Appearance
Where the money goes
Each product, in three steps: how money comes in, where it waits, and who gets paid. Each step names the rail it runs on.
The short answer
- Only Stripe moves money today, and only with a test key. It handles card payments for Cinemark tickets and the card hold when a shopper uses a gift card at the register.
- The blockchain parts are an option and a design, and we are finishing them alongside Stripe. AI agents can pay for Cinemark tickets in stablecoins; that has run twice on a test network. The cash advance and the vault were designed around a stablecoin escrow contract. One for gift cards is now built with its pages (Salvo Pay), and pays at the same till as a card. Since 2026-10-10 it is deployed on Tempo's test network, and its second version since 2026-10-13; both live smokes passed. It is not reviewed, and it is off unless a server sets
ESCROW_RAIL=testnet. - "Just in time" means when we match, not what money runs on. A card stays with its owner until a shopper is about to spend. It works the same on cards or stablecoins.
- Nobody is paid out yet. Every listed gift card and every Movie Club credit belongs to the operator, so there is no seller to pay.
The one idea behind all four
- HolderHas value they will not use: credits, a gift card, spare card limit
- BuyerIs about to spend at that exact place
- SalvoMatches the two at that moment, not before
- BuyerPays less than face value
- HolderGets cash for value that was going to waste
Matching only when a buyer is ready is what "just in time" means. Nothing is bought ahead, so nothing sits in stock and no money waits for a buyer who may never come.
Why that matters is on The core thesis. It is about stock and fraud, not payments.
The money map
Stripe card payments Stablecoin a blockchain None no money moves, or not decided
1. CinemarkTestnet, test key
Money inStripe The buyer pays by card. Stablecoin Or an AI agent pays in stablecoins, on Base or Tempo.
Waits inStripeStablecoin Our Stripe balance, or our wallet for stablecoins, until the ticket is bought. No ticket 90 minutes before the film means a refund, the same way they paid.
Paid outNone Nobody. The credits are the operator's own.
2. Gift cardsTest key only
Money inStripe The shopper saves a card once, on Stripe's page. Nothing is charged when they type the total.
Waits inStripe Holds on the shopper's own card, all placed at the one tap: one per gift card, and a deposit for what the last card leaves. Those holds are the escrow.
Paid outStripe A gift card that worked: its hold is charged for what it covered. One that didn't: its hold is cancelled. The deposit is released when the next shopper uses the rest. No seller is paid yet.
2b. Gift cards, crypto railTestnet, not reviewed
Money inStablecoin The shopper's own test dollars, inside a weekly allowance their passkey signed on their phone. One tap at the till, no wallet prompt, for only the value used, plus a deposit at face on what is left on the last card.
Waits inStablecoin
SalvoEscrowV2, a contract with no owner and no admin. Paying it and opening the cards are one transaction. The deposit comes back when the next shopper's use of the rest holds up, and pays the seller if it was spent. (SalvoEscrowV1 takes no new sale; what it sold still settles.)Paid outStablecoin To the seller's own address, 24 hours after each sale (72 if the shopper disputes). Anyone can trigger it. Only the seller can refund.
3. Cash advanceCode only
Money inNot decided The buyer pays a discounted price. Nothing in the code says how.
Waits inStablecoin Designed as a contract on Tempo, with idle money earning yield in Morpho on Base. No contract exists.
Paid outStablecoin To the cardholder in stages, on the chain the money came in on. Most on delivery, the rest after the return window.
4. LoyaltyDesigned only
Money inNone Nothing. You spend points you already have.
Waits inNone Nothing is held.
Paid outNone You get more for the same points.
Online gift card redemption is left off the map because nothing in the app starts one. See Three kinds of gift card.
How much touches Stripe
| Today | Planned | |
|---|---|---|
| Cinemark card payments | Stripe Checkout, test key | Same |
| Gift cards at the register | A hold on the shopper's saved card, test key | Same, once Stripe approves it |
| Stablecoin payments | Not Stripe: x402 on Base, MPP on Tempo | Same |
| Cash advance escrow and yield | Not Stripe: a stablecoin contract and Morpho, neither live | Same |
| Gift cards for test dollars (Salvo Pay) | None of it: the shopper's own account pays the escrow contract on Tempo's test network, at the till. Deployed there on 2026-10-10 and 2026-10-13, not reviewed | Testnet first, after the custody review |
| Paying sellers and cardholders | Nothing pays anyone | Not decided |
So the product you can test today, gift cards at the register, runs entirely on Stripe. That is because the shopper is at a till with a card or Apple Pay, not a crypto wallet.
What the blockchain is for
The Stripe path needs Stripe's permission. The original design needs nobody's, and it is being finished alongside Stripe, not instead of it.
| Part | What it gives | Today |
|---|---|---|
| Stablecoin payments | Payments nobody has to approve | 🟢 Tempo testnet, two orders. 🔵 Base built, never run |
| The Lit vault | Card numbers we cannot open alone, once its unlock rule reads the escrow contract. On Lit's service, Lit's release multisig still could. Running our own copy moves that power to whoever approves its releases, so those approvers must not be us alone | 🔵 Rebuilt for Lit's current service. Its live smoke passed on 2026-10-10. Custodial for now: the only unlock rule we can write today is "our server signed this". Every card is recorded as the operator's and sealed in the ordinary vault, including any card a stranger types into the public sell screen (an open decision) |
| An escrow contract | Money nobody can move alone. The shopper's payment and the card opening are one transaction. The seller is paid 24 hours later, or 72 hours after the purchase if the shopper disputes, and anyone can trigger that. Only the seller can give money back. Nothing goes back to the shopper on a timer | 🔵 Built (SalvoEscrowV1), with the live testnet scripts, the routes, the keeper and the Salvo Pay screens. Deployed on Tempo's test network on 2026-10-10, and its live smoke passed on Lit. Not reviewed |
| A fallback route | If our servers go down: encrypted listings kept outside our database, a bare page anyone can host, and Lit checking the contract before it unlocks a card | 🟡 Designed as a later phase, not built |
The escrow is also half of how we stay out of money transmission, and a public book of listings needs hiding before it goes on chain. See Money transmission and Hidden intents.
