🤫husshhussh
🤫husshhusshOnePuppy
🤫 hussh Research

Give the schematics away
An open letter to the engineers

Four things we cannot build without the platforms, written plainly, with the numbers derived from the code rather than typed into the prose.

Back to blogs
On voice, and on honesty.This is written in the spirit of Steve Wozniak — the engineer’s plain pleasure in a machine doing something it was not supposed to do, and his habit of handing the schematics to whoever asked. He did not write this, review it, or endorse it, and neither did anyone else named here. We claim no affiliation with Apple, Google, or NVIDIA. Everyone named is named for public work they actually did, in the same register as our gratitude page. Where a number is measured, we say so. Where it is a design target, we say that too — and where something does not exist yet, we say that loudest.

I

The club met on Wednesdays

The Homebrew Computer Club met in a garage in Menlo Park and then in an auditorium at Stanford, and the thing people forget about it is how boring the format was. Someone stood up. Someone described a circuit. Someone else said that will not work, here is why, and then told you what would. Woz handed out the Apple I schematics for free. Not as a marketing move — there was no marketing — but because a schematic you cannot read is not a schematic, and the fastest way to find out whether your design is any good is to give it to people who will tell you it is not.

We have been publishing protocol specifications for a few weeks now, and this essay is the part of the club meeting where you stand up and say what you could not get working. There are four of those. Two of them we cannot fix from where we are sitting, because the primitives we need belong to Apple and to Google. So this is that request, made in public, with the reasoning attached so you can tell us it is wrong.

The honest version of a call to action is a list of things you failed at, with enough detail that a stranger could succeed where you did not.

II

What we are actually building

🤫 Private Agent One is a systems-level agent, controlled by the person, that runs on the machines the person already owns. Not a service that rents you a model. It does the life admin nobody wants — the chasing, the comparing, the forms, the renewals — and it sits between the person and everything else, so the data and the attention stay on their side of the line. It is free to every American citizen, which is a mission commitment before it is a pricing decision: the revenue cannot come from the person, so it cannot come from their data either.

Underneath that there is a compute ladder. Most work happens on the phone. Bigger work moves to the Mac. Occasionally something wants a desk-sized machine or a rack. The interesting engineering constraint is not the throughput — it is that every rung change is a consent gate. Nothing crosses a hardware boundary the person did not agree to, and every crossing leaves a receipt.

0iPhoneNeural Engine1Macunified memory2DGX Sparkon the desk∞NVL72 rackescalated toevery rung change is a consent gate — nothing crosses without one

That constraint is what makes the problem hard and what makes it worth doing. A system that moves your data wherever it is fastest is a solved problem and a bad idea. A system that has to ask, and prove it asked, is neither.

III

A 53-byte header, and why it is boring on purpose

The transport is called hu_ssh, published as RFC-003in our own series — our numbering, not the IETF’s, and we say that on the face of the specification because a standards reader checks that first. It has a fixed header of 53 bytes, big-endian, nine fields, and nothing clever in any of them.

offset53-byte fixed header, big-endian0MAGIC2B0x6875 — ASCII 'hu'2VERSION1B0x013FLAGS1Bbit 0 encrypted · bit 1 enclave-signed · bit 2 compressed4FRAME TYPE1Bsee frame table5SEQUENCE NUMBER8Bstrictly increasing — replay protection13PAYLOAD LENGTH4B17SIGNATURE LENGTH2B19RESERVED2Bmust be zero21DEVICE ID32BSHA-256 hardware fingerprint
Variable-length payload and an optional Secure Enclave signature follow the fixed header. Offsets above are computed from the field sizes, so this diagram cannot drift from the specification it illustrates.

Woz’s floppy disk controller is the canonical story here: he got rid of parts until the thing worked with almost nothing left. That is not the same impulse as minimalism for its own sake. It is that every component is a component that can be wrong, and a protocol field is a component. The sequence number is eight bytes because replay protection is not optional. The device ID is a SHA-256 hardware fingerprint because the receiving end has to know which machine it is talking to. The reserved bytes must be zero, so that when we need them we can tell an old sender from a new one.

