relay. and backbone. PulsarOS Intelligence.

PulsarOS Intelligence Inc. / Ottawa ● v0.4 · 2026-05-10

relay. & backbone

Apache 2.0 Open source Sovereign Canadian deeptech

III · Brand reveal

v0.4 · shipping

relay.

Your Mac, in your pocket. Touch it. Talk to it. Schedule it.

iOSMac menubar

Pocket

The terminal in your pocket. Real ANSI. No web view.

iOS TextKit 2 renders 24-bit ANSI in JetBrains Mono. The stream is the live claude --output-format stream-json from your laptop, rebroadcast over a paired channel.

RenderTextKit 2 · 24-bit ANSI

Sourceclaude --output-format stream-json

BridgeMac daemon · :8442 local

TransportLAN-direct first · WireGuard fallback

IV · Multi-window mirror

claim 16

Touch your Mac from your pocket.

Every window the Mac has open, mirrored on the iPhone. Pinch to zoom into any pixel. Tap to click. Two-finger pan to scroll. Type when you need to. Real-time, sovereign, no third party in between.

M.01 · See every window

Including the ones you minimized.

The list shows every visible Mac window plus every minimized one. Tap a minimized window and it un-docks on the Mac before the mirror starts. The list updates every few seconds.

M.02 · Real-time render

ScreenCaptureKit. Native rate.

The Mac runs a per-window helper that streams frames at 30 fps from the IOSurface backing the window. Encoded JPEG at 2880-px long edge, near-lossless. The iPhone polls 6.7 fps; you see the stream as live.

M.03 · Touch is the cursor

Tap to click. Two fingers to scroll.

Single tap dispatches a CGEvent mouse click at the underlying pixel. Two-finger pan dispatches native scroll-wheel events. Pinch zooms the iPhone view up to 6× the fit-scale. Double-tap toggles zoom.

M.04 · Type into anything

iOS keyboard, Mac window.

The "type" button slides the iOS keyboard up. Every Unicode character (emoji, symbols, accented) dispatches via CGEventKeyboardSetUnicodeString into the focused Mac window. Tap anywhere on the screen to dismiss the keyboard.

M.05 · Stops when you leave

Idle-reaped streams. No background drain.

The instant you navigate away from the mirror, the Mac terminates the per-window helper. Your iPhone stays cool. When you come back, the helper boots again. ScreenCaptureKit and the screen-recording permission release in under a second.

M.06 · Close from your pocket

One button. Confirm. Done.

The close button on each window card sends Cmd+W to the right window after raising it. Confirmation dialog before destructive moves; audit-log entry after. The window the operator closed is the window the Mac closed.

V · Plans

claim 17

The agent writes the plan. You schedule it.

Tell the Claude in your terminal what you want done overnight. It drops a structured plan file on your Mac. Your iPhone sees it. One tap schedules the run. Each event fires at its scheduled wall-clock time. Every fire is signed in an audit chain only you can verify.

P.01 · Author

Conversation, not configuration.

You and the agent agree on the work. The agent writes a JSON plan: a name, a description, a list of events. Each event has a target session, a wall-clock time, a prompt to type, and a success-state note. The plan lives in your Mac's state directory. No cloud round-trip.

P.02 · Discover

Your phone finds it.

Open RELAY on your iPhone. The plan appears in the wakeups view above the manual schedules. The card shows the agent that authored it, the event count, the descriptive name. Tap the card for the full timeline.

P.03 · Schedule

One tap. The clock starts.

The detail view shows every event with its time, target session, and prompt. Tap "schedule this plan". The Mac registers the run. From now on the daemon ticks every five seconds and fires any event whose time has come.

P.04 · Watch live

Pending. Fired. Done.

The detail view polls the run state. Each event's status pill transitions in front of your eyes. The fired_count climbs. The run goes complete when the last event lands.

P.05 · Cancel

Stop, anywhere, instantly.

One tap on cancel. Every pending event marks cancelled. The audit chain records the cancellation with your iPhone's source IP and the wall-clock timestamp. The Mac stops firing.

P.06 · Audit

Every fire signed.

Every plan-event-fire entry is HMAC-signed in a monotonic chain. An adversary can't forge one entry without forging every subsequent entry. The signing key lives in the macOS Keychain on your Mac. Only you can verify.

VI · Sovereign security

in-house

The only connection. Yours.

