Nodescan revisited

Around 20 years ago, shortly after I joined Nestle Japan, I stopped working on a side project named Nodescan that had consumed 10 years and hundreds of my waking hours.

I started writing Nodescan - using Java 1.1 - in about 1998. That tells many things but not all are as obvious as they seem. You could call it a waste of time but in retrospect - while I shouldn’t have been so obsessed with it, it formed the backbone of my skills as a programmer and it taught me many aspects of software design and architecture that I used much later - and I still use today. It was a 'full stack' system with a front-end app and a server that ran services as plugins.

Nodescan is a platform for private communication, file sharing, messaging and more. Nodescan Server is reliable and easy to use in an office or at home. You can set up accounts for business contacts, friends or family members.

Nodescan Client and Server applications ran on Mac OS X, Windows and Linux! Chat, instant messaging, file sharing, search, music streaming. It worked. I ran Nodescan Server on a dedicated Fiber Optic connection at my home for more than 5 years. People could have used it. Almost nobody did.

I stopped because of the career change that left me exhausted in the evenings, and virtually no user uptake. You build a thing, nobody comes and the evenings eventually get taken oven by something else. (I watched over 300 movies in one year, renting 4-5 at a time from Tstutaya!)

What I had forgotten until yesterday was the second half of it. Nodescan V2 had an architecture underneath I called Hypernode. Hypernode never shipped. The idea was an operating system for the internet — searches, messages and events propagated in real time across nodes, rather than answered by one central index. Nodescan itself was meant to run about ninety percent without an OS: a platform, with an interface sitting on top.

It was overly ambitious, only partially implemented and I would not write it the same way now.

But there was one small thing in there that I think was right.

Hypernode's message header separated three fields that are usually combined into one: the author of a message, its owner, and the sender. In 2016 I could not have told you why that mattered. Nothing in the system really depended on it.

It matters now because it is a delegation envelope that AI agents can use. If A asks B to do something on behalf of C, you need all three, or afterwards you cannot say who was responsible. It doesn't really matter if the sender is a person clicking a button. It does when the sender is an agent acting for someone else.

So yesterday I rebuilt that header on standards that didn't exist when I first wrote it —
RFC 8693
for the chain of actors, RFC 9396 for what exactly an agent is permitted to do, RFC 9449 to bind a permission to a key so that a stolen copy is not accepted. Two of the fields were used more or less unchanged: how many replies a request will accept, and how far it is allowed to travel.

The constraint that changed is not only a technical one. Peer-to-peer query systems like Gnutella suffered due to free-riding. Running a node cost something, answering other people's questions cost more, and the rational move was to take without giving. That problem has quietly dissolved. Now every person or organisation brings their own compute — my agent runs on my subscription, yours on yours — so answering costs nothing extra, because you were already paying for the thing that answers.

The useful piece is much smaller than any of the above. Using the updated version of this — I am now calling it Agent-mandate — your website can now publish a short signed statement of facts about itself — opening hours, address, prices, whatever it actually controls — at a fixed address on its own domain. An AI assistant that checks gets the answer from the source, instead of from a scraping your site which could give it inaccurate information.

There is a free tool for anyone who wants to do the same — and the whole thing is open source.

You can sign your own information with your own key! Meaning there is no registry, no user account, nobody in the middle. That part has not changed since 2016.

I don't think being early counts for anything. Mostly it means being wrong about the timing, but it seems worth noting that of everything in that directory — the client, the server, the streaming, the whole platform — the piece that survived was a handful of fields in a message header that nobody asked for.

Want to try this on your own site? Say it yourself will generate and sign your statement for you — no account, no registry.