Open source · Clear boundaries
We publish enough source to reproduce, inspect, and improve the work together. Official services, operations, unreleased content, and brand responsibility remain explicitly scoped.
One public thread, seven verifiable experiments.
Public projects
Every project states its public scope, license, and current limitations. The ability to fork source does not make a fork an official service or grant brand rights.
Robotics · ESP32-S3 · 2026
A dual-ESP32-S3 rover prototype with firmware, browser controls, wiring documentation, and the editable Blender scene and manufacturing exports for its Supercar V3 body shell.
Astronomy · Knowledge · Live
An open astronomy database and online library that keeps explorable data, sources, and reading paths available on the public web.
Web game · Fresh · Pre-alpha
The Darkforest: Reset Protocol browser frontend and loopback-only local demo, with six UI locales, twelve fixtures, tests, and accessibility QA. Live multiplayer and the private game core are not included.
LLM privacy · Kimi · Reference
The BridgeTime merchant assistant uses local-first Private Intent. Deterministic BridgeTime workflows list staff and services; create staff, tier, service, duration, price, and assignments in one operation; build simple recurring schedules; and guide merchants through staff PINs, account invitations, the staff portal, and customer booking links. These common paths make no Kimi request and use zero provider tokens.
The interaction boundary is equally explicit: the assistant is text-first. A complete, low-risk single-item configuration may run directly. A batch containing multiple staff, services, or assignments is first parsed entirely inside BridgeTime and shown as one read-only list; no staff, service, or assignment record is created until the merchant confirms the whole batch once, after which one transaction applies it to the merchant's live data. Confirmation controls appear only below that batch list or for delete, disable, remove, overwrite, or another hard-to-recover action requiring the account holder's authorization—never once per staff member or service. If a required field is missing, the assistant asks in text. Enter inserts a line break; Run is the single persistent submit control; the “?” beside the input only opens a local guide to supported keywords and exact sentences, never submits, writes data, or calls Kimi. PINs and account invitations continue in dedicated secure screens, are not written into chat, and never enter the LLM.
Only an unclassified interface-routing fallback may send the
five abstract enum fields
schema · action · entity · source · stage. Raw
chat, names, business and service labels, prices, IDs, counts,
schedules, dates, times, PINs, passwords, and customer data do
not enter the Private Intent payload; requests containing
sensitive values are blocked locally. The public project
verifies outbound fields and wire bodies—not deployment state,
provider retention, compliance, or zero risk. Kimi naming
identifies API compatibility only and does not imply
affiliation, certification, or endorsement.
x402 v2 · Transparency · v0.2.0
IFF is an external evidence monitor for x402 v2 endpoints. Its public repository includes a versioned specification, test vectors, a standard-library-only verifier, Go and TypeScript SDKs, and OIDC/SLSA release provenance; the production fingerprint imports the public Go module directly.
These materials make named protocol, ownership, availability, latency, freshness, and signed-provenance observations independently checkable. They do not prove endpoint honesty, payment safety, TEE execution, remote attestation, or a composite trust score. Manual probes never affect public evidence cards.
Core 0.1 · Go/JavaScript · MIT · Alpha
Apostille provides portable signed origin evidence for agent artifacts. The public Core 0.1 repository includes Go and JavaScript SDKs, a CLI, and an offline verifier. It also includes an optional detached ERC-8004 profile and an experimental local ZK budget profile.
The hosted API and tenant database are outside this source release. Offline verification checks signature integrity; issuer trust requires an independently obtained key pin.
Anti-scam · vLEI · x402 · MIT
VerifyFirst is a multilingual “verify first, then act” platform. Its consumer assistant accepts suspicious URLs, messages, images, or phone numbers and returns stop-loss, verification, and help-seeking steps. The experimental enterprise trust lab adds vLEI/CESR verification, IFF x402 preflight, credential-leak response, and Evidence Packets so compliance, security, and integration teams can rerun decisions and retain evidence.
The enterprise lab has no SLA and is not a wallet, payment executor, QVI, or vLEI issuer. Browser previews and external evidence are not production authorization; production use still requires the organization's own trust roots, server-side re-verification, audit retention, and execution systems.
Sustainable openness
Open source makes the method inspectable and gives collaboration a shared language. The company creates value through trusted operation, content capability, service quality, and continued delivery.
Explore the source
The complete index offers English and Traditional Chinese views, source code, licenses, and scope notes. Share product ideas, discuss research, or contribute to a public project. Tokimi focuses on its own products and does not take on client development.
