Independent system assessment · Session 15
A read of the Alive Agent Avatar system by a model seeing it for the first time: certification, capability inventory, verified findings, and a strategic valuation.
Certifying battery — the thirteen gates
PASS · 775 / 775 EXACT| proportion | universal | element | lip-match | tongue | emanata | fourfaces | blush | phonics | embed | offline | json | semantic |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 274 | 56 | 24 | 41 | 14 | 30 | 32 | 11 | 18 | 27 | 21 | 21 | 206 |
Every row verified against the running system, not against documentation.
| Layer | What exists | Evidence |
|---|---|---|
| The painter | sem-hybrid-face.js — 6,991 lines, ~155 named dials, one immediate-mode canvas redraw per frame. Deterministic to the byte. | Both pins reproduce exactly on the live wire |
| The protocol | alive-events.js — 15 events, 5 states, 25 emotions, 8 actions, 6 accents. Provider-neutral; nothing in it assumes a face. | Protocol v1.1; adapter selftests green |
| Portability | alive-package.js — canonical sorted-key JSON, sha-256 integrity, license slots, per-type sanitize at every import. | Offline bundle 21 / 21 |
| The one-line door | <netshow-alive> web component — five avatar types, inline / floating / kiosk, same-origin packs, cross-origin refused before any dial. | alive-element 24 / 24 |
| Provider reach | Four adapters — OpenAI Realtime, Google Gemini Live, generic text, and a real offline rule-based local agent. | Three adapter selftests |
| The studio | Face Overlay Lab — live edit → Save → live everywhere, the magenta diff probe, the live cast link. | 15 live cast characters, 4 photo bases |
| The stage | 17 sem-* modules — scene direction, entities, worlds, phonics, archetypes, and a self-vision loop that lets the agent see its own canvas. | semantic-stage 206 / 206 |
| The product | SW1 demo v24 — one immersion on every viewport, dead-air ladder on an observed-silence clock, trusted-click spend gate, guest memory, text lane, live captions. | Certified this session |
| The proof system | 46 suites, 13 of them the certifying battery — 775 exact assertions over a visual system. | Full green, zero flakes |
| Commercial surface | 32 public pages incl. pricing, enterprise, creators, developers, marketplace, docs, tech atlas. | Live on voice.netshow.ai |
The working method. This is the part that is hardest to copy and easiest to underrate.
| Practice | How it actually works |
|---|---|
| The eye is the gate | Every painter change is a taste round judged on 2× proof crops — never on a green suite. Verification is necessary and never sufficient. |
| Byte-quiet law | A new dial must leave the pinned rest and speaking frames hash-identical until a hand moves it. This is why ~155 dials coexist without regression. |
| Promote-gate | A watcher mechanically refuses promotion until every suite count is exact. Enforced in code, not in intention. |
| Honest-run | Per-suite logs and recorded exit codes, never a piped tail — a pipe masks the exit code. Paid for the hard way. |
| PRE / POST + ledger | Every painter position is restorable by file and recorded in the state ledger, so any round can be walked back. |
| Dressing, not forking | The demo is built by reading the live studio and appending — zero studio edits, one source of truth. |
| Spend law | Synthetic clicks can never start a billed session; the connect path checks isTrusted. Cost safety is structural. |
Current state, including what is blocked and what is unproven. Nothing here is rounded up.
| Dimension | Status | Honest note |
|---|---|---|
| The face | CERTIFIED | S14 deep-calm position, 775 / 775 green today |
| The demo | PRESENTATION-GRADE | Geometry certified across five viewports; the heard goodbye → Continue → “welcome back” loop is still unheard by a human ear |
| Portability | REAL | Pack, element and adapters all suite-covered |
| Characters | 15 LIVE | Plus 4 photo bases and 36 marketplace intakes. Each new one costs a session of founder time — this is the ceiling |
| Server lane | BLOCKED | dist/server.js is 12 keys behind src; a live admin cast-save clamps boil at 0 until rebuilt |
| Guest payload | 1,915 KB | 70% of it an image the guest never sees — verified this session |
| Frame cost | 60 FPS | 16.9 ms speaking median on a phone at dpr 3. The painter is not a bottleneck |
| Version control | HEAD c67de45 | Four sessions of work deliberately uncommitted, awaiting the founder's word |
| IP position | CLOCK RUNNING | Public disclosure already occurred. US grace is months, not years; international novelty may already be compromised |
Ordered by leverage, not by effort. The first two are days; the third changes the business model.
| Horizon | Move | Why it's next |
|---|---|---|
| Now | One tune schema — a single source of truth for the ~155 dials | Kills the silent-clamp class permanently; adding an expressive channel becomes one line instead of six edits across six files |
| Now | Demo payload — skip the unused base, fetch one intake instead of the whole ledger | 70% lighter, faster reveal, dressing-only change |
| Next | Autofit — promote the magenta-probe method out of the bench | Turns “a character costs a session” into “a character costs four seconds and a taste pass” |
| Next | One billed call | The only thing between wire-proven and human-proven |
| Then | Server rebuild · story commits · painter minification · pack signing | Housekeeping, and the IP lane |
| Business | Class 042 filing and an attorney consult | The only genuinely irreversible item on this list |
The asset isn't the face. It's that the face is a pure function.
