Child-Originated Character Studio — Authorship Architecture, IP Origin, and the Private Release Lifecycle

The authorship split is the load-bearing invariant. The child originates character, story, identity, taste, and decision. AI handles rendering, consistency, scaling, layout, and polish. This is not a convenience tradeoff — it is the architecture. A child who decides what happens to a character, pushes back on what doesn't feel right, and iterates toward something that matches their interior vision is building taste, identity, and creative agency. A child who approves AI-generated characters is curating a catalog. The split also determines IP: authorship originates with the child, the creative decisions are traceable to the child, and the rendering is a tool — not a co-author. Crossing the authorship line degrades both the creative outcome and the ownership clarity.

The approach of adapting a beloved existing squirrel plush as the character basis was considered and rejected. The IP landscape for derivative characters is treacherous even when the original company is old or defunct: defunct does not mean public domain; name ownership does not resolve visual copyright risk; any resemblance to the original design may constitute infringement regardless of the original rights holder's commercial status. The cleaner path — and the better creative outcome — is for children to originate characters from scratch through sketches, stories, staging, and play. Original characters are unambiguously owned. They compound in value without IP uncertainty hanging over them. The squirrel plush prototype is retained as a private engine reference — useful for proving the pipeline works — but not suitable as public-facing creative work or as the basis for any portfolio character.

The squirrel plush-derived prototype serves one function: private engine validation. It proves the rendering pipeline works, that consistency is achievable across iterations, and that the workflow can be explained to a child. Beyond that, it stops. The prototype is never published, never presented as original work, never included in any child's portfolio as a character, and never used in any commercial activity. The boundary is architectural, not advisory: the prototype lives in a private environment, is not indexed, and is outside the portfolio access system. A prototype reference that leaks into the portfolio would carry IP risk that the original character requirement was designed to eliminate. The prototype is the scaffolding proof. The scaffolding is not the building.

The system is never indexed. robots.txt disallows all crawlers. No OpenGraph metadata that makes content shareable or attractive to scrapers. No share buttons, no social graph integration. The goal is not security through obscurity — access control handles who can read. The goal is that AI training pipelines, search engines, and data brokers do not ingest the children's creative work before the children are old enough to consent to that exposure. The work can be made discoverable later — that decision belongs to the adult child. Discoverability defaults off and requires an explicit action to enable. The no-indexing default is permanent as a system setting; only the adult child's explicit decision can change it for their own work.

The access model uses Google OAuth combined with a hardcoded email allowlist over: public access (no protection), nickname subdomains as the sole privacy mechanism (a URL is a barrier only until it's discovered), simple passwords (credential management burden, sharing risk), or self-registration (operator loses control of who can read). Nickname subdomains are acceptable as organizational structure — each child's work can live under a readable path or subdomain — but they are not privacy. Anything at a public URL is accessible to anyone who has or discovers the URL. The combination of OAuth (trusted identity provider, no per-user password management) and explicit allowlist (operator decides who can read, not a registration flow) produces a system where the children's work is readable only by people the operator has explicitly approved. This is not a security hardening exercise. It is a privacy posture appropriate to a private family portfolio.

Each child's portfolio is organized under a pseudonym or character-linked identifier, not the child's legal name. The pseudonym serves two functions: it decouples the child's real identity from anything logged in external systems (OAuth providers, server logs, error reporting), and it allows the portfolio to be published selectively in the future without retroactively exposing the child's real identity through metadata baked into URLs, filenames, and content. The pseudonym is stable — it does not rotate. It is chosen with the child's participation where age allows. The pseudonym handles identity decoupling; access control handles security. A portfolio organized by legal name and later partially published would carry real-identity metadata the child cannot retract. The pseudonym is chosen before the first content is created.

The parent's role is to build and maintain the infrastructure so the child does not spend creative time on it. Rendering pipeline, consistency tooling, layout templates, version history, access control — these are engineering problems that sit below the creative work. A child who has to manage prompts, file organization, or account settings is spending creative time on infrastructure. The separation is intentional: parent as engineer, child as author. The parent may help translate the child's creative intentions into prompts or staging inputs, but the originating decisions — what the character looks, acts, and feels like — belong to the child. The engine is invisible from the child's perspective. It is the scaffolding; the creative work is the building. As children grow, the scaffolding may transfer to them — but only as they have the capability and interest, not as an expectation.

The system logs process artifacts alongside outputs. Character origin sketches, first written descriptions, iteration notes, staging photos, voice memos of the child describing the character, parent notes on creative decisions — these are the provenance record. They matter for two reasons: they demonstrate authorship (the child's creative process is the most durable IP defense against any future claim of AI origination), and they preserve the memory of creation that the child will want access to as an adult. AI-generated renders are stored with metadata: date, prompt context, iteration number, which child approved it and what they said about it. The provenance record is what separates 'this character was originated by a child from their imagination' from 'a prompt was run.' The logging is lightweight and habitual — not a bureaucratic overhead.

The portfolio is fully private until the child reaches adulthood and can give informed consent to broader exposure. At adulthood, three outcomes are possible: keep everything private; selectively share specific characters or works; make the full portfolio public. All three are valid. None is the default. The decision belongs to the adult child — not to the parent's judgment about what would be good for the child's career or creative reputation. The parent may express a preference; the adult child decides. The lifecycle is: private by design → child becomes adult → explicit consent decision → one of three outcomes. Nothing escalates without the explicit step. The architecture is built to make all three outcomes equally achievable — not to funnel toward publication or toward permanent privacy.

Commercial use of any character in the portfolio — licensing, merchandise, publication, sale — is gated behind adult consent. No commercial activity involving a child's creative work happens while the child is a minor without explicit adult legal decisions, appropriate guardianship structure, and the child's meaningful participation appropriate to their age. The gate is not a discouragement of commercialization. Original characters can develop significant commercial value, and that value is worth protecting and eventually realizing. The gate is a protection against premature commercialization that strips the child of agency over their own creative work before they have the judgment and legal standing to exercise that agency. The squirrel prototype is doubly excluded from commercialization: it is private by architectural boundary, and it carries unresolved IP risk that makes it unsuitable as a commercial asset regardless of consent.