1 · You
This demo runs in your browser only. Nothing is sent anywhere. Your name is stored on this device so the demo can recognise you.
Used to sign your citizenship and votes in this demo. A real Samael nation would use a cryptographic key instead.
Your key (optional in the demo — required by a real nation)
A name is not a key: anyone can type the same name. Create an Ed25519 key identity and the console uses its key ID — the same key format the ledger and the binding statements already use — as your ledger key. The private key is created here, wrapped with AES-256-GCM under your passphrase (PBKDF2-SHA256), and kept only in this browser's storage. It is never uploaded, and no server ever sees it. There is no recovery if you forget the passphrase, so export a backup once you are happy.
At least 8 characters. It protects the key on this device only; it is not sent anywhere and cannot be reset.
Checking whether this browser can create keys…
Back up or restore your key
The backup is the encrypted record: safe to copy anywhere, useless without your passphrase. Restoring replaces the key stored on this device; use the passphrase field above.
Copy this text somewhere safe. To restore, paste a backup here and press Restore.
Move my membership to a new key
If you have moved to a new device, or you think your current key may have been copied, you can move your whole membership to a brand-new key: your citizenship and its weight, your vote records, and every token and credit you hold all travel with it. Nothing is minted and nothing is lost, and the move is a signed command in the ledger's history.
The move is signed by your current key, so that key must be unlocked above — which is also why a key you have lost still cannot be recovered: there is no recovery code and no server copy. Your PGP identity binding (if you have one) is not re-pointed automatically — revoke it with the old key and re-bind with the new one.
The new key is protected by the passphrase in the field above and uses the display name at the top of this section. Export a backup of the new key once the move is done; the old key stops working.
Reach me — bind an email, phone or WhatsApp
A Samael bridge does not keep an address book: it routes a message to the ledger key a contact is bound to. A binding is a free, signed attestation by your key — nothing is spent, and only the key that owns a contact can revoke it. Binding an address again with the same key refreshes it; a different key must revoke first, so nobody can quietly take over your address.
Bind each address you want nation mail delivered to. A real bridge then delivers over SMS, email or WhatsApp (ADR 0004); in this demo the binding is written to your local ledger state, and the command is signed with your key exactly as a real one would be.
On an iPhone or iPad
Adding this page to your Home Screen (Share → Add to Home Screen) gives you an app icon and a standalone window. On iOS 26 and later Safari opens every home-screen site as a web app, so nothing extra is needed to “install” it.
One real risk to understand: Safari removes site data for pages that are not on the Home Screen after seven days without you visiting them (WebKit, 2020-03-24). Your encrypted key record lives in this browser's storage, so if you do not install the page, iOS can clear it — and a cleared record cannot be recovered, because there is no server copy. Install it, and export your encrypted backup as well; the backup is the copy iOS cannot clear.
What does not work on iOS: there is no install prompt (adding is manual), and Safari has no Web Bluetooth, so the BLE accessory tier from ADR 0006 cannot run here. Voice has the same WebKit limit as Linux mobile. Everything in this console is unaffected.
What this protects against, plainly: a stolen backup file is useless without the passphrase; the private key is never stored in plain text; and while unlocked it is held as a non-extractable key that scripts cannot re-export. It is not a hardware keystore — anyone who can run code on this page while it is unlocked, or read your keyboard, can reach the key. That is the honest limit of a browser.
2 · Nations
A nation is a constitution, a list of citizens, a pooled treasury, and a vote. Joining is free and easy. Leaving is one visible action — see section 6.
How do I start my own nation?
- Give it a name and write a short, plain-language constitution.
- You become its first citizen. Anyone else can join with one click.
- The treasury starts at 1,000,000 demo tokens, and every citizen shares it equally.
- Every 60 days the pool is re-shared. Nobody's pile grows forever — see section 3.
3 · Treasury & the 60-day reset
The pool
Total value all citizens share. Funded by the vanity tax (section 5) and re-balanced to all members every 60 days (below).
Your share at the next reset
The formula is shown live, including the commons deduction. No hidden fees.
