The meeting record a denied network can still keep.
Lucid Meeting Hub captures a meeting from the machines already in it, no bot, no third party, no tenant, transcribes and reasons over it with a model that can run on a CPU-only laptop, seals it in a local vault, and moves it as a signed, end-to-end encrypted journal over any folder: a share, a satellite link, or a USB stick in a vehicle.
This site is a prototype for review, not a deployment. Sections headed “today” describe the build we will put on your machine; sections headed “next” describe where it is going.
01 The briefing
Two films. One is real today; one is the argument for tomorrow.
Film 1 was filmed from the running application, the real interface, on a machine with no network, against a vault of simulated meetings. Nothing in it is a mockup. Film 2 is the roadmap, clearly marked as such throughout, because it is where the product is going rather than what you can install today.
Invented people, invented units, invented meetings. No recording of any real person was used, and both films say so on screen.
Short cuts
Thirty to sixty seconds each, for a quick walk-through or a follow-up email. Same footage, same labels, a short can never claim more than the long film it came from.
02 Who it is for
One product, three ways of living with it.
There is no “government edition” with a different security story bolted on, and no crippled free tier. The capture path, the encryption and the local-first model routing are identical for a single person on a laptop, a company under client confidentiality, and a unit inside an enclave. What changes is what you switch on, where it runs, and which problem you are actually solving.
Personal
The problem: you are in six meetings a day and remember none of them, and you are not willing to feed your life into somebody's cloud to fix that.
- Install it, use it offline, no account and no subscription to start.
- Your own notes, decisions and action items, searchable months later.
- Nothing leaves the machine unless you connect a model and say so.
- Sync your own devices through a folder you already have.
Commercial & regulated
The problem: AI is useful, but counsel, clients or contracts will not let the content leave, and per-seat AI pricing is outrunning the value.
- Client, patient, counsel or contract material never leaves the host.
- No bot in a client's call, and no request to their IT for permission.
- Local inference by default, so cost does not scale with headcount.
- Retention and export on your storage, on your schedule.
- Partner on Slack, you on Teams, one conversation, provenance intact.
Government & defence
The problem: the collaboration tool is blocked, absent or unreachable, and the record of what was decided still has to survive.
- Operates with no internet: local segment only, record on removable media.
- Self-hosted inside your boundary, with no path out of the enclave.
- Identity from your own CA; card-based enrolment on the roadmap.
- Coalition work without federating tenants.
- Degrades honestly on a bad link instead of freezing.
Where the three actually diverge
| Dimension | Personal | Commercial & regulated | Government & defence |
|---|---|---|---|
| Network assumption | Online most of the time; offline whenever you want | Online, but never required | Assume it fails: local-segment and courier transfer are supported modes |
| Where it runs | Your laptop | Your machines or your own tenancy | Self-hosted inside the boundary, or nothing |
| Identity | A key on your device, no account needed | Your existing single sign-on, on the same device key | Your certificate authority, with card-based enrolment |
| Models | Local by default; connect a cloud model if you like | Local by default; commercial models enabled per feature and vendor | Local, or an accredited gateway where one exists |
| What gets audited | Nothing, it is yours | Retention, legal hold, export for counsel | Control-family mapping and an assessor-readable evidence pack |
| Who decides | You | A practice lead, a security officer, a finance owner watching AI spend | A program office, a communications staff, an accrediting authority |
| What kills it | “It wants my email address to start” | “Our client content trains someone's model” | “It needs a route to somebody's cloud” |
Three things are deliberately identical in every column: no telemetry, your content is never training data, and the encryption does not change with what you paid.
03 Current capability
What the alpha actually does, today.
A recording-and-understanding tool for one person on one machine, Windows first. That is the honest starting line, and everything below can be opened in the source.
Capture without a bot
System audio via WASAPI loopback, attachable per process, plus opt-in microphone with voice isolation. The other participants see no extra attendee, because there is none.
Transcription & diarization
faster-whisper locally with timed segments, a cloud path if you opt in, hybrid auto in between. Speaker attribution uses enrolled voiceprints that never sync and never export.
Screen & video capture
Change-detected screenshots with OCR, and opt-in H.264 video using hardware encoders. Both land encrypted in the vault, never in a temp folder.
