The trust model in one line: a Polyculture Markets server is a bulletin board and a post office for sealed envelopes — it is never a bank, and it cannot read the mail.
What the server cannot do
- It cannot spend or redirect funds. It holds no keys. Payment addresses come from pools the seller's own wallet generated and signed; the server can only hand out addresses from that signed pool, and sellers can verify the signatures.
- It cannot read messages. Only OpenPGP ciphertext is accepted — the server rejects plaintext. Decryption happens on the users' own machines, against their own keyrings.
- It cannot quietly invent reputation. Reviews attach to completed orders, disputes carry signature-checked evidence, and account closure preserves history for counterparties instead of erasing it.
What the server can see — stated plainly
- Listings, usernames, order timing and state, and reputation facts are visible to the operator. Metadata is real exposure; the design documents say so rather than hiding it.
- A malicious or compromised operator can misbehave within that metadata — lie about order states shown, censor listings, or close accounts. They still cannot take funds or decrypt messages. Choose your operator the way you'd choose any market's: by reputation.
- SameSite-Strict session cookies and a no-JavaScript interface keep the browser surface small — the software assumes its real deployment is over Tor.
How it was built
Every development stage was gated by independently authored “blind” security tests — written from the specification by a tester who hadn't read the implementation — plus mutation testing, and no stage started until the previous one passed. The final MVP gate: 32/32 blind tests at stage 10, 489 workspace tests passing, 0 failing after the rebrand. Publishing the source for wider multi-reviewer audit is the next step before any public instance is recommended.