Eleven Messages

Abstract. Scheduling a meeting among npeople is not a calendar problem. It is a distributed constraint-satisfaction problem being solved by the slowest available processor — a human — over the highest-latency link available: other humans. We measure the real cost, show why the industry’s standard fix (the scheduling link) makes it worse for everyone except the sender, and give a construction where each participant’s agent computes the intersection of free time without any party learning anyone’s calendar. We state precisely what the construction leaks, why the strategic-manipulation problem is not solvable in the general case, and what we have not built.

1. Eleven messages

Get five people into a room. Count the messages. Someone proposes three times. Three people reply. One replies with a conflict. Someone re-proposes. Two reply. The last person answers tomorrow morning, by which time one of the original three has booked something else.

That is not an edge case; it is the modal outcome. And the interesting thing about it is that the computation is trivial. Intersecting five sets of free time is microseconds of work. What costs eleven messages and two days is that the computation is being run by hand, and every step blocks on a human noticing a notification.

Jeff Dean’s latency table — the one every systems engineer has half-memorised — puts a main-memory reference at ~100 ns and a round trip within a datacenter at ~500 µs. It stops well short of the number that dominates this problem. A human round trip is on the order of 10⁴ seconds. Against a 500 µs datacenter hop, that is a factor of roughly 20 million.

operation                                    latency        vs. memory ref
------------------------------------------   -----------    --------------
L1 cache reference                            ~1 ns          1x
main memory reference                         ~100 ns        100x
round trip in datacenter                      ~500 us        5,000,000x
human notices notification and replies        ~3 hr          ~10^14x

set intersection, 5 people, one week          ~2 us
the same work, done by five humans            ~2 days

When one operation in a system is fourteen orders of magnitude slower than the others, you do not optimise the fast part. You get the slow part out of the loop. That is the entire thesis, and everything below is engineering in service of it.

2. Why the scheduling link is not a fix

The industry’s answer is to publish your calendar behind a link and let the other party pick. Look at what that actually does.

It removes the sender from the loop and leaves everyone else in it. With nparticipants it converts one person’s coordination cost into n−1people’s coordination cost, and the total human latency does not fall — it is still gated on the last person to open the link. Worse, the mechanism does not compose: two people with scheduling links cannot use them on each other. It is a protocol that only works when exactly one participant has it, which is the definition of an asymmetry, not a solution.

And the privacy cost is total. A free/busy link publishes the negative space of your entire week to whoever holds the URL. From the shape of the negative space you can read a great deal: standing meetings, working hours, travel, therapy appointments at the same hour every Tuesday.

The asymmetry to notice. The link reveals a full week to save one person eleven messages. The construction below reveals a single bit per time slot per person and saves everybody the eleven messages. The outcomes are identical. The exposure differs by orders of magnitude.

3. The shape of the data is absurdly small

Before designing a protocol, measure the object. A week, at fifteen-minute resolution, is 672 slots. One bit per slot — free or not — is 84 bytes. Restricted to plausible working hours it is closer to 23 bytes.

This is a delightful number. A week of one person’s availability is smaller than this sentence. It fits in a single TCP segment with room for the entire meeting request beside it. Any protocol that needs more than one round trip to move it is not paying for bandwidth; it is paying for a design decision.

week = 7 days x 24 h x 4 = 672 slots

alice  1 1 0 0 1 1 1 0 0 1 ...   84 bytes
bob    1 0 0 1 1 1 0 0 1 1 ...   84 bytes
carol  1 1 0 1 1 0 1 0 1 1 ...   84 bytes
                                 ------
AND    1 0 0 0 1 0 0 0 0 1 ...   84 bytes

five participants: 420 bytes in, 84 bytes out.
one round trip. no human in the loop.

4. So the actual problem is not scheduling

If the data is 84 bytes and the operation is an AND, the engineering problem is not “compute the intersection.” It is:

Compute the AND of n private bit vectors such that no party — including the one running the protocol — learns any input vector.

That is a secure multiparty computation, and it is a well-studied one. Private set intersection has a literature going back to Freedman, Nissim and Pinkas (2004), and the practical constructions have gotten dramatically cheaper since. For our shape — small fixed-length bit vectors, semi-honest majority, one shot — we do not need the heavy machinery.

4.1 A construction that fits on a page

Additive secret sharing over a small prime field, aggregated in the style of Bonawitz et al.’s secure aggregation for federated learning (2017). Each participant’s agent holds a vector v ∈ {0,1}672, 1 meaning free.

for each participant i:
    split v_i into n additive shares over F_p, one per participant
    send share (i -> j) to participant j over an authenticated channel

for each participant j:
    s_j = sum of all shares received       # a meaningless random vector
    publish s_j

anyone:
    total = sum_j s_j                      # = sum_i v_i, slot by slot
    feasible = { slot : total[slot] == n }  # everyone free

leaked: the COUNT of free participants per slot.
not leaked: which participants. no vector ever leaves its owner.

Cost, for five participants over a week: 5 × 5 × 84 bytes = 2.1 KB of shares, one round, plus the reveal. On a phone this is microseconds of arithmetic and one network round trip. Against two days of human latency, the speedup is not a percentage.

5. What this leaks, stated precisely

Publishing the per-slot sum is not zero-knowledge, and pretending otherwise would be the kind of claim that gets a security paper withdrawn. It leaks the number of free participants per slot. With n = 5 and a slot where the total is 4, an adversary learns that exactly one person is busy — and if they participated, they know it was not them, so they have learned something about the other four collectively.

Two mitigations, both real, neither free:

Threshold reveal. Compute only the predicate total == n rather than the total, using a secure comparison. This is strictly better and strictly more expensive, and it removes the partial-count leak entirely. It is the right end state.

