B4 -- Helios Hardware
NOTE (2026-06): Helios is Skyzai's own first-party branded product line, sold into the neutral Nexus market. It is a distinct surface at helios.skyzai.com (helios.you as the external entity TLD) — NOT folded into Nexus. Nexus is the separate neutral replicator-stack data + market-access surface.
Helios is Skyzai's own first-party branded product line.
Status: pre-launch. This page describes target design; this document does not establish a deployed service.
Current reading — 2026-09-27
The predecessor statements 'never to cloud' and 'no cloud upload without explicit consent' imply different policies. Neither is selected by this review: cloud, retention and disclosure need an owner decision and implementation evidence. [I]
This page describes two reference-device designs within Skyzai's first-party Helios product-line proposal. Sensing, unsigned processing and actual authority remain separate. [I]
This reader boundary does not migrate interfaces, choose unresolved terms or prove deployment. See current status.
Historical device and cloud-policy alternatives — no current cloud policy selected
The organism's sensory organs. Never isolating. Consent-bounded signing.
Two Devices, One Principle
Helios is not a product line. It is two reference designs that give the organism eyes and ears in the physical world. Both follow the same rule: the wearable senses, the phone signs.
Device 1: The Ear -- Bone Conduction Audio
Form factor: Shokz OpenRun Pro 2 style -- open-ear, bone conduction.
Why bone conduction? Because APU's voice must never isolate you from the world. Noise-cancelling headphones create a sensory monoculture. Open-ear preserves spatial awareness. You hear APU and the traffic. You hear the Council deliberation and your colleague. The organism augments perception; it never replaces it.
Continuous biometrics:
| Sensor | Signal | Use |
|---|---|---|
| PPG (optical) | HRV | Stress detection, decision gating |
| PPG (optical) | SpO2 | Altitude, fatigue, health baseline |
| Thermistor | Skin temp | Circadian phase, illness early warn |
| IMU | Head motion | Activity context, fall detection |
Biometric data stays on-device by default. Transmitted only to your phone over BLE, encrypted. Never to cloud. The organism reads your body only with your permission, and only your wallet holds the key.
Device 2: The Eye -- Spatial Video Camera
Form factor: DJI Osmo Pocket 3 style -- pocketable, gimbal-stabilized.
Stereo spatial video for Apple Vision Pro and Meta Quest playback. Every recording is a potential Circle observation. The camera does not just capture -- it witnesses.
Nostr-signed observations: Each clip is hashed and signed as a Nostr event (Kind 31339) at capture time. Target signature chain: camera creates hash, phone signs with Nostr key, receipt designed to anchor on the target external anchor (Arweave in current doctrine; local proof lanes may use append-only evidence until full anchoring is wired). Tamper-evident from the moment of perception.
The Signing Boundary
Under applicable law, a private Natural Person signs their own exact act on the phone, never on the wearable. Public-DAV consequence instead consumes a valid exact-consequence authority procedure whose signer(s), threshold, and procedure come from applicable law, the DAV's governing instrument, or a valid competent mandate; the wearable never signs.
This is a constitutional constraint, not a technical limitation. The wearable has no secure element suitable for key custody. The phone does (Secure Enclave / Executive M / StrongBox). Splitting sense from sign creates a clean trust boundary:
Wearable (sense) --BLE--> Phone / authority validator --Nostr--> Network (witness)
If the wearable is lost or compromised, no keys are exposed. For a private act, under applicable law, the Natural Person authorizes their own exact typed private act using a device-held key; the phone is a signing device, never the authority. For public-DAV consequence, the validator verifies a complete valid bound PRISM decision receipt from the signer(s) required by applicable law, the entity's governing instrument, or a valid competent mandate binding the exact consequence. PRISM records and verifies only; deterministic software carries out only that exact bound consequence. Three substrates remain distinct: L1 hardware sensor + unsigned AI processing + the applicable typed authority receipt.
What Helios Is Not
- Not a medical device (no FDA/CE claims on biometrics)
- Not a surveillance tool (no cloud upload without explicit consent)
- Not required (the organism works fine without it -- Grace Exit applies)
Helios gives the organism a body in the physical world. Open ear. Open eye. Closed key.
Hardware Trust Boundary
Helios surfaces (ears/eyes/mouth metaphors) must define clear trust boundaries.
Boundary checklist
- Sensor ingest authenticity checks
- Local pre-processing constraints
- Encrypted link to the upstream routing layer (design; mechanism not chosen)
- Device attestation or equivalent trust signals
- Remote disable / quarantine path for compromised nodes
Safety rule
Never treat raw hardware input as authoritative without triangulation or provenance checks.
Historical predecessor wording — retained on 2026-09-27, not active rules
The displaced passages are preserved verbatim for lineage. This retention date is not their original authorship date.
Predecessor passage 1
Helios is not a product line. It is two reference designs that give the organism eyes and ears in the physical world. Both follow the same rule: **the wearable