I
The club met on Wednesdays
The Homebrew Computer Club met in a garage in Menlo Park and then in an auditorium at Stanford, and the thing people forget about it is how boring the format was. Someone stood up. Someone described a circuit. Someone else said that will not work, here is why, and then told you what would. Woz handed out the Apple I schematics for free. Not as a marketing move — there was no marketing — but because a schematic you cannot read is not a schematic, and the fastest way to find out whether your design is any good is to give it to people who will tell you it is not.
We have been publishing protocol specifications for a few weeks now, and this essay is the part of the club meeting where you stand up and say what you could not get working. There are four of those. Two of them we cannot fix from where we are sitting, because the primitives we need belong to Apple and to Google. So this is that request, made in public, with the reasoning attached so you can tell us it is wrong.
The honest version of a call to action is a list of things you failed at, with enough detail that a stranger could succeed where you did not.
II
What we are actually building
🤫 Private Agent One is a systems-level agent, controlled by the person, that runs on the machines the person already owns. Not a service that rents you a model. It does the life admin nobody wants — the chasing, the comparing, the forms, the renewals — and it sits between the person and everything else, so the data and the attention stay on their side of the line. It is free to every American citizen, which is a mission commitment before it is a pricing decision: the revenue cannot come from the person, so it cannot come from their data either.
Underneath that there is a compute ladder. Most work happens on the phone. Bigger work moves to the Mac. Occasionally something wants a desk-sized machine or a rack. The interesting engineering constraint is not the throughput — it is that every rung change is a consent gate. Nothing crosses a hardware boundary the person did not agree to, and every crossing leaves a receipt.
That constraint is what makes the problem hard and what makes it worth doing. A system that moves your data wherever it is fastest is a solved problem and a bad idea. A system that has to ask, and prove it asked, is neither.
III
A 53-byte header, and why it is boring on purpose
The transport is called hu_ssh, published as RFC-003in our own series — our numbering, not the IETF’s, and we say that on the face of the specification because a standards reader checks that first. It has a fixed header of 53 bytes, big-endian, nine fields, and nothing clever in any of them.
Woz’s floppy disk controller is the canonical story here: he got rid of parts until the thing worked with almost nothing left. That is not the same impulse as minimalism for its own sake. It is that every component is a component that can be wrong, and a protocol field is a component. The sequence number is eight bytes because replay protection is not optional. The device ID is a SHA-256 hardware fingerprint because the receiving end has to know which machine it is talking to. The reserved bytes must be zero, so that when we need them we can tell an old sender from a new one.
What does not exist yet: a conforming implementation. hu_ssh is a specification and a reference design. We published two essays in July that listed source files as though you could clone them, and you could not — those files described an intended layout. We withdrew the claim, put a banner on both essays, and wrote the correction down on the status page. It is in this essay too, because a call to action that quietly omits your last mistake is a sales pitch.
IV
252 scopes is the actual product
The protocol underneath all of this is the Personal Consent Handshake Protocol. RFC-001 is the handshake — how two parties agree. RFC-002 is the vocabulary they agree about, and it is the part that took the longest, because a consent protocol with a vague vocabulary is a consent protocol that consents to everything.
Registry 0.5.0 has 252 scopes across 7 roots. The largest is wants with 109. 109 of them map to the IAB taxonomy, so an advertiser can express what they want in language they already have and get back a specific, revocable grant instead of a cookie. 80 sit at tier 3 or above, which means they cannot be bundled: a named counterparty, a named purpose from the 8 we publish, one at a time, or no grant.
| Root | Scopes |
|---|---|
| wants | 109 |
| prefs | 58 |
| life | 32 |
| story | 18 |
| privacy | 16 |
| favorites | 16 |
| profile | 3 |
Those numbers are read out of the registry when this page builds. If someone adds a scope tomorrow, this paragraph changes by itself. We do it that way because we have already shipped a page whose figures were true when written and false a week later, and a stale number in a specification is indistinguishable from a lie to the person reading it.
V
Hermes, NemoClaw, and being precise about whose work is whose
NemoClaw is an open-source reference stack that orchestrates OpenClaw and names Hermes among its runtimes. We did not write either. We wire a Hermes Agent to a person’s One PKM so an external agent can import scoped context and write approved updates back under consent, and that connector is ours. The stack it connects to is not, our internal configuration of it has no canonical published spec, and we mark it as such wherever it appears. You can read the connector story on the OpenClaw page.