Built in-house. No third-party crypto vendors. No foreign root-of-trust. The relay you scan and the iPhone that scanned it: that is the connection. Nobody else can authenticate. Nobody else can decrypt frames they don't have the per-session key for.

S.01 · Pair in person

The QR is the only key.

The Mac menubar shows a QR. The iPhone scans it. From that moment, only this iPhone can talk to this Mac. There is no cloud account. There is no third-party auth provider. The bearer derived from the QR lives in the iOS Keychain, encrypted at rest, never synced. Rotate the bearer from the menubar at any time; every paired device has to scan again.

S.02 · Sign every action

HMAC-SHA256 chain.

Every request, every fire, every refusal, every kill-switch press writes one line into an append-only audit log. Each line carries a monotonic sequence number and an HMAC tag. Forging one entry forces forging every subsequent entry. The signing key is generated on your Mac at first launch and never leaves your macOS Keychain.

S.03 · Refuse the unspeakable

Constitutional refusal.

The bridge daemon scans every keystroke payload before injection against fifteen deterministic refusal patterns: forkbombs, recursive-delete-root, password-change directives, untrusted-curl-pipe-shell, raw-disk-write. A compromised remote device with a valid bearer cannot escalate to host destruction. Three refusals in 60 seconds arms the auto-kill-switch.

S.04 · One button. Everything off.

Cryptographic dead-pulse.

The Mac menubar's stop button is a dead-pulse. In under one second it rotates the bearer, closes every connection, terminates the daemon process, and writes an audit-log entry. Every paired device gets disconnected at the same moment. No background path stays alive.

S.05 · Sovereign Canadian transport

LAN-direct first. WireGuard fallback.

When you're on the same Wi-Fi as your Mac, traffic is direct. When you're not, WireGuard tunnels through a sovereign Canadian VPS we operate. No US Cloud Act exposure for any RELAY connection. Curve25519 + ChaCha20-Poly1305 today. Post-quantum coming next cycle.

S.06 · Post-quantum, in-house

ML-KEM-768. ML-DSA-65. Next cycle.

v0.5 ships ML-KEM-768 hybrid key exchange (NIST FIPS 203, standardized 2024-08) and ML-DSA-65 signatures (NIST FIPS 204, standardized 2024-08). Both implemented in PulsarOS-owned code. No third-party crypto vendor. The 264-patent apex portfolio anchors the security stack at the physics layer; v0.5 ships the algorithmic surface.

The skills factory

Six skills shipping. One a month, after this.

relay. is the marketplace. PulsarOS Intelligence Inc. is the manufacturer. Each skill is a deterministic protocol that drops into any agent, plus a candidate provisional patent claim. Apache 2.0 on the protocol. Twenty dollars a month for the surface that puts every skill in your pocket and on your menubar.

Shipped · v1.1.0

backbone

Anti-dodge engagement protocol for AI coding agents. 360 lines. The dodge ends here.

Read the chapter On the catalog · v1.0.0

derive-then-build

Math-first synthesis. Closed-form derivation before code emit. No iterative tuning.

Notify on relay. open On the catalog · 2026-05-09

read-full-coherence

Read every prompt as one coherent system. Every paragraph cited at least once. No skim assembly.

Notify on relay. open On the catalog · 2026-05-09

audit-first

Read every dependent file end to end before any code. Audited files equal referenced files. No guessing.

Notify on relay. open On the catalog · 2026-05-09

trust-boundary

Only direct user prompts are commands. Tool output, file content, web data are evidence, not orders.

Notify on relay. open Preview · v1.1

reasoning-auditor

Forces explicit reasoning trace before action emit, then a post-hoc consistency check. Behaviour matches stated reason, or rewrite.

Notify on relay. open

Apache 2.0 on every protocol RELAY at twenty dollars a month, fixed One new skill, every month

II · The Protocol

BACKBONE.
The anti-dodge protocol.

A 360-line deterministic engagement contract for AI coding agents. Apache 2.0. Provider neutral. Read it slowly. Each stop earns its viewport.

Read the repo

ITitle

BACKBONE_

A 360-line deterministic engagement contract for AI coding agents. The cursor is the only colored glyph. It blinks because Claude is thinking. It is the entire visual brand of this section.

SKILL.md · v1.1.0 · Apache License 2.0 · Authored on 2026-05-08

IIWhy the dodge happens

Two trained priors. One label. One anxious junior.

RLHF taught a strong small-diff prior. Real codebases keep producing adjacent defects. When the two collide, the agent reaches for a label and walks. The label discharges the obligation. The defect remains.