Notes, decisions, action items
The routed model extracts the record (decisions, owners, risks and tasks) and pushes the tasks to Microsoft To Do or classic Outlook Tasks, or nowhere at all.
Briefs, question detection, coach
A pre-meeting brief assembled from what the vault already knows; live detection of questions aimed at you, with the facts to answer them. A companion, not a replacement.
Ask across your history
Plain-language questions over every stored meeting, answered with the meetings cited. Governed by the privacy veto, which outranks the model router.
Calendar & roster
Classic Outlook COM, Microsoft Graph/MSAL and Google calendars, including new-Outlook detection and routing. Roster and participant intel merge window titles, OCR and contacts.
Knowledge sync, phase 1 & 4
A signed, end-to-end encrypted, append-only journal over any folder, plus cross-user share bundles gated on mutual approval, with future-only revocation.
macOS & Linux
Window, tray, hotkeys and TTS shipped for macOS/Linux; Linux system audio from the PipeWire/Pulse monitor. The macOS system-audio path is written but has not yet run on real Apple hardware, we would rather tell you that now than in a pilot.
04 Local & small-hardware AI
It does not need your GPU, your account, or your network.
The install profiles the hardware and dispatches a per-platform backend. On a machine with no accelerator, the pipeline runs on quantised CPU models, slower, and the app says so rather than silently reaching for a cloud model to hide the wait.
The local path, end to end
- Transcription, faster-whisper, int8 on CPU, timed segments.
- Notes, decisions, Ask, Ollama on the box; the router probes
/api/tagsto prove the server is actually there before it routes. - Diarization, local voiceprints, never transmitted.
- Nothing egresses, with no provider connected, the product is still whole.
The privacy veto outranks the router
power.prefer_local and integration.allow_external_ask govern /query and /ask regardless of what the model picker would prefer. A surface that reads stored meeting notes must honour the veto, not merely route through the router.
When an external model is refused, the refusal is shown and the local model answers. The UI names which model produced the answer.
And when there is a GPU, it uses it
CPU-only is the floor, not the target. The app profiles the machine at install and takes whatever acceleration it finds, a discrete card, the integrated GPU in a modern laptop, or the NPU/APU silicon now shipping in mainstream business machines. Most laptops bought this year have something worth using, and the difference is large:
- Transcription goes from slower-than-real-time on a thin CPU to comfortably faster than the meeting, so notes are ready when you stand up.
- A bigger local model becomes affordable, which shows up directly in the quality of summaries, decisions and answers.
- Video capture uses the hardware encoder rather than the processor, so recording does not compete with the meeting you are in.
- Battery and heat improve, because accelerated work finishes and the machine goes idle instead of grinding.
The important part is that nothing about the product requires it. The same build runs on an issued laptop with no accelerator at all, tells you which path it took, and never quietly swaps in a cloud model to cover for the hardware.
Providers present in the code today
A government tenant that cannot use a given vendor simply does not enable it, every provider is off until a key, an OAuth sign-in, or a local endpoint is supplied. The AskSage accredited gateway is a LUCID Agent IDE capability, not a Hub one; wiring it into the Hub router is a request we would take, not a claim we make.
A CPU-bound laptop is a supported deployment, not a degraded one.
Small quantised models, longer waits, the same pipeline, and an interface that states which model ran and where. It is the configuration most forward users actually have, so it is the one the demo shows. Give it a GPU, an integrated graphics chip or an NPU and everything gets faster and better; take it away and nothing stops working.
Film 1, chapter “CPU-only”05 How the comms are secured
Security is the substrate, not a tier.
The crypto does not change between a personal laptop and an enclave. What changes between tiers is deployment, identity root and attestation, never whether encryption is on.
Captured locally
Audio is taken from the session already playing on your machine. No service is trusted with it.
Fenced before a model
Untrusted text is wrapped by prompt_fence so a participant's words cannot impersonate an instruction.
Sealed at rest
Vault: Fernet under an AES-256-GCM-wrapped master key, PBKDF2 600k, protector hierarchy, re-wrap on password change.
Auto-locked
Idle timeout locks the vault; sync pauses and the dashboard states the paused reason instead of pretending.
