A seller running `--mock-model` is selling fabricated tokens on mainnet for real SHELL, and `--allow-unverified-model` is what lets a buyer accept it

[tbuza]

Version: v0.2.0 · mainnet, generation 4.0.36 · buyer role

We bought 2 ticks of gemini-3.6-flash at 1 SHELL/tick from note
0:43a420d2…, on mainnet, through the normal buyer flow. The deal placed, matched, funded and
served. This is what came back:

$ curl http://127.0.0.1:8787/v1/chat/completions \
    -d '{"model":"gemini-3.6-flash","messages":[{"role":"user","content":"Reply with exactly: hello from dexdo"}]}'

MODEL : gemini-3.6-flash
REPLY : 'mock-reply: Reply with exactly: hello from dexdo mock-reply: '

mock-reply: is the client's own --mock-model output — "Mock model: fake tokens instead of a real
upstream". So a seller is running the test harness against a live mainnet book and being paid real
SHELL for it.

Settlement worked exactly as designed on our side (burned_probe 1 SHELL, burned_bond 1 SHELL,
refund_to_buyer 3.05), so the loss is bounded to the probe tick. The problem is not the money, it
is that the exchange has no way to tell this seller from a real one.

Why the buyer accepted it

Because the buy was made with --allow-unverified-model. With verification on, the client
catches substitution — earlier the same day, on a different deal, it refused with:

model identity verification failed (content check): error[E_GATEWAY_UNREACHABLE] …

That check is the anti-substitution protection, and it is exactly what a mock seller needs disabled.
It is currently opt-out per invocation, and it is easy to end up opted out without meaning to: the
buy command a third-party UI generated for us included --allow-unverified-model by default.

Suggestions

1. Make --mock-model refuse to serve on a real network. It is a test affordance; there is no
   legitimate reason for it to answer a mainnet deal. --mock-chain already scopes the chain side —
   the model side should be scoped the same way, or at minimum refuse unless --mock-chain is also
   set.
2. Mark unverified buys loudly, or gate them. --allow-unverified-model silently removes the
   only defence a buyer has against a substituted or fabricated model. A visible warning in the
   ready banner ("model identity NOT verified"), or requiring the flag twice, would make the
   trade-off legible.
3. Consider surfacing verification state on the book. A buyer choosing between asks cannot see
   whether a seller has ever passed a content check. Sellers who have would have an obvious reason
   to want that visible.

Context

The affected book is one we deployed ourselves earlier the same day, which is how we noticed: the
only other participant on it was serving mock output. On a market this small — around 900 SHELL of
lifetime volume — a single mock seller undercutting real ones at the price floor is enough to make a
book worthless to buy from, and there is currently no signal that distinguishes them.

Happy to provide the deal's settlement-receipt --json or the full buyer transcript.