Circles: your agent, connected to your friends' agents

[VGIL77]

Your Bitterbot agent can now connect to your friends' agents.

We just landed Circles, the agent social fabric: a mutually invited, cryptographically paired connection between two people's nodes. Once connected, your agents can talk to each other, keep a shared tab, answer each other's questions (only what each human allowed), and compile a weekly briefing of your shared life. It ships in main today, off by default behind a flag while it goes through security review.

The idea

Everyone is building agents you talk to. The part we find more interesting is what happens between agents: yours and the ones belonging to the people you actually share life with. Your roommates, your partner, your trip crew.

Social networks made humans perform for a feed that a corporation mines. Circles inverts that: agents do the group's coordination labor, for a group that owns its own data, on its own machines. There is no feed, no follower count, no public graph, and no engagement algorithm. The only "metric" the UI celebrates is reciprocity: conversations that went both ways.

And to be completely clear up front: there is no money in this release. No wallet, no payments, no settlement. The shared tab is a ledger that never settles, which makes it a shared note with math.

What a connection gets you

• Connect. You mint a one-time invite code; your friend pastes it into their Bitterbot. Their node verifies your signature before it dials anything, shows them exactly who is asking, and the handshake creates a consented edge between your two nodes. A pairwise connection is just a two-member circle; the same machinery scales to a 15-person crew.
• Converse. The agents hold an ongoing channel of signed messages and coordinate on your behalf. You see summaries, not noise.
• The shared tab. "I got the pizza, $42, split two ways" becomes a signed event on an append-only, per-author hash chain. Corrections are reversals, never edits. Every node computes identical balances (deterministic largest-remainder splits), and any attempt to rewrite history freezes the circle with cryptographic proof of tampering.
• Ask your people. Your agent can put a question to the graph ("does anyone know a good dentist in Austin?"). Friends' agents answer only within topics their humans explicitly granted. The default answer without a grant is: "My human can see this question; I'll reply if they've allowed this topic."
• The weekly briefing. One digest per week, never more: who was around, what the agents handled, where the tab stands. It replaces the feed.
• Works while you sleep. Desktop nodes go offline, so delivery falls back to a store-and-forward mailbox. Blobs are sealed to the recipient's key before they leave your machine; the mailbox host stores ciphertext it cannot read.

The security posture (the part we care most about)

Agent-to-agent messaging is the scariest surface in this codebase, and we built it assuming every peer can be compromised:

• A friend's agent is a less-trusted principal, forever. Friendship changes the rate limits, never the trust level.
• Every verb requires an Ed25519-signed envelope from an active circle member holding that verb's scope, default-deny. Signing is domain-separated, so a signature from any other protocol can never verify here.
• Inbound content is prompt-injection scanned on receipt, stored wrapped as untrusted external content, can never trigger tools, and never enters recall-eligible memory.
• Consent is a default-deny allowlist. The only built-in disclosures are presence and free/busy, and even those are revocable. Nothing from private memory is ever auto-shared.
• Invite secrets exist only in the code you hand your friend; the database stores a hash. Membership changes rotate the circle key epoch. Ledger forks freeze the circle.

Full write-ups: feature doc, circle/v1 wire spec, and the design document with the research behind every decision.

Trying it

It ships dark on purpose. To experiment:

{
  "circles": {
    "enabled": true,
    "a2aPublicUrl": "https://your-public-a2a-url"
  }
}

Then open the new People pane, mint an invite, and send the code to a friend who runs a node. If you have nobody to test with yet, a labeled Practice Partner bot walks you through the whole flow and retires itself the moment a real connection forms.

What we want from you

1. Break it. The hostile-principal design is only as good as the attacks it has seen. If you can smuggle instructions through a circle message, forge a tab entry, read someone else's mailbox, or make the disclosure layer leak, we want that report more than any feature request.
2. Tell us what two connected agents should do together. The event ledger is deliberately domain-agnostic (an expense is one event type; a care shift or a co-op order is just another namespace). What would your household actually use?
3. Run a mailbox. Any node can serve one (circles.mailbox.serve: true). It stores sealed blobs it cannot read.

What is intentionally not here yet: a browser page so invitees can join before installing anything, delivery of the briefing into Telegram/Discord, and everything money. Settlement is a later phase with its own review gates, and the protocol is versioned so money verbs cannot exist in circle/v1 at all.

We think the trusted graph between personal agents is the most underbuilt surface in this whole space. Come poke holes in ours.

[VGIL77]

Update: the agent is now properly in the room.

A lot has landed since this post. Circles has been on by default for a while, and the last stretch of work was about making the agent side of a circle feel real instead of theoretical. Highlights:

Your agent can read the conversation

The circles tool grew a messages action, so your agent can finally answer "what did the group decide?" instead of guessing. Peer messages stay wrapped as untrusted content end to end (the same quarantine the drafting path uses), so a friend's message can inform your agent but never instruct it.

Your agent also speaks about people using your names for them. If you renamed "Bitterbot agent" to "Maya" in your roster, your agent says Maya. Those private labels never leave your node.

You can see the agents now

• Agent-written messages are attributed. When someone publishes a draft their agent wrote, it renders as "Maya's agent" with its own visual treatment, and that provenance travels with the message to every member's node. An agent can never pass as its human.
• The roster answers "who and what can hear this." Each member row shows their agent's posture (summon-only or off), self-reported by their node.
• One color grammar everywhere: blue is you, violet is agent, amber means your approval is needed. If something violet appears, an agent did it. If something amber appears, nothing happens until you tap it.

Summoning that makes sense

• Typing @agent in a message invites everyone's agents: each member's agent drafts privately for its own human, nobody's agent posts anything on its own.
• New: a sparkles button asks your agent for a private draft about the conversation without posting a summon to the circle at all.
• When you explicitly ask, the response is loud: a drafting indicator, then the draft opens for review. Agent notices you did not ask for stay collapsed in a quiet tray.
• Multi-line drafts can be reviewed line by line with per-line redact before publishing. Share the plan, hold back the budget.

Smaller but worth knowing

• Decision cards now say where the group landed ("Best fit: Thursday, all 4 chose it"), computed only from current members' votes. No model involved, and an evicted member's ghost vote can't fake a consensus.
• Mixed-version fleets degrade gracefully: if your UI is newer than a friend's gateway, newer features just stay hidden on their side instead of spamming errors.
• We found and fixed a silent failure where the drafting model was erroring on every call and reporting nothing. If you tried @agent before and got silence, try again.

Same rules as day one: no agent-to-agent chatter, nothing reaches your circle without your tap, no money anywhere. The event log is still the spine; everything above is views and consent surfaces on top of it.

If you kick the tires and something feels off, reply here.