Reach is the Foundation Models framework talking to itself across an individual’s own trust boundary. One instance runs on the device, inside any app that adopts it; one runs on a machine they own— a Mac, or a cluster of Macs pooled over Thunderbolt. Any iOS, macOS, or visionOS app reaches the latter by swapping a single dependency, because a session on a Reach model reads identically to one on the system model: prompts, guided generation, tools, streamed snapshots. Underneath, nothing resembles a service. There is no account, no vendor discovery, and no coordination server anywhere. Pairing is one gesture carrying two keys: the phone scans a QR rendered by reach pair, proves possession of a key minted in and never leaving the Secure Enclave, and passes back a WireGuard key that reachd writes directly into the cluster's own mesh, membership becoming a fact on disk rather than a session with a server. Apps are ruled separately: ReachKit mints each one its own key, reachd parks the request, and the keeper surfaces a sheet the person answers. Default deny, per app, per model. Trust lives in the session and never in the road, which leaves the roads plural and disposable. On a local network there is no tunnel at all, and away, the same mutually authenticated session rides the mesh. Walking out the door is therefore not a migration but a re-attachment: the local address goes unroutable, the client races its candidates, and generation resumes mid-token against the daemon's held replay.

None of the parts are new, but the last meter between them is. Apple opened the Foundation Models framework to conforming providers and announced the framework itself for open source, and RDMA over Thunderbolt 5 shipped in macOS 26.2, but both the hardware and the API arrived in advance of a trust layer. What someone running their own cluster has in the meantime is an unauthenticated endpoint stuck to a VPN, or a vendor answer that wraps their own models in the vendor's account, discovery servers, and client at both ends, or the platform's own utilities, which grasp at local servers and stop at the URL. So reachd's center is a slot rather than a model (today open weights on the host GPU via MLX, scoped an adapter fronting an exo cluster pooling memory over RDMA, in principle any conforming provider), and the cluster is never exposed to the internet: what faces the world is one UDP port speaking WireGuard, which answers nothing unauthenticated, not even to say no. The human interface work concentrates in the keeper, the companion app holding the device's identity and the grant console, where ceremony, grant sheet, and the ledger to come are designed surfaces, because the trust they express has no system vocabulary yet.

Reach is open source under Apache-2.0, on GitHub. Identity designed by Vanessa Spiral.