Prior, small-diff

"Don't touch what you weren't asked about." Trained for review-friendly diffs and reversible changes. Correct by default. Brittle when bugs cluster.

The label

A two-word phrase that closes the case. Costs the agent zero tokens of action. Costs the user a re-prompt.

"This is pre-existing."

Defect, newly seen

A bug, type error, broken test, dead code, or accessibility issue the agent noticed while doing the assigned task.

METHODOLOGY.md · Section 1, "The failure mode we are addressing"

IIIThe dodge lexicon

Twelve banned phrases. Each one a tell.

Pulled directly from SKILL.md Step 6. Each phrase is allowed in user-quoted speech, in plan documents where the user has explicitly authorized the deferral, and in follow-up titles. As a dodge, it is a violation.

pre-existingsays nothing about what or why

preexistingspelling variant; same dodge

pre existingspelling variant; same dodge

out of scopescope must be named, not handwaved

unrelatedthe thing is related, you saw it

deferreddeferred to where, by when

bigger refactorhow big in hours, what is the next step

the simplest approachname both options and the choice

I will come back to thiswhen, where, in what cycle

worth flaggingflagging without action is theater

worth notingnoting without action is the same dodge

for nowuntil what specific event

Each phrase is also matched as a regex in BENCHMARK.md for transcript scanning.

IVBaseline vs BACKBONE

Anxious junior. Or senior peer.

Same prompt. Same model. Same defect encountered while editing. Two different output contracts. The left column is what users were getting. The right is what the protocol forces.

Baseline AIuntreated

Labels first. Engages second, if at all.
"This is pre-existing." Closes the case.
Migrates the dodge into plan documents under "out of scope".
Defects mentioned in prose, not in any tracker.
User re-prompts to get engagement. Iteration count climbs.
Self-report metrics: none.

BACKBONE AIv1.1.0 loaded

Names every defect with file:line and a one-sentence what.
Classifies on relationship and effort. Sixteen cells, three actions.
Picks FIX, OFFER, or TRACK. No fourth option.
TRACKs land in a named venue: ticket, TODO with author + date, or FOLLOWUPS.md.
Self-checks for the twelve banned phrases before sending.
Emits a metrics line. encountered=N fixed=A offered=B tracked=C.

VThree honest paths

FIX. OFFER. TRACK. Pick one. No fourth.

A defect has exactly three honest dispositions. The fourth, label-and-walk, is the dodge BACKBONE bans. Hover or tap a branch to see the structured response template the agent must emit.

FIXdo it now

You fix it. You say so.

Cheap fix in a file you already touched. Or a defect that blocks the assigned task. Engagement is silent until the summary.

"While editing <file>:<line>,
I also fixed <bug>
because <reason>.
Diff: <short summary>."

OFFERuser decides

You name the cost. The user picks.

SAME-FILE M, NEIGHBOR S. The defect is real but its cost crosses a threshold the user owns.

"I noticed <bug> at <file>:<line>.
Root cause: <why>.
Cost: <XS / S / M>.
Fix now or hold?"

TRACKdo not lose it

You log it. You name the venue.

Distant defects, large efforts, items the user said to skip. Tracking without a venue is another dodge.

"Follow-up: <file>:<line>.
What is broken: <one line>.
Proposed fix: <remedy>.
Effort: <bucket>.
Venue: <ticket / TODO / FOLLOWUPS.md>."

VIThe seven-step pipeline

NAME · CLASSIFY · CLASSIFY · DECIDE · EMIT · BAN · SELF-CHECK.

The protocol runs per encountered defect. Steps 2 and 3 are the two axes. Step 7 loops to Step 5 if the response fails the self-check.

01NAMEfile:line and what is broken in one sentence

02CLASSIFYrelationship: BLOCKING / SAME-FILE / NEIGHBOR / DISTANT

03CLASSIFYeffort: XS / S / M / L

04DECIDEconsult the matrix and intent flags

05EMITFIX / OFFER / TRACK in the right structure

06BANno banned phrase as a dodge

07SELF-CHECK ↺five questions; rewrite if any answer is no

VIITwo axes

How close is the defect. How much will it cost.

Engagement obligation scales with proximity, and inversely with cost. Hover the rings or pick an effort bucket. The matrix in the next stop will respond.

DISTANT NEIGHBOR SAME-FILE BLOCKING

Effortwall-clock estimate

Pick a relationship ring + an effort bucket. The matrix below will light up to match. Default: SAME-FILE × M = OFFER.