Coarsening. Report at 30- or 60-minute resolution rather than 15. Fewer slots, less structure, and — usefully — closer to how people actually think about meetings.

The honest position. The cheap construction leaks a count. The expensive one does not. We should ship the cheap one with the leak documented on the page a person can read, and replace it with threshold reveal. Shipping the cheap one and describing it as private would be a lie, and it is the specific lie this entire company exists to not tell.

6. The part that does not have a solution

Here is the problem nobody’s protocol fixes, and the one most scheduling products quietly ignore.

An agent can lie. If my agent knows I prefer Thursday afternoon, it can report Tuesday as busy. The protocol computes a perfectly correct intersection of incorrect inputs. Cryptography guarantees that nobody learned my vector; it guarantees nothing about whether my vector was true.

This is mechanism design, not security, and the news there is not good. Gibbard (1973) and Satterthwaite (1975) tell us that for a sufficiently rich preference space, any non-dictatorial deterministic mechanism is manipulable. There is no clever protocol that makes truthful availability reporting a dominant strategy in the general case. Anyone who claims otherwise is either restricting the preference space severely or is mistaken.

What is actually available:

• Make lying costly rather than impossible. If an agent declares a slot busy and the owner is later observed to have accepted a different meeting in that slot, that is recorded. Not punished by us — recorded, in a log the owner reads. A reputation signal is a weak instrument, and a weak instrument that is honestly described beats a strong claim that is false.
• Reduce the incentive.Most manipulation is not adversarial, it is preference expression wearing a disguise. If the protocol has a first-class way to say “free, but I would rather not,” the agent has no reason to lie about being free. A large share of strategic behaviour in real systems is the result of a missing field.
• Accept it. Humans lie about their calendars today, constantly, and the world continues. The bar is not perfection; it is whether the protocol is better than eleven messages. It is.

7. Why this rides on an open protocol

A scheduling protocol that only works between two users of the same product has rebuilt the problem it claims to solve. The interesting meetings are exactly the ones that cross organisational boundaries — you and your contractor, you and your kid’s school, you and four people at three companies.

So availability is exchanged agent-to-agent over MCP: an open standard, implementable by anyone, with no requirement that the other party runs our software. This is a commercial decision as much as a technical one, and it is the right one for an uninteresting reason — a protocol’s value is superlinear in the number of participants, and the fastest way to have few participants is to own it.

8. The engineering shape

Two principles from people whose public work we have learned a great deal from, pulling in different directions, which is why both are useful.

Small, self-contained, liftable.Andrej Karpathy’s public teaching keeps returning to code someone could take out and use without importing your whole world. Every piece of this decomposes that way: a bit-vector encoder, a secret-sharing primitive, an aggregator, an MCP transport. None of them needs to know about the others, and none needs to know it is doing scheduling. The secret-sharing module does not contain the word “calendar.”

Measure the real constraint, then let the layout follow it. The Dean instinct. We did not begin by asking how to build a scheduler. We asked what the slowest operation was, found it was fourteen orders of magnitude worse than everything else, and designed to remove it. Every other decision fell out of that measurement, including the ones that look like privacy decisions — the vector is 84 bytes because we are removing the human, and it is private because it is 84 bytes and therefore cheap to secret-share.

The observation worth keeping. The privacy property and the performance property are the same property. A protocol that moves one bit per slot is fast, and it is also nearly nothing to leak. Systems where doing the right thing is also the cheap thing tend to survive contact with a deadline. Systems where privacy is a tax get their privacy removed in week eleven.

9. What we have not built

Stated plainly, because a roadmap that reads like a changelog is a marketing document.

• None of this is shipped. The construction above is a design. What exists today is the directory and the intent layer; the scheduling protocol is being built.
• Threshold reveal is not implemented. The first version will leak per-slot counts, and that will be documented where a person can read it, not in a footnote.
• We have no benchmark. The latency figures above are from published tables and arithmetic, not from our implementation. When we have measured numbers we will publish those instead, including if they are worse.
• Timezones and recurrence are not modelled here, and anyone who has implemented a calendar knows that is where the actual pain lives. A bit vector says nothing about what happens when one participant crosses a DST boundary mid-week.
• The reputation signal is unspecified. We know what it should do. We do not yet know how to make it resistant to the obvious attack, which is simply having two agents.

10. The point

The reason to care about eleven messages is not the eleven messages. It is that this is the smallest complete instance of the thing we are actually building.

A person has an agent. It works on their side of the line. It talks to other people’s agents on their behalf, reveals the minimum required to get an answer, and hands back the answer rather than a form. The person did not go anywhere or operate anything. Scheduling is just the version of that which is small enough to specify completely on one page — which is exactly why it is the right one to build first.

Get this one right and the shape generalises: to quotes, to claims, to appointments, to every errand where the work today is a human relaying structured information between two systems that could have spoken directly. That is most errands.

References and gratitude

Public work we have learned from, cited with admiration and no claim of affiliation or endorsement.

• M. Freedman, K. Nissim, B. Pinkas, “Efficient Private Matching and Set Intersection,” EUROCRYPT 2004 — the origin point for treating intersection as a cryptographic primitive.
• K. Bonawitz et al., “Practical Secure Aggregation for Privacy-Preserving Machine Learning,” CCS 2017 — the secure-summation shape this construction borrows.
• A. Gibbard (1973) and M. Satterthwaite (1975) — why strategy-proofness is not available, and why saying so is better than pretending.
• Jeff Dean’s widely circulated latency numbers — the habit of measuring the constraint before designing for it.
• Andrej Karpathy’s public teaching on small, modular, liftable code — the reason the secret-sharing module does not know what a calendar is.
• The Model Context Protocol specification — the open transport this rides on.