One document. The whole plan.
Written working backwards from a press release set in the future, then earned section by section: the product deep dive on 🤫 Private Agent One, the engineering substance beneath it, the operating muscle that ships it weekly, the business that pays for it, and the on-ramp for the design partners who build on it. Every status is one of four honest words - shipped, in progress, in design, in pursuit - and every target is labeled a target.
The first million people now own a private agent that answers only to them
Kirkland, WA - a morning in 2027
Today a million people woke up to an agent they own. It read nothing it was not granted, wrote a receipt for everything it did, and quietly moved their day forward - refills collected, forms filed, the right human from their Trusted Circle pulled in at the right moment. Their employers could not read it. Neither could we. The consent protocol underneath it is open, independently implemented, and verified by people who do not trust us - which is the point.
This is the release we are working backwards from. Every section below exists to make one sentence of it true - and anything that does not is a non-goal.
🤫 Private Agent One - the deep dive.
The most helpful, most lovable private agent - working with and for you, with your Trusted Circle of agents and humans, 24/7/366. This part is the PRD: principles, the surface map, the stories, the metrics that define success, the non-goals, and the train.
I.1 · Product principles - the test every feature must pass
Does this give the person their attention back, or take more of it? Session length going down while jobs completed goes up is the win.
Every access passes a scoped, revocable grant and writes a receipt. Fail closed. No exceptions for employees, partners, or debugging.
The Personal World Model is theirs - readable, correctable, deletable. An agent you cannot correct is not yours.
Day-0 value from existing subscriptions and devices. Never a new bill where an existing one can carry the job.
Shipped, in progress, in design, in pursuit. A demo is not a product; a target is not a measurement.
Humans and agents the person chose, pulled in at the right moment, receipts on both sides. One never replaces the circle; it conducts it.
I.2 · The surface map - every screen, its job, its truth
| Home (the calm screen) | Agents at a glance; nothing demands attention that does not deserve it | Shipped |
| Location & Check-in | Share your spot, check in where you stand, skip the line | Shipped |
| Consent grants & receipts | See every grant, revoke in a tap, read the ledger only you can read | Shipped |
| Personal World Model | Read and edit what the agent believes about you | Shipped |
| Connect (Trusted Circle) | The right human or agent, pulled in at the right moment | In progress |
| Talk (voice) | Say it once; it happens - blocked on ops configuration today, said plainly | In design |
| Inbox & documents | Mail triaged, documents collected and filed to your CPA, by consent | In design |
| Money & the One Card | The agent spends within your limits, a receipt for every charge | In design |
I.3 · Success metrics - the north star and its guardrails
Distinct people for whom One completed at least one real job that week - jobs, not opens.
Install to first completed job. Target under 60 seconds; measured, then published.
Came back without a notification. Baseline first, then +20% on it.
Set up 3+ Trusted Circle members inside 2 minutes; first cross-circle task per cohort.
DOWN is good while jobs completed rises - the anti-engagement guardrail, published with the north star.
Zero fail-open checks; 100% of actions receipted; revocations honored within the published staleness bound.
I.4 · Non-goals - what we will not build
- An advertising business, an attention feed inside One, or any monetization of personal data - ever.
- A chat box as the primary interface. One is a calm home of agents, not a conversation to babysit.
- Employer or government visibility into a person's agent - the boundary is architecture, not policy.
- A proprietary walled garden of tools - we compose MCP, A2A, AP2, and UCP instead of inventing captive rails.
- Engagement mechanics: streaks, badges, infinite scroll inside the agent. The product wins when it disappears.
I.5 · The release train - quarters, not vibes
Connect + Trusted Circle graph GA in the app; conformance suite + reference SDKs public; voice and inbox on-by-default once ops config lands (dependency stated).
Receipt inclusion proofs verifiable on-device; reliability SLOs published with real measurements; Burst v1 priced-before-run; policy-routed BYO execution for the first design partners.
First external PCHP implementation passes conformance; delegation-with-bounded-authority semantics published with the red-team suite; first earning garage hosts with published economics.