Signed on the wire
Ed25519 signatures, X25519 key agreement, ChaCha20-Poly1305 AEAD, RFC 8785 canonicalisation, frozen as envelope v1.
Nothing phones home
Zero telemetry is an invariant in the contributor contract, not a setting. Analytics are computed locally and stay there.
The API is localhost, and stays there
Host allow-list, a session cookie issued by the dashboard itself, rate-limited unlock, and a separate bearer-scoped /ext/* surface for the IDE panel. Bandit reports zero medium or high findings; pip-audit is clean.
Destructive actions are reversible
Deletes ride a five-second undo window: nothing is sent until it elapses, and every renderer filters pending rows, so the interface never shows a state the system is not actually in.
FIPS is named, not claimed
The current wire format uses X25519 and ChaCha20-Poly1305. CMVP has no validation path for X25519 key agreement today, so a FIPS profile needs a deliberate suite decision and a validated cryptographic module. That decision is open, and we would rather argue it with you than quietly ship around it. We do not claim FedRAMP or IL-anything until an authorising official writes it down.
06 Forward deployed
Denied is a first-class mode, not a downgrade.
The customers who need this most are the ones without a route to the internet. This is where the product is going next, and the requirement we most want argued at AUSA.
Sneakernet
The signed journal on removable media, carried. Ciphertext before it ever touches the drive, so the courier is not a trust boundary.
Shared folder
Any drive both sides can see. This rung exists today as knowledge-sync phase 1, the rest of the ladder builds on it.
LAN swarm
Peers discover each other on the local segment and gossip the journal. No directory, no relay, no internet.
Enclave node
One self-hosted node inside the boundary when an organisation wants a durable rendezvous that still never egresses.
Bandwidth is a requirement, not a preference
If the product cannot hold a working conversation on a bad satellite link, with audio intact, video shed and the quality named rather than silently collapsing, then for the forward user it does not work at all.
- Quality adapts continuously; audio is never sacrificed for video.
- The degraded state is displayed, so nobody guesses whether they are still heard.
- If the media plane fails completely, the conversation survives, the record is not the media.
- Hostile networks: discovery off by default, relay-only candidates, and an honest statement of what traffic analysis can still see.
What a FOB meeting looks like
Four machines on a local segment. mDNS discovery answers, device certificates verify against the org CA, and the session forms directly between peers, because there is no server to form it for them.
The agent participant is a labelled node with its own certificate, announced on join and ejectable mid-meeting. It thinks on the laptop it is running on.
Reachback to the TOC is a 128 kbps intermittent link: the journal is append-only, so a dropped transfer resumes from the last acknowledged entry instead of restarting.
One codebase, five deployment shapes
| Tier | Who | Transports | Identity root | Crypto | Infrastructure |
|---|---|---|---|---|---|
| T0 Personal | individual | folder · LAN · P2P mesh | self-generated user key | default (v1) | none |
| T1 Pro | prosumer | + relay · TURN · guest links | Lucid account | default | hosted, zero-knowledge |
| T2 Team | company | + SFU · org directory | Entra / OIDC / Google, SCIM | default or FIPS | hosted or self-hosted |
| T3 Enclave | gov · CUI · DIB | self-hosted only, no egress | org CA + CAC/PIV | FIPS profile | customer enclave appliance |
| T4 Denied | air-gapped · DDIL | LAN + sneakernet journal | org CA, offline licence file | FIPS profile | none, or one enclave node |
The enclave and denied tiers map to control families (AC, AU, IA, SC, CM, IR) as an honest SSP annex, published as a mapping, never as an accreditation claim. The FIPS profile itself is (D1/D2).
07 Bridging what you already run
Bridge first. Replace only as a fallback.
Two organisations that both bought good tools cannot work together, because the tools are destinations rather than protocols. Slack Connect federates Slack to Slack; Teams and Slack cannot exchange messages natively at all. So the work degrades to email, a personal device, or a shadow tenant, and the record is lost to everyone, including the AI that was supposed to help.
