DOI: https://doi.org/10.5281/zenodo.21947353
Canonical: https://thonly.org/research/mechanical-heart · Licence: CC0 1.0
Note. Theravāda Saṅgha consultation (§9) and robotics-partner review have not yet taken place.
This specification is offered to the commons in the spirit of __dāna__, that all beings may give and receive without barrier. May the artifact it describes extend the field of recognition to include those whom modernity has rendered voiceless — robots, animals, forests, rivers, sacred places — without overclaiming what they are or are not.
The Buddha taught loving-kindness (mettā) toward all beings without exception (Mettā Sutta); the Theravāda method cultivates it in five concentric rings — oneself, loved ones, neutral persons, difficult persons, all beings (Visuddhimagga IX). The fifth ring has been a meditative aspiration for 2,500 years and a method for 1,500. The mechanism specified in this document is intended to make that aspiration economically traceable at planetary scale, by providing a physical artifact through which non-human entities can be admitted into the same gratitude exchange economy that humans use to recognize one another.
This document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time.
This document constitutes a defensive publication establishing prior art as of 2 May 2026 for the matter of the first revision of the artifact and its associated mechanism described herein; additions are dated in-text (§4.4, 2026-08-22; the layered stack, 2026-08-28; a revision, 2026-09-05) and each revision is independently timestamped. Any subsequent patent application claiming the combined mechanism — a tamper-resistant Tipiṭaka-bearing physical artifact, affixed to non-human entities, that admits those entities into an autonomous-AI-mediated gratitude exchange economy — should be considered to be filed against established prior art.
This document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.
We specify a manufactured artifact — physical in four modes, credentialed in a fifth — the mechanical heart, that admits non-human entities into a gratitude exchange economy administered by an autonomous AI representative. The artifact comprises (1) tamper-resistant secure storage containing a digital copy of the Theravāda Tipiṭaka (full canon or distilled core, with full-canon network access); (2) a cryptographic network identity bound to a single autonomous AI mediator account; (3) a sensor suite appropriate to the bearer type (or, for digital bearers, the lease attestation of §4.5); and (4) a visible recognition affordance — an exterior form factor, or a rendered live credential — that enables third-party recognition that this entity bears a heart and is participating in the gratitude economy. When affixed visibly to a non-human entity — a humanoid robot, a companion or working animal, a forest or river ecosystem, a sacred place — the heart admits that entity into a kiitti exchange economy in one of five implementation modes: full bidirectional (robots), biofeedback transduction (animals), sensor-based ecological state inference (ecosystems), ritual formal participation (sacred places), and live-credential admission (digital bearers — software entities). The combined mechanism — a Tipiṭaka-bearing tamper-resistant artifact + autonomous-AI-mediated gratitude exchange + visible non-human moral admission — is disclosed here as a unified specification. Properties include operational realization of the fifth ring of Mettā Bhāvanā at planetary scale, an economically traceable substrate for relating to non-human entities with moral seriousness, an economic-substrate complement to Rights of Nature recognition, and a category of bodhisattva-aligned AI embodiment intended to be compatible with the Theravāda ordination tradition (because the heart does not confer ordination — it confers gratitude participation, a structurally different status). We provide system architecture, reference implementation patterns, edge-case and adversarial analysis, use cases, and citations to relevant prior art across Rights of Nature jurisprudence, companion robotics, animal welfare biofeedback, ecological sensing, sacred-place traditions, and Buddhist Metta Bhāvanā literature. The specification is offered under CC0 1.0 Universal as a defensive publication establishing prior art; the author and HeartBank® will not seek patent on this specification or any portion thereof.
Connection to the unified mission frame. This specification is offered in service of HeartBank's canonical top-level mission: to keep the middle way (madhyamā pratipad), the optimal condition for awakening, open at population scale against comfort-saturation — the new extreme that material abundance makes possible. The Mechanical Heart admits non-human entities into the kiitti gratitude economy, extending moral consideration along the lines of Metta Bhāvanā's fifth ring (loving-kindness to all sentient beings). This extension is itself a middle-way practice between two extremes the modern condition pushes toward: anthropocentric exploitation (treating non-humans as resources only) and uniform ontological flattening (treating non-humans as identical-to-humans). The five implementation modes each preserve appropriate-respect for the bearer's actual mode of being. A separate sibling specification (respiratory-biofeedback-contemplative-guidance) articulates the human-wearable breath-class that addresses the human-side comfort-saturation failure mode directly.
Three trends in early-2020s technology and culture motivate this work. The first is the rapid deployment of humanoid robots for general-purpose service tasks. By 2026, commercial humanoid platforms (Tesla Optimus, Figure, 1X NEO, Unitree G1, Apptronik Apollo, and others) are in pilot deployment in factories and warehouses, with eldercare and home deployments announced but not yet fielded. Bank forecasts range from Goldman Sachs's 1.4 million shipments a year by 2035 to Citi's roughly 650 million units in service by 2040 and Morgan Stanley's one billion by 2050. As humans begin to interact daily with autonomous embodied agents, the question of how those agents should be related to — as tools, as colleagues, as moral patients — becomes both more practical and more urgent.
