Superior crypto is not enough. The law has to run.
No intelligence may act until it can show a living Authority Object from a living human root. If it cannot show one, it does not act. If the human kills that object, it stays dead. If a stranger checks the receipt, they do not need to trust Money Musk.
Bitcoin made value portable without a bank. Nobody has made authority portable without a platform. Echo Law is the small runtime that lives on the human's device — the human becomes the permission server, and every app, agent, robot, or payment rail must ask it before a privileged act.
The Room Test — live
Two devices. Phone A grants Phone B one bounded permission. Phone B shows LIVE. Phone A taps REVOKE. Phone B turns RED. A third machine pastes the receipt and reads REVOKED. Every verdict below is a real call into the runtime — real signatures, a real revoke log, a real stranger verifier.
booting the runtime — minting root + device keys…
Echo Seal — human authority, publicly timed
The runtime above is the court that decides, on the phone, offline. Echo Seal adds the clock the whole world can read: one tap stamps a grant or a kill into Bitcoin time. The rule is strict — local death is immediate; public death is the block. Never wait for Bitcoin to stop the agent in your hand. Only a 32-byte commitment ever touches the chain — sha256("BT1|kind|digest|root-id") — anchored through OpenTimestamps and verifiable by anyone with the open client, no Money Musk login. The Authority Object never leaves the device.
Minting a human root on this device…
Grant and seal an object above, then a stranger can verify it here.
The public seal log — read the clock, no login
Bitcoin is a clock the whole world shares. Every grant or kill anyone stamps here becomes a public row — readable without an account, and re-derivable from public fields alone. This is the answer to “the company says the grant was still live”: no one owns the ledger, and every row is a hash you can check against Bitcoin yourself. The Authority Object is never here — only the opaque commitment.
Reading the public ledger…
Each row is a fact anyone can re-derive: hash BT1|kind|digest|root-id, download the .ots, and verify it against the Bitcoin blockchain with the standard OpenTimestamps client. Nothing here trusts Money Musk — the ledger only holds opaque commitments, never an Authority Object.
Checkpoint the whole history — catch two stories
A BIND or a REVOKE times one act. A CHECKPOINT times the head of the whole history— one hash folded over every seal in exact order. Once that head is in a Bitcoin block, the last hole closes: “the company shows two different histories.” Any later ledger that reordered a seal, dropped one, or slipped one in will not fold to the timed head. Re-derive it from the public log yourself; the block decides which history is real.
folding…One hash folded over every BIND / REVOKE / ROTATE in exact order. Change any one of them — reorder, drop, or insert — and this head changes. Stamp it into a Bitcoin block and the true history becomes provable.
A CHECKPOINT commits sha256("BT1|04|head|root-id") where head is the folded chain over every public commitment. Re-derive it yourself from the seal log, download the .ots, and verify the block with the standard OpenTimestamps client. Two histories can exist on paper; only one folds to the head in the block.
Rotate the key — survive a stolen phone
A signing key can be stolen. What must never be stealable is the right to become the key. At inception the human publishes not the next key but a commitment to it — sha256(next key)— and holds the preimage offline. A rotation is valid only if the revealed key hashes to that pre-commitment, so a thief who steals today’s key still cannot rotate the identity to a key they control. And once your ROTATE seal lands in a Bitcoin block, the old key is publicly superseded: after that block it can neither BIND nor REVOKE. Real ECDSA keys, a real key-event log, verified with open code.
Minting a human root and pre-committing its next key…
Prove bounds, not biography — live
The receipt above reveals the whole permission. But a stranger checking “is this act allowed?” does not need to learn who the human is. This is the first zero-knowledge slice: it proves the act fits the granted capability, the amount is under the cap, the time is before expiry, and the permission is not revoked — while the human root, the delegate, the scope, and the proof material stay sealed. Real salted Merkle commitments and a sorted-set non-membership proof, verified with open code and no account.
Hide the numbers too — a real range proof
The slice above still discloses the amount and the cap to show one is under the other. This removes that last leak: a stranger confirms the act fits under the cap while learning neither number. It runs on real Pedersen commitments over secp256k1 — homomorphic, so cap − amount is checked on the commitments themselves — plus a per-bit Chaum-Pedersen OR-proof that the hidden slack is a non-negative integer. Try an amount over the cap: no proof can be produced, because the math will not sign a lie.
