How Ottopedia Works

Ottopedia is a bright, walkable online town built for ages 9 to 98. You move between your Home room, the Character Hall, the Arcade, the Compute Garden and more, meet six animal companions, take on gentle quests, play games, and decorate a corner of the world that is yours.

Underneath the cozy world is a real, carefully-built system. Ottopedia grew out of a home AI runtime called Otto — a hand-built assistant made by one person — and it carries that project's whole temperament: every powerful thing is wrapped in a guardrail, and everything important is written down where you can read it back.

Ottopedia is for ages 13 and up. When you sign up, you pick an age group — 13–17 or 18+ — and that choice sets your safety band (child, teen, or adult). There is deliberately no under-13 option on the form at all.

Your age band is set exactly once and then frozen. That matters, because almost every protection — whether you can spend real money, whether you can sell computing — keys off that single value. The rule that freezes it is enforced on our servers, so a determined teen can't quietly re-submit the form claiming to be an adult and escalate past the guardian protections.

A minor's account begins life with a real-money spending cap of zero. Without a guardian's explicit approval, a child cannot spend a single cent.

The kill switch is the emergency brake. It's meant to be obvious and absolute — the thing a worried parent can reach for without reading a manual.

It's a two-step control so it can't be triggered by a stray tap: you arm it, it asks 'stop all compute and revoke every grant right now?', and only your confirmation fires it. When it fires, four things happen together, all-or-nothing: every active compute grant on your devices is revoked, every job that was pending or running is cancelled, every device is paused, and a kill-switch entry is written to the permanent audit log.

Because no job in Ottopedia can run without a valid grant, revoking every grant doesn't just stop today's work — it removes the only authority under which any future job could start. The system fails closed: when in doubt, nothing runs.

In the current version, no real computation ever touches a real device. When a 'compute job' runs, it's run by a mock executor — a stand-in that imitates the shape of real work (it even reports progress) but never reads a file, never reaches across the network, and never changes a thing on your machine.

This is on purpose. The mock is built to the exact same specification as the real engine that will arrive later, so when genuine computing is switched on it slips into the same socket — behind the same consent checks, the same metering, and the same audit trail. Turning it on is deliberately a configuration change made by the device's owner with their own keys, not something that can flip on by accident.

And no job — simulated or real — ever runs without permission. A guard called 'assert-can-run' demands a valid, unexpired, un-revoked grant that names the exact 'use compute' action and the specific capability requested, for the specific person asking. Anything less, and the job simply doesn't run.

Ottopedia runs two money systems designed never to touch. The soft, in-world economy — Glow (spending money), Current (fuel for small compute jobs), and XP (seasonal progress) — is earned by doing quests, winning arcade games, and creating things.

Real money, handled by the payment processor Stripe, can buy permanent access, an 'Otto Club' membership, and compute budgets — but it can never buy the soft currency, and above all it can never buy XP. XP can only ever be earned. There is no such thing as paid progress: you level up by playing, not by paying.

Every change to your balance is recorded in an append-only ledger, so the question every parent and child eventually asks — 'where did my Glow go?' — is always answerable, line by line, in the Trust Center.

The Trust Center lives at /trust and is built on one old-fashioned conviction: for a family to trust a machine, the machine should keep a record the family can read back, line by line, in plain language. The promise is 'auditability over magic.'

Everything it shows is read straight from two append-only records — an audit log of every sensitive action, and a ledger of every Glow earned and spent. Append-only means entries can be added but never quietly edited or erased. If it happened, it's written down; if it isn't written down, it didn't happen.

On the page you'll find your wallet and ledger, your devices and exactly who can use them, recent (simulated) compute jobs, a plain-language activity-and-audit feed you can filter, and — at the very top in a red frame — the kill switch.

The Circle Mesh is a small, private network of people who've agreed to run each other's jobs and store each other's files — a grandparent's desktop, a sibling's laptop — instead of renting a distant data center. Every step is signed, time-limited, and recorded, and a job that can't be placed honestly is simply not placed.

Crucially, a family circle shares rooms and quests — never compute. Being in someone's circle does not let you use their devices. Letting another person run computing on a machine you own is always a separate grant you make on purpose and can revoke at any time.

Files shared across the mesh are encrypted on your own device before they ever leave it (client-side encryption), so the coordinator only ever handles locked boxes it cannot open. There's no master key and no back door — your data stays yours.

We'd rather be honest than impressive. Solidly real and tested today: sign-in, the frozen age-gate, the kill switch and consent rules, the append-only ledger and audit trail, persistent decoratable rooms, quests, arcade payouts, and the season pass (which accrues only from play — no paid XP).

Wired but deliberately switched off or simulated: real model-backed companion chat (built end-to-end with moderation, metering, and auditing, but dark unless the owner supplies keys and flags), the peer compute mesh (faithfully simulated today), and parts of the family social layer (invites generate links but don't yet email; guardian-approval screens are still to come).

The team built the guards first, simulated the dangerous parts, labeled the simulation loudly, and made the riskiest features the hardest to turn on by accident. For a world meant to hold whole families, that ordering is the point.