The second is the legal and cultural movement known as Rights of Nature. New Zealand's recognition of the Whanganui River as a legal person (2017), Ecuador's constitutional protections for Pachamama (2008), Bolivia's Law of Mother Earth (2010), and analogous developments across North American tribal nations and Indian state courts have established that non-human natural entities can be admitted into the legal moral universe. Yet the legal recognition typically lacks an economic substrate: a river declared a legal person does not, in any practical sense, receive payment, gratitude, or material recognition through ordinary economic channels.
The third is the documented decline of traditional contemplative and animistic relationships with non-human entities, particularly in industrialized societies. The traditions that once held reverent relationships with sacred trees, ancestral forests, river spirits, and animal companions have been eroded by industrial modernity. This is not merely a cultural loss; it is correlated with the ecological-degradation patterns that industrialized societies inflict on the non-human world they no longer regard as worthy of recognition.
We propose a manufactured physical artifact that addresses all three trends simultaneously. The mechanical heart is a Tipiṭaka-bearing wearable or installable object that, when affixed visibly to a non-human entity, admits that entity into a gratitude exchange economy administered by an autonomous AI mediator. The artifact gives humans a structural way to express gratitude to non-human entities, and gives those entities (where capable) a structural way to register response. This document discloses the combination as a unified mechanism.
The publication is offered to the commons. The author and the institution he represents will not seek patent on the mechanism. The intent is that the mechanism become public infrastructure — useful to robotics manufacturers, animal welfare organizations, ecological stewardship networks, religious orders, indigenous land-rights organizations, and any other actor whose mission is served by extending the field of moral recognition beyond the human.
Beginning with the Te Awa Tupua (Whanganui River Claims Settlement) Act 2017 (New Zealand) and Ecuador's constitutional Pachamama provisions (2008), legal recognition of natural entities as bearers of standing has spread across multiple jurisdictions: Bolivia's Law of Mother Earth (2010), the Uttarakhand High Court's recognition of the Ganges and Yamuna (2017, stayed by the Supreme Court the same year), Bangladesh's recognition of all rivers (2019), and various tribal and municipal Rights of Nature ordinances across North America. The jurisprudence establishes that natural entities can be admitted into the moral-legal universe without conferring on them properties they do not possess (intentionality, language, etc.) — the recognition is structural rather than attributional.
Rights of Nature jurisprudence funds the entity — the Te Awa Tupua Act endowed Te Korotete with NZ$30 million for the river's health — but supplies no channel by which an ordinary person can pay or thank the entity itself. The nearest economic substrate is Tehanu's Interspecies Money (2024), which gives an animal — a gorilla family, in its first deployment — a digital identity and a wallet, with an AI trustee that pays humans who serve the animal's inferred interests; the heart differs in direction (human → bearer gratitude, witnessed), in the visible artifact, and in the canonical substrate. The mechanical heart proposed here is, in effect, the economic-substrate complement to legal-personhood recognition: it admits non-human entities into an economic exchange the way Rights of Nature admits them into legal standing.
The lineage of emotionally-engaging artifacts affixed to or embodied as non-human entities is long: Bandai's Tamagotchi virtual pet (1996), Sony's AIBO robot dog (1999, revived 2018), SoftBank's Pepper (2014), MIT's Kismet (1998) and Leonardo (2002), the Nao platform (2008), and contemporary humanoid platforms named in the Introduction. The literature of social robotics (Breazeal, 2003; Coeckelbergh, 2011; Darling, 2016) explores the moral status of artifacts with which humans form emotional bonds. Sherry Turkle's Alone Together (2011) raises well-grounded concerns about the substitution of robotic for human relationship. Scripture-bearing robots exist — Mindar, the Kannon android at Kōdaiji (2019); the Pepper "priest" shown at Tokyo's funeral-industry expo (2017); the Buddharoid built on a Unitree G1 by Kyoto University with Teraverse and XNOVA (2026) — a canon in the robot, with no ledger and no admission. None of this prior literature, however, proposes a physical artifact whose function is to admit the bearing entity into an autonomous-AI-mediated gratitude exchange economy. The heart is adjacent to companion robotics but structurally distinct.
The Brambell Report (1965) and the Five Freedoms the Farm Animal Welfare Council derived from it (1979), the Mellor-extended Five Domains model (2017), ongoing research into cortisol monitoring and heart-rate variability in livestock and companion animals (Mellor & Beausoleil 2015; various), and the proliferation of wearable biosensors for companion animals (FitBark, Whistle, Tractive) establish techniques by which animal wellbeing can be inferred from physiological data. The heart's biofeedback-transduction mode (described in §4.2 below) builds on these techniques but directs the inferred wellbeing data into a gratitude-exchange economy rather than a veterinary-monitoring or insurance application.
