[test] Receipt-bound feedback; polymarket-search reads the keyword index

[MikeyPetrillo]

POST /api/feedback {tx, verdict, reason} $0.001. The credential is the settlement transaction: the ledger records who paid for each call, so a row can only be written by that wallet, about that call, once.

The receipt is the right to speak. The wallet comes from the signed EIP-3009 authorization; the route is identity-bound like attest and receipts, so a rail whose payer we cannot verify never sees it and is never charged. A wallet in the body changes nothing, and the two refusals (unknown transaction / not yours) are the same sentence and name no slug, so a stranger learns nothing about whether a transaction is ours or what it bought.

One payment, one verdict. sale_feedback.tx is the primary key and the write upserts. A buyer may change their mind; they cannot stack five ratings on one call.

Two verdicts, not stars. A scale invites an average, an average invites a ranking, and a ranking built on a handful of self-selected reviews is a number that looks like a measurement and is not one.

What this has over a payment-only rating: we already record sha256 of the exact JSON bytes each call served, so a verdict is bound to a specific answer, not only to money moving. A bad verdict requires a reason and is logged with the slug and that digest; the digest rides back on the receipt so the buyer can hash their own copy and confirm they are rating what we served.

The buyer's words go to the log and to /__operator/sales.json (no payer address) and are never published. The public tally, GET /api/feedback/summary, is counts only with raters as distinct payers, bad counts printed beside good ones, and is PoW-eligible: honest ratings should be free to read.

The $0.001 is the facilitator's settlement floor and is there because the payment is the identity, not as a charge for complaining. Every refusal is a >= 400, so it cancels settlement and costs nothing.

scripts/test-feedback-kit.js (54, offline, in CI) with seven mutations killed: the payer match, divergent refusals, the bad-reason requirement, the log line, DISTINCT raters, the upsert, and a body-parameter fallback for the caller. Four corpus cases; free-tier egress probe, both catalog sweeps, cross-surface, MCP self-consistency and the ledger suites green locally.

🤖 Generated with Claude Code

Also in this batch: polymarket-search could not find "bitcoin"

Caught by the nightly corpus. The match has always been ours (exact substring over question, slug, description), but candidates came only from the volume-ordered list, so findability was a function of search depth. The 08-29 fix paged to 600 rows and named "bitcoin" as one of the terms it restored; a fortnight later it read 0 again, and a hand sweep of the first 3,000 active markets by 24h volume found not one — Fed and football own the top of that list.

Gamma does have a keyword index (/public-search?q=), and the comment in our own code saying it does not was wrong. It is fuzzy (a gibberish query returns a Copa America event), so it is a candidate source and our exact predicate still decides: the index supplies reach, the predicate keeps precision, and an unmatchable query still returns the honest zero. The volume scan stays as fallback and top-up, so an index that changes shape degrades the tool to yesterday instead of emptying it.

Measured after: "bitcoin" found in 57 rows and one request, where it was 0 in 600 rows and six. New searchedKeywordIndex, and searchExhausted is now honest — the old expression would have claimed the whole active list was read the moment the index filled the page without the scan running. Six mutations killed.

The corpus case asserting ethereum news in a 48-hour window was my expectation, not a defect (104 items in that window, 39 matching bitcoin, zero matching ethereum); it now asks for the best-covered asset and records why.