What does not exist yet: a conforming implementation. hu_ssh is a specification and a reference design. We published two essays in July that listed source files as though you could clone them, and you could not — those files described an intended layout. We withdrew the claim, put a banner on both essays, and wrote the correction down on the status page. It is in this essay too, because a call to action that quietly omits your last mistake is a sales pitch.

IV

252 scopes is the actual product

The protocol underneath all of this is the Personal Consent Handshake Protocol. RFC-001 is the handshake — how two parties agree. RFC-002 is the vocabulary they agree about, and it is the part that took the longest, because a consent protocol with a vague vocabulary is a consent protocol that consents to everything.

Registry 0.5.0 has 252 scopes across 7 roots. The largest is wants with 109. 109 of them map to the IAB taxonomy, so an advertiser can express what they want in language they already have and get back a specific, revocable grant instead of a cookie. 80 sit at tier 3 or above, which means they cannot be bundled: a named counterparty, a named purpose from the 8 we publish, one at a time, or no grant.

RootScopes
wants109
prefs58
life32
story18
privacy16
favorites16
profile3

Those numbers are read out of the registry when this page builds. If someone adds a scope tomorrow, this paragraph changes by itself. We do it that way because we have already shipped a page whose figures were true when written and false a week later, and a stale number in a specification is indistinguishable from a lie to the person reading it.

V

Hermes, NemoClaw, and being precise about whose work is whose

NemoClaw is an open-source reference stack that orchestrates OpenClaw and names Hermes among its runtimes. We did not write either. We wire a Hermes Agent to a person’s One PKM so an external agent can import scoped context and write approved updates back under consent, and that connector is ours. The stack it connects to is not, our internal configuration of it has no canonical published spec, and we mark it as such wherever it appears. You can read the connector story on the OpenClaw page.

This distinction matters more than it sounds. The single most common way a small company misleads engineers is by describing an integration in language that implies authorship. If we say “our runtime” about somebody else’s runtime, every other claim on the page becomes something you have to check.

To the engineers at Apple

You built the thing this whole design depends on. Unified memory means the Neural Engine and the CPU look at the same tensor without a copy, and that single architectural decision is why a private agent on a laptop is a serious proposition rather than a demo. Two asks.

Ask 1

A third-party-callable Secure Enclave attestation for local agents

What we want
A way for a process running on a user's own Mac to obtain a hardware-rooted statement — this computation ran in this enclave, on this device, unmodified — that a remote party can verify without trusting our server.
Why it has to come from you
The root of trust is in silicon you designed and key material we cannot reach. There is no user-space substitute: anything we build is a claim about a claim.
What we do today instead
We sign with a device key held in software and are explicit on the specification page that this is weaker. The FLAGS byte in the header reserves bit 1 for an enclave signature that nothing can currently produce.
Ask 2

An on-device consent receipt primitive, at the OS layer

What we want
A system-level record of what an app was granted, by whom, for what purpose, and when it expires — readable by the user in one place, and revocable there.
Why it has to come from you
Consent enforced by an app is consent enforced by the party with the incentive to erode it. App Tracking Transparency proved a platform can move an entire industry with one dialogue; this is the same primitive with a vocabulary attached.
What we do today instead
We keep our own receipts and publish the ledger design, which works exactly as far as the person's trust in us extends — which is not far enough, and should not be.

To the engineers at Google

We are Google-first and Gemini-first in the day-zero experience: someone who arrives with a Google account and nothing else has a working agent before they configure anything. Gemma being open is the reason the local half of the ladder exists at all. Two asks here too.

Ask 3

A stable on-device inference contract across Android and ChromeOS

What we want
One API for local model execution with a published memory and latency envelope, so an agent can decide which rung of the ladder a task belongs on before it starts, rather than by trying and failing.
Why it has to come from you
The scheduling decision needs numbers only the platform knows: what accelerator is present, what is thermally available, what another app has reserved. From user space we can measure it after the fact, which is too late.
What we do today instead
We probe capability at runtime and fall back conservatively, which means we route work upward — off the device — more often than the hardware actually requires. Every unnecessary escalation is a consent prompt the person did not need to see.
Ask 4

Take the scope vocabulary and break it

What we want
Adversarial review of the 252-scope registry from people who have run consent at population scale. Tell us which tier assignments are wrong, which purposes are unenforceably vague, and where the IAB mapping leaks more than the person thinks it does.
Why it has to come from you
You have run consent flows for billions of users and know the failure modes we have not met yet. A vocabulary this size cannot be validated by the team that wrote it.
What we do today instead
We test it against ourselves, which finds the bugs we were already capable of imagining. The registry is versioned and published so that this review is possible; it is at v0.5.0 for a reason.

