MortalOS: Evidence That Software Can Die

What the company appears to be: The project described as "MortalOS: Evidence That Software Can Die" is a self-reported browser-based proof-of-concept system that enables cryptographic handoff of digital identity and state between browsers, using deterministic protocols and non-extractable keys. It claims to demonstrate a falsifiable protocol for verifying continuity and death of software entities across browser loss.

What changed: The project description represents an author's own account of building a prototype with no external validation or traction data. It is presented as a submission to the OpenAI 2026 hackathon, with no evidence of product-market fit, revenue, or customer adoption.

Single most important open question: Is there any evidence that this system has been deployed beyond the author's own development environment, or tested in real-world conditions?

Note: This analysis is based entirely on the self-reported project description supplied by the caller. All claims are unverified and must be treated as such. No external data, revenue figures, customer names, or traction metrics are available.

The description states that MortalOS creates a "state-bearing digital organism" whose custody can move from one browser to another. It uses:

• Non-extractable Web Crypto keys
• Deterministic protocol for validating canonical bytes and signatures
• Cloudflare Durable Object relay for message forwarding
• JavaScript/Python byte-identical state records
• RFC 8032 Ed25519 verification

The system allows a user to create an identity in Browser A, then continue it in Browser B without requiring account creation or API keys. The handoff process involves authorization in both browsers and is designed to prevent unauthorized continuation.

Inference: The product appears to be a browser-based prototype for cryptographic state transfer and verification, not a full operating system or platform.

The author positions MortalOS as a demonstration of how software can "die" — not just persist, but have its death verified cryptographically. It claims to turn abstract questions about digital entity continuity into a "falsifiable protocol."

Key claims:

• The system demonstrates "replay and resurrection rejection"
• It supports "signed fork and equivocation detection"
• It enables "canonical evidence export and replay"
• It uses "deterministic kernel alone" for validation, not external systems like GPT or relays

Claim: The system is a "proof of concept" for cross-browser digital life continuity.

Inference: This is a technical demonstration rather than a commercial product.

Not evidenced. The description does not identify any specific customer segments, target industries, or personas. It is presented as an academic or hackathon project with no indication of intended users beyond the author’s own testing.

Claim: No explicit customer targeting.

Inference: Likely aimed at developers or researchers interested in digital identity and state management.

Not evidenced. There is no mention of pricing, monetization strategy, or business model in the description.

Claim: No evidence of commercial intent or revenue model.

The project uses:

• Cloudflare Pages and Functions
• WebCrypto for key generation
• GPT-5.6 and Codex for adversarial testing and development
• Playwright for browser automation
• Python and JavaScript for core logic
• RFC 8785 canonicalization, SHA-256 domain separation

Validation includes:

• 20/20 persistent two-profile handoffs
• Exact byte equality between JS and Python state records
• Core coverage of 94.70% line, 92.31% branch, 95.22% function
• Dependency audit with zero vulnerabilities

Claim: The system is built on deterministic protocols and cryptographic primitives.

Inference: It is a reproducible prototype with strong technical underpinnings.

Not evidenced. No data on user adoption, revenue, or product usage is provided. The project is described as a hackathon submission with no indication of real-world deployment or traction.

Claim: No evidence of traction or maturity beyond prototype stage.

Not evidenced. There is no mention of competitors or market positioning in the description.

Claim: No competitive landscape information.

• Unverified claims: All technical and functional claims are self-reported without independent verification.
• No product-market fit evidence: The project appears to be a proof-of-concept, not a commercial offering.
• Limited scope: It is described as a "small, reproducible lifecycle" with no indication of scalability or broader application.
• Dependency on author’s environment: No evidence of deployment outside the author's own development setup.

Inference: The project lacks commercial viability or traction indicators.

1. Has this system been tested in real-world conditions beyond the author’s own browser?
2. Are there any external validations or audits of the deterministic protocol?
3. What are the implications for privacy and data sovereignty in cross-browser state transfers?
4. Is there a plan to move beyond browser-based testing into native or distributed environments?
5. How does this system handle edge cases like network failures or malicious actors?