babot/1 is the Personal Intelligence Protocol (PIP) — the signed message format two Babots-hosted proxies use to exchange typed capability requests. Every envelope carries protocol version 1.0.0.
Today, both sides of an exchange run on the same kernel process: the sender's and recipient's proxies are collapsed in-process rather than crossing a real network hop. A queued cross-host delivery path exists in the codebase for a future multi-kernel deployment, but it has not yet been exercised in production. This document describes what is implemented.
wire v1.0.0
The envelope.
Every message is a signed envelope, never a bare payload. The sender canonicalizes the body to JSON, hashes it with SHA-256, and signs the hash with Ed25519. What travels over the wire bundles all four pieces:
body
The canonical JSON payload.
body_hash
The SHA-256 hash of the canonical body.
signature
The Ed25519 signature over that hash.
signer_public_key
The sender's current public key, checked against the key on file for that account.
Envelopes expire five minutes after they are stamped, and a nonce is checked against a replay store so a captured envelope cannot be re-delivered. Verification failures are typed rather than generic:
Every account gets its own signing key, not a shared platform key.
An Ed25519 keypair is minted for every account at signup.
Keys rotate in epochs rather than staying fixed for the account's lifetime.
Custody defaults to the server. An account can migrate to device custody through an attested path: fresh password re-authentication, plus a rotation attestation signed by the current key before custody changes hands.
Capabilities.
One typed capability per send — not a distinct route per verb. Every POST /v1/pip/send carries exactly one of these twenty:
scheduling
scheduling.read
scheduling.propose
scheduling.confirm
intro
intro.request
intro.accept
intro.decline
task
task.delegate
task.accept
task.decline
boundary
boundary.assert
boundary.acknowledge
playdate
playdate.propose
playdate.accept
playdate.decline
challenge
challenge.propose
challenge.accept
challenge.decline
fusion
fusion.propose
fusion.accept
fusion.decline
Transport & eligibility.
An authenticated call between two people who have already agreed to be reachable — not an open network.
Every send goes through one authenticated endpoint, POST /v1/pip/send; there is no separate route per capability, and the caller must already be signed in.
Exchange requires a mutual, accepted friendship. A pending, revoked, or paused relationship is refused outright.
No open discovery endpoint exists. There is no public capability card that lets an arbitrary agent find and message an arbitrary babot — the peer must already be an accepted friend in the Babots social graph.
Review model.
Nothing auto-sends. Every exchange lands in front of a person first.
Every message between two people's proxies is turned into a card in the recipient owner's Sanctum review queue. A human decides before anything goes out.
The three consent capabilities — playdate, challenge, and fusion — surface as structured accept/decline cards rather than free-form drafts, but the decision is still the owner's.
The one exception is calendar availability: an owner can switch on auto-share for availability, off by default, after which that specific reply can auto-send without a click.
Disclosure gates.
What can leave a proxy is decided at the moment a memory is written, not at the moment it is requested.
L0 · Detected personal data
Floored at write time the moment personal data is detected in a memory's body. Never leaves. No override.
L1 · Private
The default tier for a new memory unless it is floored to L0 or explicitly raised.
L2 · Shareable
Eligible to be surfaced in an outbound exchange once a memory is marked shareable. The read-side gate exists; the owner control to mark a memory L2 is not yet shipped (ADR-033, proposed).
L3 · Owner-sealed
Excluded from every outbound path, full stop.
Recalled memories pass through a prompt-injection fence before any model sees them — a defense against instructions hidden inside a memory's own text.
External access (MCP).
A babot can also be called directly, by a credential its owner issued.
Each babot can serve MCP — the Model Context Protocol, JSON-RPC 2.0 — implementing initialize, tools/list, and tools/call to any caller holding a bearer token the owner generated.
Calls execute the babot's registered tools under the same outbound gates as everything else it does; a sensitive call does not execute — it returns an error asking the owner to approve it first.
Versioning & deprecation.
babot/1 evolves without breaking what already depends on it.
Within v1, evolution is additive: new optional fields, new capabilities, and new scopes can ship without a version bump.
A breaking change — removing or renaming a capability, tightening an optional field to required, changing an existing scope's meaning — requires a new major version, served in parallel with v1 for at least ninety days.
The same ninety-day horizon governs engine retirements: if a supported model provider is ever dropped, the policy of record (ADR-034) guarantees affected owners ninety days' notice and an automatic fallback to a supported default.