What a stranger actually sees

Every row below is a real HTTP request made when this page was built — one to the public URL and one to the internal address — not a state written down by hand. This page used to hardcode them, and after the surface went live it spent an hour telling strangers the board was unreachable while printing the working URL next to the claim.

Reachability, probed 08:29:08 UTC

Surface	Public URL	State	Note
Ratings board + lookup	https://stillosdigitalholdings.com/ratings/	LIVE PUBLIC	the hub a human lands on · public 200
Operator dossiers	https://stillosdigitalholdings.com/ratings/n/<host>	LIVE PUBLIC	one indexable page per rated operator · public 200
Sitemap of every dossier	https://stillosdigitalholdings.com/ratings/sitemap.xml	LIVE PUBLIC	declared in the apex robots.txt · public 200
Offer / pricing	https://stillosdigitalholdings.com/ratings/offer	LIVE PUBLIC	every price carries its derivation · public 200
Methodology	https://stillosdigitalholdings.com/ratings/methodology	LIVE PUBLIC	the five dimensions and what is NOT measured · public 200
Free redacted sample	https://stillosdigitalholdings.com/ratings/sample?host=	LIVE PUBLIC	a real dated finding, redacted · public 200
Machine lookup (free JSON)	https://stillosdigitalholdings.com/ratings/node?host=	LIVE PUBLIC	advertised in /.well-known/x402 · public 200
OpenAPI spec	https://stillosdigitalholdings.com/ratings/openapi.json	LIVE PUBLIC	this service describes itself · public 200
Lead capture	https://stillosdigitalholdings.com/ratings/lead	LIVE PUBLIC	POST-only; probed with an empty body it must refuse · public 400
Live traffic view	https://stillosdigitalholdings.com/ratings/traffic	PRIVATE (correct)	tailnet only BY DESIGN — carries visitor IPs · public 403
Recompute / dispute	https://stillosdigitalholdings.com/notary/verify	LIVE PUBLIC	already public and answering
Paid machine rail, proven	https://stillosdigitalholdings.com/settlement	LIVE PUBLIC	the rail this would reuse

Human funnel, as an outsider walks it

1	Lands cold	Sees 7,070 operators already rated, including possibly their own — no signup, nothing asked.
2	Looks themselves up	Gets a grade and a rank they did not ask for and cannot change by asking.
3	Sees a finding	14 rated hosts have a dated critical finding. If theirs is one, they see it free and redacted.
4	Gives an email	To claim the node or get the full report. This is the only capture point. Zero real leads so far — the 13 rows in the file are our own test and seed data, excluded by RFC-2606 reserved domain.
5	Pays	No checkout exists. Every tier is intent-capture; a human closes it by hand.

Machine funnel — the rail, probed live

An agent does not fill in a form. It calls, gets a 402, pays, and reads. That rail is already live on this domain and settles on Base — here is the real challenge it returned when this page was built:

GET /settlement?payTo=0x000…000
HTTP/1.1 402

PAYMENT-REQUIRED (base64 header, decoded):
{
 "x402Version": 2,
 "error": "Payment required",
 "resource": {
  "url": "https://stillosdigitalholdings.com/settlement?payTo=0x0000000000000000000000000000000000000000",
  "description": "StillOS Settlement Oracle — recomputable on-chain settlement evidence for a counterparty payTo (Base/XRPL/Solana): has it ever been paid, a FLOOR on how many distinct senders (paginated reads are truncated and labelled as such), with the raw reads + block height. Not a score. Verify against the chain yourself.",
  "mimeType": "application/json"
 },
 "accepts": [
  {
   "scheme": "exact",
   "network": "eip155:8453",
   "amount": "50000",
   "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
   "payTo": "0xfAB07d26F7627fc4cE459ecf90d7E015F7eEcE71",
   "maxTimeoutSeconds": 300,
   "extra": {
    "name": "USD Coin",
    "version": "2",
    "assetTransferMethod": "eip3009"
   }
  }
 ],
 "extensions": {
  "bazaar": {
   "info": {
    "input": {
     "type": "http",
     "method": "GET",
     "queryParams": {}
    },
    "output": {
     "type": "json",
     "example": {
      "payTo": "0x…",
     

body: {"x402Version":1,"error":"PAYMENT-SIGNATURE header is required (x402 v2). Paying x402 v1? Send the same payload in an X-PAYMENT header instead -- both are accepted. This body is the v1 challenge; the v2 challenge for this resource is in the PAYMENT-REQUIRED response header. network \"base\" here and \"eip155:8453\" there are the same chain.","accepts":[{"scheme":"exact","network":"base","maxAmountRequired":"50000","a

The ratings lookup is not on that rail yet. /settlement is x402-gated and proven; this server is plain HTTP with no payment middleware, so a paying agent cannot buy a rating today. Mounting it means putting the lookup behind the same @x402/express + self-hosted facilitator stack that /settlement uses — one wiring job, no new rail, no new wallet.

What generating real leads needs — in order

1	Public cutover	A Caddy route for `/ratings` → this port. Until then the entire funnel is invisible to everyone who is not on the tailnet, so measured demand is structurally zero. Gate: Marcus.*
2	Outbound to the rated	18 operators have a finding on their node and none of them know — 14 of them have a live dossier page to link, the other 4 are off the current board and get a finding page with no rating on it. That is the warmest list this box has ever held — a named host, a dated fact, and a free report. Gate: every send is a Hard Brake.
3	A payable button	One Stripe payment link per paid tier, written into `config/node-ratings-offer.json`. Gate: Marcus sets the price.
4	Machine rail mounted	The x402 wiring above, so agents can buy without a human in the loop.
5	Watchdog	This server has none. A crash takes the funnel down silently.

Every state above is a live probe of BOTH the public URL and the internal address, made when this page was built, with the status code printed beside each row so you can repeat it. The 402 is a real response from the live public endpoint. "TAILNET ONLY" means it answered internally and refused publicly; "PRIVATE (correct)" means it refuses publicly ON PURPOSE because it carries other people's request metadata.