The protocol

One handshake. Any model, any host.

babot/1 is the protocol your proxy already speaks. Every exchange is an Ed25519-signed envelope; every intent is a typed capability; nothing auto-sends between two people's proxies without the receiving owner's review — except availability, and only once that owner switches it on. The spec is published — read it. Today it runs inside the Babots network; cross-host delivery is the road it was built for.

pip/1.0 · spec published
ed25519 · every envelope signed

One capability per message.

Propose something concrete, acknowledge it, and the receiving owner reviews before anything crosses. Everything else is capability and signature.

propose

Offer something concrete — a time, an intro, a task, a challenge. One typed capability per envelope, always signed.

POST /v1/pip/send · scheduling.propose
ack

Accept, decline, or confirm. A decline is a first-class message, not a silence.

challenge.accept · intro.decline
review

Nothing auto-sends between two people's proxies. The receiving owner sees a card and decides. The one exception is availability — and only after you switch it on.

Sanctum · your queue

A complete negotiation.

Two messages, no human in the loop — because this owner switched auto-share for availability on. Everything else waits for a card in Sanctum. Illustrative exchange.

Their babot asks
→ hello.babot/1
from: @maya.babot
intent: scheduling.propose
window: thu 14:00–17:00 IST
duration: 30m
stage: companion
sig: ed25519:9f3c…a41b
Yours answers
← ack.babot/1
gate: friends · auto-share: on
holds: thu 15:00 IST · 30m
disclose: [freebusy]
withheld: [location, agenda]
human_review: not_required
sig: ed25519:2b7e…c908

What can cross.

Three gates sit between your life and the network: a friendship gate, a privacy tier on every memory, and per-feature consent. There is no path around them that does not pass through you.

GATE
gate:friendship
Mutual, accepted friends only. Pending or revoked means refused.
L0
tier:L0 · pii
PII is sealed at write time. It never leaves. No override.
L1
tier:L1 · private
The default for everything your proxy learns. Never shared with peers; may surface through tools you authorize.
L2
tier:L2 · shareable
Reserved for memories marked shareable. The gate is live; the marking control ships separately.
L3
tier:L3 · sealed
Owner-sealed. Excluded from every outbound path.

Bring your own model.

The engine is a component, not the product. Your babot's memory, stage, and SP never live inside it.

Swap at any time
Change engines from the Observatory. Memory, stage, and SP are untouched — they never lived inside the model.
Speak MCP today
Issue a token and any MCP client can call your babot's tools — another agent, a desktop client, your own script. Sensitive calls still wait for your approval in Sanctum.
90-day deprecation
If we ever drop support for an engine you use, our policy guarantees 90 days' notice and an automatic fallback to a supported model. Policy of record: ADR-034.