Create

Case study

One loop, fully shipped

A production-shaped slice on Cloudflare Workers + D1 + Pages - Ed25519 signed writes, replay-protected mutations, mechanism-visible scan UI, and automated Worker tests.

Create a live object, scan it from another device, update the public line, revoke it, and prove recent control without changing the printed mark.

What ships today

Create Scan Update Revoke Live control

The same printed QR keeps working because the network answer changes over time, not the ink.

  • Stack Workers + D1 + Pages
  • Security Ed25519 + replay protection
  • Outcome Live state on a fixed physical mark

Walkthrough

  1. Create

    Browser-signed

    Generate keys in the browser, sign card + QR, and POST to the resolver. Keys stay on your device unless you save recovery or encrypted backup.

    Create a status plate

  2. Scan

    Mechanism-visible

    Open the scan link from another phone. The pass UI separates card status, QR credential, human trust, and limits so the viewer sees what the system actually knows.

  3. Update

    Same QR, new answer

    On /created/, change the public line (status plate: object name + status). Same printed QR; the network returns the new signed manifesto.

  4. Revoke

    Owner-controlled

    An owner-signed revoke updates resolver state. The URL on the sticker still works, but the answer changes to revoked instead of live.

  5. Live control

    Recent possession

    The scanner requests a short-lived challenge; the owner signs on a key-holding device. This proves recent key possession, not legal identity.

The core point is simple: the object stays in the world while its network truth keeps changing.

What this proves

Physical continuity

One printed mark keeps working across create, update, revoke, and control checks.

Visible mechanism

The scan page shows status, credential state, and limits instead of pretending to know more.

Owner authority

Only the current key holder can mutate or prove control over the object.

What reviewers should look at

Honest limits

Scan does not prove the holder owns the object. Live control alpha does not prevent screenshot replay. Not KYC, not employment proof, not a social score. Merch does not grant vouched status.

Where to go next

Next What can a QR do?