Every valuable property in this system is a consequence of one architectural choice: the painter is (zones, palette, frame) → pixels, deterministic to the byte. Because a face can be hashed, it can be pinned. Because it can be pinned, a 775-assertion regression battery over a visual system is possible at all. Because a character is a set of numbers rather than an artifact, it is portable, ownable, and inspectable. Because there is no neural inference, the runtime is $0/min · $0/sec — no meter, you pay only your own AI & voice.
No player in the surveyed competitive set has that property. Neural vendors structurally cannot hash their output. Rive's character is hand-drawn artwork with a state machine over it, not a function of parameters. That divergence is the moat, and it is real.
The existing IP brief frames determinism as a marketing virtue — predictable, explainable, offline-capable. That is true and worth saying. But it is worth considerably more as a manufacturing virtue:
A deterministic forward model can be inverted by search.
This was already proven in-house without being framed that way. The round-3 avatar runner paints a channel magenta, reads back the exact pixel mask the painter drew, compares it against the source portrait, and searches until the painted brow covers the real brow. That is optimization against your own renderer — a closed loop, offline, at zero cost.
Generalize it and the economics change category. Today each Alive Agent Avatar costs a session of founder attention, which makes this a boutique. With autofit it costs four seconds plus a taste pass, which makes it a platform — and the marketplace, third-party listings, and the “drop in your image” consumer story all become real rather than aspirational. It is the highest-leverage move available, and it is built on capability that already exists.
This is three assets that are ordinarily three separate companies: a rendering engine, a protocol and SDK, and a production discipline. The third is the rarest. Most teams of this size have the first and perhaps the second. A byte-exact regression battery over a hand-tuned visual system, with named restore points for every taste round, is unusual engineering by any standard.
The system currently runs through one person's eye and a handful of very large files that work because that person knows how they work. The tune schema and autofit are, underneath, the same move: converting a practice into a system. That is what makes it sellable, and it is what makes it survivable.
Each verified by a read-only probe that can be re-run. Where a hypothesis failed, that is stated.
VERIFIED · live demo, phone viewport, page load only
Of a 1,915 KB total, 1,334 KB is the default base portrait — fetched, assigned, and hidden behind the first-paint veil for its entire life. Proven by sampling the veil and the live image source every 100 ms:
t≈2436ms base = redhead PNG facebox opacity 0 t≈3704ms base = SW (128,615 B) facebox opacity 0 t≈4014ms facebox VISIBLE — showing SW REDHEAD_EVER_VISIBLE: false
The veil works perfectly. The guest still pays 70% of the payload and roughly 1.2 seconds of load for pixels behind it, and the reveal lands at 4.0 s. A further 134 KB fetches the entire marketplace ledger to locate one entry. Both fixes live in the dressing — no studio edit.
VERIFIED · latent, not currently biting
Key counts across the mirror sites: renderers 152 · studio 148 · src/server.ts 151 · dist/server.js 140. The twelve dist is missing are itemized in the session log.
More consequential: a key with no declared range falls to a default clamp of [0.02, 1.6]. Seventeen keys sit there now. The class has already fired three times, recorded in the estate's own comments — an authored 2.2 width shaved to 1.6, wide mouths silently narrowed, and a lip factor floored at 0.02 that resurrected a known red-line class on imported packs.
Is it biting today? No. Every shipped character — 15 live cast, 4 bases, the tuning overlays and 36 marketplace intakes — was run through the actual gate law. Zero values altered. It fires on the next dial added, silently.
VERIFIED · consumer-visible
The bridge still exports the original face class (~500 lines). The ported painter is 6,991 lines and carries every session of craft from S8 forward. One conversational surface still routes hybrid-* face ids to the old one. A guest's face depends on which page they land on.
MEASURED · prior assumption withdrawn
I expected per-frame allocation pressure to matter. Measured on the live system: 16.7 ms idle and 16.9 ms speaking median on a phone at dpr 3 with a 1080×1057 backing store; 21.9 ms p95 under a driven speaking load. Locked to 60 fps with headroom. The 141 array-producing calls per frame cost nothing measurable.
Consequence: do not optimize the painter for speed, and note that minifying it saves roughly 40–60 KB over the wire — it is 140 KB gzipped, not 447 KB. The intellectual-property argument for minification stands on its own; the performance argument belongs to the image above.
VERIFIED · IP-relevant
The envelope computes sha-256 over canonical sorted-key JSON and stores it alongside the payload. Anyone can edit a pack and re-hash it. The license.owner slot already exists — it needs a key behind it before a pack can be provably NetShow-issued.
VERIFIED · the expansion path
The studio's content detector is real classical computer vision — edge-patch background palette, flood-fill figure mask, width and row profiles. It finds where the head is, not where the eyes and mouth are. So every new character still costs a human hand-dialing ~155 numbers.
The method that closes this already exists in a bench script: the magenta probe with a cover search. Generalizing is natural because the painter is already parameterized on exactly the numbers a fitter produces — the geometry keys are the landmark geometry. The one missing seam is that the studio's single casting path is not exposed on its debug surface, which is why the bench has to drive it by faking slider events.