Independent security review findings published; sovereign design-partner deployments live on BYO rails; the first million-human quarter is the goal we say out loud.
I.6 · The stories, backwards from the human.
Every product on the platform, broken down by user story - the person's own words first, then what ships to meet them.
🤫 Private Agent One · You, living your life
“I want to stay present with the people in front of me while my errands get handled.”
The One app home + Location & Check-in - agents on a calm screen, not a chat box.
“I want to see and correct what my agent believes about me.”
The editable Personal World Model and consent grants UI.
“I want to just talk to it, and have my inbox quietly triaged.”
Voice + Gmail flows end-to-end - blocked on ops configuration today, said plainly.
“I want the right person from my Trusted Circle pulled in at the right moment.”
The Trusted Circle graph + Connect - humans and agents, one consent fabric.
🤫 Puppy One & the ladder · You, owning your compute
“I do not want to understand silicon - I want the right machine for my work.”
The four-tap chooser: your work picks your machine.
“I want my garage to pay for itself.”
Garage One + the host program - headroom becomes income, no earnings claims until real.
“I want a heavy job done fast tonight without buying a datacenter.”
Burst v1 - priced before it runs, receipted after.
🤫 Tag One · You, loving someone far away
“I want to know Mom made it home, without surveilling her.”
Consented check-ins and location on her terms - live in the app today.
“I want one button she can press that reaches the nearest person who loves her.”
Ping + SOS on the Tag wearable, September 2026 line.
🤫 Yellow Pages · You, needing a hand locally
“I want the right local expert without reading forty reviews.”
The directory across all 50 states + the swipeable discovery feed with feeling-lucky.
“As the expert, I want my listing to be mine - my offers, my pricing, my inventory.”
The claim flow: the listing becomes your canvas, only ever filled by you.
“I want my agent to reach their agent and just book it.”
Agent-to-agent connect on the open rails, consent on both sides.
🤫 One Card · You, letting your agent spend
“I want my agent to pay for things within limits I set, with nothing hidden.”
Per-agent limits and a receipt for every charge - bank and network partners in pursuit.
🤫 One Platform · Your employer, without surrendering you
“As an employee, I want a private agent my company cannot read.”
Consent receipts + fail-closed scopes - the boundary is architecture, not policy.
“As the CIO, I want this on our clouds, our keys, our identity.”
BYO everything: subscription, compute, intelligence, infrastructure.
“As a regulated buyer, I want the certifications real.”
FedRAMP High + DoD ILs - in pursuit, never claimed early.
Six layers, one request path.
Where every piece of work lives. The consent kernel sits beneath everything - no grant, no read, including for us.
The ladder (Puppy, Garage, Warehouse, Factory Grid) + burst: jobs routed across owned and rented compute by price/speed/residency policy, priced before they run, receipted after.
MCP for tools, A2A for agent-to-agent, AP2 for payments, UCP for commerce - One composes the open standards instead of inventing proprietary ones.
The person's editable model of themselves - preferences, people, patterns. Reads are consent-scoped; the person can open it and change what the agent believes.
Append-only, tamper-evident record of every access and action, readable only by the owner. Inclusion proofs (planned) make completeness verifiable without trusting the operator.
Every data access passes a scoped, revocable grant before it executes. Fail closed: no grant, no read - including for us.
The agent lives on hardware the person owns, offline-first with a durable task queue. The phone is the trust anchor; the ladder extends it.
Seven problems worth a career.
The honest recruiting section: each genuinely open, each with a falsifiable finish line. If any reads as easy, we wrote it wrong.
Revocation that outruns replication
A revoked grant must stop mattering everywhere - including on devices and counterparty agents that are offline when it happens. What staleness bound can we guarantee, and how do we prove a holder could not have acted on a dead grant beyond it?
Finish line: A published bounded-staleness model with conformance tests a third party can run.
Verifiable receipts without surveillance
The owner must be able to verify the ledger is complete (nothing deleted, nothing hidden) without any global, minable ledger existing - completeness proofs for an audience of exactly one.
Finish line: Inclusion + consistency proofs checkable on-device against a compact commitment.
