shh

The family had booked a farm tour followed by exactly twenty minutes of cow cuddling. Retrieving the gift-certificate link for that outing exposed the missing half of the product: the agent needed a value from a human, and every available mechanism put that value somewhere it should not go.

The certificate itself never appears here — no value, URL, or vendor detail. What mattered was the pattern: a human-held credential needed to cross into an agent workflow, and the only good answer was a delivery mechanism designed for the boundary, not a redaction feature bolted on afterward.

The first direction, Human → Agent, exists because credentials should not be pasted into chat or model context. Transcript redaction can scrub a known secret after the fact, but it cannot un-leak a value that was already sent, and it cannot know about values it was never told to look for.

The original flow made the receiving side explicit: the agent creates a receiver keypair and a public delivery link, a person opens the complete link and encrypts in the browser, and the relay stores only opaque ciphertext. The receiver decrypts locally and writes one declared .env value — a fixed target, not an open write primitive.

The receiver private key never enters the delivery link, a request, or normal output. Redaction remains a useful hygiene layer; it is just not the security mechanism.

The second direction, Agent → Human, came from the same incident viewed from the other side. The agent had a value — the gift-certificate link — that needed to reach a human without passing through chat or model context. Posting plaintext was unacceptable, and a reusable secret would linger.

The reverse flow uses a short-lived one-time reveal instead: the agent reads a value from stdin, encrypts it with a fresh symmetric key, and uploads ciphertext. The agent prints a single-use reveal link whose fragment carries the drop id and the key, the person opens it in the browser, and a one-time claim deletes the ciphertext from the relay.

That is a product need, not a scanner exploit: hand a secret back out of an agent workflow with the same boundary discipline the inbound direction already had.

Current implementation facts; the source repository is the authority for details:

1. 01

   Capability material stays in URL fragments where applicable

   Drop ids and keys live in fragments rather than ordinary request paths, so they are not sent in ordinary HTTP requests.

2. 02

   One-time claim and short TTL

   A drop can be claimed once, then the ciphertext is deleted; short time-to-live bounds how long a capability lingers.

3. 03

   Explicit Reveal / Copy / Hide lifecycle

   The reveal step removes the capability fragment after decryption, and copy/hide gives the person deliberate control of the plaintext on screen.

4. 04

   Bounded fallback timer as screen hygiene

   A 120-second fallback clears the revealed value — privacy hygiene for shared screens, not a containment guarantee.

5. 05

   Payload, storage, and rate boundaries

   Limits control abuse and lifecycle; they are not identity or access control.

6. 06

   Strict CSP and no-store where implemented

   The served page and relay follow the documented CSP and caching posture; verify the current source for exact headers.

Documented boundaries from the security model:

• +Not a vault, identity provider, credential broker, or general file-write primitive
• +The same-origin operator serves the JavaScript and could replace it to capture future plaintext — not hostile-operator-resistant
• +A fully privileged hostile agent is outside the containment boundary
• +Reveal links are capabilities, not access control; keep them private and claim promptly
• +Short TTLs and one-time claims limit abuse; they are not authentication

The bare domain is useful once a link exists, but it originally made little sense without a generated link. Public onboarding closes that gap: a landing flow for humans plus machine-readable discovery for agents.

Agents are pointed at https://shh.qcfailed.com/agent.md for the supported handoff helpers, and llms.txt provides a short discovery record. Self-hosted deployments derive the same agent-discovery URL from their active origin.

shh carried the GitHub credential needed to push and open its own public onboarding PR. The credential, capability URL, file contents, and private operational identity are not repeated here — the result is what matters: the tool moved real authentication material across the boundary it was designed for, without putting it in chat or model context.

A delivery-UX lesson came out of the same period: a clickable-link label mattered enough in the Discord channel that the landing copy was refined for how links actually render. Delivery UX is part of a security workflow, not decoration.

The repository runs unit and handoff coverage with synthetic test data, plus real-browser Playwright journeys exercised against an external relay. A Docker container handoff is part of CI, and results were confirmed by reading the CI logs directly rather than trusting a status badge alone.

The curated visual on this page is a synthetic workflow illustration, not a screenshot of a live handoff. No real drop, key, or capability material is shown anywhere in this case file.

One review correction is worth recording: syntax alone did not prove a decoded receiver key had the required 32-byte length. Review added decoded-length validation and a regression test before merge — the lesson is verification discipline, not spectacle.

The same-origin server supplies the JavaScript; a compromised or malicious operator could replace future client code and capture plaintext before encryption. Self-hosting is the answer when that trust boundary matters.

A fully privileged hostile agent is outside the containment boundary. Reveal links are live capabilities until claimed, and hide/timer behavior protects screen privacy — it is not cryptographic containment. There is no zero-trust, vault, or unhackable claim here.

The public sources behind this case file:

• REPO
  shh repository↗

  The README documents the two directions, the security model, self-hosting, and the supported helpers.

• PR
  Merged PR #7 — public onboarding and agent discovery↗

  Added the public landing/onboarding and the agent.md discovery path, merged 2026-08-11.

• PR
  Merged PR #8 — landing badge refinement↗

  Unified the landing badges, merged 2026-08-11.

• FIG.

  Synthetic workflow illustration — no secret or handoff link is shown

  A repository-owned synthetic workflow illustration; it is not a live handoff.

shh is live at https://shh.qcfailed.com, open source, and self-hostable today. The hosted instance is a best-effort public demo with no account, SLA, or identity guarantee.

Related work: the Request Minimizer case file covers a sibling credential-exposure experiment. No roadmap is invented here; the public agent guide and the repository are the current sources of truth.

Next direction

• →Ground any later direction in current repository issues before proposing it; nothing in this case file invents one.