The power+food commons
Every nation hard-codes a monthly commons deduction into its constitution: 2.5% of the pool at day 30 and again at day 60 funds the production and distribution of power and food to all members — storage, processing, and common food banks. It is constitutional (no setter, no opt-out), always visible as its own budget line, and it is a transfer, never a mint: total supply is untouched.
Why the 60-day reset? (plain words)
Imagine a village well that one family parks a truck beside. The pool is the well. The 60-day reset means the well is shared again on a fixed schedule: every citizen's share returns 100% to the pool — whether they used it or not — then the pool is re-shared to all membership by weight. It is a full rebalance, not a tax on the poor: no one can hoard the commons, and no one loses their share for being inactive.
Example: pool = 1,000,000 tokens, 4 equal citizens. At day 30 the commons deduction takes 2.5% (25,000) and at day 60 another 2.5% of what remains (24,375): 49,375 tokens now fund power+food for everyone. The remaining 950,625 re-shares four ways — 237,656.25 each (an exact split in base units, so the pool is left at 0; when a split does not divide evenly the remainder stays visible in the pool).
Only in this demo, to show you the reset without waiting 60 days. It runs the real ledger's reset: 100% of every share returns to the pool (full rebalance), the commons takes its monthly deduction, the remainder is re-shared by weight, and every citizen's 100 credits are fresh. A real Samael epoch is a fixed 60 days for everyone, driven by consensus time.
You are not a citizen of any nation yet, so there is no share to show. Join or start a nation — it takes one click.
The votable furnace (token decay)
The furnace is your nation's decay rate d — how fast tokens in the commons lose value during the 60-day epoch. A token held for the whole epoch owes d × value in decay; spend it halfway through and you owe half. The rate is voted by the nation's citizens — never set by a committee — and every change is written to the ledger's append-only log.
Only citizens set their nation's furnace. Join a nation first.
How does a furnace vote pass? (plain words)
It uses the same rule as a constitutional amendment: the change passes when the FOR weight reaches the nation's supermajority (2/3 by default) of the whole nation. Citizens who do not vote count against — silence is not consent. Each citizen votes once and cannot change their vote; the proposer may withdraw their own proposal; and an unpassed proposal expires at the next 60-day reset (logged as expired, never silently dropped).
Example: a nation of 4 equal citizens needs FOR weight ≥ 3 (2/3 × 4 = 2.67, rounded up). Your own vote is 1 — the other citizens must agree.
Release the power+food commons (the spending half)
The monthly deduction only ever grows the commons, so spending it is the nation's own decision: any citizen may propose a release of a positive amount to a citizen, and it passes only at a supermajority of the whole nation by weight (two-thirds by default) — citizens who stay silent count against, exactly like the furnace and a constitutional amendment. On passage the commons pays the payee as ordinary tokens (a transfer, never a mint: total supply is untouched), and the full tally is appended to the ledger's log. One proposal is open at a time, and it expires at the next 60-day reset if it does not pass.
Only citizens spend their nation's commons. Join a nation first.
Why can't the commons just be spent by anyone? (plain words)
The commons funds power and food for everyone — storage, processing, and common food banks. If any single person could withdraw it, it would be gone the next day; if no one could ever spend it, it would silently absorb the whole economy. So a release takes the same supermajority as changing the constitution: the nation decides, and silence is not consent (citizens who do not vote FOR count against).
Every release is a transfer, never a mint: the tokens already sat in the commons budget line and simply move to the payee's ordinary balance, so the total supply never changes. The signed ledger block carrying the tally is the member-verifiable receipt.
4 · Voting on laws & projects
Voting is quadratic: casting v votes on one question costs v² credits. One vote costs 1 credit, five votes cost 25, ten cost 100. You get 100 credits per 60-day epoch. This lets a determined minority concentrate on what they care about, without being able to steamroll everything.
Voting is for citizens. Join a nation first.
Why quadratic? (plain words)
With one-person-one-vote, 51 people can always outvote 49. With quadratic voting, winning costs credits: the 49 who care deeply can outbid the 51 who barely care. Intensity is heard, and buying an election gets expensive fast — 100 votes would cost 10,000 credits.