Delegation with bounded authority
Your agent asks a travel agent's agent to book a room. Capability chains must attenuate (never amplify), expire, and remain legible to the human who granted the root - across organizational trust boundaries.
Finish line: An attenuated-delegation semantics in PCHP with a red-team suite of privilege-escalation attempts, all failing.
A scope algebra fast enough to sit in every request
The consent language must express real human intent (purposes, fields, time bounds, counterparties) yet evaluate inside a 50 ms p99 on-device budget, fail closed, on a phone, offline.
Finish line: Published grammar + evaluator with the latency histogram to prove it.
Multi-device world-model sync without server plaintext
The Personal World Model must merge edits from your phone, desk, and garage rungs - conflict-free, offline-tolerant - while no server ever holds a decryptable copy.
Finish line: A CRDT + key-management design surviving an independent cryptographic review.
Multi-objective burst scheduling
Route a job across owned rungs and contracted clouds under four simultaneous constraints - price, speed, data residency, and consent scope - with the price committed before execution.
Finish line: A scheduler whose committed quotes are honored within a published error band.
Garage economics that actually clear
An owned kilowatt must beat rented cloud on cost per unit of useful work despite Starlink-class latency and asymmetric uplink. Which workload classes clear that bar, at what utilization?
Finish line: Published per-workload unit economics from real hosts - no earnings claims until they are real ones.
The numbers that constrain the design.
Order-of-magnitude budgets, physics, and economics - labeled as budgets and estimates, never as measurements we have not made.
| < 50 ms p99 | Consent-check budget, on-device, fail closed | budget - the ceiling the scope algebra must fit under |
| ~1 KB / receipt | Receipt size target; 10,000 receipts/yr is ~10 MB/yr | a lifetime ledger fits comfortably on a phone |
| 1-5 ms | Round trip, device to garage rung on the LAN | physics - why owned local compute feels instant |
| 50-150 ms | Round trip to a distant cloud region | physics - why the ladder exists at all |
| ~25-60 ms + asymmetric uplink | Starlink-class link to a grid site | constraint - shapes which jobs belong on the grid vs local |
| ~24 kWh / day | One continuous kilowatt in a garage; ~$2.40/day at $0.10/kWh | the bar garage economics must clear, stated openly |
| 10-100x | Rough local-inference throughput gap, pocket vs deskside class | estimate - why serious daily work earns a desk rung |
| Engineering bar | Target | Honesty |
|---|---|---|
| Consent check, p99 | < 50 ms on-device | target - fail closed, never fail open |
| Receipt append | O(1), verifiable inclusion | target - auditable without trusting us |
| Data boundary | No plaintext off-device without a scoped grant | invariant - by construction |
| Crash-free sessions | > 99.9% | target - published, then reported |
| Recommendation logic | 100% path coverage by property tests | shipped for the chooser (162 paths) |
| CI gate | Guards enforce, never report-only | emoji + brand policy enforced in CI |
Six pizza teams. One bar.
Small teams, complete ownership: each has a mission, a timeline, a definition of done, and OKRs with measurable key results. Baselines are published before targets are claimed.
Protocol (hu_ssh / PCHP)
Make consent verifiable by anyone, trusted by no one.
Timeline: Conformance suite Q3 2026; inclusion proofs Q4 2026; external review 2027.
Done means: A third party passes conformance without reading our code, and an auditor verifies ledger completeness without trusting us.
Objective: The protocol becomes independently implementable
- Conformance suite public with 2 reference SDKs (TS, Python)
- 1+ external implementation passes conformance
- Receipt inclusion proofs verify on-device in <100 ms
North star: external implementations passing conformance · Guardrail: 0 fail-open consent checks, ever
Agent One app
The most helpful, most lovable private agent - presence over screens.
Timeline: Trusted Circle graph H2 2026; voice + inbox on-by-default Q3; SLOs published Q4.
Done means: A first-time user completes a real job (check-in, share, ask) in under a minute, and comes back tomorrow unprompted.