VI

Four things we do not know how to do

The specification carries an open-problems section, which is unusual and deliberate. A specification listing no open problems has either solved everything or not looked.

KV-cache portability

Moving a task up a rung means moving attention state between model families with different tokenizers and layouts. We do not have a representation that survives the crossing. Today we re-prefill, and pay for it.

Revocation mid-flight

A person revokes a grant while a burst is already in transit. We can stop the next frame. We cannot unsend the last one, and pretending otherwise would be the worst kind of comfortable lie.

Compromised owner device

If the machine the person owns is owned by someone else, it signs valid frames. The protocol has nothing to say about this. Ask 1 is the closest thing to an answer.

Regretted consent

Nothing in a consent protocol prevents a person agreeing to something they will wish they had not. Receipts make it visible and reversible going forward. That is all they do, and we should not oversell it.

VII

Where to start, if you want to

Everything is published. The specification index is laid out the way the Model Context Protocol lays out its own, because that is a good layout and copying a good layout is not a character flaw. The comparison with MCP’s 2026-07-28 revision lists seven changes and which five we adopted, including the ones we think they got right and we did not. RFC-002 has the whole vocabulary. RFC-003 has the wire format down to the byte.

The most useful thing you can do is disagree with something specific. Tier 3 might be the wrong boundary. Eight purposes might be six too many or twenty too few. The sequence number might want to be a nonce. We would rather find that out from you in a garage in Menlo Park, metaphorically, than from a user three years from now whose data went somewhere they did not intend.

Publish the schematic. Say what you could not get working. Wait to be told you are wrong. That was the whole method, and nobody has improved on it.

🤫

Read RFC-003 →Read RFC-002 →The Quiet Machine →

Products

  • Agent One
  • The 🤫 One app
  • Puppy One
  • Which Puppy is right for you?
  • The Puppy 100
  • Tag One
  • The 🤫 Store
  • The 🤫 One Card
  • Pricing
  • Claim your One
  • The product roadmap

🤫 Yellow Pages

  • The 🤫 Yellow Pages
  • Discover in the feed
  • Find a local expert
  • Coverage & markets
  • Connect - in Agent One
  • Ping an expert

Business & Enterprise

  • 🤫 for Business
  • Small & medium business
  • 🤫 Concierge (VVIP)
  • 🤫 for the Enterprise
  • Industry solutions
  • Federal government & agencies
  • 🇺🇸 Defense & national security
  • For advisors (RIAs)
  • Partner Portal
  • One for Sellers
  • Developers

Watch, read & learn

  • The media library
  • The 🤫 Feed
  • See it in a minute
  • Listen - the podcasts
  • Blogs
  • The field guide - the book
  • Research & papers
  • Guides - by topic
  • Academy
  • Events & public assets
  • Wiki

Company & open

  • About
  • Team
  • Investors
  • Fund A
  • Building in the open
  • News & investor relations
  • Release notes
  • Careers
  • Contact
  • Explore - the whole site, mapped
  • Sitemap

Trust, rights & gratitude

  • The Hussh Protocol (PCHP)
  • Day 0 Trusted Circle
  • The case - a right, made enforceable
  • Data-rights landscape
  • Accessibility
  • 🤫 Champions of the Community
  • 🤫 Faculty - the professors
  • Gratitude - people we admire
  • The 1024 - humans of the world
  • Search every page
  • Browse (developer view)

🤫 Private Agent One is free for every American citizen. We do not sell your data, your attention, or your contacts.

Company and product names are used to describe interoperability only and do not imply affiliation or endorsement. Certifications described as “in pursuit” are not held today.

Copyright © 2026 Hushh Technologies Corporation. All rights reserved.

Privacy PolicyTerms of UseYour data rightsAccessibilitySite Map

🇺🇸United States

🤫husshhusshKirkland, WashingtonMore ways to reach us: talk to a human or find an agent near you.