hu_ssh — moving agent state between machines a person owns.

Draft. Specified, not implemented.

What problem sits underneath this.

A personal agent runs on hardware its owner already has, and most of what it does should never leave that hardware. Occasionally a task genuinely outgrows the device — a long reasoning chain, a compile, a multi-agent negotiation — and the honest options are to fail, to degrade, or to move the work somewhere larger.

Moving the work is only acceptable if the move is governed. hu_ssh is the transport for that move: it carries agent state between machines, and it is designed so the consent layer above it can gate every hop rather than trusting the first one.

The economics that make this worth specifying: Apple Silicon shares one physical memory pool across CPU, GPU and Neural Engine, so on the edge the expensive operation is not compute — it is copying, and that copy has already been eliminated. A transport that respects that fact moves diffs and delegations, not context.

A 53-byte fixed header.

Every frame begins with a fixed header in big-endian network byte order, sized so a reader can validate and dispatch without allocating.

A parser MUSTtreat a short buffer as “not yet” rather than as an error — partial reads are the normal case on a network. It MUST reject a frame whose magic bytes are not 0x6875, and MUST NOT process a frame whose sequence number does not exceed the last accepted value on that session.

Seven frames.

StateSync is the frame that justifies a binary transport at all. Without it, bursting a task to a larger model means the remote re-computes attention state the edge already has — the single largest hidden cost in any hybrid design, and invisible until measured.

Attest once, verify cheaply after.

Edge (owner's device)                    Remote (compute the owner burst to)
  │                                         │
  │── 0x01 HandshakeInit ──────────────────▶│  full attestation chain validated
  │                                         │  ephemeral AES-256-GCM session key derived
  │◀─ 0x01 accept (version, capabilities) ──│
  │                                         │
  │── 0x30 StateSync (chunked) ────────────▶│  pre-computed attention state
  │── 0x10 AgentCommand ───────────────────▶│  verified against session key
  │◀─ 0x11 AgentStream ─────────────────────│
  │◀─ 0x21 ToolResponse ────────────────────│
  │                                         │
  │── 0xFE Heartbeat ──────────────────────▶│  absence triggers local fallback

Validating a full attestation chain on every frame would be absurd at frame rate, so it happens once. The handshake derives an ephemeral symmetric key, and subsequent frames are verified against that. This is a deliberate trade and it belongs in the specification rather than in someone’s postmortem.

Loss of the remote is not an error condition. When heartbeats stop, an implementation MUSTcontinue the task on local hardware rather than surfacing a failure. The remote is an optimisation; the person’s task is not.

Two boundaries, both enforced by hardware or kernel.

What this does not defend against, stated plainly. A compromised owner device signs valid frames — enclave attestation proves the hardware, not the intent of whoever is holding it. A malicious remote operator can read anything delivered to it; the protocol limits what is delivered, it does not make the recipient trustworthy. And nothing here prevents a person from consenting to something they will regret.

A transport, not a universe.

hu_ssh sits beneath the consent layer, not beside it. RFC-001 decides whether an exchange may happen; RFC-002 decides what vocabulary it speaks; hu_ssh moves the bytes once both have said yes.

It composes over the same open rails as the rest of the stack rather than replacing them: MCP for tool access, A2A for agent negotiation, AP2 and UCP for anything that moves value. Where MCP standardised how an agent reaches a tool over HTTP, hu_ssh addresses the case MCP explicitly does not: bulk state moving between machines the same person owns, where the bottleneck is memory bandwidth rather than request semantics.

Design decisions here follow the seven changes we adopted from MCP’s 2026-07-28 revision — date-stamped versions carried per request, no held session state above the grant, and a deprecation window we still owe.

What we do not know how to do yet.

• KV-cache representation across model families. StateSync assumes the edge and the remote can agree on an attention-state format. Between different model families they cannot, and the fallback is to pay prefill twice.
• Backpressure under burst. Credit-based sliding-window flow control is specified; the right window sizing under real GPU contention is unmeasured.
• Attestation on non-Apple edges. The threat model leans on the Secure Enclave. Android StrongBox and TPM-backed desktops need an equivalent that is not merely analogous.
• Revocation reaching an in-flight burst. RFC-001 requires revocation to invalidate every derived access. A long-running remote task holding a session key is exactly the case that is hard.

These are stated because a specification that lists no open problems has either solved everything or not looked. Ours has not solved everything.