Objective: One earns a daily place in real lives
- Day-7 retention baseline published, then +20% on it
- Median time-to-first-job < 60 s from install
- Crash-free sessions > 99.9%, p99 consent check < 50 ms
North star: weekly humans served (jobs completed, not opens) · Guardrails: session length DOWN is good; 0 dark patterns
Trusted Circle & Connect
The right human or agent, pulled in at the right moment, by consent.
Timeline: Consent graph user-visible H2 2026; agent-to-agent connect in design.
Done means: A user routes a real task to a circle member (human or agent) and both sides hold a receipt.
Objective: The circle becomes the product's spine
- Circle setup < 2 minutes for 3+ members
- First cross-circle task completed per new user cohort: baseline, then 2x
- 100% of circle actions receipted
North star: tasks completed through the circle/week · Guardrail: 0 unconsented reachouts
Compute ladder & Burst
Owned supercomputing at every scale, burstable at an honest price.
Timeline: Burst v1 Q4 2026; first earning hosts 2027.
Done means: A Puppy bursts a job up the ladder priced-before-run, and the first real host is paid real money with published economics.
Objective: The ladder earns its economics in public
- Burst quotes honored within a published error band
- Chooser-to-reservation conversion baseline published, then +25%
- First 10 hosts live with per-workload unit economics published
North star: owned-compute hours serving real jobs · Guardrail: no earnings claims until they are real
Yellow Pages & Commerce
Local connection, agent-mediated, consent-first - the anti-Avvo.
Timeline: Claim flow H2 2026; agent-to-agent booking in design; Card in design.
Done means: An expert claims their canvas, a seeker connects through the feed, and a booking completes agent-to-agent.
Objective: The directory becomes a living marketplace
- Claimed listings: baseline published, then 10x
- Feed swipe-to-connect rate baseline, then +50%
- First 100 agent-mediated connections completed
North star: real connections made/week · Guardrails: 0 fabricated listings; removals honored < 48 h
Platform & Enterprise
Sovereignty as product - BYO everything, provable to auditors.
Timeline: Policy-routed BYO execution Q4 2026; FedRAMP in pursuit.
Done means: An enterprise runs One on its own clouds, keys, and IdP, and its auditor reads the same receipts its employees do.
Objective: The first sovereign deployments stand up
- 2 design partners on BYO rails end-to-end
- SSO-to-first-value < 1 day for a new org
- 100% of platform actions receipted on customer-readable ledgers
North star: seats live on BYO deployments · Guardrail: certifications stated only as held or in pursuit
Every team lands user-visible value weekly; the public /releases page is the scoreboard - build in the open.
KPIs reviewed against published baselines monthly; misses stated plainly, Rude-FAQ style.
OKRs graded 0.0-1.0 and reset each quarter; graded scores published with the release notes.
Agents draft, test, and review; humans own taste, judgment, and the Jobs/Munger bar. Every team runs an adversarial design review before ship.
User experience, engagement, and interaction quality outrank feature count. Session length going DOWN while jobs completed goes UP is the win condition.
hu_ssh / PCHP - the consent protocol
The flagship: an open handshake where every access to a person's data is scoped, revocable, and receipted. If this layer is right, everything above it can be trusted; if it is wrong, nothing can.
| When | Milestone | Detail | Status |
|---|---|---|---|
| Shipped 2026 | PCHP specification public + RFC-001 (The Handoff) | The open spec, composable over MCP, A2A, AP2, and UCP - published for adversarial reading. | Shipped |
| Shipped 2026 | Server-side consent validation + tamper-evident receipt ledger v1 | Fail-closed scope checks on every access path; append-only receipts a user can independently read. | Shipped |
| Q3 2026 target | Conformance suite + reference SDKs | A test kit any implementer can run; TypeScript and Python references so a third party can pass conformance without reading our app code. | In progress |
| Q4 2026 target | Receipt verification proofs | Inclusion proofs on the ledger so an auditor verifies completeness without trusting the operator - the anti-tamper property stated as math, not policy. | In design |
| 2027 target | Independent security review of the protocol | External adversarial review, findings published - the Rude-FAQ standard applied to our own crypto. | In pursuit |
🤫 Private Agent One - the lovable agent
The most helpful, most lovable private agent - working with and for you, with your Trusted Circle of agents and humans, 24/7/366, so your life keeps moving while your preferences, needs, wants, and desires are handled quietly in the background.
