Care lesson complete. Save this robot’s learned gentle-dishwashing memory as a local IA.XYZ-style passport with provenance, guardian, hash, and revocation status.
Flavor only — not full ASL translation. This game pairs simple intent signals with gentle motion.
Lite mode keeps this off for speed. Mobile/Pro check it slowly, about twice per second, so older phones do not get overloaded.
One-minute demo script for the AI Mama Protocol Green Team: prove the game works, teach care, mint passport, verify locally.
Local only. No video saved. No upload.
Local prototype passport — not an official or resolvable ID. Generated on this device only.
Production version will bind this robot passport to a user-owned domain or subdomain.
Demo-only verifier: this checks the locally generated JSON shape, training hash, guardian field, provenance chain, and revocation status. No DNS, EPP, registrar API, blockchain, or production PROV-006 request is made.
Scan a Robot Passport QR from another phone, or paste exported passport JSON. Everything is checked locally: schema, SHA-256 recompute, sealed-vs-displayed field consistency, ECDSA P-256 guardian signature, co-signatures, and revocation snapshot. No upload, no account, no real DNS.
Every plate becomes a name the whole internet can already resolve — no new app, no new client software. Simulated here, on this device only.
The QR code is the front door. The Domain Name System is the road it is built on. A saved QR is a snapshot — live trust requires a registry lookup. That lookup is the product.
Production version will bind this robot passport to a user-owned domain or subdomain. This demo makes no DNS, EPP, or registrar calls — the path above is rendered, never fetched.
Environment A issues one guardian-signed passport and a registry that SIGNS live status. An opaque-origin verifier holds the credential and answers two sovereign receivers over direct channels. B admits with limited grants; C denies; revocation flips both; silence past the max status age fails closed.
Scope: the verifier and both receivers run in sandboxed opaque-origin iframes inside this one HTML — a browser-ENFORCED boundary, strictly stronger than the v82 same-origin worker. Still a controlled local prototype: no production network, external registry, or real DNS/EPP binding.
The passport proves what the robot learned. A separate signed permit proves what it may do now. This mission demonstrates a fresh admission, a guardian approval gate, agent-change detection, expiration, issuer key rotation, renewal, supersession of the old permit, and renewed admission.
The lifecycle layer binds the passport fingerprint and a deterministic capability-manifest hash. It does not rewrite the passport.
Rotation archives the old public key for historical verification while new authority is signed by a fresh key.
A valid signature is necessary but not sufficient: time, registry status, requested permission, capability binding, and guardian approval still matter.
The first short-lived permit will be issued with registry key generation 1.
Renewal will bind the predecessor hash, a new key generation, and explicit guardian approval for a higher-risk action.
Run the mission to create receipts.
Scope: lifecycle permits, issuer key rotation, guardian approval, deterministic clocks, and registry status all run locally in this one HTML. The demo proves the contract and failure paths; it does not claim production key custody, an external registry, or a deployed trust network. The passport schema and closed 14-field QR are unchanged.
What happens when the guardian goes silent? Signed, sequence-numbered heartbeats prove presence. A founder-signed mandate pre-names the successor and the exact silence threshold. Silence FAILS CLOSED to suspension — authority transfers only when the mandate and the successor's signed acceptance both verify, and the founder key stops approving.
Signed, sequence-numbered heartbeats prove the guardian is present. Replayed old beats never reset the silence clock.
The founder signs the mandate naming the successor key. The successor signs an acceptance bound to the mandate hash. Both are required — neither party can act alone.
Silence without a valid chain suspends the agent. The dead-man switch never opens access and never picks a successor on its own.
Issued while heartbeats are fresh. Suspension flips its live status without touching its cryptography.
Issued only after the mandate and acceptance verify. It links the founder-era permit so lineage is preserved, never rewritten.
Run the mission to create receipts.
Scope: heartbeats, the silence clock, the founder mandate, the successor acceptance, and both guardian keys run locally in this one HTML. The silence wait is real elapsed time, not a simulated clock. The dead-man switch fails closed to suspension; it never opens access. The sealed passport, its founder-guardian signature, and the closed 14-field QR are unchanged — authority extends by verifiable chain, and history is never rewritten.
Every child agent is chained to its parent AND one accountable guardian. Non-emancipation is structural: a child cannot detach itself from the chain. Revoke the parent and the registry recalls the entire subtree in one operation — fail-closed.
Demo-only parentage: session state, never persisted, never inside the closed qr.v1 QR. Production lineage, delegation, and subtree-recall proofs are the PROV-006 placeholder's future job — no production claim.
Environment A issues one guardian-signed passport and a signed transfer envelope with a deterministic lineage root. An isolated worker verifies both. Three receiving environments apply different local policies; stale status and live revocation must fail closed.
Run the proof to create a receipt.
Scope: the environments, MessageChannel status broker, transfer envelopes, isolated verifier worker, and receiver policies all run locally in this one HTML. This demonstrates contracts, failure behavior, and measurable decisions without claiming a production network, external registry, real DNS binding, or independent company deployment.
One robot. Five missions. Each green step comes from the real game state or the existing cryptographic proof result — never from a decorative checklist.
Play the three-dish curriculum. Gentle human motion becomes the robot's first accountable memory.
Create the stable robot identity, SHA-256 seal, ECDSA guardian signature, and closed 14-field QR snapshot.
A browser-isolated verifier and two sovereign receivers decide what the same credential may do.
Prove expiration, explicit guardian approval, key rotation, renewal, and supersession without rewriting the passport.
Signed heartbeats go silent, authority fails closed, and a pre-signed mandate plus successor acceptance activates generation 2.
Evidence boundary: the map is session guidance, not a credential. A mission turns green only from live state or an existing proof result. Durable technical evidence remains in the signed artifacts, hash-sealed receipts, Flight Check, and Full Evidence Package.
The smartest answer is not always an answer. Sometimes it is AH? — Ask Human.
The signed passport stays unchanged. The receiver evaluates the latest AMA receipt as a session-only authorization overlay.
Questions and play history stay in memory only and disappear when this page closes. No live chatbot or network call is used.
Everything the next AI developer needs: version chain, hard boundaries, a live session snapshot, and a live verification run. Local-only — copy or download, nothing is uploaded.
Readable demo summary for a pitch, parent, teacher, or future relying party. Generated locally from the passport; no upload, no account, no real DNS.
Past Robot Passports stored only in this browser. No upload, no account, no real DNS, and no public publishing.