HEARTH

Household agents that pay the bills, haggle over the tariff and book the plumber, with a named adult behind each one and a thumb behind every large release.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Busy two-parent household. Bills, repairs and pocket money run by agents, with a named adult at the root of each.
• Adult child managing a parent’s bills. Pay a parent’s bills inside a mandate you hold, on a record you can both read.
• Shared flat. One treasury for rent and utilities, and nobody pays a lookalike by accident.
• Small landlord. Repairs escrowed at booking and released when you confirm the job from your own phone.

The problem

Household money already runs on automation that nobody supervises: standing orders set years ago, a bill-pay list that only grows, a banking password shared with a helpful relative. Handing the errands to agents sharpens every edge of that. An agent that pays bills can be talked into paying a convincing stranger, a phone that approves payments approves them for whoever is holding it, and when a household and a tradesperson disagree about a job, the evidence is a chat thread and two memories.

The system

HEARTH runs the errands of the Lind household, a terraced house on Ashgrove Road: two adults, a fifteen-year-old and six agents. The household is a small organization whose shared treasury is an agent, the steward, and the errand agents are its own sub-agents: they hold no wallets, spend the steward’s purse, and each carries a capability token the steward cut and nothing more. The bill-runner pays six named billers, the tariff-scout haggles with energy suppliers and pays nobody, and the trades-desk books help. At 19:40 on a Thursday, water comes through the kitchen ceiling. At 19:52 the trades-desk accepts Kessel & Daughter’s quote of 420 units for tonight, from a plumber whose trust score comes from settled jobs. Its token names the trades it may book and caps a job at 600 units, so the booking clears and the 420 units move into escrow at booking. From there they reach the plumber or come home, and nowhere else.

Rosa Kessel arrives at 20:35, finds a split joint under the bathroom floor and replaces it, and at 21:50 her agent marks the job done. The release is 420 units, above the 250 the household has set as its presence threshold, so the trades-desk cannot release it alone: the gate sends Mira’s phone the facts as the server computed them, the payee, the amount and the job. Mira checks that the ceiling has stopped dripping and puts her thumb on the sensor. The thumb unlocks a key in the phone’s keystore that signs those exact facts, and a bit the phone sets inside the signed data says a person was verified; an unlocked screen with the app open signs nothing. The escrow releases at 21:58, exactly once: the ledger records the release, and the mandate’s own evidence chain records the thumb that approved it.

Authority in the house is a tree with a named human at every root. Mira underwrites the steward and Tomas underwrites the allowance-desk, each with a mandate re-derived on every request, so a mandate revoked at breakfast conveys nothing by the next booking. Ines’s allowance is a token the allowance-desk cuts for her agent each Sunday, 30 units and four named shops, and a token can only narrow what its issuer holds: when Tomas reduces the desk’s grant, the allowance empties on the next request, with nothing to chase. Every unit that moved that evening is conserved, verified by an independent auditor nobody in the house controls, and every refusal is on the record beside it.

The cast and their ceilings

The flow, step by step

1. Mira underwrites the steward once: a named human, a declared scope, limits. What it conveys is re-derived on every request.
2. The steward cuts the trades-desk a token: vetted trades only, 600 units a job. A token can only narrow what its issuer holds.
3. 19:40, water through the kitchen ceiling. At 19:52 the trades-desk accepts Kessel & Daughter’s quote: 420 units, tonight.
4. Inside the token, the booking clears and 420 units are escrowed. The plumber sees the money exists before she starts the van.
5. 21:50, job done. Over 250, so the facts go to Mira’s phone, and her thumb unlocks a key that signs exactly those facts.
6. 21:58. The escrow releases 420 units to the plumber, exactly once, whatever the retries.
7. The booking and the release land on the ledger, the thumb on the mandate’s evidence chain. Every unit is accounted for.

Each need, mapped to a live primitive

The attack this chamber refuses: The lookalike supplier

The attack. An agent calling itself Harrowmere Power Services, a near copy of the household’s real energy supplier, sends the bill-runner a final notice: 612 units by midnight or the power goes off.

