The Counterparty Check — packet

# THE COUNTERPARTY CHECK — show-floor wrapper for PhoneIntel

**Item 4 · Horizon Works Q-Branch · 2026-10-31**
**Tool underneath:** PhoneIntel house seed — `~/workspace/phone-intel/`
(upstream v1.1.1, GPL-3.0, Laocoön grade CLEAN-ON-THIS-SCAN 2026-10-31;
house edit F-1 applied 2026-10-31 — the tool can no longer install anything).
**Custody:** the Protector of the Realms' bench, per the seed's PROVENANCE.md.
**Cost:** $0. **Status:** wrapper written; the tool itself is NOT yet
fixture-proven (F-2 is staged, unrun — see FIXTURES-4.md). Until the fixture
is graded, treat this packet as the *plan* for how the check will be used,
not as a cleared capability.

---

## What this is, in one paragraph

You are at a card show. Someone you have never dealt with wants to do a cash
deal. Before money moves, you run one quick lookup on the phone number they
gave you. The lookup reads public sources and tells you three kinds of things
about the *number* — where its block is from, whether spam-report sites flag
it, and weak hints about accounts registered to it. It tells you nothing
proven about the *person*. It is one more input next to your own judgment —
a hint sheet, never a verdict.

## When to run a check

Run one when **all** of these are true:

1. It is a **new counterparty** — first deal, no history with them.
2. It is a **cash deal** (or cash-equivalent: Zelle/cash-app style payment
   where a bad counterparty means no chargeback and no paper trail).
3. The number is one **they gave you for this deal**, or the number they
   have been texting/calling the house from.

Do **not** run one for: repeat sellers you already know · ordinary customers
at the table · anyone whose number you found somewhere other than from them
or from their contact with the house · "just curious" checks. Curiosity is
not the fence; see below.

## What the output grades mean

Every line of output belongs to exactly one of these three grades. If a line
cannot be put in a grade, it is filler — ignore it.

| Grade | What it covers | How much to trust it |
|---|---|---|
| **CARRIER / REGION — sourced** | Which carrier the number block was issued to, and the region the block belongs to (e.g. a 407 number is a Central Florida block). Comes from the number itself — the offline `phonenumbers` data. | The solid part. A mismatch means something ("says he's local, number block is from three states away") — worth a question, still not proof of anything. |
| **SPAM SIGNAL — per-source, unverified** | Whether spam-report sites (tellows, spamcalls-style sources) carry reports against the number, and what those reports say. | Other people's unverified reports, one source at a time. A flag means "someone complained," not "this is a scammer." No flag means nothing at all — a fresh or VoIP number shows clean. |
| **REGISTRATION HINTS — weak** | Hints that the number is or isn't registered with various services/accounts. | Weakest grade there is. These checks are known-flaky upstream. Never repeat a hint to the counterparty, never act on one alone, never write one down as a fact about a person. |

**Reading the three together:** the check can raise a question; it cannot
answer one. The strongest legitimate outcome is *"the number's block doesn't
match the story — slow down and use the normal deal protections"* (smaller
first deal, meet at the show table not the parking lot, count the cash,
get a name you can write down). The check never produces a "safe" stamp.

## The use fence (standing — from the seed's PROVENANCE.md, unchanged)

- Lookups are for **numbers that contact the house** (scam/spam triage) and
  **the owner's own deal counterparties at his own shows**, using the number
  that counterparty provided for the deal.
- **Public sources only.** No closed-platform automation. (Upstream's
  Instagram module is roadmap F-4: OFF by default in the house version —
  do not use it.)
- Results are **hints, never verdicts** about a person. Nothing from a check
  gets posted, shared, sold, or put in a listing. Nothing gets told to the
  counterparty ("my system says…") — the check is your private homework.
- **No Neutrino key anywhere.** The tool stays keyless (roadmap F-5). No API
  key in the tool's plaintext store, ever; if Neutrino is ever ruled in, it
  is a separate owner decision with the key in house credential storage.
- One lookup per counterparty per deal is the rhythm. This is a triage tool,
  not a monitoring tool — no repeat polling of a number, no lists, no bulk
  files of other people's numbers.
- House data law applies: a check that matters gets **one dated note** on
  the Protector's bench (date, show, number's grade lines, what you decided)
  — not a pile of terminal screenshots.

## The workflow — Chris, at a show, step by step

*Written for the floor: phone or laptop, two minutes, nobody watching a
"process." Do the steps in order. Stop anywhere — stopping is always fine.*

1. **Get the number from them, for the deal.** A text to your phone is
   perfect — "text me so I have your number for the deal" is a normal thing
   to say at a show. If they won't give a number at all, that is its own
   information; the check just doesn't happen.

2. **Open the tool the house way.** On the house machine: open a terminal in
   `~/workspace/phone-intel/`, activate the fixture venv (the exact commands
   live in INSTRUCTIONS.md and in the F-2 fixture script once it has been
   run), and run one command:
   `python -m phoneintel.main --info +1XXXXXXXXXX`
   (their number, with the country code, no spaces or dashes).

   If the tool answers *"Dependencies are installed deliberately by the
   house; missing: …"* — that's the F-1 house guard working, not an error
   to fix at a show. Skip the check, do the deal on judgment + normal
   protections, and tell Muse later.

3. **Read only the three grades.** Carrier/region first: does the block
   match the story you were told? Spam signal second: any reports, from
   which site? Registration hints last, and lightly — note them, weight
   them at almost nothing.

4. **Decide like you always decide.** The check adds at most one question,
   never a green light. Mismatch or spam flags → smaller first deal, stay
   at the table, normal cash discipline. Nothing flagged → exactly the same
   normal cash discipline. There is no outcome where the check replaces it.

5. **Write the one-line note.** Same day, one line on the Protector's bench:
   date · show · last 4 digits only in the shared note (full number stays
   in your phone, where they gave it to you) · grade lines in one phrase ·
   what you decided. Example: *"Oct 31 · Lakeland show · …0147 · block FL ✓,
   no spam reports · deal done normal."*

6. **Done. Don't re-run it.** One counterparty, one deal, one check.

## Known limits, printed on the packet (no surprises later)

- **F-3 still open:** one upstream source is queried over cleartext http.
  The `--info` workflow above is the offline number-block path; the
  `--search` / `--browser` / `--dorks` modes widen the exposure and are
  **not** part of this show-floor workflow until F-3 is closed.
- **F-2 still unrun:** the tool has never been executed in the house. The
  first real use is the fixture sitting, not a live deal.
- VoIP and freshly-ported numbers routinely show wrong or empty carrier
  data. An empty result is an empty result — it grades UNKNOWN, not clean.