Threat model

• Bidder browser. Joins with an invite token (24 h, single use) and then a session token (4 h). It sees its own ceiling and nobody else's: redactForViewer in auth/authorize.ts drops any ceiling that does not name the viewer.
• Auctioneer browser. Holds an auctioneer token (12 h). It can control the auction and enter bids for bidders. It cannot create auctions or mint a successor link: both need the admin key (http/auctions.ts, http/auctioneer-token.ts).
• Screen display. Holds a screen token (12 h). A screen never receives ceilings or per-bidder frames, and sees public audit rows only.
• Operator. Sends the key in the x-admin-key header. With it: create an auction, rotate or revoke auctioneer links, list rooms, void all holds or release a review (/ops/...), read metrics, export the ledger and replay bundle. This is the most powerful secret.
• Stranger with a link. A token for another auction, an expired, revoked or edited one, or the wrong kind is refused (verifyToken returns unauthorized). An invite that was already used answers invite_used. A leaked auctioneer link is killed by the rotate endpoint, which raises a per-auction floor.
• Edge checks. Origin allowlist (PUBLIC_URL plus CORS_ORIGINS) on HTTP and both sockets, per-source rate limits (RATE_*, behind TRUSTED_PROXY_HOPS), body size caps and baseline headers: CSP default-src 'none', HSTS, nosniff, no referrer (http/security-headers.ts).
• Token door. A token is payload.signature, HMAC-SHA256 with TOKEN_SECRET. The server checks the signature in constant time, then audience, lifetime, kind, identity binding and the revocation list. During a rotation TOKEN_SECRET_PREVIOUS is accepted until TOKEN_SECRET_PREVIOUS_UNTIL. A secret under 32 bytes stops a production boot.
• Audio door. The /audio socket takes the auctioneer token as its first message within 5 seconds, never in the URL, then enforces rate, size and duration limits. Audio before auth closes the socket with 4401.
• Admin door. The header value and ADMIN_KEY are hashed with SHA-256 and compared with timingSafeEqual (http/ops.ts). In production the key must be at least 24 characters and must differ from TOKEN_SECRET (config.ts).
• Webhook door. The raw body is verified before anything is read from it, through PayPal's own verification endpoint with PAYPAL_WEBHOOK_ID (G4 PASS on real events; tampered-event rejection is covered against the fake only). The certificate URL host must be paypal.com or a subdomain. Bodies over 256 KiB are refused and only an event id and an outcome are logged.
• Inside the host. One Node process. Nothing here runs before a door check has passed. The engine still validates every bid, whoever sent it.
• Room, engine, ledger. The engine accepts or rejects every bid and appends it to the hash-chained ledger. A role table (auth/authorize.ts) lists which role may do which operation; anything not listed is denied.
• Payments. Holds, settlement saga and journals. Only the sandbox API host over https is allowed (payments/src/guard.ts), PAYPAL_ENV must be sandbox, and fake payments are refused in a production-like setting. The admin key can void all holds or release a review through /ops; the audit row names the actor admin.
• Voice bridge. Turns speech into bids that still go through the room gate and the engine. The bidder comes from the paddle that was heard, never from the token. Drop records leave the transcript out.
• Storage. Room log, ledger and settlement journals in files on a persistent disk (/var/data in render.yaml) or in Postgres through DATABASE_URL. The memory store is refused in production unless explicitly allowed.
• PayPal sandbox. Reached with OAuth client credentials (PAYPAL_CLIENT_ID, PAYPAL_CLIENT_SECRET) and nothing else. It sends signed webhook events back. The host name is fixed to api-m.sandbox.paypal.com; a CI check fails the build if source names the live host.
• Speech providers. Audio leaves the host only when VOICE_STT names Deepgram or Groq and its key (DEEPGRAM_API_KEY, GROQ_API_KEY) is set. The default build plays cached transcripts and sends nothing. The product tells people: "Audio is sent to a speech service to read bids. Do not speak personal data."
• GitHub Actions. Gate and nightly workflows read the sandbox app and buyer secrets from repository secrets (names such as PAYPAL_CLIENT_ID, SANDBOX_BUYER); values are masked in logs and never recorded. The gate workflows run in the sandbox-nightly environment and only from main.

Boundary crossings: browsers and the operator reach the host over HTTPS and WebSocket carrying a signed token or the admin key. The host reaches PayPal with OAuth client credentials. PayPal reaches the host with a signed webhook event. The host reaches a speech provider with an API key only when one is configured. GitHub Actions reaches PayPal with the sandbox secrets.