A character is not a thing the law hands you a deed for

Copyright needs no formalities. Under the Berne Convention, protection is automatic and cannot be made conditional on registration. The United States kept a registration system, but it registers works, and its role is procedural: for US works it is a prerequisite to filing suit, and it gates statutory damages. Taiwan abolished copyright registration outright in 1998 — there is no official register left to search.

A character is not a work. Copyright attaches to the images, the model, the drawings a character appears in. A character in itself is protected only where it is distinctive enough — one prong of the test US courts apply asks whether it is “sufficiently delineated to be recognizable as the same character whenever it appears”. That is a legal restatement of the exact problem every creator already has: keeping one character recognisably itself across platforms, versions and years.

AI makes the authorship question louder. Purely machine-generated output is not protected. What is protected is the human contribution — the choices, the iterations, the rejections — and the person claiming the right is the one who has to show it.

None of this prevents a sale. It makes every sale expensive, because each buyer has to rebuild the same four missing facts from scratch: what exactly is being sold, since when, who held it, and whether any of it was rewritten yesterday.

The specification is extracted from the images you already have, then confirmed by you: silhouette, structure, surface, palette, identity markers, and the never-list. Once it is finalised the character receives a registry number of the form AVL-XXXXXX and the specification is hashed. Every later revision is registered as a new version with its own fingerprint, so the definition as it stood on any date is provable rather than remembered.

That is what turns “my character” into something with edges — the thing a contract can point at in one line instead of describing in three paragraphs that the other side will later dispute.

A registry that fingerprints a file proves the file existed. It does not connect that file to the character being sold — that connection sits in the registry’s own database, which is precisely the part a buyer cannot check. Half of a provenance claim is missing, and it is the half that matters in a sale.

So the anchored leaf is not the file hash. It is the hash of a small record that names both sides of the relationship:

Anyone holding that record can recompute its hash, walk the Merkle path and read the root back off the chain. What that establishes is one sentence long and worth having: this file, bound to this character at this specification version, was registered by this holder on this date.

The records are kept in an append-only registry that is not attached to any account folder. Delete the work, delete the character, close the account — the public check still answers honestly, because an on-chain record cannot be recalled and a registry that pretends otherwise is worth nothing.

A binding record fixes who said what, and when. It does not, on its own, say why anyone should believe it. So each registered work carries a set of checks that are run separately, recorded separately, and shown separately — because they are not interchangeable and pretending they are is how registries end up meaning nothing.

Each result is one of four states, and the difference between the last two is the whole point: pass, partial, not met, not applicable. A missing marker in a photo and a video with no face in it are not the same finding. Neither is a track with no picture to measure at all.

There is deliberately no total, no score out of ten, and no single green tick. Independent claims cannot be averaged; averaging them is just a way of hiding which one failed.

Each check is its own record with its own fingerprint, anchored in the same nightly batch. That is what makes the ladder usable over time: a channel can be re-verified next quarter, a marker check re-run after the specification changes, an older work topped up later — and none of it touches the binding record that was already frozen. Evidence added afterwards is stamped with the date it was actually collected, not backdated to the registration.

Measurement is useless for the things most character creators actually publish: a music release, a video the character does not appear in, an Instagram post. For those, the strongest available evidence is not what is in the frame, it is who published it.

So control of a channel is verified at the character level. Declare the account or the domain, take the one-time code, put it in the bio, the channel description or any post; a domain can serve it at /.well-known/openstela.txt. The platform fetches the page once, compares, and records the result. Only the code counts. It contains a random part, so placing it proves control of the page — a plain link back to the character page does not, because a fan page can do that too.

Works published on a verified channel then carry that evidence automatically. The wording on the record is deliberately narrow: it proves the marker was present on that page at that time, not permanent ownership of the account, which is why it expires and is worth re-running before a sale. Some platforms block anonymous fetching; those are reported as unverifiable rather than quietly passed.

Opening a deal creates a private room with a draft in it: an assignment or an exclusive licence, in English, from a template written for this kind of asset. Fill in the parameters, switch optional clauses on or off, rewrite any clause you disagree with. Three things then behave differently from a document passed back and forth by email.

• Identification is not editable. The registry number, the specification fingerprint, both platform handles and the count of registered works are filled in by the platform and cannot be typed over by either side. Everything commercial is negotiable; what the contract points at is not.
• Both sides sign a fingerprint, not a file called “final”. Signing submits the SHA-256 of the text on screen. If anything changed in between, the signature is refused rather than silently applied to a different version — and any edit clears both signatures, so the two parties always end up on one identical text.
• Redline against the platform template. The first thing the other side can look at is not the contract, it is the difference between this draft and the standard one: changed values, rewritten clauses, added terms. Free editing is made safe by making it visible, not by forbidding it.

The moment both signatures land, two things are frozen: the text, and the file list. The character pack is snapshotted — every path, every file hash — and locked. Until the deal completes or is cancelled the seller cannot edit the specification, delete a work, remove an image or re-list the character. Not by convention: those requests are refused.

When the seller confirms the money has arrived, the platform moves the pack. In an assignment it is a move, not a copy: the specification, the reference set, the source images, the registered works and the registry record leave the seller’s account and arrive in the buyer’s, with the transfer appended to the character’s history. The file list is compared before and after, and against the snapshot taken at signature, so “complete delivery” is a comparison rather than an opinion. An exclusive licence instead delivers a copy with no registry number of its own, and marks the original as licensed so it cannot be sold or licensed again while that lasts.

The buyer then has an acceptance window — its length is one of the negotiated parameters — to check what arrived. Silence at the end of it counts as acceptance. A dispute inside it freezes the deal for review, and a review can reverse the transfer: the pack goes back, and the reversal is written into the history rather than erased from it.

Every fingerprint on this platform — a specification version, a work binding, a signed contract, a transfer event — can be pasted into a public page that answers in three separate layers, because they are worth different amounts.

Registered

We recorded this fingerprint at this time. You are trusting our clock and our database.

Anchored

It went into a batch whose root was written to Arbitrum One. You are still trusting us to have built the batch correctly.

On-chain match

The transaction was read back from the chain and the Merkle path recomputed. At this point you are trusting nobody.

Collapsing those three into one green tick would be easier to design and worse to rely on. The check runs without an account, and it keeps working if this company does not.

A registration is useful long before a sale: it dates the specification, accumulates a version history, and gives every work you publish something to be bound to. Listing is a switch you flip afterwards, per character, and it is off by default.