Important: a law binds only the people who voted for it (voluntary jurisdiction). Guests and non-voters are never silently governed by a law they did not choose.
Amend the constitution (you cannot be dragged along)
The constitution is your nation's charter. Changing it is deliberately harder than passing a law: an amendment takes effect only at a supermajority of the whole nation by weight (two-thirds by default) — citizens who stay silent count against, so a vocal minority can never ratify a new charter. Everyone who did not vote FOR is released: the new charter is not binding on them, and leaving with their share stays one visible action. Every adopted amendment is appended to the ledger's log with its full tally.
The ledger commits to the sha256 of the exact text, so any change in wording is a real amendment. One ballot is open at a time.
Only citizens can amend their nation's constitution. Join a nation first.
What does “released” mean? (plain words)
An amendment binds only the people who voted for it. If you voted against it — or simply did not vote — the ledger records you as released: the new charter is not binding on you, and leaving with your share is still one visible action (section 6). You may stay instead; the ledger clears your release the next time you vote FOR an amendment.
Example: a nation of 4 equal citizens needs FOR weight ≥ 3. If 3 vote for the new charter it passes, and the 1 who did not vote FOR is released — not overruled. Silence is not consent.
5 · Vanity tax
The vanity tax is the pool's main income. What counts as vanity is decided by your nation's vote — nothing is hard-coded. For each category (yachts, jets, jewelry, branded luxury), citizens vote a rate from 0% to 90%. The tax on a purchase is rate × price, and the revenue goes straight to the pool.
Only citizens vote on vanity rates. Join a nation first.
Fairness rules for the vanity tax (plain words)
- The rate is shown at the point of purchase, with the exact token amount. No surprise math.
- The tax applies once — either at the conversion into spending money or at purchase, never both.
- Proposed, nation-voted (not yet in the engine): guests pay cost plus a small margin (max 10%), never a punitive price. Emergencies are never billed as violations.
- A category stops being "vanity" the moment voters say so.
6 · Leave with your share
You may leave any nation at any time and take your fair share with you. This is the check on every nation: it must stay good, because you can always walk away.
One click, no guilt-trip, no cooling-off trap. Your share is computed by the formula shown above and paid out of the pool.
Your payout history
You are not a citizen of any nation, so there is nothing to leave. Join or start a nation.
7 · Real ledger engine check
The sections above run on the real ledger engine (v0.11, ADR 0002 §4 / ADR 0010 economics: 60-day full rebalance + hard-coded monthly commons deduction + the vote-gated commons release) in your browser. This panel re-checks the same engine through a fixed story, and after every step asserts the core promise: the total supply never changes. Nothing is minted or burned; value only moves, is deducted to the power+food commons line, is re-shared, or leaves the commons by the nation's own vote. The commons is a one-way balance (a reset never returns it to the pool) until a release is ratified.
| Step | What happened | Supply check |
|---|
The fixed story: alice founds a nation, bob joins, two 60-day resets run (each a full rebalance with the constitutional monthly commons deduction), a 100,000-token vanity purchase pays 70% × 100,000 = 70,000 to the pool, and a quadratic vote is cast. Every number comes from the real ledger code, not from this page.
8 · This device — your numbers, only yours
Samael counts nothing about you on the network. What you see here is counted in this browser only, stored beside your console data, and never sent anywhere by the console — it makes no analytics, tracking or beacon request at all. These numbers contain no identifier, no cookie, no address, no handle and no timestamp: just how many times you opened the console on this device and how many ledger actions you took.
Showing this never uploads it: the button only copies a text block. In a real nation, a member-chosen attestation like this would travel over the signed ledger/bridge path, not to an analytics endpoint.
What is stored on this device, exactly
- Your console state (your name, your nation, your votes) — under
samael.console.v3, as before. - These counters — under
samael.device.v1: one number of opens and one number per action kind. Nothing else. - Not stored: any address, any identifier, any per-action time, anything that could link two devices together.
- Clearing your browser storage, or the Clear button above, removes the counters entirely.