Skip to main content

The Protocol

Eight tenets. Any system that claims to implement the Hypercontext Protocol honors all of them, and a user can tell.

This protocol is deliberately not an implementation spec. Implementations will differ: different transports, different storage, different agents doing the curating. What cannot differ is the contract. These tenets describe what the protocol respects, humanistically, for the person whose context is on the line. When someone hears that a product implements the Hypercontext Protocol, it should be very clear what is happening.

1. Minimal disclosure​

You should only share as much as excellence of service requires. A travel agent gets your travel style and your dates. It does not get your journal, your relationships, or your trauma. Relevance is the reason to share; the moment a request exceeds what relevance requires, the request is wrong.

2. Deletion on disconnect​

When you disconnect your context from a service, there is a mechanism to easily and genuinely delete what the service held. Leaving is real. A connection you cannot cleanly undo was never a connection; it was a transfer.

3. Connect your context, not your identity​

The front door to a service stops being "sign in with Google" and becomes "connect your context": create an account and add your scoped context immediately, so you never re-share what you already know about yourself. The service is excellent from the first minute because it starts knowing exactly what it needs.

4. Your curator decides​

The agent that chooses what crosses the boundary works for you, and only for you. Your curator reads the service's request, reasons about which pieces of your castle are genuinely needed for the job, and passes only those. The service never reaches in. AI is good enough at reasoning about context that this judgment call is cheap and automatic.

5. Sovereign home​

No service holds more than a tiny sliver of your context unless you host it yourself. The castle stays yours: your files, your format, your storage. Everything a service holds is a copy of a sliver, never the source of truth.

6. Transparency of holdings​

At any moment you can ask a connected service what of yours it currently holds and get a complete, legible answer. This tenet gives tenet 2 its teeth: you cannot verify the deletion of what you cannot enumerate.

7. Purpose-bound use​

Context shared for a job may be used only for that job. Not for training models, not for sale to brokers, not for advertising, not for any secondary purpose you did not grant. This is the service's side of the bargain. "Don't overshare" is the user's discipline; purpose-binding is the platform's.

8. Expiring grants​

A connection is a lease, never a transfer. Grants default to a limited term and lapse unless renewed. The travel agent's access expires after the trip. Disconnection is the default fate of every connection, so forgetting to revoke is safe.

Trust does not change the contract​

A service with a thousand five-star reviews still gets only what the job requires. Trust earns the connection. It never earns the castle. Even in the worst case, a leaked sliver is a limited attack window: some information about a flight, never your life.

Further Reading​