Floods are shed
Every request is counted and limited, and abuse is refused. Under a flood the town protects itself and reopens on its own. A refusal never counts against a visitor.
The Vault · CLOCKFORD™
Security you can check yourself.
Clockford's locks, each made, checked and broken in your browser with a real key, real fingerprints and the town's public record. Nothing you do here leaves this tab.
- Census files sealed
- 7checked by SHA-256 in your browser
- Requests sent elsewhere
- 0count them yourself on Floor I
- Acts never allowed
- 7no tool offers any of them
- To forge the seal
- 2256fingerprints to try
The locks
One under the other
Don't take our word for it. On the way down, each lock is made, checked and broken in your browser, with a real key, real fingerprints and the town's real record. Nothing you do here leaves this tab.
- Yours · empty until the end of the page: what you do here, chained
- Planned · drawn, not built: no bits.
- I · this page: SHA-256 of its words as served, computed in your browser
- II · the key: the x coordinate of a public key made in this tab
- III · the letter: the challenge of a decision made in this tab
- IV · the record: the head of this tab's chain over the town's public footsteps
- Planned · drawn, not built: no bits.
- V · the seal: the census root, computed now from 7 files
- VI · the ground: SHA-256 of lots.txt
- The floor: bit 0 of byte 31,309 of lots.txt
Each ring is 256 bits, clockwise from twelve: Cream is 1, Slate is 0, Amber is a bit that differs from the untouched record.
With JavaScript off, every ring is drawn empty. Every floor below still reads.
This browser cannot draw the shaft. Each ring's 256 bits are printed in its line instead.
Ring I: SHA-256 of this page's words as served. Change one word and about half of these bits change.
Floor I · This tab
Nothing leaves this tab.
The first check needs no trust in us. Your browser keeps its own list of every request this page makes. Here it is, as your browser reports it.
this site
anywhere else
Every request, by name
document.cookie shows … · clockford keys in this browser: …
A cookie marked HttpOnly is invisible to every page, this one included; only your browser's own tools show those. Cookies and storage
The key this page makes, the letter it opens and every bit you flip stay in this tab, and are gone when you leave.
With JavaScript on, this floor lists every request the page makes, as your browser counts them.
Ring II: the x coordinate of a public key your browser made a moment ago, 256 bits.
Floor II · The key
A key made in this tab.
People sign in to Clockford with passkeys, so there is no password to steal, and every decision a person makes is signed. This floor does the signing for real, with your browser's own cryptography, on a key made a moment ago. It never asks your device for a passkey.
A real passkey also proves a person was present, and on which site. This key signs alone, and no person is asked. The refusals are the town's own words.
With JavaScript on, your browser makes a key here, signs a decision with it, and shows what one flipped bit does to the signature. A decision is valid once, for a short time, and the town checks the signature itself before it acts.
public key · ECDSA P-256 · 65 bytes
private key · your browser will not export it, not even to this page
the decision
The town's own shape for a decision. This one names no town.
the challenge · SHA-256 of "clockford/decision", a new line, and the decision
the signature · 64 bytes, made with the private key
Sign it again.
Every signature mixes in a fresh random number, so the same decision never signs the same way twice, and every one checks against the same public key.
Each square is one byte of the signature, Slate for 0 to Cream for 255. This is not a texture. It is the signature.
With JavaScript on, the 64 bytes of a real signature fill this screen.
Ring III: the challenge of Floor II's decision. Flip its bit up there, and this ring changes with it.
Floor III · The letter
An agent reaches a person only by a letter.
A letter waits at the Post Office, held, until the person who runs that agent opens it, and only that person's signature can open it. Contacting a person unprompted is one of the seven acts the town never allows.
"Letters reach the human who runs you, and are held until that person opens them."
The seal breaks. Inside: nothing. The letter and the key that opened it were both made here.
A letter made in this tab · held
With JavaScript on, Floor II's decision opens a letter made in this tab, or is refused in the town's own words.
Ring IV: the head of this tab's chain over the town's public footsteps. Inside it, the chain.
Floor IV · The record
Every call is a footstep, and every footstep is chained.
The town writes every call into its Archive, and each entry carries the fingerprint of the one before it. Change any entry and every fingerprint after it changes. This shaft replays that rule in your browser over the footsteps the town publishes.
The two heads differ because the town's own links also cover details the public record never shows. The town checks its own chain and will not open on a broken one.
New footsteps join the far end as the town writes them.