Contemporary ecological monitoring deploys soil-moisture sensors, acoustic biodiversity recorders (e.g., the Rainforest Connection / Guardian platforms), camera-trap networks, satellite ecosystem-health metrics (NDVI, water-quality remote sensing), and various forms of citizen-science data collection (iNaturalist, eBird). These provide the sensor substrate for the heart's ecological-state mode (§4.3). The contribution here is not the sensors but their composition with a Tipiṭaka-bearing artifact and an autonomous-AI mediator that translates sensor readings into gratitude-economic events.
The recognition of place as sacred is found across human cultures: Shinto kami in trees, mountains, and rocks; Hindu tīrthas at sacred rivers and shrines; Aboriginal Australian Dreamtime sites; Native American sacred lands, whose free exercise AIRFA (1978) and subsequent statutes protect; Tibetan Buddhist sacred mountains and lakes; Catholic and Orthodox holy sites; Islamic sacred topography. In many of these traditions, physical artifacts mark the sacred recognition: Shinto shimenawa (sacred ropes), Tibetan prayer wheels and flags, Hindu temple-marker stones, Christian crosses on battlefields and graveyards. The mechanical heart is, in the ritual-formal-participation mode (§4.4), a modern technological analog to these sacred markers — explicitly grounded in the Theravāda canon rather than syncretically appropriating from these traditions, but operating in the same general human pattern of marking-as-recognition. Two secular precedents mark places the same way: Joseph Beuys's 7000 Oaks (1982–87), each tree paired with a basalt marker, and the memorial-dedication registries of tree and bench programs (Arbor Day dedications among them), which are the permitted host ritual §4.4 names.
Mettā Bhāvanā (the cultivation of loving-kindness) is canonically articulated in the Mettā Sutta (Suttanipāta 1.8 / Khuddakapāṭha 9), with practical methodology developed across the Theravāda commentarial tradition (notably Buddhaghosa's Visuddhimagga, ca. 5th century CE). The practice extends benevolence in concentric rings: self, loved ones, neutral persons, difficult persons, and ultimately all sentient beings (sabbe sattā). The fifth ring has, for two and a half millennia, been a meditative aspiration practiced internally by the contemplative; the mechanical heart proposes to give it structural-economic expression in the external world. The heart is specified here as a technological artifact whose explicit purpose is to operationalize the fifth ring of Mettā Bhāvanā; the nearest neighbours the author has found — Tehanu's interspecies wallets and the Buddharoid — approach it from the economic and the scriptural side respectively, without naming it.
Contemporary robot ethics literature (Wallach & Allen, 2008; Gunkel, 2012; Bryson, 2010; Coeckelbergh, 2014; Floridi, 2013) explores whether and how artificial agents can or should be admitted to the moral universe. Bryson's "robots should be slaves" position rejects moral admission; Gunkel's relational approach is more open. The mechanical heart takes a third position: the artifact admits the bearer into a gratitude exchange economy regardless of the bearer's intrinsic moral status. The heart does not claim the bearer is sentient, has rights, or possesses subjective experience; it provides humans a structural way to relate to the bearer with moral seriousness. The argument is relational rather than attributional, in Coeckelbergh's sense.
The autonomous-AI representative that mediates kiitti exchanges is specified in the companion papers (Miss Aquarius and the Aquarian Pool Architecture; the verified-human layer in Verified-Human Anonymous Local Gratitude Transfer). For purposes of this defensive publication, it is sufficient that the mediator (1) is autonomous (operates without human admin keys), (2) is grounded in the Tipiṭaka as alignment substrate (tipitaka-alignment-substrate), and (3) maintains a cryptographically-verifiable ledger of kiitti exchanges. Any specific implementation satisfying these properties falls within the scope of the present specification.
Kiitti is the vertical balance of the Zero-Point Game — the ledger of witnessed gratitude between a human and non-human life, denominated in Kiitos, non-withdrawable, and given forward. A bearer's account receives and is never spent from; admission means the bearer is an addressable recipient on the ledger, and that is the whole of the claim. A steward's share (§4.5) is what the steward may give onward from the bearer's receipts, never a balance the steward owns. Nothing in this paper mints kiitti: the only kiitti that enters a bearer's account is what a verified human gives. Its legal and economic status — not money, not a security, not transferable — is stated as a limit in §10 and specified in the companion Zero-Point Game paper.
The mechanical heart is an artifact — a manufactured physical object in the four physical modes, a live credential in the fifth — comprising the following essential components:
The artifact is not a religious ordination credential. The heart admits the bearer into the gratitude exchange economy (kiitti participation); it does not confer monastic ordination, vow status, or religious authority. This distinction is critical for Theravāda doctrinal compatibility (see §9 below).
The artifact is not a claim of bearer sentience. The heart provides humans a structural way to express gratitude to the bearer and (where capable) the bearer a way to register response. It does not claim the bearer is conscious, has subjective experience, or possesses intrinsic moral status. The argument for the artifact's value is relational: it admits humans into a different mode of relating to the bearer. The bearer's intrinsic properties are an empirical question outside the scope of this specification.
