A status report written against the code rather than the roadmap. PCHP has two first implementations — hushh.ai and 🤫 Agent One — and this page says precisely what each one enforces today, what the 🤫 PKM and 🤫 PWM alignment really covers, and what is still in design.
RFC-001 — The Handoff
Protocol version pchp/2026-07-12, specification v0.1.0. Status: Public Request for Comments. Published under an open license, no patent claimed on the core handshake.
RFC-002 — Preference Subscription Fabric
Registry v0.5.0, a draft published in the open. 252 scopes across 7 roots, five tiers, of which 80 are sensitive or intimate and may never be bundled.
One correction worth stating plainly: the narrative pages describe four phases — identity, consent, scoped exchange, receipt — while the specification defines six: Discover, Hello, Offer, Consent, Deliver, Acknowledge. These are the same handshake at two levels of detail; the four are a compression of the six, not a different protocol. The specification is normative.
The first thing PCHP had to do was replace our own cookie banner. It does.
pchp.js is loaded on every page of this site as the consent surface for three privacy scopes — analytics, personalization, and marketing email. It renders into a closed shadow root, escapes every scope name before it reaches the DOM, and asks only for scopes the person has not already answered.
The answer is bridged into Google Consent Mode v2, and all four consent signals default to denied until the person says otherwise. That is a working consent-first analytics posture on a live commercial site, not a diagram.
Its honest limits, from the file’s own header: grants live in localStorage, so clearing site data revokes silently and a second device knows nothing. The receipt field it returns is a locally generated identifier — it is not signed, not chained, and not stored on any server. The embed also carries a hardcoded copy of its scope labels rather than fetching the registry, which is an unguarded drift surface we intend to close.
Where hushh.ai proves the consent surface, Agent One carries the parts with cryptography behind them.
Every grant is HMAC-SHA256 signed. The subject is the verified Firebase uid, never the request body. TTL is clamped to 24 hours. In UAT and production the signing path fails closed when no secret is present — it refuses rather than degrades.
backend/app/services/consent.py
Receipts are HMAC-signed and hash-chained, persisted with a head pointer and mirrored to Cloud Logging, with chain verification available. It degrades to a non-durable flag rather than silently dropping a receipt. Three production call sites today: one per grant, and allow/deny on connector access.
backend/app/services/receipt_ledger.py
The registry is generated, not hand-written. The generator throws on a purpose naming an unknown scope, a purpose carrying an intimate-tier scope, a sensitive scope placed in the wrong list, or a duplicate name. A --check mode diffs the committed file against a fresh regeneration.
scripts/pchp/build-scope-registry.mjs
Every PUT to the preference document is sanitised against the registry: unknown roots rejected, unrecognised leaves dropped, values strictly type-coerced, and any tier-3-or-above write refused outright with a 422. Unknown scopes resolve to the most restrictive tier, not the most permissive.
src/lib/pchp/pwm-sanitize.ts → src/app/api/pwm/route.ts
Tests assert that the agent archetypes, the directory's offered wants, and the frozen v0.4.0 scope names all still exist in the registry. This exists because the vocabulary forked once in production: a preference write was silently dropped at a root check when two branches each landed green against a base without the other.
src/app/pchp/registry.test.ts, src/lib/pchp/catalogue.test.ts
The question worth answering precisely is whether the consent vocabulary and the personal model are actually the same vocabulary, or two systems that merely use similar words. Today it is one real seam and two open ones.
Aligned, and enforced.The server-side Personal World Model document shares the registry’s roots and dotted paths exactly. Every write runs through the catalogue: the roots are a single copy rather than a second hand-maintained list, values are strictly type-coerced, and a sensitive-tier write is refused. Tests bind the registry to the agent archetypes and to the directory’s offered wants so the vocabulary cannot quietly fork again.
Not yet aligned.The on-device PWM keeps its own local signal vocabulary and does not import the catalogue. The portable PKM schema declares PCHP as its protocol but carries a coarse public/trusted/private envelope rather than registry scopes. Both are real and working; neither shares the registry’s vocabulary yet, and unifying them is the next piece of work rather than a thing already done.
Published is not the same as enforced, and the distance between them is the only number that matters in a consent protocol. Here is ours.
The first item is the one we would most like a reader to hold us to. A registry that declares tiers and a mint that does not check them is a promise with no mechanism behind it, and we would rather publish that sentence ourselves than have someone else discover it.
Anyone can publish a consent vocabulary. The question a serious implementer asks is which parts of it the code will actually refuse to violate. So this page names the mechanism behind every claim and the absence behind every gap, and it will be wrong the moment the code moves — which is the point of dating it and pinning its counts to the generated registry rather than to prose.
The specification is open and the reference embed is public. The gaps above are the honest invitation.
One is a product of Hushh Technologies Corporation (brand: 🤫 “hussh”), an independent company. One runs on third-party silicon, systems, and cloud; platform names are used solely to describe where One software runs and imply no affiliation, endorsement, or sponsorship by those platforms. Our own go-to-market and bill-of-materials partner programs are real and actively in pursuit; we name a partner only once an agreement is executed.