immutable-drive

Pay once for a drive of files and get an IPFS address whose contents are funded to stay on Filecoin for 100 years. Filecoin sells storage month by month, so the service deposits the whole term up front into Filecoin Pay, with a margin for price rises, and publishes enough on chain and in a signed, hash-chained ledger for anyone to check the funding. The browser builds the drive's CAR file itself, so the address is known before anything is uploaded. Tested on Filecoin's calibration testnet, never on mainnet.

How a drive gets stored

The server takes the CAR in resumable chunks and checks it before any payment: one root, the quoted size, every block hashing to its CID, no block that no file points to, and per-file screening that refuses executables, encrypted files, archives and large opaque blobs. A refused drive costs nothing. Payment is by card through Stripe or by wallet in USDFC. A worker then funds an account for that order alone, uploads to two providers, waits for the IPFS indexer, appends a signed ledger entry and seals the drive, after which nothing can be added.

Prices are read from the on-chain price list for every quote. Vault keeps two copies in separate data sets and costs about $500 for the smallest drive, because Filecoin's proving fee is per data set; Single keeps one copy for about half that; Shelf keeps two copies in shared, pooled data sets with a $5 minimum.

An endowment nobody can drain

In the first phase the operator holds each order's account key, so a leaked seed could withdraw unlocked funds. Phase 2 moves the money into one contract per copy with no withdraw path. Funds leave only by release, to a beneficiary fixed at creation, after the data set is deleted; by migrate, to a sibling endowment from the same factory that holds exactly the same pieces and is proving, once the original data set has ended or gone unproven for half the inactivity window; or by refund, before the data set exists. A third contract gates every write: only the curator adds pieces until the drive is sealed, and removal needs a legal demand filed on chain and waited out, one to seven days, with no wait for court orders or child safety.

Stated honestly

• Verified on the calibration testnet with throwaway funds: the gateway three times, one full order over HTTP paid by wallet and sealed in about ten minutes on a term shortened to three months, sealing enforced on chain, legal removal, and the Phase 2 contracts live. The README counts 144 tests for the rest.
• Never run: mainnet, a real 100-year deposit of about 440 USDFC, Stripe itself, a refund with real money, the Shelf tier, and failover between real providers.
• The Phase 2 contracts are unaudited and refused on mainnet unless explicitly overridden. The terms and copyright policy are drafts no lawyer has read, and no DMCA agent is registered.
• The daily ledger snapshot never pins in real mode, because nothing provisions the account it uses. The ledger is still served and verifiable.
• No commits yet, and not deployed.