# Clean Sky hardening and checkout investigation
BB2G · October 12, 2026

## Verified payment route
The live Clean Sky proposal loaded an external quantum-safe.bornbetween2generals.com/embed.js badge. Clicking it opened the Quantum-Safe scanner, then its Pro subscription page, then a Stripe checkout visibly labeled "America's Future Inc sandbox". The checkout session used test mode and advertised Quantum-Safe Pro at $29/month. No payment was submitted.

This is a separate product route, not a Clean Sky app purchase. The concurrent payment investigation merged PR #6 removing the badge from Clean Sky and replacing it with a local, noncommercial status section. This hardening release preserves that work. This does not disable the separate Quantum-Safe service, change its Stripe credentials, establish its legal account ownership, or identify historical payouts. Those require authenticated Stripe account, payment and payout records. Never paste secret keys or bank/card details into chat.

The GitHub releases collection was empty at inspection. That does not establish zero downloads: website assets, source ZIPs, Git clones and copied browser code are separate channels. No download census or historical visitor count has been verified.

## Software changes and evidence
- Change approval now requires a requester identity, rejects that requester as an approver, and rejects a reviewer alias reusing the requester's registered public key. Two other distinct active reviewer keys must approve the same digest. Real identity/role enrollment remains unbuilt; callers must supply an independently authenticated requester and reviewer roster.
- Signed sensor reports can carry an event ID and sequence. A configured consumer suppresses repeated event IDs. The browser lab demonstrates session deduplication. Sequence ordering/rollback protection is not implemented by event deduplication.
- The verifier accepts an atomic consume adapter. tools/replay-store.mjs implements a local SQLite uniqueness store with synchronous=FULL and file permissions 0600. Missing or failed storage never authorizes evidence.
- Database reopen and fresh-process checks demonstrate replay rejection. This protects the retained local database; deleting or rolling back that database resets its history. Distributed reconciliation, independent rollback witnesses, retention limits, encryption at rest and authenticated enrollment remain integration work.
- Keep the SQLite database outside every served/deployed directory, in a private persistent directory. Use Node 22.13+ or Node 24. The public static browser lab continues to use ephemeral session keys and in-memory aircraft replay state; this release does not deploy a backend challenge service.

Example integration:
```js
import {openReplayStore} from './tools/replay-store.mjs';
import {verifyEvidence} from './assets/identity-core.mjs';
const store = openReplayStore('/absolute/private-directory/clean-sky.sqlite');
try {
  const result = await verifyEvidence(bundle, independentlySuppliedContext, pinnedTrust, store);
} finally {
  store.close();
}
```

Run `npm test` for the original security checks plus hardening checks. The flight/privacy integration in draft PR #5 is separate and is not merged by this change. Animated hero flight trails are preserved.

## Further work
Connect restart-safe challenge storage to the future authenticated service, enforce requester/approver role enrollment, implement signed sequence rollback controls, verify map association and privacy, finish mobile/browser checks, and inspect Stripe live payments/payouts through owner-authenticated access. Hardware, mesh radios, live feeds and agency integration remain unverified.