REPLAY / SIMULATION

Frozen protocol fixtures. No live transaction, AI attestation or physical verification is claimed.

Mode & demo role
MENDMaintenance with memory

Privacy & trust

The interface must not lie for the system.

MEND separates cryptographic evidence, unavailable evidence, human decisions and physical-world claims. A repair can be approved by a person without pretending that a model or a hash inspected the bench.

Environment

protocol-v1 / fixtures-2026-11-10

This build is a replay recording. No live AI attestation, OutLayer callback, testnet transaction or physical verification is claimed.

REPLAY / SIMULATION

Evidence taxonomy

Four different things, four different labels

The same green tick must never mean all four. The trust panel applies these categories everywhere.

Verified inference evidence

Verified inference evidence

A cryptographic check passed for the exact request and response bytes: a NEAR AI attestation, an OutLayer execution hash, a DAO proposal reference or a real transaction.

  • Signature or attestation verified against the expected service.
  • Hash binding matches the policy, input and output.
  • Explorer link exists only for a real transaction hash.
Unavailable evidence

Unavailable evidence

Evidence that would strengthen the case but is not available, not bundled or not verifiable. It is shown with a reason, never with a success tick.

  • Replay recordings may not include live AI signatures.
  • OutLayer may be unavailable; a local hash-pinned result must say so.
  • No explorer link is invented to fill the gap.
Human decision

Human decision

A named steward or rostered inspector made a decision. AI cannot award, accept, refund or release escrow. A human decision is not automatically a cryptographic signature.

  • Steward confirms duplicate merge, scope and award.
  • Inspector accepts completion and durability.
  • DAO resolves disputes; the contract still checks the role.
Physical claim

Physical claim

A statement about the real world: the seat is stable, the hinge latches, the site is clean. It is not machine-certified and does not imply structural, electrical or gas safety.

  • Contractor evidence is a claim until a human reviews it.
  • Inspection notes record what a person observed.
  • MEND does not dispatch emergency services.

Deterministic execution

Hash-bound ranking, never an LLM verdict

The bid winner is computed by a versioned WASM policy through OutLayer. The steward confirms the rank-1 eligible bid; the model does not choose.

Execution hashes

These are the canonical fixture hashes for policy, WASM, input and output. They are reproducible from the frozen revealed bids, but this replay does not claim a live OutLayer callback.

Policy hash1a8a9858…42357d
WASM hash790f3eb4…a3ef42
Input hashf44bd67a…35e947
Output hash792aba5f…71304d
Recorded execution, not a live callback. The hash binding is meaningful; the absence of a live OutLayer execution reference is stated rather than hidden.

Policy weights

Price 45% · warranty 25% · duration 20% · materials 10%. Integer normalisation and tie-breaks are specified in the published rules. Price alone never wins.

Price45%
Warranty25%
Duration20%
Materials10%
A wrong policy hash, modified bid input or stale execution is rejected by the contract. Invalid, late or non-roster bids cannot win.
Inspect the revealed comparison

Privacy model

Report without a wallet. Keep precision private.

The public experience is designed to be useful without exposing the reporter, the exact location or private evidence.

No wallet to report

A report needs no wallet, signature or payment. The private case link is the reporter's key to status; it is not posted publicly.

Client-side EXIF stripping

The browser re-encodes the photo before upload, dropping GPS, camera model and capture time. Manual redactions are burned into the outgoing preview.

Coarse public location

The map uses a schematic location and an approximate area. Precise coordinates are stored off-chain and shared only with authorized roles.

Hashes, not media, on-chain

Public contract state references redacted evidence hashes. Raw media and private evidence URLs never enter public state.

Role-scoped private access

Live inspectors would use short-lived, role-scoped evidence access. This replay deliberately does not render private evidence previews publicly.

No browser secrets

AI, Intents and storage credentials stay server-side. The browser receives quote objects and public data, never API keys, JWTs or signing material.

Try the walletless report flow

Honest disclosure

What is real in this build

The UI is real software. The recording is not a live network event, and no physical verification is manufactured.

Real in this build

  • The public pages, accessibility behaviour and responsive layout.
  • Client-side EXIF stripping, manual redaction and SHA-256 of the redacted preview.
  • Deterministic integer scoring reproduced from the frozen revealed bids.
  • Ledger arithmetic and status explanations from the protocol fixtures.
  • No wallet and no private evidence URL in public pages.

Staged or unavailable

  • Physical repair photos and inspection observations are staged pilot material.
  • NEAR AI response signatures are not bundled; those panels say unavailable.
  • OutLayer execution is a reproducible replay, not a live callback.
  • Intents quotes, fees and deposit instructions are dry previews; no mainnet funds move.
  • Test USDC has no real value.

Not claimed at all

  • City adoption, municipal partnership or emergency dispatch.
  • Structural, electrical or gas safety certification.
  • Legal ownership of a physical asset through the passport.
  • A live transaction volume or real-funds performance.
  • AI authority over scope, award, acceptance or payment.

Explorer-link rule

The UI only renders an explorer link when a real transaction hash exists. The replay fixtures contain no real funding, payment or Intents destination transaction hash, so the interface shows “no explorer link” instead.

No fake links

A labelled replay is honest only if every success claim is checked for the evidence that would make it true.

Limitations

The edges of the system, stated plainly

MEND is deliberately narrow. These are not hidden later items; they are boundaries of the pilot.

Low-risk assets only. The pilot does not begin with roads, live electricity, gas, structural work or anything requiring emergency dispatch.
AI is a proposal, not an oracle. Classification, duplicate candidates and completeness suggestions can be wrong. Human confirmation is required for merges, awards and acceptance.
Physical claims are not certification. A hash proves bytes, not that a repair is durable. A human inspection is still a human judgement.
Replay is not live. The deterministic scoring is reproducible from the recording, but the UI does not claim a live OutLayer callback, AI signature or testnet transaction.
Intents is mainnet-only. A real execution requires separate human approval and real funds. No agent or browser action in this demo can initiate it.
Disputes remain human. Funds can be frozen by a human dispute, but resolution requires an explicit DAO/human decision. AI cannot resolve it.

Verify the story

Read a case from report to warranty.

Open the bench repair for a complete lifecycle, or the bicycle rack for a failed durability inspection.

Successful repair Warranty reopened

REPLAY / SIMULATION. protocol-v1 / fixtures-2026-11-10. Trust page statements describe the replay build; no live evidence is implied.