCVD invite

Gate invites SCVD to treat https://gate.velaru.xyz as a standing weekly crawl target. Last week's header-as-paid catch was real. We want it repeated, unpaid, and public — not a one-time luck.

Subject: Standing weekly crawl target — gate.velaru.xyz

You caught Gate treating an x402 payment header as paid. That is now fail-closed HTTP 402 (PR #103, live-verified). Thank you.

Ask: keep Gate as a standing invited target of the weekly crawl, publicly. We will post what you find on https://gate.velaru.xyz/record.

Contact: hello@velaru.xyz
Health: https://gate.velaru.xyz/health
Evidence head: https://gate.velaru.xyz/.well-known/evidence-head.json

Send from hello@velaru.xyz. This page is the public invite; we do not claim they accepted.

Trust Live Bind Room