Source Library, Device-Bound Local Custody & Private PKM Capability
Public concept specification for the Source Library capability, defining device-bound local custody and private PKM capability bounds under PCHP, framed within the Hussh control-plane model.
TL;DR: Source Library is the device-bound, BYOK custody edge of your private agent. It keeps your source records under keys that never leave your device, so the durable backup of your holdings is your own. Hussh is the control plane that authorizes and relays exchange, never the custodian of what is exchanged. Raw broad-scope grants are retired in favor of private, per-device PKM capability contracts under PCHP.
Relations
Architectural Overview
The Source Library capability represents the device-bound local custody engine within the Hussh Personal Knowledge Model (PKM) framework. It establishes a strict, local-first storage architecture for personal context, ensuring that your source records, receipts, documents, and personal indexes remain stored under your control, protected by hardware-backed encryption.
Under recent protocol advancements, broad public consent scopes for source libraries have been retired. In their place, Source Library operates strictly as a private PKM capability governed by per-device capability contracts and explicit user consent handshakes.
Where Source Library Sits in the Control-Plane Model
Hussh is the control plane, not the custodian of your holdings. Your private agent, One, runs in your own pod (a small container in your own cloud under BYOC), with keys on your own device under BYOK. Hussh operates that pod on your behalf but holds none of your information: it keeps only public metadata (an identifier and the pod's public key), relays sealed ciphertext between parties, and authorizes consent.
Source Library is the custody edge of that model. It is where plaintext actually lives (inside your pod and on your device) and nowhere else. Everything Hussh and the network see is encrypted. There is no Hussh vault of your records and no Hussh backup-of-record. The durable backup is your own, held in your own cloud, unlockable only with material that never leaves your device.
Core Principles
- Device-Bound Local Custody: Source Library assets stay under your control on your own device and in your own pod. Encryption keys are generated and held in hardware-backed secure storage on the device, never mirrored to Hussh.
- BYOK Unlock Stays on Your Device: The material that unlocks your holdings never leaves your device. Because Hussh holds only public metadata and sealed ciphertext, no party other than you can decrypt what Source Library protects. This is what makes your backup genuinely your own.
- Private Capability Scoping: Source Library access is never granted as a blanket or standing permission. Every read or write rides an explicit PCHP grant that is single-use, signed, scoped to exact targets and time bounds, and revocable at any moment.
- Zero Remote Plaintext Exposure: External agents and services receive only bounded, encrypted, or zero-knowledge derived outputs. Raw content from the Source Library is never transmitted or mirrored to a central Hussh store. Hussh relays ciphertext; it does not read it.
- Auditability and Revocation: Custody operations produce cryptographic audit records held with your holdings. You keep real-time revocation authority, immediately locking device-bound keys when a session ends or a grant is withdrawn.
Why This Framing Matters
The control plane and the custody edge are deliberately kept separate. Hussh is the enabler for exchange, not the holder of what is exchanged. Consent is explicit and scoped through PCHP, so each exchange rides a single-use, signed, revocable grant rather than a standing pipe into your records.
For you, that separation is the concrete meaning of "Own your AI. Own your data. Own your compute." Your private agent is yours (One in your pod), your compute is yours (your own cloud under BYOC), and your holdings are yours (custody at the device edge under BYOK). Source Library is the part of the system that makes the last of these literally true: the durable copy of your records, and the only key that opens it, sit with you.