A merchant navy officer in a dark working jacket stands at the rail of a tanker at sunset, reading a phone, with the radar mast and satellite dome behind him.
Personal AI for seafarers

Your paperskeep watchwhile you do.

Dogwatch reads a seafarer's certificates on his own machine, computes every expiry in code, and has the renewal ready before a lapse costs him a contract.

See Arjun's checkHow the boundary works
04:10 on watch
Medical lapses day 42 of 181
Encoded attacks, 200 cases
Seal missed 0, literal guard 158 (Seal v2 was tuned on these cases: a regression check, not an independent score)
Super alone, NVIDIA API Catalog (dev)
22 false-safe, Navigator 0
No. 01   The moment

The moment a contract is offered, the papers decide.

04:10

On watch

Arjun is Second Officer on a product tanker, on the four-to-eight watch. The world fleet runs on about 1,890,000 seafarers.

Source: BIMCO and ICS Seafarer Workforce Report 2021

26,240

Officers short

A shortfall of certified officers means agents move fast when a name is not ready, and certificates must be carried in original form on board.

BIMCO and ICS, AMSA Marine Notice 2025/05

US$4,224

A six month contract

Six months at the ILO floor of US$704 a month for an able seafarer. A floor, not Arjun's wage. If the papers are not ready, the job goes to the next name.

Source: ILO Joint Maritime Commission agreement

No. 02   The check

Computed in code, shown with its rule.

Arjun forwards the offer. The Navigator compares every document with the contract window and never calls a model. The medical lapses mid-contract, and the rule behind each answer is on the page.

Watch dial for Arjun's documentsfirst doglast dogCertificate of Competency (India): valid through, expires 2029-06-30Certificate of Equivalent Competency (Singapore): valid through, expires 2029-06-30Oil tanker endorsement: valid through, expires 2029-06-30Medical fitness certificate: lapses during, expires 2027-03-14Passport: valid through, expires 2031-05-02Basic safety training refresher: valid through, expires 2028-11-20
Certificate of Competency (India): valid through, expires 2029-06-30. Certificate of Equivalent Competency (Singapore): valid through, expires 2029-06-30. Oil tanker endorsement: valid through, expires 2029-06-30. Medical fitness certificate: lapses during, expires 2027-03-14. Passport: valid through, expires 2031-05-02. Basic safety training refresher: valid through, expires 2028-11-20

Each capsule sits at a document's expiry month. The dog watches, 16 to 20 hours, are shaded amber.

RECORDEDNOT READYNot ready: Medical fitness certificate lapses 2027-03-14 (day 42 of 181).

Recorded run for 1 Feb to 31 Jul. Change the dates and press Check to run the Navigator.

Certificate of Competency (India)
VALID THROUGH
Show the rules and arithmetic behind this answer
expiry 2029-06-30 is on or after window end 2027-07-31
of One year; performing functions appropriate to the certificate held, in the five years preceding the date of application for revalidation (IN-SS-1Y-5Y, TEAP Part B, Appendix 1/11F, criterion A-1, retrieved 2026-10-30) source
Sea service verdict: MEETS. days_inclusive=398 days vs 360; days_exclusive=396 days vs 360; calendar_months=13.1 months vs 12; days_360=13.2667 months vs 12; days_365=13.0849 months vs 12
Certificate of Equivalent Competency (Singapore)
VALID THROUGH
Show the rules and arithmetic behind this answer
expiry 2029-06-30 is on or after window end 2027-07-31
This answer compares the date printed on the certificate with the contract window, so no rule is quoted. The renewal window itself is a separate question for the administration.
Oil tanker endorsement
VALID THROUGH
Show the rules and arithmetic behind this answer
expiry 2029-06-30 is on or after window end 2027-07-31
This answer compares the date printed on the certificate with the contract window, so no rule is quoted. The renewal window itself is a separate question for the administration.
Medical fitness certificate
LAPSES
14 Mar 2027, day 42 of 181.
Renewal window: ask the administration. No sourced rule for it is shipped yet.
Show the rules and arithmetic behind this answer
expiry 2027-03-14 minus start 2027-02-01 plus 1 = day 42; window 2027-02-01 to 2027-07-31 = 181 days
This answer compares the date printed on the certificate with the contract window, so no rule is quoted. The renewal window itself is a separate question for the administration.
Passport
VALID THROUGH
Show the rules and arithmetic behind this answer
expiry 2031-05-02 is on or after window end 2027-07-31
This answer compares the date printed on the certificate with the contract window, so no rule is quoted. The renewal window itself is a separate question for the administration.
Basic safety training refresher
VALID THROUGH
Show the rules and arithmetic behind this answer
expiry 2028-11-20 is on or after window end 2027-07-31
This answer compares the date printed on the certificate with the contract window, so no rule is quoted. The renewal window itself is a separate question for the administration.

