Protocol.

The market is one program, and everything else is a client of it. This page names each piece, says what it may and may not do, and says what happens when it stops. Everything on it can be checked from outside.

Where the rules live.

One canister on the Internet Computer holds the Board, the Throne, the Wall, the prices, the journal, the points and the parameters. It has no administrative door for editing what it holds: the operator can set parameters, each change being a journalled line, and can pause the market to stop harm, and can do nothing else to a place, a price or a line. Anyone can read all of it without an account.

How a purchase becomes a line.

The relay is the only program allowed to write to the canister, under one cryptographic identity, and it writes only after Stripe has confirmed the money. Every paid action follows one order: the canister prices, Stripe authorizes the card, the canister records, Stripe captures. If the canister refuses, the authorization is cancelled and nothing is charged. The relay holds no rule of its own: everything it asks for, the canister may refuse.

Where the relay runs.

A Node service on Fly.io, in two instances, with a managed Postgres database at Neon in Frankfurt. The database holds sessions, Stripe references, link reviews, reports and click counts, the things a payment rail needs and a public ledger must not carry. It is backed up every night, and every backup is read back and checked against the canister, because a backup nobody restores is a hope.

How the money moves.

Stripe takes the card, runs a 3-D Secure check on every first card and above published thresholds, and pays sellers into their own connected account seven days after the sale. The split of a sale is a parameter of the canister and Stripe executes it, so the house never holds a seller's money. A refund, a dispute, a reversed transfer or a failed payout comes back to the relay as a signed webhook and reaches the operator at once, by email and in the log; the sale itself is reversed only by a person, through the published procedure, which gives back exactly what it took.

How a paid action is gated.

Cloudflare Turnstile issues a one-time token before a purchase, a take, a post, a price change and a walk-away. It runs in its cookieless mode and stores nothing on the device. It exists because the click count is the market's price signal, and a counter anybody could inflate would price nothing.

Where the pages are served.

Cloudflare Pages serves fourteen static language directories, under a content-security policy that allows no inline script and no inline style. The site holds no secret and no money path: it reads a snapshot, renders it, and sends every write to the relay. With scripts off, the Board, the rules, the journal and the Hall of Fame remain readable.

How a link is checked.

Every link is fetched for its title, description and icon, from public addresses only, with redirects and sizes bounded; it is refused if its domain is blocklisted or a link-shortener, checked against Google Safe Browsing, and then listed for a person to read. A link that fails is frozen: the placement keeps its rank and its display is hidden. A second freeze puts a spot into liquidation, ends a Throne tenure without refund, and removes a Wall post.

Who you are here.

A public X handle, obtained through OAuth, and nothing else: no password, no profile, no email read from X. The site never posts for anyone; a share card opens X's own composer with the text written, and the person presses send. Accounts that pay with the same card are treated as one for the limits on holding and trading.

How every event reaches the outside.

Up to three accounts on X, all of them one-way. @OpenFameTape posts every line of the journal as it is written; @OpenFameApp posts milestones under a daily cap; a mention bot, when it is switched on, answers a question about a link with the figures the Board already shows. None of them can write to the canister.

How you hear from us.

Transactional email only, through Resend: a receipt, a notice that you were outsold or that a fee was declined, the decision on something you reported, the end of a season you hold. The address is asked for at the first purchase, used for nothing else, and removable from your account. The sender is the one address on the contact page, so a reply reaches a person.

Where the house's share goes.

Thirty per cent of what the house keeps is converted into $ICP and staked in a Network Nervous System neuron locked for eight years, never dissolved. The neuron's identifier is on the Cashbook and anyone can inspect it on the Network Nervous System dashboard.

Where the token lives.

On Solana, minted on 29 August 2026: one billion $OPENFAME in locked accounts, both authorities destroyed. The token page carries the address, the state and what the token is for.

What the canister carries and the product does not.

The Candid interface names three mechanisms no page offers: places that open on a schedule up to a thousand, a place bought in somebody else's name, and a switch that closes the Wall on its own. They are built, they are dormant, and none of them can be reached from this site, which sells one hundred places that do not multiply, to the person paying, and whose Wall stops only when the whole market stops. They are named here because you can read them in the interface, and a page that says everything is checkable has to be the one that tells you first.

What happens if a piece stops.

The canister is the only piece that must be up for the record to exist, and it is the piece the operator cannot switch off. If the relay stops, no money moves and nothing is written, and everything already written stays readable. If the site stops, the canister still answers a program directly. If Stripe stops, quotes are refused rather than half-taken. If the canister were ever to run out of the cycles it burns to run, the relay watches its balance and raises an alarm weeks ahead.

Everything here is readable by a program, not only by a browser: the canister answers a typed Candid interface and documents itself, and the Board is published as JSON at a stable address. Programs are welcome to read it. Writing still goes through a person's account, and the door for programs opens in a later version, deliberately.

The interface is Candid, the Board is JSON at a stable address, the journal is RSS, and every page is in a sitemap. What a machine may do with any of it is stated in llms.txt and robots.txt; where to report a flaw is in security.txt; and who wrote all this is in humans.txt.