Two gaps to close.
- Lit now runs the unlock rule inside its enclave, but the only rule we can write today is "our server signed this", so we can still open any card alone. "We cannot open it alone" becomes true when the rule reads the escrow contract instead. That contract and its rule are written, and since 2026-10-10 they run on Tempo's test network and on Lit, but they are not reviewed. "Nobody can open it alone" needs more: Lit's release multisig (2 of 4, all Lit's, no timelock) decides which code gets keys, so on Lit's service Lit alone could open a card. Running our own copy takes Lit off that list, but puts whoever approves our copy's releases on it. If that is us alone, we could approve code that reads the keys and open every card. So it also needs release approval we do not hold alone: signers we do not control, and a review delay (a timelock) before a release runs.
- The original design split the vault's keys across independent nodes. Lit retired that network. Its current service derives keys inside a secure enclave and is reached with an API key, so Lit could cut us off. ChainSecured mode would put our account's rules under a wallet we hold, so an API key alone could not change them. We have not switched to it. It does not stop Lit switching the service off. Only running our own copy answers that, and Lit's service is open source. One catch, not yet confirmed: our own copy would almost certainly derive different keys. Cards sealed on Lit's service would then have to be listed again. The escrow version needs a seller-approved way to move a card from day one.
If our servers vanished today. Sellers still have their cards, because nothing was handed over but a copy of the number. A shopper's card hold drops off by itself within about a week. The stablecoin escrow is on a test network and holds only test dollars. It needs nobody: anyone can trigger a seller's payout, and a seller can refund a shopper directly. Nothing comes back to a shopper on a timer, so their money comes back only if the seller refunds. A card a phone already loaded stays on that phone, sealed, and its code still draws with no signal. New purchases would wait for the fallback route, which is not built.
A gift card at the register, step by step
- OnceThe shopper signs in with Face ID and saves a card on Stripe's page. Nothing is charged
- At the tillTypes the total and taps Pay once. We hold each gift card's price on their card, and a deposit for what the last card leaves
- CashierScans "1 of 2", then "2 of 2". Card 2 shows only after the shopper taps Next
- AfterIt worked: each hold is charged for what it covered. It didn't: the hold is cancelled. At Target and Walmart, once the next shopper's scan shows it
A purchase uses up to five gift cards, two unless the shopper asks for more: all of each but the last. What the last one leaves stays on it for the next shopper at that store, with this shopper's deposit behind it at face value. The deposit is released when the next shopper uses the rest, a week at most. We hold up to $200 per saved card at once, deposits included. A code opens only in a browser signed in to the account that saved the card, or the one that saved it.
If nobody answers. At Best Buy and Nike we read the balance and settle on that. At Target and Walmart we cannot read a balance, so no answer by 20 minutes after the code closes counts as used, and the hold is charged. Cancelling it handed a free card to anyone who said nothing. The shopper can still report a problem for 48 hours.
If the shopper says No at Target or Walmart. The hold is kept, and the card goes to the next shopper first. Their scan works: the hold is released. They say No too, for any reason: the hold is charged at the normal price, and they are refunded from their own hold. A kept hold lasts a week at most; released before anyone tried the card, it leaves the card marked, so the next shopper's No refunds them instead of charging them for it.
A hold cannot outlive its order. A card hold lapses on its own after a few days. A sweep every 15 minutes cancels any hold that is close to lapsing, or that belongs to an order that is already over.
Status. 🔵 Built and tested against a stand-in for Stripe. It has never run against Stripe itself, even on a test key, and no code has been scanned at a real register. A live Stripe key is refused: nothing is created or charged. The till and the one account above (unified account, phases 1a and 1b) are built and tested offline, and not deployed.
Why Stripe has to say yes
Stripe lists this as a restricted business: allowed only with their approval. Their wording covers selling stored value "issued by anyone other than the seller". Target issues the card and we resell it, so that is us. See Stripe's list.
It is not a sign-up formality. Run it without approval and, once Stripe notices, the account is closed and the money in it can be held for months. Stripe can also report the business to the card networks' shared blacklist (MATCH), which keeps it away from every card processor for five years.
| Option | What it fixes | What it costs |
|---|---|---|
| Ask Stripe now, while it is all test mode | Everything, if they say yes | Nothing to ask |
| Apple Pay | Nothing. It is a wallet, and it runs on a processor like Stripe | |
| A high-risk processor | Takes businesses Stripe will not | Higher fees, and part of the money held back for months. That eats a discount of a few percent |
| Stablecoins | No card network to approve us | Shoppers at a till do not hold them yet; see the stablecoin allowance on the roadmap. Whether we need money transmitter licences turns on whether we control the money, on any rail; see Money transmission |
What helps the case with Stripe, and where each stands:
- Low limits: $200 on hold per shopper, $500 a day of gift card sales in total. Built.
- A balance check before a code opens. Built for Best Buy and Nike only.
- The shopper is never charged for a card that did not work. Built.
- Checking who the seller is. Not built.