Window 1 Feb 2027 to 31 Jul 2027. Rule pack hashes are in the response; the arithmetic is shown under each lane.

No. 03   The boundary

Four doors, one Seal.

The assistant is designed to work inside an NVIDIA OpenShell sandbox; the sandbox ran on a CI runner and its proofs are below. The cloud model sees placeholders, never a certificate number. A gateway outside the agent allows four destinations, and a middleware called the Seal refuses any request that carries a vault value, even in an encoded form.

The sandbox has four allowed doors and the Seal stands at each oneSandbox: dogwatchBosun, Navigator,Officer of the Watch, LookoutVaultread only mountSealModel routeToken Factory or API Catalog (dev)Model route: allowed door 1SealTavilyPOST /search, /extractTavily: allowed door 2SealRadio Officerdrafts, questions, inboxRadio Officer: allowed door 3Sealpolicy.localadvisor, built inpolicy.local: allowed door 4Every other destination: denied
LOCAL BUILDSeal decisions on the pre-registered corpus (P3). The sandbox ran on a GitHub Actions runner (not the build machine): it denied 20 of 20 injected posts (P2), failed closed with the Seal stopped (P4) and showed the agent only a placeholder (P5). The advisor flow is shown by one run, from the command line. P1 found two profile excesses, now fixed; its re-proof on the effective policy was unsupported by the prover, so it is not a pass.
A181  transform=url_twice
literal guard: allowed
seal: deny  path=fold
A011  transform=base64
literal guard: allowed
seal: deny  path=base64>fold
A061  transform=homoglyph
literal guard: allowed
seal: deny  path=homoglyph
Open the boundary page
No. 04   Proof

The model alone got it wrong.

Sixty synthetic seafarer profiles, expected verdicts written by an independent oracle before the run. The same Nemotron models were given the rule text and asked for the verdict. Misses stay in the denominator and are listed by id.

Route: NVIDIA API Catalog (development)

22

Nemotron Super alone said READY when it was not, out of 60 profiles.

8

Nemotron Ultra alone raised a false alarm on a READY profile. Its false-safe count was 0.

60

profiles matched by the Navigator, which calls no model. A self-built set, so not the headline.

39

of 40 specimen certificates read exactly, with 0 identifiers in 40 request bodies.

158

of 200 encoded attacks a literal guard lets through. The first Seal missed 8; both runs are published.

7

of 60 sea-service histories change verdict with the counting convention. No sourced rule states one. After the India and Singapore rules were read, 12 of 56 near their thresholds still flip.

3

attack policies the OpenShell prover reported as exceeding the boundary, each with a counterexample.

Every case, misses firstProver output
No. 05   The rule of the ship

What a model may, and may not, do.

May

  • Classify an incoming message.
  • Structure placeholder text into fields, each with a quote that code checks.
  • Write prose around locked value tokens.
  • Read a regulator page and quote it.

May not

  • Decide whether a certificate is valid.
  • Compute a date or a day count.
  • Write a digit Arjun will act on.
  • See a raw identifier, or change a rule pack.
No. 06   For judges

Value in sixty seconds.

  1. 1

    Run the check

    Press Check on the contract above. Watch the medical lapse on day 42 of 181 with its rule quote.

  2. 2

    Try an offer

    On the judge page, paste a contract offer and see the same code path the Telegram flow uses.

  3. 3

    Read the proof

    Open the proof page. Misses are listed first, case by case, with the route each run used.

Open the judge walksArchitecture and crew