This distinction matters more than it sounds. The single most common way a small company misleads engineers is by describing an integration in language that implies authorship. If we say “our runtime” about somebody else’s runtime, every other claim on the page becomes something you have to check.
To the engineers at Apple
You built the thing this whole design depends on. Unified memory means the Neural Engine and the CPU look at the same tensor without a copy, and that single architectural decision is why a private agent on a laptop is a serious proposition rather than a demo. Two asks.
A third-party-callable Secure Enclave attestation for local agents
- What we want
- A way for a process running on a user's own Mac to obtain a hardware-rooted statement — this computation ran in this enclave, on this device, unmodified — that a remote party can verify without trusting our server.
- Why it has to come from you
- The root of trust is in silicon you designed and key material we cannot reach. There is no user-space substitute: anything we build is a claim about a claim.
- What we do today instead
- We sign with a device key held in software and are explicit on the specification page that this is weaker. The FLAGS byte in the header reserves bit 1 for an enclave signature that nothing can currently produce.
An on-device consent receipt primitive, at the OS layer
- What we want
- A system-level record of what an app was granted, by whom, for what purpose, and when it expires — readable by the user in one place, and revocable there.
- Why it has to come from you
- Consent enforced by an app is consent enforced by the party with the incentive to erode it. App Tracking Transparency proved a platform can move an entire industry with one dialogue; this is the same primitive with a vocabulary attached.
- What we do today instead
- We keep our own receipts and publish the ledger design, which works exactly as far as the person's trust in us extends — which is not far enough, and should not be.
To the engineers at Google
We are Google-first and Gemini-first in the day-zero experience: someone who arrives with a Google account and nothing else has a working agent before they configure anything. Gemma being open is the reason the local half of the ladder exists at all. Two asks here too.
A stable on-device inference contract across Android and ChromeOS
- What we want
- One API for local model execution with a published memory and latency envelope, so an agent can decide which rung of the ladder a task belongs on before it starts, rather than by trying and failing.
- Why it has to come from you
- The scheduling decision needs numbers only the platform knows: what accelerator is present, what is thermally available, what another app has reserved. From user space we can measure it after the fact, which is too late.
- What we do today instead
- We probe capability at runtime and fall back conservatively, which means we route work upward — off the device — more often than the hardware actually requires. Every unnecessary escalation is a consent prompt the person did not need to see.
Take the scope vocabulary and break it
- What we want
- Adversarial review of the 252-scope registry from people who have run consent at population scale. Tell us which tier assignments are wrong, which purposes are unenforceably vague, and where the IAB mapping leaks more than the person thinks it does.
- Why it has to come from you
- You have run consent flows for billions of users and know the failure modes we have not met yet. A vocabulary this size cannot be validated by the team that wrote it.
- What we do today instead
- We test it against ourselves, which finds the bugs we were already capable of imagining. The registry is versioned and published so that this review is possible; it is at v0.5.0 for a reason.
VI
Four things we do not know how to do
The specification carries an open-problems section, which is unusual and deliberate. A specification listing no open problems has either solved everything or not looked.
KV-cache portability
Moving a task up a rung means moving attention state between model families with different tokenizers and layouts. We do not have a representation that survives the crossing. Today we re-prefill, and pay for it.
Revocation mid-flight
A person revokes a grant while a burst is already in transit. We can stop the next frame. We cannot unsend the last one, and pretending otherwise would be the worst kind of comfortable lie.
Compromised owner device
If the machine the person owns is owned by someone else, it signs valid frames. The protocol has nothing to say about this. Ask 1 is the closest thing to an answer.
Regretted consent
Nothing in a consent protocol prevents a person agreeing to something they will wish they had not. Receipts make it visible and reversible going forward. That is all they do, and we should not oversell it.
VII
Where to start, if you want to
Everything is published. The specification index is laid out the way the Model Context Protocol lays out its own, because that is a good layout and copying a good layout is not a character flaw. The comparison with MCP’s 2026-07-28 revision lists seven changes and which five we adopted, including the ones we think they got right and we did not. RFC-002 has the whole vocabulary. RFC-003 has the wire format down to the byte.
The most useful thing you can do is disagree with something specific. Tier 3 might be the wrong boundary. Eight purposes might be six too many or twenty too few. The sequence number might want to be a nonce. We would rather find that out from you in a garage in Menlo Park, metaphorically, than from a user three years from now whose data went somewhere they did not intend.
Publish the schematic. Say what you could not get working. Wait to be told you are wrong. That was the whole method, and nobody has improved on it.
🤫