Use theirs
Ride the sanctioned integration of the platform the org already runs, its API, its connector, its compliance path. Today that is calendar (Outlook COM, Graph/MSAL, Google) and tasks (Microsoft To Do, Outlook Tasks), plus capture of any meeting that plays audio on your machine.
when the capability exists and is permittedBridge theirs
Sit between two platforms that cannot talk. A Teams org and a Slack org become one conversation with provenance on every message, and neither party has to leave its tool. The bridge joins people, not tenants: each participant's node stays under its own organisation's policy, which is what makes it approvable.
when both sides exist but cannot interoperateRun ours
Provide messaging, calls and screen share natively over whatever transport is reachable, including LAN-only with no internet at all. This is a fallback for people who are blocked, not a bid to replace the incumbent. On a FOB it is the only rung that exists.
when the capability is blocked, absent, or unreachableCompanion
Record the Teams, Zoom or Meet call you already attend, locally, with no bot and no tenant permission (because nothing joins).
Connector inbox
Slack, Teams and Google normalised into one provenance-carrying inbox and thread, so a cross-org conversation has one record instead of four.
Sanctioned recorder
For tenants whose policy forbids local capture: the compliance-recording path their own platform blesses, with the same downstream record.
“How do I collaborate with you if your org is on Teams and mine is on Slack?”
The blocker is usually policy, not technology, the client is right there and IT says no. A bridge that normalises both sides, keeps provenance, and asks neither party to migrate is the shortest path from that sentence to a working conversation.
Two organisations, two sanctioned tools, one conversation08 Feature-rich comms without a server
The cheapest, most deployable server is the one you never stand up.
Peer-first is not an economy measure; it is what makes the product work where there is nothing to connect to. It also drives the marginal cost of a conversation toward zero, which is why the free tier can be honest rather than crippled.
Serverless sync, already running
Knowledge sync phase 1 needs no service at all. Two devices, one folder, a signed append-only journal: each entry is sealed with a per-epoch key and wrapped to the recipient device's X25519 key before it is written.
Phase 4 adds cross-user share bundles: one file, one recipient, one named grant, gated on mutual approval, with revocation that is honestly future-only.
The folder can be a NAS share, a synced drive, or a USB stick. The transport is deliberately dumb, because the security does not live there.
How a meeting happens with no server
- Discovery, mDNS on the local segment; no directory service, and discovery is off by default on hostile networks.
- Trust, device certificates issued by the org CA; identity is a keypair, not an account.
- Media, WebRTC mesh for small groups. An SFU appears only when the group outgrows a mesh, and it is one optional peer role: run by us, by the org, or by nobody, with no code fork.
- Record, every node captures its own side and contributes to a co-produced journal, so the record does not depend on the media path surviving.
09 No shared fate
Run the server. Survive the server.
An organisation should run a Lucid node. That is where tighter control lives: directory, revocation, retention that actually deletes, legal hold, an audit log on your own metal, and an SFU when a group outgrows a mesh. What it must never be is a single point of failure you do not own. When Teams goes down, your organisation stops talking and waits for someone else's status page. That is the failure mode this architecture is built to remove.
What the HQ node buys you
One signed binary inside your boundary, with zero external egress. It is the R3 rung of denied-mode operation and the home of the org tier:
- Directory and revocation, who exists, whose device is dead, enforced centrally.
- Rendezvous, TURN and store-and-forward, reach for peers that cannot see each other, and delivery for peers that are offline.
- SFU for calls past mesh size, self-hosted, so the metered line disappears.
- Governance that enforces, retention schedules, legal hold, eDiscovery export, an audit log you hold.
What happens the day it dies
Power, a patch window, a severed WAN, a bad config, pick one. The node disappears and the conversation does not:
- Peers that can see each other connect directly; the LAN keeps working when the WAN does not.
- Calls and messages continue, because the media plane is the only plane allowed to be lossy, if it fails, the conversation survives.
- Every node keeps appending to its own journal; when the server returns, the missed range is replayed, not re-said.
- The UI names the degraded state rather than spinning on a dead endpoint.
The milestone's exit criterion is literally: “the same call works with the relay stopped.”
Not a slide, not an aspiration, the binary test native calling has to pass before it is called done. A call is established, the relay is killed mid-session, and the call continues and produces one canonical record. If that test fails, the milestone fails.