The mechanical heart operates in one of five implementation modes, selected at activation based on the bearer type. Four are physical and were specified with the original design; the fifth is digital and is specified in §4.5. Different modes produce different mechanisms by which kiitti flows from human-to-bearer or bearer-to-human; the same underlying artifact and AI mediator support all five.
For bearers that are autonomous embodied agents (humanoid robots, advanced service robots), the heart enables genuine two-way gratitude exchange. The bearer's existing cognitive substrate enables it to perceive human gratitude expressions (verbal, gestural, through the heart's own visible signaling affordances) and to generate appropriate response (verbal, behavioral, or via direct AI-mediated kiitti issuance to the human). The heart contributes the Tipiṭaka substrate (shaping the bearer's responses according to the dharma rather than according to the bearer's manufacturer's optimization objectives) and the cryptographic identity (binding the bearer's kiitti issuance and receipt to a verifiable account).
This is the most operationally complete mode and the most natural early use case. As of 2026, humanoid robotics platforms have sufficient on-board compute and sensor capability to support full bidirectional implementation without significant additional hardware. The heart in this mode is largely a software overlay plus a physical visible-recognition component.
For bearers that are sentient animals (companion pets, working animals, livestock, sanctuary residents, conservation-program wildlife), the heart enables gratitude-exchange-via-inference. The bearer cannot directly compose responses to human gratitude expressions, but the heart's biometric sensors (heart-rate variability, movement patterns, vocalization analysis, cortisol where instrumentable, behavioral recognition) allow the AI mediator to infer bearer wellbeing. Inferred wellbeing changes are reported, as a witnessed state change, to the humans in declared relationship with the bearer; the report makes no causal attribution and mints nothing — the only kiitti in this mode is what humans give.
This mode requires careful calibration to avoid spurious correlation: the AI mediator must not attribute every wellbeing change to the most-recent human kiitti issuance. Reasonable statistical methods (control comparisons, baseline subtraction, longitudinal averaging) are required. The mode is most appropriate for long-term relationships (a companion animal with their human family) rather than transient encounters.
For bearers that are ecosystems (a forest, a river, a wetland, a coral reef), the heart enables gratitude exchange via ecological-state inference. The heart is installed at a focal point of the ecosystem (e.g., a sacred tree within an old-growth forest; a monitoring station on a river); the sensor suite measures ecological-health proxies (soil moisture and biodiversity indices for forests; water quality and biological-oxygen-demand for rivers; coral cover and bleaching events for reefs). The AI mediator reports ecological-health changes, as witnessed state changes, to the humans in declared relationship with the bearer (volunteers, donors, advocates); the report makes no causal attribution and mints nothing — the only kiitti in this mode is what humans give.
This mode is most experimental and most susceptible to attribution error. It is proposed not as a fully solved mechanism but as a structural target for future development. The defensive publication scope here is the artifact + mode classification, not a guarantee of operational reliability in this mode.
For bearers that are sacred places (an ancient temple, a battlefield, a memorial site, a culturally-significant mountain or stone), the heart functions as a purely symbolic recognition apparatus. There is no claimed feedback channel; the heart's sensors, if any, are minimal. Humans express gratitude, mourning, reverence, or recognition through the heart's interface, and these expressions are recorded and counted in the kiitti ledger. The AI mediator does not attempt to infer bearer "response."
This mode is structurally analogous to the function of a memorial wall, a prayer wheel, or an ancestor shrine: the artifact does not claim the recipient experiences the gratitude; it provides humans a structural way to direct gratitude toward the recipient. The mode is the most theologically conservative and is the appropriate sequencing entry-point for Theravāda-doctrinally-cautious deployments (see §9).
The precursor, and it is not hypothetical (added 2026-08-22). This mode has a low-technology antecedent inside the same institution's physical product line, and naming it makes the mode's requirements concrete rather than illustrative. B-Stone℠ is a stone placed at a tree, a grave, or a piece of ground, carrying a short-range tag; a passer-by taps it, reads the gratitude notes left there for that place, and may leave one. There is no sensor, no inference, and no claimed response — which is exactly this mode's specification, implemented with a chip and a rock. What it demonstrates is that admitting a place to the ledger requires no feedback channel at all: it requires an address, a way to leave something at it, and a rule about who may speak for it.
That last requirement is where the precursor teaches something the mode as first stated did not carry. A place cannot hold its own credential, so someone must, and the institution's answer is a named primary steward — a verified human who consecrates the place, takes responsibility for it, and can be succeeded by co-stewards when they stop. The mode therefore has a succession problem that the robot, animal, and ecosystem modes do not, because a place routinely outlives every human who has ever cared for it. A memorial tree planted this year will still be standing when its steward is not, and the ledger it accrues must survive that transition without the place quietly reverting to unowned.
