Technical architecture

Engineering notes from building Pixie, written for technical readers. Each category opens with its broadest view; the articles beneath it go deeper.

These notes describe a protocol you can check. The specification, the machine-checked proofs, and the test vectors are published.github.com/sociofabric/pixie

Contact Discovery

Every social app answers "which of my friends are here?" by uploading your address book — quietly building a map of who knows whom for a server to keep. This series walks the pipeline that answers the same question while the server learns nothing linkable: an identifier computed blind, a lookup the database cannot see, defenses for the doors an oracle leaves open — all of it on quantum-safe lattices.

Read

Lattice Foundations: SIS, LWE, and Post-Quantum Trust

The two lattice problems the whole stack stands on, and why decades of attack — quantum included — haven't dented them.

Read9 min read

The Lattice OPRF: Deriving presence_id

Turning a phone number into an unlinkable identifier, without the server ever seeing the number.

Read9 min read

The Verifiable OPRF: Trust, but Verify

A server can run the protocol perfectly with the wrong key to tag you. Every reply must prove it didn't.

Read10 min read

Bulk Membership: Private Information Retrieval

Looking something up is itself a leak. Querying the directory so it cannot see the query.

Read8 min read

Guarding the Directory: Enumeration, Sybils, and Poisoning

Rule-following callers can still enumerate, flood, or poison an oracle. Guarding the directory's front door.

Read10 min read

Algorithm: Oblivious Linear Evaluation from Ring-LWE

The core two-party step: the client learns an inner product with the server's secret key, while the server sees neither the query nor the result.

Read8 min read

Algorithm: Post-Quantum Oblivious Transfer

The rounding step needs a client to pick one of two server messages without the server learning which — and the classic tools for that are not post-quantum.

Read7 min read

Algorithm: Rounding by Oblivious Transfer (Route B)

The blind evaluation ends with a noisy value split between two parties. Rounding it correctly turns on a carry bit neither side is allowed to see.

Read11 min read

Algorithm: The NIZK

Proving the server used the committed key — in a proof small enough for a phone to check on every reply.

Read8 min read

Algorithm: The Proof Ring

A proof over modular arithmetic leaves room to equivocate. Pinning down the exact integer identity instead.

Read8 min read

Algorithm: OLE Packed

Each polynomial in the proof witness carries one useful number and 63 empty slots. Packing them 64-to-a-polynomial shrinks everything — if the algebra can be kept honest.

Read8 min read

Algorithm: Succinct Proofs by Folding

An honest proof that ships its whole witness costs megabytes per lookup. Folding it recursively delivers the same guarantee in 52 KB.

Read9 min read

Algorithm: Known-Answer Testing

Every other article in this series makes a server prove something. This one is about what you do when proving is impossible — when the check you would need requires the very secret the protocol exists to keep from you. The answer is older…

Read8 min read

Algorithm: The Transparency Log

Several articles across these series reach a point where they need a fact to be the same fact for everybody — the discovery key served for a phone number, the roster of devices on an account, the list of live token-issuing keys — and each…

Read13 min read

Algorithm: What a Lookup Proof Binds

A directory lookup comes back with a key and a proof. This article is about what that proof actually asserts — four separate bindings you can hold in your head at once — and about the period in this codebase when it asserted three of them…

Read14 min read

The Relay

You hit send, and a server in the middle delivers. Encrypting the content is the easy part — that server could still log who talks to whom, when, and how often: a social graph assembled from envelopes alone. This series tours the layers that strip that knowledge away, one problem at a time, until the relay is reduced to routing bytes it cannot attribute.

Read

The End-to-End Layer: What the Relay Can Never See

Keeping message bodies sealed — including against an adversary recording today and decrypting in the quantum decade.

Read7 min read

Sealed Sender: Hiding Who Is Talking

Abuse control needs the relay to check that a sender is real and not banned. Doing that check without the relay ever learning which user is sending.

Read6 min read

Sender Unlinkability: The Pseudonym Problem

One stable ticket across chats is a pseudonym. Stopping the relay from linking your conversations together.

Read6 min read

The Envelope: Minimizing What the Relay Must See

The relay must know how urgently to wake a phone — and nothing else about the message.

Read6 min read

A Relay That Holds Nothing: Ephemeral Delivery

A durable inbox is the most dangerous object a relay can own. Delivering without one.

Read6 min read

Reading Without Being Watched: Oblivious Pull

Catching up after being offline, without revealing which conversations lit up while you were gone.

Read5 min read

Waking a Sleeping Phone: Push Without a Social Graph

Waking a sleeping iPhone without letting push tokens join your device to your traffic.

