What Shipped: The Permission Gateway, July 2026
An honest product update on the Permission Gateway - what is running, what three security findings we fixed, what is still blocked, and what we deliberately have not built yet.
We build in the open, which means the product updates have to include the parts that are not going well. This is where the Permission Gateway actually stands at the end of July 2026.
What is running
The consent contract works end to end. A person sets a profile, grants a subscriber scoped and time-boxed access, the subscriber reads only the fields that grant resolves to, every access writes a signed receipt, and revocation stops future reads immediately.
We verified this against a real Postgres instance rather than mocks, and then verified the verification: the full hash chain and every signature were recomputed independently from raw database rows, by code sharing nothing with the code under test. Thirty-one checks, all green. A system that grades its own homework proves nothing, so we did not let it.
Three security findings, fixed
We ran an adversarial pass against our own design and found three real flaws.
- A hash chain cannot detect tail-truncation. Delete the newest entries and what remains is a perfectly valid chain. Fixed with gap-free sequence enforcement and head anchoring.
- Revoke had a time-of-check-to-time-of-use race. A read could interleave with a committing revocation. Fixed by serialising reads against revocation inside a single locked transaction.
- Distinguishable error codes formed an existence oracle. "Does not exist" and "was revoked" are different answers, and the difference leaks a real fact about a real person. All read-path denials now collapse to one undifferentiated code.
The full write-up, including what we still cannot promise, is in We Tried to Break Our Own Ledger.
The News and Investor Relations portal
Shipped this week. /news is the front door. /news/facts is a fact sheet where every line is checkable, and /api/news/facts serves the same object as JSON — the page a journalist reads and the payload an agent fetches are generated from one file, so they cannot drift apart.
The fact sheet leads with what we have not done: no certification we do not hold, no named customers, no testimonials, no funding or valuation figures, and the two things we genuinely cannot do — delete your data from a model we do not operate, or retract data a subscriber already received.
Discovery went out with it. The site now names the international search and answer engines explicitly — Baidu, Yandex, Naver, Seznam, DeepSeek, Qwen and peers — because information about who we are should be readable by every engine on earth, not only the Western ones.
What is blocked
The Permission Gateway is not in production. It runs on our test environment. The production deployment is blocked on infrastructure credentials that need a human with the right access to set, and we are not going to route around a production secret to move faster. Until that clears, we describe it as a test environment, because that is what it is.
What we deliberately have not built
Being honest about the roadmap means naming the gaps, not just the milestones:
- No public subscription marketplace. A subscriber has to already know the person and the scope.
- No agent-to-agent negotiation. Today a human grants and an agent reads. Two agents transacting on behalf of two consenting humans is design, not code.
- No pricing or settlement for paid subscriptions.
- No RSS feed or per-release permalinks on the news portal yet, which is the next thing we will fix, because it is what makes everything else syndicatable.
On engineering, honestly
One more thing worth recording, because it is the kind of detail that usually stays internal.
While shipping the news portal we found that our continuous integration was running only half the guards it claimed to run. The brand, emoji and design checks were in the local script but not in the pipeline, so they were enforced only on whoever happened to run them by hand. A piece of copy that violated our own emoji policy had reached the codebase through that gap.
The gate now runs the same list as the local script. The interesting part is not the emoji — it is that a guard nobody runs is not a guard, and we had been telling ourselves otherwise in a comment. Checking whether your checks actually run is worth doing periodically.
The bar
Everything above is meant to be verifiable. If a claim here cannot be checked against the site, the code, or a dated release note, it should not have been written. Tell us where we have fallen short of that and we will fix it.
The 🤫 hussh magazine
Written by hussh Team, and built to read beautifully here — and to travel to 🤫 One on your phone, your glasses, and visionOS, as one immersive magazine you own.