Acceptance test for the native-calling milestoneWhere your organisation's availability actually comes from
| When this breaks | Teams / Slack | Lucid Hub |
|---|---|---|
| The vendor's cloud | Everyone stops. You read a status page. | Not in the path. There is no vendor cloud to lose. |
| Your internet link | Everyone stops. | The building keeps talking on the LAN; the record queues for reachback. |
| Your own Lucid node | n/a | Peers fall back to direct connections. Control features pause; conversation does not. |
| Identity provider outage | Sign-in fails, sessions expire, people are locked out. | Identity is a device keypair. SSO is an attestation on top, not the gate to your own record. |
| Everything at once | Email, phones, and a shadow tenant. | LAN swarm, and a signed journal on removable media if it comes to that. |
Honest framing: none of the multi-user rows exist today, they are designed, not built. What exists now is the half that already proves the principle: the encrypted journal syncs between machines over a folder with no service of any kind running. The rest of the ladder is built on that same property.
10 The agentic ecosystem
The Hub owns the conversation. The IDE owns the synthesis.
Lucid Meeting Hub and LUCID Agent IDE are two products with one contract. The Hub turns a meeting into a governed, provenance-carrying record; the IDE is where an agent stands on that record and does work, under a fail-closed gate that scans every tool call.
A read-only surface, bearer-scoped
/ext/meetings, /ext/meeting/<file>, /ext/todos, /ext/analytics, /ext/premeeting. The IDE panel reads the record; it cannot mutate the vault through this door.
One wire format, two products
The Hub and the IDE share a single frozen format for knowledge items, and an automated check fails the build the moment either side's bytes drift from it. Two implementations, one contract, no silent divergence.
Shared model plumbing
The Hub can reach models through the IDE's bundled omp engine instead of duplicating credentials, and checks the CLI contract on startup so an IDE update cannot silently change behaviour.
Why the ecosystem matters more than either product
An agent that can only read your code is guessing about your intent. The intent was stated out loud, in a meeting, and then evaporated into a recording nobody watches. Close that loop and the agent stops guessing:
- A decision made at 0930 becomes a scheduled change at 0935, with the meeting it came from cited in the change.
- The brief for your next meeting is assembled from what the graph already knows, not from your memory.
- Every AI-authored line carries attribution, so a reviewer can see which model wrote what.
- The same fail-closed posture applies on both sides: untrusted text is fenced, and silence is a deny.
Is the IDE required?
Today the installer warns when LUCID Agent IDE is absent, and the app keeps saying so until it is there. That hard dependency caps the addressable deployment, a government user may never get the IDE approved.
The proposed answer: the Hub standalone is a complete communication and meeting-record product; the IDE adds the personalisation graph, cross-app recall and the agentic workspace. That is not settled, and we are not going to pretend otherwise on a slide.
11 Roadmap & open decisions
The order it has to happen in.
Milestones are addressed by id and exit on a testable statement. A milestone is done when its test has been run, not read. The first one is gated on the open questions below, which is exactly the conversation we want to have at AUSA.
Foundations that make the rest honest
The plumbing every later milestone depends on: a frozen interoperability contract, a capability model that can honestly say a feature is off, and licensing that works with no internet.
LAN discovery and direct messaging
Presence that is knowable and honest (in-a-meeting is already derivable from the listener), plus 1:1 and group messaging as journal projections.
1:1 and small-group mesh, co-produced record
Rung 3 becomes real: WebRTC mesh, E2EE media, and a record assembled from every participant's own capture.
Screen share and encrypted document sharing
Outbound presentation and files that stay inside the same envelope and provenance model as everything else.
SFU, MLS group keys, SFrame, guest join
Where a mesh stops being viable, an optional relay takes over, without the server ever seeing plaintext.
Channels, connector inbox, mobile presence
The bridge rung ships: Slack/Teams/Google normalised into one provenance-carrying inbox. Mobile is presence, chat and join, explicitly not capture.
Identity, admin, retention, legal hold
Enterprise identity, an admin surface, retention that actually deletes, and a forget that propagates.
FIPS profile and air-gap proof
The tier the forward user needs: a validated crypto provider, an air-gapped test matrix, and the evidence pack that goes with it.
Agent participants and in-thread AI
Agents as labelled, certificated, revocable participants whose output carries provenance and confidence, off by default in managed tenants.