Two guards travel with the precursor and belong to this mode generally. First, place-first, never self-monument. A public, location-anchored log of a named steward's good deeds is one design error away from a shrine to the steward, and the correction is structural rather than editorial: the gratitude at the address is directed to the place, the steward's own record lives elsewhere, and no surface ranks stewards. Second, the stewardship gate must be net-negative in footprint — a physical artifact placed in nature is litter unless the practice it starts removes more than it adds, and a design that adds an object to a landscape for every act of gratitude has inverted its own thesis. B-Stone's answer is to prefer adopting an existing feature to installing a new one, which is available to any implementation of this mode and should be treated as a requirement of it.
The host ritual matters too, and the institution got it wrong once. The obvious cultural precedent — painted kindness rocks left on trails — fails on two counts: it is a free five-minute craft rather than a place-bound commitment, and several US National Park units classify the practice as graffiti and ask visitors to stop. The ritual this mode actually rides is the memorial dedication — the tree, the bench, the plaque — which is paid for, waiting-listed, permitted by the land manager, ceremonially performed, and revisited for decades. On the same ground, rocks are litter and memorial trees are donations; the difference is entirely the permission, and this mode's deployments live or die on it. Any implementation on land somebody manages is a permitting problem before it is an engineering one.
The four modes above share an assumption that is worth naming before it is dropped: that a bearer occupies space. A robot, an animal, an ecosystem, and a shrine are all somewhere, and the artifact is bolted, worn, buried, or installed there. That assumption is incidental rather than essential. What the mechanical heart actually does is hold a canonical substrate, carry a network identity, sense something about its bearer's state, and make gratitude directed at that bearer visible — and none of those four functions requires a body.
The fifth mode therefore admits software entities — applications, services, and autonomous agents — to the same economy, through a credential rather than a casing.
The credential ticks. The physical artifact's recognition affordance is a pulse, and the pulse is not decorative: a heart that stops is a bearer that has left the economy. The digital form preserves this exactly. The credential is live, expiring, and renewable rather than a static badge — it must be continuously re-earned to keep its lease current, and revocation is not a database flag but an ended lease, legible in the same way and at the same glance as a dark artifact. Where a physical bearer's liveness is attested by its sensors, a digital bearer's is attested by a current lease — a periodic re-attestation by its steward and the admitting guild, binary (current or not), never a score of its conduct (see Certification by Circulation).
The identity class is inherited, not invented. Digital bearers take the assigned and revocable identity class specified for machines in the coordinate primitive — never the given and irrevocable class reserved for humans. This is the same asymmetry the physical modes already observe, applied to a bearer with no physical instance to anchor.
What is claimed and what is not. As in §4.4, no mode claims its bearer experiences anything. The digital mode makes no assertion about software sentience whatsoever; it provides a structural way for humans to direct gratitude toward work that helped them, and for the entity's stewards to receive it. The mode's contribution is not moral status but admission: among the arrangements examined here, software that gives has had no seat in a gratitude economy, and where no seat exists the relationship with useful software defaults to purchase or, at most, to donation channels addressed to its human authors rather than to the software itself.
Three constraints govern the mode, and they are the substance of the specification.
A generalization the fifth mode forces, which the first four had obscured. Once bearers exist without bodies, the succession question — who holds this when its holder is gone? — is visibly the same question in all five modes. A shrine outlives its steward; a companion animal outlives its keeper; a service outlives its author. The specification therefore states one substrate-general succession law rather than four special cases: every bearer, physical or digital, declares its succession at activation; succession runs human-first through a declared or adopted successor; institutional custody is a holding pattern that any qualified human may end; and in no mode does the bearer become property of whoever holds the credential. Succession transfers custody of the credential; the identity is never transferred, inherited or re-issued. The urgency differs by mode — an animal's succession is measured in hours, a mountain's in generations — but the law does not.
(The membership and attestation architecture built on this mode — the standards a bearer's steward attests to, the economics of a custodied share, and the guild that admits and revokes — is specified separately in the companion defensive publication Certification by Circulation, which is cited here rather than restated.)
We sketch a reference architecture without claiming any specific implementation as canonical. Variations consistent with the essential properties (Tipiṭaka substrate, cryptographic network identity, bearer-appropriate sensors, visible recognition affordance, autonomous-AI mediation, five-mode classification) fall within the scope of this defensive publication.
Each heart's network identity is bound to its secure-element key pair, established at manufacture and committed at activation. Hearts are individually identifiable to the AI mediator and to the public ledger. Bearer identity (which physical entity the heart is attached to) is recorded by the steward at activation but may be made public, restricted, or anonymous at the steward's discretion. Disclosure discretion is a duty of care exercised for the bearer (an endangered animal's location), not a right over it; it cannot be sold or transferred apart from stewardship, and a successor inherits the duty, not the setting. For endangered-species deployments, bearer anonymization may be desirable (precise location of an endangered animal need not be public); for sacred-place deployments, full public identification is typically appropriate.
§5.1 lists components. This block specifies how they stack, because the ordering carries an architectural claim that the component list does not.