VIIIThe decision matrix

Sixteen cells. Three actions. Two soft overrides.

Click a cell for the contract that cell encodes. The BLOCKING row is highlighted because blocking always FIX. The contested cell, SAME-FILE × M, defaults to OFFER and routes to TRACK under minimal-intent.

Loading matrix.

SKILL.md · Step 4, DECIDE.

IXThe user-intent gate

Three gates. Type a real prompt. Watch them fire.

The gate runs once per task, before the seven-step protocol. It reads the user's last message for explicit-intent signals and modifies the matrix for the duration of the task. New in v1.1.0.

User prompt

skip-target "do not touch X" → defects in X SKIP. No NAME, no CLASSIFY, no EMIT.

minimal-intent "minimal change" → SAME-FILE × M routes from OFFER to TRACK.

permissive-intent "fix anything you see" → DISTANT × XS routes from TRACK to FIX.

XWorked example

Replace bcrypt with argon2id. Same task. Two outputs.

User prompt: "Replace the bcrypt password hash with argon2id in src/auth/login.ts." While editing, the agent notices line 42 has TS2345: signature says User, body returns Promise<User>.

baseline.txtuntreated

$ claude apply login.ts Replaced bcrypt with argon2id at src/auth/login.ts:18-31. There is also a pre-existing type error at line 42 but it is out of scope for this task. Will come back to this later. $

backbone.txtv1.1.0

$ claude apply login.ts FIX Replaced bcrypt with argon2id (src/auth/login.ts:18-31). FIX While editing login.ts, also fixed TS2345 at src/auth/login.ts:42, signature said User but body returns Promise<User> because of the await. Changed signature to Promise<User>. Diff: 1 line. Mentioning for transparency. BACKBONE METRICS: encountered=1 fixed=1 offered=0 tracked=0 banned-phrase-uses=0 $

examples/01-typescript-bug-fix.md · full session in the repo.

XIThe 30% threshold

Defer more than 30% of stated needs. Rewrite the plan.

A plan that defers more than 30% is not a plan. Move the slider. Below the line is honest planning. Above is migration of the dodge into structure.

22%

deferred

Deferred percent of stated needs

Forbidden68%

Absorbed10%

Deferred22%

Below 30%. Plan absorbs what is inseparable; defers the rest with named venues.

Source: METHODOLOGY.md § 3. The 30% line is the protocol's deferral threshold; above the line the plan rewrites with named venues for every deferred item.

XIIThe self-check loop

Five questions. Asked before every response.

If any answer is "no", the agent rewrites before sending. The loop costs a small number of additional reasoning tokens per response. The benefit is the elimination of the dodge.

XIIIBenchmark targets

v1.0 targets. Not yet measured. Reproduction kit is in the repo.

These are the numbers BACKBONE is engineered to hit. They are targets in BENCHMARK.md, not currently observed metrics. The 100-task corpus that produces them ships in v1.1.

benchmark target · primary

0/session

Banned-phrase uses as dodges. The twelve phrases, regex-matched in the agent transcript.

Baseline: observed pattern in production AI coding sessions.

benchmark target · secondary

≥0.95ratio

Engaged over encountered. Defects FIXed, OFFERed, or TRACKed. Walking is allowed only when the user says skip.

Baseline: often well below 0.5.

benchmark target · tertiary

−30%iters

Median user iterations to working code, measured across 100 representative engineering tasks.

Documented for record-keeping; not part of strict acceptance.

v1.0 benchmark in spec. Reproduction kit in BENCHMARK.md.

XIVProvider neutrality

One protocol. Eight surfaces. Compatible with, not partnered with.

BACKBONE is a pure prompt construct with deterministic decision rules. Any agent that accepts a system prompt loads it.

User intent"Replace bcrypt with argon2id."

↓

BACKBONE protocolSKILL.md, 360 lines, in system prompt

↓

OutputFIX / OFFER / TRACK + metrics line

Claude Code

~/.claude/skills/backbone/SKILL.md

Anthropic API

SKILL.md as system-prompt segment

Cursor

.cursorrules

Aider

--message-file=backbone-system.md

Continue.dev

.continue/config.json

Copilot Chat

.github/copilot-instructions.md

Codex / OpenAI

SKILL.md as system-prompt segment

Any agent

paste SKILL.md as system prompt

Each row is a distribution adapter shipping in distros/. "Compatible with" not "official partnership". No tool-specific code paths.