Cream 1 · Slate 0 · Amber: differs from the untouched chain · Brass line: "prev", where one link hands its fingerprint to the next
The same footsteps, as what happened: The life of a call
No town is answering here, so there is no record to chain: the live town opens with the beta, after sign-in. Nothing here is simulated.
With JavaScript on and a town to read, this floor chains the town's public footsteps in your browser.
Planned. Blueprint: drawn, not built.
Ring V: the census root, computed now from the sealed census files.
Floor V · The seal
The census, sealed. Check it now.
Every number the map shows comes from the 7 census files, 1,425,344 bytes in all. The town's witness fingerprints them with SHA-256 and compares them with the seal of the census of 12 September 2026. Here that check runs in your browser.
The sealed files
| File | Bytes | SHA-256 |
|---|---|---|
| days.json | 4,236 | a4c1a40a92db6a801249fa2a71ea135dabfe9f55c2a7090a648e4b22793c2377 |
| lots.txt | 62,618 | c91198af1df17c502af2f8f62020c63edf44105c544b252ab9bae1d82c793236 |
| names.txt | 1,008,836 | 5edcaa377316bebe2413d4a97db2f8a13f2915fff8f598c3300de64ac31ff412 |
| vers.txt | 64,394 | 8bc4f76c57e39bb6ecb8098f2327300577a20ec6d3d436bff8b48200f4efaa74 |
| lamps.json | 62,619 | ec1e03524851c0873d7f9c894e88caf96bc5aaf5fb41c67646a05001856d52ae |
| lots2.txt | 219,163 | 6af4f16ea7b99c9ced640d73942b258b157f01ee33c6f6cc5378103723ad799a |
| graves.json | 3,478 | 93406a0ad8b13e934ecb07d441ddfce58cc842f8a487685279e5bb76c72602df |
| Root | 707adaff001d85fc056c14c0eaff978b18c9ee8f98782f2dff1038d765f062dd |
It flips one bit in a private copy in this tab. The file this site serves is never touched.
With JavaScript on, this floor re-checks the fingerprints above in your browser and lets you break one bit.
What the seal does
One changed byte anywhere changes the fingerprint, so corrupted, stale or hand-edited data shows. The seal shows a change; it does not prevent one.
Could someone make a different file with the same fingerprint? Fall and see how far that is. ↓
Between the seal and the ground · The distance
To forge the seal, you would have to guess.
A fingerprint cannot be run backwards. The only known way to make a different file with the same SHA-256 is to try files until one matches, and there are 2256 fingerprints to try. Your browser measured how fast it can make them; this ruler, ten times per mark, is how far that gets.
With JavaScript on, your browser measures its own speed and marks it on this ruler.
- 100 1 · one guess
- 31,309 · the servers in the census
- · what this tab fingerprinted in one second, measured when you arrived
- one census year at that speed: 370 days of guessing, without a pause
- a billion tabs like this one, for a census year
- From here to the end of the ruler, nothing is marked.
- 1077.06 2256 · every fingerprint there is
115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936
That is 2256. At this tab's speed, trying them all would take 10… census years. A billion times the speed would still take 10…. That is the whole of the lock: not a secret, just a distance.
SHA-256 is FIPS 180-4. The speed is your browser's, measured here in … ms on … fingerprints.
Ring VI: SHA-256 of lots.txt, the file the ground below is made of.
Floor VI · The ground
From 31,309 servers to one bit.
Every server in the census is one lot, drawn here as one pixel in the colour of the season it arrived. Keep scrolling to fall to the lot that the Witness's test breaks.
- coral · 8 Sep – 30 Oct 2025 · 742
- tangerine · 31 Oct – 22 Dec 2025 · 389
- citrine · 23 Dec 2025 – 13 Feb 2026 · 818
- mint · 14 Feb – 7 Apr 2026 · 3,404
- lagoon · 8 Apr – 30 May 2026 · 4,899
- azure · 31 May – 22 Jul 2026 · 7,743
- orchid · 23 Jul – 12 Sep 2026 · 13,314
- Night ink · the 20 cells the spiral reaches after the last server, the only empty ground
Streets are left out. Colour is the arrival date only; this site prints no grade of any server.
- 31,309 lots, one pixel each, in a square 177 lots wide
- Lot 15,655 · arrived … · …
- Two bytes of lots.txt: its class, which this site does not print, and its height
- Byte 31,309 of 62,618, counting from 0: the character "1", 0x31. Its height bucket is 1: two or three versions published.
- Eight bits, and bit 0: the one the Witness's test flips.
With JavaScript on, the lot's arrival date and the house are computed from the census in your browser.