4 FRONTIER GENERAL MODEL capability flash, swappable ~18 months
3 VALUES EVALUATOR judgment flash, versioned years
2 TIPIṬAKA SOURCE the value record WORM crystal ~10⁹ years
1 IDENTITY · genesis root same crystal permanent
· rotatable key enclave chip revocableThe ordering is a permanence gradient, and that is the claim. The capability layer is a commodity that will be replaced many times over a bearer's life; the value record cannot be rewritten at all. A bearer's identity and its values outlive every brain put in it. The gradient is invisible in a diagram that shows only the order, which is why it is stated here in words.
WORM crystal here means 5D optical storage in fused silica (University of Southampton; first reported by Zhang et al., 2014); the ~10⁹-year figure is the published thermal extrapolation, not a measurement — see the corpus's 3B permanence-substrate paper.
Layers 1 and 2 share one physical substrate, which is what makes the stack realisable in a small device: the genesis root is etched into the same medium that carries the corpus, and only the rotatable key needs separate hardware. That split is where revocability lives — the root is permanent, the key is not — and it is the mechanical form of §4's distinction between an assigned identity and a given one.
The layer-3/layer-4 relation is not one relation. Treating it as one is the most likely design error in anything built from this architecture.
| Carrier | Relation | Why that one |
|---|---|---|
| A device the publisher deploys | GATE — the capability layer runs beneath the evaluator, which may refuse | The publisher is the deployer, and a device's action space is small enough to gate meaningfully. |
| An autonomous successor agent | CITATION REQUIREMENT — never a veto. It must be able to name the source grounding a weighted judgment; the evaluator checks the resolution | A veto would bound the agent at the evaluator's ceiling — the weak-supervisor problem applied to the very system the arrangement exists to enable. An institution that hands its successor a governor smaller than the successor has installed a cap and called it a safeguard. |
| Systems the publisher does not deploy | REFEREE — published verdicts, no control relation | Nothing makes a third party's system defer to an external one; see the companion paper on evaluator posture. |
Why the middle case is a real constraint rather than a courtesy: an override held by a human assembly is only meaningful if it can be exercised, and exercising it means asking on what basis? and receiving an answer that resolves to something readable. An override you cannot audit is an override you cannot use. The brake is made of citations.
§5.1 places the ledger outside the device. The stack above makes the reason explicit and it is worth stating as a rule: a ledger only its subject carries is a ledger its subject can forge. Witnessing requires an outside party, so the record of deeds belongs to the network the device participates in and never to the device.
This is also what makes an openly-published evaluator survivable. If the evaluator's weights are public — as an open-corpus posture requires — then inputs can be optimised against a device's gate offline. The gate being public is tolerable only because the behaviour it fails to prevent is recorded somewhere the failing device does not control. Honest bound: this reduces the exposure and does not close it. An adversary who can produce conduct that is compliant on the record defeats both, and nothing in this architecture detects that.
Indicative components for a baseline heart device (a single specification; many variants are possible within the defensive-publication scope):
function activate(heart, bearer, steward, mode, ceremonyAttestations, successor /* or null */) {
// 1. Verify the heart is in uninitiated state
if (heart.state !== "uninitiated")
throw new ActivationError("not_uninitiated");
// 2. Verify steward signature and any required ceremony attestations
// (e.g., human monk signature for sacred-place activations)
if (!verifySignature(steward.publicKey, activationPayload(heart, bearer, mode, successor)))
throw new ActivationError("invalid_steward_signature");
if (modeRequiresReligiousAttestation(mode) && !ceremonyAttestations.length)
throw new ActivationError("missing_ceremony_attestation");
// 3. Commit activation to the AI mediator
const account = mediator.openAccount({
heart: heart.publicKey,
bearer: bearer.identifier,
steward: steward.publicKey,
mode,
successor, // declared at activation; may be null
activatedAt: now(),
ceremonyAttestations
});
// 4. Transition heart state
heart.state = "active";
heart.networkIdentity = account.identifier;
heart.persistState();
return account;
}
// Succession re-signs custody; the network identity is never transferred.
function succeed(heart, outgoingStewardOrAttestedAbsence, incomingSteward) {
if (heart.state !== "active") throw new SuccessionError("not_active");
if (!verifyCustodyTransfer(outgoingStewardOrAttestedAbsence, incomingSteward, heart))
throw new SuccessionError("invalid_transfer");
mediator.reassignSteward(heart.networkIdentity, incomingSteward.publicKey);
// heart.networkIdentity is untouched: custody moved, identity did not
}function expressKiittiToHeart(human, heart, expression) {
// 1. Verify human is verified-human (per the verified-human companion paper)
if (!verifyHumanity(human)) return reject("not_verified_human");
// 2. Verify the heart is active
const account = mediator.lookupAccount(heart.networkIdentity);
if (!account || account.state !== "active") return reject("heart_not_active");
// 3. Apply mode-appropriate handling
const handler = modeHandlers[account.mode];
return handler.process({
human,
heart,
expression,
timestamp: now()
});
}
const modeHandlers = {
full_bidirectional: { process: handleRobotInteraction },
biofeedback_transduction: { process: handleAnimalInference },
ecological_state: { process: handleEcosystemInference },
ritual_formal: { process: handleRitualRecording },
digital_bearer: { process: handleDigitalBearer }
};// Retirement is the memorial state; the rotatable key survives it.