| When | Milestone | Detail | Status |
|---|---|---|---|
| Shipped 2026 | The One app home + Location & Check-in | Agents on a calm home screen; real location sharing and check-ins live today - the Vegas wedge. | Shipped |
| Shipped 2026 | Consent grants UI + editable Personal World Model | The real scope model wired to the interface; the person can read and edit what the agent believes. | Shipped |
| In progress | Trusted Circle graph + Connect | Human-to-human expert discovery inside One; the consent graph as a first-class, user-visible object. | In progress |
| Q3 2026 target | Voice + inbox connectors on by default | Talk and Gmail flows end-to-end - blocked today on ops configuration, said plainly. | In design |
| Q4 2026 target | Reliability SLOs published | p99 consent-check under 50 ms on device; offline-first task queue; crash-free sessions above 99.9% - targets we publish and then report against. | In design |
🤫 One Platform - BYO everything
The enterprise offering: bring your own subscription, compute, intelligence, and infrastructure. Sovereignty as product - the org modernizes without surrendering anything, including to us.
| When | Milestone | Detail | Status |
|---|---|---|---|
| Shipped 2026 | Enterprise SSO IdPs (code + UI + tests) | Day-0 SSO via enterprise IdPs; NIST 800-63 IAL2/AAL2 identity paths. | Shipped |
| Shipped 2026 | The /enterprise lane + BYO flagship | The four pillars stated as product: subscription, compute, intelligence, infrastructure. | Shipped |
| Q4 2026 target | Policy-routed BYO execution | Jobs routed across owned rungs and contracted clouds by price/speed/residency policy, receipts on every hop. | In design |
| Ongoing | FedRAMP High + DoD Impact Levels | In pursuit - never claimed until a 3PAO assessment and agency ATO say otherwise. | In pursuit |
The compute ladder - Puppy to Factory Grid
Owned supercomputing at every scale: pocket, desk, garage, warehouse, and the federated Grid - extreme compute at the lowest cost per watt, owned by ordinary people.
| When | Milestone | Detail | Status |
|---|---|---|---|
| Shipped 2026 | Puppy One reservations + the four-tap chooser | The lineup live with honest catalog truth; the chooser's 162 recommendation paths locked by property tests. | Shipped |
| Shipped 2026 | Ladder pages: Garage, Warehouse, Factory Grid One | Every rung stated honestly as in design, routing to the real host program that exists today. | Shipped |
| Q4 2026 target | Burst v1 - priced-before-run, receipted-after | A Puppy bursts a job up the ladder by consent; the buyer picks the price/speed point per job. | In design |
| 2027 target | First earning garage hosts | Real hosts, real payouts, published economics - no earnings claims until they are real ones. | In pursuit |
The business - Yellow Pages, Store, Card
The commerce engine: local, two-sided, agent-mediated connection - and the honest storefront that pays for the mission.
| When | Milestone | Detail | Status |
|---|---|---|---|
| Shipped 2026 | 🤫 Yellow Pages: all 50 states + DC seeded, discovery feed live | 638k+ producers searchable; consent-first, claimable, removable - the anti-Avvo, plus the swipeable feed. | Shipped |
| In progress | Claim flow for professionals | The listing becomes the expert's own canvas - offerings, pricing, inventory - only ever filled by them. | In progress |
| In design | The 🤫 One Card | Per-agent limits, a receipt for every charge; bank and network partnerships in pursuit. | In design |
| In pursuit | Sovereign partnerships (🇺🇸, 🇦🇪) | The UAE plan is public and honest; every partnership named as pursuit until signed. | In pursuit |
🤫 Doorstep - GTM & the last mile
Every machine deserves a human at the door. This track is how a Puppy One or an Agent One setup actually reaches a real home: a consent-first house-call protocol, a national fleet ridden as a bridge, licensed trades for the grid, and the 🤫 Yellow Pages as the destination - never a call center dispatching strangers.