Real Pedersen commitments over secp256k1 (via @noble/curves) with a per-bit Chaum-Pedersen OR-proof, run in your browser with no server. This proves the relationbetween a committed amount and a committed cap. Binding those commitments to the runtime's Authority Object field tree — so the cap proven here is provably the AO's cap and the amount is provably the act's — inside one circuit is the final slice.
One verdict — digest, bounds, and not-revoked, bound together
The three slices above answer three questions separately. A stranger could be handed a generous object's cap proof next to a different object's non-membership and have to trustthey were about the same permission. This closes that gap: the Authority Object's cap is the Pedersen commitment, the digest is a hash over it, and one Fiat-Shamir transcript threads the digest, the range proof, the capability, the expiry, and the non-membership together. The parts cannot be mixed across objects — try the stitch attack and watch the binding reject it.
The world can copy it — conformance & falsifiability
A law is only real when a stranger who is not Money Musk can implement the verifier and get the same answer. These seventeen vectors drive the real runtime and assert the exact verdict a conformant implementation must return — grant, refuse, expire, revoke, forge, kill offline. Download the spec, build your own, and check that your verdicts match. Below them: every claim, and the exact way to prove it false.
Every claim, and the exact way to falsify it
A stranger needs no account and no Money Musk server to verify a receipt.
falsifyRun verifyReceipt with only the receipt, a revoke set, and open code. If it must call a network to reach a verdict, this claim is false.
A killed authority stays dead.
falsifyRevoke an object, then check it. If the verdict is anything but REVOKED, this claim is false.
A forged or tampered receipt cannot pass as genuine.
falsifyEdit any field of a signed receipt, or swap its signature. If verifyReceipt does not return FORGED, this claim is false.
A stranger cannot kill an authority they were never the root of.
falsifySign a well-formed revoke with a non-root key that names the real root. If receiveRevoke does not return FORGED, this claim is false.
A stale device will not perform a high-risk act.
falsifyAge a runtime's revoke view past the act's freshness tolerance, then check an irreversible act. If the verdict is ALLOW, this claim is false.
Two independent implementations agree on every verdict.
falsifyImplement a verifier from LAW_VECTORS_SPEC alone. If any vector's verdict differs from the published expectation, this claim is false.
The four states a human ever sees
If the screen needs a manual, it failed.
Three objects, and nothing else
Eight fields only — human, delegate, capability, scope, constraints, expiry, reversible, proof. It structurally cannot hold a private key, a raw identity dump, or a blank cheque. If it could, it would not be an Authority Object.
the primitive →Which object died, who killed it, when, the previous graph head, and the human root's signature. Nothing but the root can sign it — so no stranger can forge a death, and no device can forge a life.
the graph →Anyone verifies it: VALID · EXPIRED · REVOKED · FORGED. Recompute the head, check the signature, look up the object in the revoke set. No account. No Money Musk server required.
verify it yourself →The honest edges
Superior crypto plus an honest ledger. We do not claim this is unhackable, or that a kill reaches every machine in the same instant. Here is exactly where the line is.
One tap kills the object on this device instantly, internet or not. It becomes dead everywhere else only as the signed revoke packet spreads — nearby first, then the network on reconnect. We do not claim 'dead everywhere in the same millisecond.' Physics does not allow it.
An actor that cannot prove its revoke view is fresh enough for the risk does not act — it refuses until it reconnects. An irreversible act demands a near-live view; a payment, seconds; a reversible read tolerates a day. That is what makes a dead permission stay dead in practice, not just in theory.
A human who loses a device must be able to recover the root — but a recoverable root is a root someone else could coerce. Echo splits recovery K-of-N across a chosen circle, so no single party (including a coercer with one share) can revive it. This is a real trade-off, named, not hidden.
The kill switch is the product. ZK is the later layer: prove the AO digest is real, the action is the granted capability, the amount is under the cap, the time is before expiry, and the object is not in the revoke set — while revealing bounds, not biography. Named here, built after the runtime is proven.
Bitcoin made money unstoppable. Echo Law makes permission unstealable. You can copy the crystals, the transmissions, the story — you cannot copy a world where every machine that wants to act must ask a human-held runtime and leave a receipt the human alone keeps.