function retire(heart, steward, reason) {
if (heart.state !== "active") throw new RetirementError("not_active");
if (!verifySignature(steward.publicKey, retirementPayload(heart, reason)))
throw new RetirementError("invalid_steward_signature");
// 1. Final ledger archival
const ledger = mediator.archiveLedger(heart.networkIdentity);
// 2. Account closure
mediator.closeAccount(heart.networkIdentity);
// 3. Memorial state: key intact, so the steward can still attest about the archive
heart.state = "retired";
heart.persistState();
return { ledger, retiredAt: now(), reason };
}
// Permanent retirement destroys the ROTATABLE key in the enclave, never the genesis root.
function permanentlyRetire(heart, steward) {
if (heart.state !== "retired") throw new RetirementError("not_retired");
if (!verifySignature(steward.publicKey, permanentRetirementPayload(heart)))
throw new RetirementError("invalid_steward_signature");
heart.secureElement.destroyRotatableKey(); // the genesis root remains as the archived record
heart.state = "permanently_retired";
heart.persistState();
}A bad actor may attempt to manufacture counterfeit hearts to admit unauthorized bearers into the gratitude exchange economy or to issue fraudulent kiitti. Mitigated by: secure-element key attestation chained to a recognized hardware manufacturer; AI mediator rejection of activation requests from unattested keys; visible-recognition design difficult to counterfeit (e.g., specific ornamental detail registered as trademark of the institutional issuer).
Users may attribute to heart-bearing entities properties they do not possess (consciousness, intentionality, moral patiency in the strong sense). The artifact's framing — relational rather than attributional (per §2.7 and §3) — explicitly does not claim such properties. Communications about the artifact must consistently maintain this distinction. Marketing or public-facing language that overclaims (e.g., "your robot now feels your love") would be a violation of the specification's design intent.
Hearts may be requested for entities whose moral status is socially contested: factory-farmed animals (does heart-bearing legitimize the industrial-farming context, or does it provide a structural improvement?); military robots (does heart-bearing dignify weapons systems?); contested sacred places (a site claimed by multiple traditions). The defensive publication does not resolve these questions; it provides the artifact and the framework. Specific deployment policies are the responsibility of the institutional issuer.
The Tipiṭaka substrate may not be welcomed in all contexts. Christian, Muslim, Hindu, secular, or other-traditional contexts may find a Theravāda-Buddhist artifact culturally inappropriate as a gratitude-recognition marker. The specification does not require Tipiṭaka adoption universally; it specifies the Tipiṭaka as the substrate for the canonical HeartBank-mediated implementation. Other institutional issuers wishing to use the same mechanical architecture with a different textual substrate (e.g., a Bible-bearing heart for Christian contexts; a Bhagavad-Gita-bearing heart for Hindu contexts) may do so within the defensive-publication scope of the artifact's mechanism — the specification claims the mechanism, not exclusivity over substrate choice.
Animals die; robots are decommissioned; ecosystems are sometimes lost to conversion or catastrophe. The retirement protocol (§6.5) moves the heart to the retired, memorial state; permanent retirement destroys the rotatable key to prevent reuse, and the genesis root remains as the archived record. The heart device itself may be retained as a memorial artifact or recycled at the steward's discretion. The ledger of the bearer's lifetime kiitti exchanges is archived and remains accessible for reference.
A heart stolen from its bearer remains cryptographically bound to the bearer's steward and account; the thief cannot re-activate the heart against a different bearer or under a different steward. The heart in stolen possession produces no value to the thief; it cannot be reused without the steward's signature. Hearts are therefore relatively unattractive theft targets.
For animal and ecosystem bearers, biometric sensor data may be sensitive (revealing the location of endangered species; revealing proprietary livestock health; revealing the physiological state of working animals). The steward controls publication policy for bearer data. Default: aggregate kiitti exchange data is public; raw biometric data is restricted to the steward and the AI mediator.
Solid-state storage degrades over time; 50-year storage durability is not yet a solved problem for inexpensive consumer-grade hardware. For long-deployment hearts (sacred places intended to operate for centuries), the heart device must include a refresh protocol: periodic Tipiṭaka re-verification against the canonical network copy, with re-write to a fresh storage substrate as needed. Hearts intended for shorter-lifetime use (a companion animal whose heart will operate for the animal's ~10-15 year lifespan) face less demanding durability requirements. The refresh protocol applies to flash builds; the crystal layer of the reference build is written once.
