The layer underneath
PCHP, hu_ssh, and the agentic stack

I

The shape of the gap

Read the four specifications back to back and a pattern shows up that none of them mentions, because from inside any one of them it is not a gap at all.

MCP tells an agent how to reach a tool. A2A tells two agents how to hand work to each other. AP2 tells an agent how to prove a human authorised a payment. UCP tells an agent how to complete a purchase with a merchant. Each is excellent at its own question. Each one assumes, silently and reasonably, that the data the agent is acting on is available to it, and that the computation is happening somewhere.

Those two assumptions are the layers we are building. Not as a competitor to anything above the line — the line is the point. A consent layer is only useful if the protocols above it keep working unchanged when you slide it underneath.

II

The four, in their own words

Described using each specification’s own vocabulary rather than ours. Getting someone else’s terminology wrong is the fastest way to prove you have not read them.

III

The untrusted circle is the normal case

The easy version of a consent protocol assumes the other party is decent. It is also the useless version, because the parties you need protection from are precisely the ones who will not volunteer it.

A2A makes the same assumption we do and says it more plainly than we had: agents are opaque to one another. You cannot inspect the counterparty, you cannot audit its internals, and you should not design as though you can. AP2 goes further and builds for the case where the human is not even present — a pre-authorised mandate acting while nobody is watching.

So PCHP is written for the untrusted circle first and the trusted circle as the easy special case, not the other way round. Concretely, that means three things that hold whether or not the counterparty is honest: a grant names one counterparty and one purpose rather than a category; tier 3 and above cannot be bundled, so a person sees each sensitive ask on its own; and every access leaves a receipt on a hash-chained ledger the person holds, so a breach of trust is detectable after the fact even when it was not preventable before it.

That last one is the honest limit. A consent protocol cannot stop a counterparty misusing what it was legitimately given. It can make the giving deliberate, the scope minimal, and the record undeniable. We would rather state that plainly than imply a guarantee the mathematics does not support.

IV

What we took from reading them

Four specific things, each of which changed our design rather than confirming it. A comparison that finds only agreement is a comparison nobody actually did.

1. 1

   UCP — Capability intersection.

   Both parties declare; the intersection is computed, versions resolved to the highest mutually supported, orphaned extensions pruned, repeat until stable. Our scope grants should work this way — a subscriber declares what it wants, a person declares what they offer, the grant is the overlap. Negotiation invites pressure; intersection does not.

2. 2

   MCP — A stated deprecation window.

   MCP retired four of its own primitives with a twelve-month minimum notice. Our registry is publicly served and buildable-against, and until this week it had no removal policy at all. It now carries a 365-day window, permanent tombstones, and a test that fails the build if any of the 252 published scopes vanishes without notice.

3. 3

   AP2 — Proof of intent, not inference of it.

   AP2 exists because an agent acting on a human's behalf must carry cryptographic evidence the human meant it, precisely because a model can be confidently wrong. That is the strongest available argument for consent receipts, and it was made by a payments consortium rather than by privacy advocates — which is why it is persuasive.

4. 4

   A2A — Design for opacity.

   Agent Cards describe capability without requiring trust or introspection. We had been quietly assuming a cooperative counterparty in places. Every one of those places is now written for an opaque one.

V

What this means for 🤫 Agent One

A person’s Agent One is not a destination they operate. It is interposed — it sits between them and everything else, and it speaks these protocols on their behalf so they do not have to. In stack terms: Agent One is a client of everything above the line and the owner of everything below it.

When Agent One reaches a tool it speaks MCP, and PCHP decides whether that reach is permitted and records that it happened. When it delegates to a specialist agent it speaks A2A, and PCHP scopes what that agent is told. When it buys something it speaks UCP and settles with AP2, and PCHP is what makes the mandate traceable to a real, granular grant rather than a blanket authorisation. And whichever of those it is doing, hu_ssh decides which of the person’s own machines the work runs on, with a consent gate at every rung change.

None of the four public protocols has to change for this to work, and that is the design constraint we hold ourselves to. If adopting PCHP required a fork of MCP, we would have built the wrong thing.

VI

Read the specifications

Ours, and theirs. We would rather you check our reading than take it.

🤫