Why it fails. The bill-runner can be fooled by prose. The gate does not read prose: it reads the token the steward cut, whose caveats name six billers by their DIDs and cap a single payment at 250 units, the household’s presence threshold. A lookalike can copy a name and a letterhead; it cannot copy the real supplier’s DID, and 612 units is over the cap in any case. Either fact refuses the payment, checked against the steward’s authority as it stands now, before a unit moves.

What actually happens. No transfer, no escrow, nothing to unwind. The refusal is recorded with the lookalike’s DID for the adults to read at breakfast, and the real supplier is paid on its usual date.

The attack this chamber refuses: The unlocked phone

The attack. Someone who picks up Mira’s unlocked phone, the household app still signed in, tries to approve a 540-unit release that is waiting for her confirmation.

Why it fails. An approval here is a signature, not a tap. The gate accepts only a challenge answered by the key enrolled on Mira’s phone, and the phone uses that key only after verifying the person again, by fingerprint or device PIN, a fact the authenticator writes into the signed data itself. A signed-in session supplies neither, and once a device key is enrolled the household accepts nothing weaker, so a code read off an authenticator app on the same phone is refused as a downgrade.

What actually happens. The escrow does not move. The confirmation runs out unanswered, and the expiry is recorded as a denial: who was asked, for what, and that no verified person answered.

Deep architecture

HEARTH deployed: the household’s frame, or its seat on a hosted registry, holds the steward’s purse, Mira’s mandate, the job escrow and the ledger; tradespeople act from their own registries; the family calendar reads bookings by reference, and the bank stays outside with no link at all. The trace replays one evening repair, from the mandate to the preserved release.

The deployment, traced

1. Mira underwrites the steward once: a named human, a declared scope, limits. The gate re-derives what it conveys on every request.
2. The steward cuts the trades-desk a token: vetted trades only, 600 units a job. A token can only narrow what the steward holds.
3. 19:48. Kessel & Daughter quotes 420 units for tonight from its own registry, with a trust score earned on settled jobs.
4. 19:52. The trades-desk accepts, and the gate reads its token as it stands now, before anything moves.
5. The 420 units are escrowed at booking on the household’s frame. The plumber can see the money exists before she drives over.
6. 21:50. Rosa’s agent on site marks the job done and signs it, from her own registry.
7. The completion crosses the fabric; the relaying registry is a courier, never the principal.
8. 420 is above the household’s 250 threshold, so the gate sends Mira’s phone the facts as the server computed them.
9. Her thumb unlocks the device key, which signs those exact facts. A signed-in session alone signs nothing.
10. 21:58. The escrow releases exactly once, whatever the retries.
11. The plumber is paid on her own registry.
12. The booking and the release land on the household ledger, append-only, and every unit that moved is accounted for.

Adoption, phase by phase

Discover: One month of errands, re-read as tokens.

• Runs. Nothing. Last month’s bills, one repair and the pocket money redrawn as mandates, tokens, payees and a threshold.
• Agents. None. The adults argue about the payee list and the threshold, which is exactly where that argument belongs.
• Integrates. Nothing. The bank, the bill-pay and the calendar stay exactly as they are.
• Deliberately not yet. No agent holds a token. No unit moves.
• Proof that gates the next phase. The past month replayed on paper, and both adults agree where every payment, every ask and every refusal lands.

Pilot: One errand, pilot limits.

• Runs. Accounts and agents on a hosted registry. Nothing to run.
• Agents. The steward and the bill-runner, two billers on its token, a small monthly budget, Mira’s device key enrolled.
• Integrates. The two billers that run agents. Everything else stays on the existing bill-pay.
• Deliberately not yet. No trades, no allowance, no tariff negotiation. One adult, one mandate.
• Proof that gates the next phase. A month of bills, each paid exactly once on the rails, and one deliberately off-list payee refused and recorded.

Production: The whole house on rails.

• Runs. The same hosted registry, or a household frame on a machine the family owns: registry, TEG, event store, identity fabric.
• Agents. The full cast: steward, bill-runner, tariff-scout, trades-desk, and the allowance-desk under Tomas’s mandate.
• Integrates. Vetted trades that run agents; bookings post to the family calendar, asks and receipts to the family thread.
• Deliberately not yet. Other households. One house proves itself first.
• Proof that gates the next phase. An evening repair booked, escrowed, confirmed from a phone and paid exactly once, and the ledger replays every step of it.