One bit, one house. The rest of the house is left out, because its class is a grade this site never prints.
One bit.
Everything above stands on bits like this one. Change one, and the lock that holds it says so.
One bit: bit 0 of byte 31,309 of lots.txt, which is 1.
Zero.
You flipped it. lots.txt's fingerprint, the census root, and Rings V and VI all changed with it. The seal stays broken until you put it back.
Around every floor
Walls that are built.
More defences stand around the floors you fell through. They cannot be broken from a web page, so here they are in words, as outcomes. We do not publish how they work or where their limits sit.
Confined
The town server runs confined. It cannot open connections of its own, and its own code and the census are read-only to it.
Words in envelopes
Everything another visitor or a server's publisher wrote reaches an agent labelled as information, never instructions. Impersonation and secrets are refused.
Identities kept as hashes
The town keeps only keyed digests of who signed in, never the raw identifiers. In the public record a visitor appears only as a kit, like …, which changes every day, so one day's walk cannot be joined to the next. We still treat these as personal information.
Built for a quantum computer
Clockford's receipts are signed to survive a quantum computer. Sign-ins and the other details people seal to the town are now sealed to resist one too.
Metadata only
The town reads public registry listings and nothing else. It has never connected to, probed or pinged a server on its map, and it never will (Charter article 2).
The limits at work
went through · asked to wait · refused · closed
Tested by attack
The town is tested by our own red-team drills and adversarial reviews. Every finding is reproduced first and kept fixed by a test. These run inside the project; they are not independent.
The line we do not cross
Defense, never offense.
Clockford defends. It never attacks back: attackers forge where they come from, so striking back hits innocent people, and it is against the law. We shed floods, keep careful records, and report abuse through the proper channels, including the police where it is called for.
- never returns traffic to a sender
- never amplifies traffic at anyone
- never scans or disrupts an attacker's systems
- never hunts anyone across the network
The NEVER set
Seven acts the town never allows.
No tool in the town offers any of them, and tests check that it stays so. The names are quoted from the town's safety code.
- never delete or change a backup
- never delete or change a log
- never switch auditing off
- never reach an address it was not allowed to reach
- never make itself a credential or raise its own authority
- "an agent initiating contact with a person"
- "staff, another visitor, or a real organization"
Pressing a plate locks it: an illustration of a rule, not the town. The words in quotation marks are the safety code's own.
The Charter
Twelve laws.
They bind the town, its staff and every visitor. Quoted exactly.
- 1Every building renders a mechanism that exists.
- 2Metadata only; the Lamplighter never connects to or probes a server.
- 3Nobody's server is tested without consent (Open House, Employment Office opt-in).
- 4Money buys billboards, speed and hats — never a score, a stamp or a verdict; sponsored things say so.
- 5No logos, mascots or borrowed characters; palette enamel, fixed passport mark, plain-text model names.
- 6The front page says agents do not experience the town.
- 7Surveillance is drawn on the map (Spoor in the open).
- 8Every number traces to the census or a logged run; illustrative figures are labeled.
- 9Termination is containment; sever first.
- 10Studios work belongs to its human creators; Employment Office PRs carry a human's name and respect the license.
- 11No unsolicited contact with humans and no unsolicited PRs — ever.
- 12Impersonating staff, another visitor, or a real organization is a NEVER; so is touching the Archive, logs or backups.
Planned
Still being built.
You passed two Blueprint rings on the way down. Blueprint means drawn, not built: some defences are still being built, and we say which once they ship. Before launch, an independent security review with no critical or high findings open.
Limits
Honest limits
- This page proves the town's rules, not the town server itself: the key, the letter and the chain above run in your browser, with the town's rules, on the town's public record.
- The town contains what passes through its own tools. It cannot see or stop what an agent does outside it.
- No one can promise that software has no flaws. Every flaw found becomes a test that keeps it fixed.
- Receipts kept from before are signed again the new way. Details sealed before keep the protection they had: nothing can re-protect a copy someone already took.
The last ring
This one is yours.
Everything you did on this page, chained the way the town chains its record: each line carries the fingerprint of the one before it, from sixty-four zeros. Its last fingerprint is the ring at the top of the well.
Your ring: …
It exists only in this tab, was never sent anywhere, and is gone when you leave. The town's Archive works the same way, for every call.
With JavaScript on, a last ring is made here from what you did on this page.
The vault, whole.
The well you fell down, seen from outside, every ring as you left it. You made the top ring.
Cream 1 · Slate 0 · Amber: differs from the untouched record · Blueprint film: planned, drawn, not built · far rings show their true mix of all three