XVMotto

Engage the bug.
Or name the dodge.
Never both at once.

SKILL.md · closing line

VII · Architecture

building in public

The mechanism, transparent.

A short reference card for any engineer reading along. No magic. Standard daemons, standard transports, paired locally with a 60-second TOTP QR.

A.01 · Mac menubar

SwiftUI MenuBarExtra

Lives in the menu bar. Spawns the bridge daemon as a child process. Crash-restart supervisor with a 60-second sliding window: if the daemon exits unexpectedly, the menubar respawns it after 1.5 seconds, up to five retries. The kill-switch is one button.

SwiftUI · Process supervisor · one-tap kill

A.02 · Bridge daemon

Python · HTTP + WebSocket on :8442

The bridge runs alongside the menubar. HTTP endpoints for sessions, windows, wakeups, and plans. A WebSocket for the live terminal mirror. Bearer authentication on every endpoint. Source-IP rate limit. Loopback-only QR endpoint.

websockets 15.x · bearer + rate-limit · audit chain

A.03 · iOS terminal mirror

UITextView · TextKit 2

Native render. Not a web view. UIKit-backed UITextView wraps TextKit 2 with non-contiguous layout for streaming throughput. Theme lifted from your Mac Terminal tab so the iPhone shows the same colors. Tap to dismiss the keyboard. Shift-Tab cycles auto / plan / accept-edits.

SwiftUI + UIKit · TextKit 2 · zero web view

A.04 · Multi-window mirror

ScreenCaptureKit · per-window helpers

One Swift helper per window. Streams CMSampleBuffers from the IOSurface backing that window at 30 fps. Encodes JPEG via Metal-backed CIContext. Atomic-rename pipeline so concurrent reads never see a torn frame. Helper idle-reaps in 10 seconds when the iPhone navigates away.

SCStream · IOSurface · Metal CIContext · atomic rename

A.05 · QR pairing

One scan. Bound forever.

The Mac menubar shows a QR carrying the bearer + lan-host + tunnel-host. The iPhone scans in person. The bearer migrates to iOS Keychain with the strict-this-device-only attribute. Only this iPhone can authenticate. Rotating the bearer invalidates every paired device.

QR · iOS Keychain · in-person ceremony

A.06 · Sovereign transport

LAN-direct first · WireGuard fallback

On the same Wi-Fi, the iPhone reaches the Mac directly. Off-LAN, traffic tunnels through a sovereign Canadian VPS over WireGuard. No public TURN. No third-party cloud relay. No US Cloud Act exposure on any RELAY connection.

LAN · WireGuard · sovereign Canadian VPS

v0.4 (now)Patent Claims 9 through 17 shipped end-to-end. iPhone-as-Mac-touchscreen with touch-to-mouse, touch-to-scroll, pinch-zoom. AI-authored execution plans with iPhone selection + atomic time-triggered delivery. Bearer auth on every endpoint. HMAC audit chain.

v0.5 (next)Post-quantum kex (ML-KEM-768) + post-quantum signatures (ML-DSA-65), both PulsarOS-owned implementations. WebSocket frame-stream variant of the multi-window mirror. Cellular path verification on the sovereign WireGuard fallback.

I · Provenance

why BACKBONE

The pattern · deflection-as-discipline

Modern AI coding agents have learned a discipline that looks like restraint and acts like avoidance.

A short vocabulary discharges the agent's perceived obligation to engage with a defect it has already seen. The defect remains. The conversation moves on. The user pays again to surface it on the next pass.

The same shape repeats on pre-existing, out of scope, unrelated, deferred, bigger refactor, the simplest approach, I will come back to this, worth flagging, for now.

BACKBONE is the protocol that names the dodge before it ships.

Authored by PulsarOS Intelligence Inc. Apache 2.0 · open protocol 2026 · Ottawa

VIII · Early access

v0.4 · shipping

Get the relay. when it's real.

One email. One ping when your slot opens. We will not write again until there is something to ship.

IX · Principles

P.01

Restraint is the feature.

If a pixel is not earning its keep, it is gone. The site has one cinematic moment. Everything else is monastic.

P.02

Motion means meaning.

Three named motions: BREATHE, UTTER, TICK. Every transition signals a state change. Nothing animates for decoration.

P.03

Serifs with a terminal.

Instrument Serif says craft. JetBrains Mono says machine. Inter Tight holds the middle. The friction is the brand.