PCHP · PERSONAL CONSENT HANDSHAKE PROTOCOL
Consent is an
execution boundary.
A protocol is meaningful when the code refuses an unsafe action—not when a page merely describes one.
The familiar four-part story—identity, consent, scoped exchange, receipt—is a compression of this six-phase protocol, not a different protocol.
ENFORCED IN CODE
Subject-bound grant
HMAC-SHA256 signed; verified Firebase UID; TTL capped at 24 hours.
Scope registry
Generated vocabulary; unknown scopes resolve most restrictively for preference writes.
Action boundary
Action-capable MCP tools are blocked without a consent token in the active context.
Receipt trail
Grant and connector access receipts are HMAC-signed and hash-chained.
DO NOT CONFUSE WITH SHIPPED
- Registry validation at token mint is still an open seam.
- Preference-document reads and writes are not yet receipted server-side.
- The public discovery document and hosted PCHP MCP service are not implemented.
- Site-banner choices remain device-local; clearing site data clears them.
“Published is not the same as enforced.”
Can an agent proceed without the exact person, purpose, scope, validity, and current consent status? If yes, the protocol has not done its job.