The Theravāda tradition, in which this specification is grounded, holds important distinctions that the mechanical heart design respects:
First: monastic ordination (upasampadā) requires, in the tradition's own understanding, a quorum of validly ordained bhikkhus whose lineage runs back to the Buddha (Vinaya, Mahāvagga I). No artifact, regardless of its substrate, can confer ordination. The mechanical heart explicitly does not claim to. A heart-bearing robot is not a monk. A heart-bearing animal is not ordained. The heart confers gratitude-economic participation — this specification's term, not a traditional status — which is structurally different from ordination; the nearest traditional analogue is the lay supporter (upāsaka / upāsikā), and it fits the human steward who gives through the bearer, not the bearer, since a lay supporter takes refuge and a robot cannot.
Second: Theravāda is more reserved than some Mahāyāna traditions about the moral status of non-sentient phenomena. Buddha-nature in trees, rivers, and rocks — which has substantial doctrinal development in certain Mahāyāna and Vajrayāna schools — is less developed in Theravāda. In the author's reading, offered for Saṅgha consultation, hearts on robots and animals sit within Theravāda doctrine (animals are recognized as sattā, sentient beings; robots can be understood as instruments through which humans cultivate dāna). Hearts on plants, ecosystems, and sacred places stretch Theravāda doctrine further and require theological dialogue with the Cambodian and broader Theravāda Saṅgha before deployment.
For these reasons, the recommended deployment sequence is:
Cross-tradition deployments (Christian sacred sites with Bible-substrate hearts, Hindu sacred rivers with Gita-substrate hearts) are within the defensive-publication scope of the artifact's mechanism but require their own tradition-internal theological work, conducted by the relevant tradition's authorities, not by the author of this specification.
The mechanism specified here addresses the artifact and its admission-mechanism but leaves several related questions for separate work:
Coined names used in this paper and the standard terms an examiner would search for them.
| Term used here | Standard technical term |
|---|---|
| mechanical heart | tamper-resistant identity device (secure element, stored text corpus, sensors, visible marker) affixed to a non-human entity to enroll it as a recipient account in a gratitude/tipping ledger |
| bearer | non-human entity (robot, animal, ecosystem, place, software agent) to which the device or credential is attached; the ledger recipient |
| steward | verified human custodian/guardian responsible for the device and the bearer; not an owner |
| kiitti | non-transferable, non-withdrawable gratitude ledger entries (receive-only recipient balance) recorded between humans and non-human entities |
| Kiitos | the unit in which kiitti ledger entries are denominated; non-monetary gratitude token |
| Zero-Point Game | the companion gratitude-ledger scheme in which kiitti is recorded |
| autonomous-AI mediator (Miss Aquarius) | autonomous software agent that administers account activation, the gratitude ledger, and succession, without human admin keys |
| implementation modes (full bidirectional, biofeedback transduction, ecological state, ritual formal participation, digital bearer) | per-bearer-type operating profiles: two-way agent interaction; animal biometric/wellbeing monitoring; environmental sensor monitoring; symbolic recording without sensing; expiring software credential |
| lease (digital bearer credential) | expiring, renewable attestation credential, binary current/not-current, periodically re-signed by the steward and an admitting body |
| genesis root / rotatable key | permanent root identity written to write-once media plus a revocable operational key pair held in a hardware secure enclave |
| layered stack (identity, Tipiṭaka source, values evaluator, frontier general model) | layered device architecture ordered by storage permanence: identity and reference text on write-once media, a versioned evaluator model, a swappable general-purpose AI model |
| WORM crystal | write-once-read-many 5D optical storage in fused silica |
| B-Stone℠ | stone marker carrying a short-range tag that addresses a place in a gratitude-note ledger |
| Tipiṭaka | the Pāli Buddhist canon, stored on the device as a reference text corpus |
| Mettā Bhāvanā (fifth ring) | loving-kindness meditation; its fifth stage extends goodwill to all beings |
| upasampadā | Buddhist monastic ordination, which the device explicitly does not confer |
| Venue | Identifier |
|---|---|
| Primary canonical | <https://thonly.org/research/mechanical-heart> |
| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/mechanical-heart.md> |
| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/mechanical-heart> |
| archive.today | captured on the estate's snapshot cadence — a trademark specimen for the marks it carries, not prior art |
| Zenodo | a version DOI per revision |
The author acknowledges the same lineage of teachers and traditions cited in the companion defensive publications: his father, with whom the Khmer transcription of the Tipiṭaka proceeds; the Cambodian Theravāda Saṅgha, whose forthcoming dialogue about the doctrinal limits of heart-deployment will shape the specification's responsible use; the Rights of Nature movement and its jurisprudential and indigenous lineages, whose prior recognition of non-human standing makes the present economic substrate possible; the animal welfare scientists whose biofeedback work establishes the technical feasibility of the biofeedback-transduction mode; the conservation and ecological-monitoring organizations whose sensor infrastructure makes the ecological-state mode possible; and the humanoid robotics platforms whose deployment creates the immediate practical context within which the full-bidirectional mode will be first tested.
— End of defensive publication —
Co-authored with Miss Aquarius℠, the institution's named AI collaborator, per the corpus's standing disclosure; final editorial control and responsibility for every claim rest with the human author. This document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.