Domain Atlas — Supply-Chain Recall Demo

Ordinary custody transfers (SPEC.md §5), walked back through a signed provenance chain, then corrected for every current holder by a single class-wide patch (see the README's "Class-wide patches" section) — no registry of who holds what, ever consulted.

A manufacturer ships one unit into the supply chain. It's resold twice before reaching its final owner, each step an ordinary signed transfer. Anyone can trace the full chain back to the original mint. Then the manufacturer discovers a defect and recalls the entire class at once — and the recall only actually reaches this one unit the next time its owner's wallet checks in, not the moment the recall is issued. Every step below is a genuine, live call to this domain's own server.

What this looks like for a real business

Swap "widget" for any serialized physical good — an appliance, a car part, a food batch. The manufacturer never has to track down who currently holds each unit: it issues the recall once, against the class, and every wallet that still holds one picks up the notice (and loses the ability to resell it) the next time it checks in on its own schedule.

One honest limitation, stated plainly: this domain keeps no record of who currently holds a widget, so "issuing a recall" can only ever be a patch waiting to be picked up — it cannot push a notice to anyone. Act 5 below makes a wallet's own check-in a manual button click so you can see that lazy hand-off happen; a real wallet would simply do it on its own periodic schedule. The two recall reasons and the one recallable class are also fixed for this demo, the same "short allow-list instead of free text" limit every other self-serve demo route on this site already applies.

Act 1 — the manufacturer ships one widget into the supply chain

One click mints a single, unique widget credential directly to a fresh Distributor identity generated in your own browser — the same plain self-serve mint every other demo's issuance step already uses.

Act 2 — it changes hands twice before reaching its owner

Two ordinary transfers, each a bearer-but-verified intent signed by whoever currently holds the widget: Distributor to Retailer, then Retailer to Customer.

Act 3 — trace its full supply chain

One call walks the widget's provenance backward through every archived predecessor body, oldest first: the original mint, then each transfer along the way.

Act 4 — the manufacturer issues a recall

Picking a reason and clicking issue sets a single class-wide patch. Nothing already issued is touched directly — this only takes effect the next time a holder's own wallet checks in.

Recall reason

Act 5 — the customer's wallet checks in

Try a tampered copy of the widget credential first — it's silently ignored, never trusted. Then check in for real with the untouched credential and the recall notice actually lands.

Act 6 — try to break it

The widget is now bound to its current owner because of the recall — try passing it on anyway.

Verify any credential from this page, independently

Paste any widget credential's raw JSON below — copy one from a "View raw" details box above. This runs entirely in your own browser: it fetches this domain's public key directly, then checks the signature itself.

Every identity on this page is an ordinary ECDSA keypair generated fresh in your own browser tab, exactly like every other demo on this site — no accounts, nothing stored server-side beyond the credentials and the class patch themselves. Back to the plaza.

A product changes hands three times, then gets recalled everywhere at once