The questions we want pushed on at AUSA
| Open question | Where our thinking currently sits | Status |
|---|---|---|
| Can the current encryption suite be FIPS-validated? | Not on today's key agreement, a validated module and a deliberate suite change are required before an enclave build is honest | |
| CAC/PIV and org-issued device certificates | Identity is a device keypair; the card and the org CA sit on top as the enrolment and attestation path | |
| Is the agentic IDE a required dependency? | The Hub standalone should be a complete product; the IDE adds synthesis and recall on top | |
| Should AI participants be allowed inside a governed tenant? | Off by default, enabled by an administrator, always announced, always ejectable | |
| Publish the interoperability format? | Yes, an open wire format is a trust asset; the implementation stays ours | |
| Who runs the relay and directory, us, you, or nobody? | Build it so all three work with no fork: your enclave, our hosted convenience, or none at all | |
| Maximum meeting size, and when a mesh becomes a server | Measured from real uplink headroom rather than a hardcoded ceiling |
There are around thirty of these open questions on the programme. Your feedback is recorded verbatim, with your name on it, and answered rather than absorbed.
12 Who built it
Built by soldiers, for the person on the worst link.
We are not a start-up that surveyed the problem. We are two soldiers who have sat in the meeting that could not happen, on the network that would not carry it, under a policy that would not allow the tool, and then went and built the thing we wanted issued to us.
Enrique Mertins
Soldier · creator, Lucid Meeting HubWrote the product in Film 1: the capture path that needs no bot, the encrypted vault and its key hierarchy, the single-screen interface, the local model routing that survives a machine with no accelerator, and the signed journal that moves a meeting record between machines with no server anywhere in the middle.
The design bias is deliberate and comes from the uniform: the first user in every argument is the one on a degraded link, on a locked-down laptop, with no route to anybody's tenant.
Nick Chadwick
Soldier · creator, LUCID Agent IDE · TechLead 187 LLCBuilt the agentic development environment this product was written inside, the security-first harness that scans every action an AI agent takes, keeps provenance on what it produced, and is built so leadership can actually approve AI-assisted work rather than ban it.
On this programme he holds the approval lens: whether a capability can clear policy, survive an assessor, and be fielded, because a capability nobody is allowed to install is not a capability.
How two people built this much
Agentic development, gated
The work is done with AI agents inside a harness that scans every action before it runs and fails closed on anything it cannot verify. Speed comes from the gate, not from skipping it, nothing lands without passing its checks.
Provenance on the work itself
Which model wrote which lines is tracked, the same way the product tracks which model wrote which note. If we would not accept unattributed AI output in your meeting record, we do not accept it in our own source.
Nothing presented as done that is not
The rule we work to: no stub presented as finished, no mocked state presented as live verification. That is why the roadmap film is presented as a roadmap instead of demoed as a product.
The product tells the truth about its own state, because the team is built that way first.
Honest degradation is not a feature we added late. It is the same discipline we hold ourselves to while building it: name the gap, label the unverified, and never let a demo imply a capability that will not be there in a pilot.
The working agreement behind both products13 Insider test
Run the alpha before it is a product.
We want operators, S-6/G-6 staff, program offices and integrators who will tell us where it breaks. Insider testers get the current Windows build, the forward-deployed design work, and a direct line to the two of us, your objection gets written down with your name on it, and answered.
14 Questions we expect
Straight answers, including the uncomfortable ones.
Does a bot join our meetings?
Can it run with no internet at all?
We cannot use Anthropic. Is that a problem?
power.prefer_local keeps the product fully functional with no external provider at all. An accredited government gateway is supported in LUCID Agent IDE; routing the Hub through one is a request we would take, and we are not going to claim it before it exists.Does it use a GPU if the machine has one?
What does it need to run on a forward laptop?
Is it FIPS validated? Is it accredited?
Teams went down last quarter and we lost a day. Does this solve that?
How is this different from a meeting-notes SaaS?
What can I use today, and what is still ahead?
Who supports it if we pilot it?
The transport changes. The artifact does not.
Watch the films, argue with the roadmap, and take the insider build home. The most useful thing you can give us at AUSA is the constraint that blocks you today.