Read7 min read

Rate-Limiting a Stranger: Anonymous Admission

Anonymous senders still need rate limits, or spam wins. Metering happens where you are known, enforcement where you are not — joined by tokens neither end can link.

Read7 min read

Deniability: Messages No One Can Prove You Sent

Convincing your friend it's really you — while leaving nothing that could convince anyone else.

Read7 min read

Algorithm: Sealing the Envelope

An envelope with no sender field still has to resist tampering, replay, and re-addressing. The exact bytes on the wire, and the single MAC that binds them.

Read5 min read

Algorithm: The Admission Token (Lattice OPRF)

The token factory: metered where it mints, anonymous where it spends. Blind evaluation keeps the two ends of the same token cryptographically unlinkable.

Read10 min read

Algorithm: The Double-Spend Ledger

A single-use token is only single-use if someone remembers it was spent. Keeping that memory tiny, atomic, and self-erasing.

Read5 min read

Algorithm: The Attested Push Seal

A push token can join your phone to your account's traffic if anyone can read it. Storing tokens so even the registry holding them cannot.

Read5 min read

Algorithm: The Deniable Handshake (CDH)

Saying the first hello with no signature — authenticated to them, deniable to everyone else.

Read5 min read

Algorithm: Who Gets to Put You in a Group

Every article before this one has been about two people. This one is about the moment a third arrives — how a device decides that a group it has never seen, delivered by a server that deliberately does not know who belongs to it, is a…

Read14 min read

Agent

Your phone holds the most complete record of your relationships that has ever existed — every message, every call, every plan, every "we should really catch up." Pixie ships a personal agent that reads that record and helps you actually…

Read

Choosing Brains: the Model Bench

An agent harness is, at bottom, a loop wrapped around a language model: gather context, ask the model, act on the answer, repeat. Everything else in this series — planners, skills, tool calls, huddles — rides on that one call. So the first…

Read12 min read

The L1–L2–L3 Harness

A model small enough to run on your phone can hold a perfectly good conversation. Ask that same model to also decide when it needs a tool, follow a multi-step procedure, and write a well-formed tool call — all at once, in one context…

Read15 min read

Skills, Tools, and the @-Namespace

An agent that only does what its developers hard-coded is a feature. An agent whose owner can teach it new procedures — in plain prose, on the device, without writing a line of code — is something closer to a colleague. This article is…

Read14 min read

The Homebase

Your phone is the wrong machine for half the things an agent wants to do. It throttles under sustained load, its RAM caps the models it can run, and its disk is a fraction of the multi-terabyte drive sitting idle on your desk. The obvious…

Read14 min read

The Agent in Your Day

Every other article in this series is about how the agent works — how models are chosen, how the harness splits reasoning into layers, how tools are bound and skills shared. This one is about where all of that machinery actually touches…

Read18 min read

Mechanism: On-Device Curation

The Settings model browser looks like a boring list: a few names, some sizes, a download button. Behind it is a pipeline that pulls thousands of community model repos off the internet, throws most of them away on purpose, and guarantees…

Read15 min read

Mechanism: External Routing & Fallback

Every time Pixie's agent is about to think — a chat reply, a brief, a huddle turn — it first has to answer a deceptively simple question: which model answers this one? This article is about the one function that decides, the settings that…

Read14 min read

Mechanism: CallTool — One Tool to Bind Them

Pixie's on-device executor can use five different tools, but it is only ever handed one. That one tool is call_tool, a meta-tool whose entire job is to run other tools. This article is about why a small model works better when you take its…

Read13 min read

Mechanism: Skill Bundles & Sharing

A skill you have refined — the phrasing that finally makes the planner check the calendar before answering, the search procedure that never skips a source — is a procedure worth giving away. But a skill is not a file you can just attach.

Read13 min read

Mechanism: Inference over the Relay

Your phone holds the conversation; your Mac holds the big model — reaching it is the mechanism we call BigBrain. This article is the wire between them — how a handset asks its own Homebase to run a completion, over the same sealed channel…

Read15 min read

Mechanism: Sharing a Homebase

Tim has a Mac Studio running a model his friends' phones could never load. Jim has a phone. The Homebase ended with Tim inviting Jim to use his models — read-only access to compute, nothing else — BigBrain pointed at someone else's…

Read17 min read

Mechanism: MCP — Letting Other Agents In

We call this mechanism Puppeteer. Pixie's agent is not the only agent on your Mac. Claude Desktop is sitting right there. So is whatever local model you run in some other harness. Sooner or later you will want to type "ask Pixie who I've…

Read16 min read

Mechanism: Memory & the Notebook

An agent that helps you care for your relationships is only as good as what it remembers — and an on-device model has a context window of a few thousand tokens, against a life that produces years of messages, calls, posts, and journal…

Read16 min read