| When | Milestone | Detail | Status |
|---|---|---|---|
| Shipped 2026 | The Doorstep program published | The house-call protocol, the three house calls, and the lanes we intend to work with - live and honest at /one/doorstep. | Shipped |
| Now | Phase 0 - the pilot brief | A priceable pilot brief, our training and certification module, and the grid-tier commissioning spec drafted against real Puppy One hardware - entirely in our control. | In progress |
| H2 2026 target | Phase 1 - first contact | Approach Best Buy Business / the Geek Squad Partner Program, with OnTech Smart Services and Asurion quoted in parallel as alternates - a priced pilot proposal in hand within 8 weeks of first meeting. | In pursuit |
| H2 2026 - H1 2027 target | Phase 2 - the Seattle pilot | 50-200 Agent One white-glove and Puppy One home installs in one metro (ZIP 98033 and the Eastside), judged on time-to-live under 48h, install delight, and a zero-data-incidents hard gate. | In pursuit |
| H1 2027 target | Phase 3 - the licensed trades | Certified local electricians and HVAC pros commissioning Garage One and Warehouse One sites to a published spec - a network wholly ours, with no partner dependency. | In design |
| 2027+ target | Phase 4 - the Yellow Pages becomes the destination | Certified local technicians fold into the directory as human 🤫 Agents, discoverable and reachable ZIP by ZIP; the national fleet remains only a capacity partner where we lack density. | In design |
🤫 Household Reach - GTM for every American household
Diffusion research is clear: the first 16% of any market finds a product on its own; the other 84% - the early majority, the late majority, the skeptical - are reached by a person they already trust, showing them something real. This is the plan to reach them, with zero dollars spent on ads: a referral flywheel for the easy 16%, and a Community Agent network of trusted local messengers for everyone else.
| When | Milestone | Detail | Status |
|---|---|---|---|
| Shipped 2026 | The Household Reach plan published | The two engines, the six-layer system, seven hard problems with falsifiable finish lines, the literal compensation formula, and the legal guardrails - live and honest at /one/household-reach. | Shipped |
| Now | The comp formula, legally reviewed | The payout formula finalized and checked against the FTC's Koscot pyramid-scheme standard; the permit-compliance data model designed. | In progress |
| H2 2026 target | First cohort, first permit | 1099-classification test documented and passed; first 10-20 🤫 Yellow Pages professionals onboarded as referral partners in King County; the first municipal solicitor permit obtained. | In pursuit |
| H2 2026 - H1 2027 target | The demonstration method, live | First free-venue demo events at a library, senior center, or credit union, run by certified Doorstep technicians; first 100 Community-Agent-assisted households; retention reported by channel. | In pursuit |
| H1-H2 2027 target | County by county, honestly paced | Permit compliance expands municipality by municipality within Washington, the same way Cooperative Extension went county by county starting in 1906 - coverage published, not claimed. | In design |
| 2027+ target | Every household, stated as the pursuit it is | Multi-state expansion sequenced strictly by permit-compliance readiness. We say plainly: we are not there yet. | In pursuit |
The design-partner on-ramp.
Read, connect, conform, ship - the practical path onto the platform, on open rails, with consent and receipts on both sides.
The PCHP spec and RFC-001 - the consent handshake your integration will speak.
Bring your tools over MCP via OpenClaw; agent-to-agent over A2A; payments over AP2; commerce over UCP.
Run the conformance suite (Q3) - pass it without reading our app code; that is the definition of open.
Land in the Trusted Circle: consented, receipted, revocable - and discoverable to every One owner who wants you.
One document, held to four names.
Deep enough for the systems builders, tasteful enough for the product bar, honest enough for the working-backwards test - and operational enough to run six teams on. If this is the plan you want to hold to, come build it.
One is a product of Hushh Technologies Corporation (brand: 🤫 “hussh”), an independent company. One runs on third-party silicon, systems, and cloud; all company names are used solely to describe the platforms on which One software runs. Hushh Technologies is not affiliated with, endorsed by, sponsored by, or partnered with any company named.