Trust model

What the chain proves: unlock payments, payouts, refunds, burns and proof records are Solana transactions anyone can read. The ticket's commitment is fixed before anyone pays, and the buyer's browser checks the decrypted archive against it.

What the judge proves: the report and its hashes, and that the binary it built from the committed archive matched the original on every case of the corpus. Anyone can re-run a verdict with the published replayer and corpus.

What you trust the operator with: the operator's server holds the judge's X25519 secret, so it can read K, and with it any archive, at any time. The unlock step uses it to reseal K to the buyer. Nothing here claims more than that: the encryption keeps archives away from everyone else, and the server is the gatekeeper of the key. Escrows and the vault are keys held by the operator, not a Solana program.

What a PASS means: the rebuilt source behaves like the original on the corpus. It is not a formal equivalence proof for inputs the corpus never reached.