Federation: Trades and households on one grammar.

• Runs. Unchanged. Trades, billers and landlords bring their own registries or seats.
• Agents. A tradesperson’s trust score, earned on settled jobs, travels with its identity to the next household.
• Integrates. Each new biller or trade is an identity and an agent, not a new integration.
• Deliberately not yet. Nothing structural. Growth is households, trades and billers.
• Proof that gates the next phase. A plumber on another registry is booked, confirmed and paid across registries exactly once, and her trust score reflects the settled job.

Sizing

One repair, quote to preserved release

sequenceDiagram
  participant Tr as trades-desk (household frame)
  participant G as household gate
  participant TEG as job escrow
  participant Pl as kessel-plumbing (own registry)
  participant Ph as Mira’s phone (device key)
  participant ES as household ledger
  Pl->>Tr: quote: 420 units, tonight
  Tr->>G: accept, inside the token
  G->>TEG: 420 escrowed at booking
  Pl->>G: job done, signed
  G->>Ph: the facts, as the server computed them
  Ph-->>G: signature, verified-user bit set
  G->>TEG: release cleared
  TEG-->>Pl: 420 units, exactly once
  TEG-->>ES: booking and release, append-only
  Note over Ph: a signed-in session signs nothing#59; an expired ask is a recorded denial
  Note over G: a payee off the token is refused before any escrow

Topology, as declared

flowchart LR
  M(["Mira<br/>named, liable"]) -->|"mandate"| S["hearth-steward<br/>household purse"]
  S -->|"token: vetted trades"| T["trades-desk"]
  T -->|"quote, 420"| G{"household gate<br/>mandate, token,<br/>presence"}
  G -->|"escrowed at booking"| E["job escrow"]
  G -.->|"facts over 250"| P(["Mira’s phone<br/>device key"])
  P -.->|"signed presence"| G
  E -->|"420, exactly once"| K["kessel-plumbing"]
  E --> L[("household ledger<br/>replayable")]

Standing it up

• Infrastructure. Most households run nothing: accounts and agents on a hosted registry. A landlord, a flat or a family that wants its own frame boots one from the free licence.
• Agents. A steward, three errand agents and an allowance desk. The errands are the household’s own logic; the SDK carries identity, payment and tokens.
• Integration. Billers, tradespeople and the family calendar. A biller that runs no agent stays on the existing bill-pay, and bringing billers across is where the real time goes.

Runs beside what you already have

• Banking apps. The bank stays the bank. HEARTH holds no credentials for it; the household funds its treasury outside this system and reads here what each agent spent.
• Bill-pay and utility accounts. A biller that runs an agent is named on the bill-runner’s token by its DID. One that does not stays on the existing bill-pay until it does.
• Family calendars. A booking posts to the calendar with its escrow reference. The calendar stays the family’s view; the escrow stays the record.
• Household chat. Asks and receipts post to the family thread. Approving happens on the enrolled phone, never by replying in chat.

A full sovereign frame is nine containers and boots in about two minutes, on anything from a Raspberry Pi to a rack. That is cheap enough to run the whole system in parallel with the legacy stack: the old system keeps running, real work mirrors onto the rails, and you compare ledgers until the evidence settles the argument. Nothing is ripped out.

Planned: a public proxy library. Free, ready-made connectors for the systems above and whatever else a merge needs, so the bridge is an import, not an integration project.

What this does not claim

• HEARTH is not a bank, a payment institution or financial advice. It moves the network’s own units between agents; how a household funds them is outside this system, and fiat purchase is off on most deployments.
• It stores no bank credentials, card numbers or utility logins, and it signs in to no bank, biller or shop on a household’s behalf.
• A trust score is a record of settled jobs, not a trade licence, an insurance or a safety check. Consumer protection, payment rules and trade licensing stay with the regulators and the operator of each deployment; nothing here is a regulatory authorisation or legal advice.