The Quiet Machine
The human is in the middle

Prologue

Two garages, fifty years apart

In 1976 a man sat in a garage in Los Altos and designed a computer mostly because designing it delighted him. Steve Wozniak’s Apple I and Apple II were not committee objects. They were the work of one engineer who wanted the fewest chips that could possibly work — and who then, and this is the part that matters, gave the schematics away. He printed the design. He handed it to the Homebrew Computer Club. He wanted other people to be able to build one.

That instinct is the whole reason the personal computer is personal. Not the plastic. Not the price. The fact that the machine’s insides were legible to its owner, and that its designer wanted them to be.

We are writing from a different garage, and the machine is not one box. It is an iPhone that turns out to be an ultra-high-bandwidth edge supercomputer; a Mac on a desk; a 🤫 Puppy One humming in an actual garage on an actual Starlink link; and, when the work genuinely demands it, a rack of NVIDIA silicon somewhere with cheap power and good cooling. hu_ssh is the wire that makes those one machine, owned by one person.

We are giving the protocol away for the same reason Woz gave away the schematics. A protocol you cannot read is not a protocol. It is a leash.

One

The human is in the middle of the circle

Draw a circle. Put a person in the middle — not a user, not a segment. A person, with a Tuesday, and a renewal notice, and a kid’s dentist appointment, and a form from the county due back on the 14th.

Around that circle stand everyone who serves them: their insurance producer, their financial adviser, their doctor, the contractor who is late, the caseworker at the benefits office, the volunteer at the food bank, the bank and the credit union and the utility. These are human agents, and they are the ones who repeatedly show up. Also on that circle: every AI service and subscription the person pays for and genuinely enjoys.

Now the only question that matters: who is standing between the person and all of that? Today, nobody. The person is the integration layer — the API gateway between forty institutions that will not talk to each other, holding the retries in their head, the only one who remembers that the thing from March never got resolved.

🤫 Private Agent One is the answer. The person’s own agent, sovereign over their own data, agents and compute, whose entire job is the day-to-day private and personal agent work they would love to hand to somebody else. The chasing. The comparing. The forms. The renewals. Work that is nobody’s idea of a life.

This is architecture, not a slogan. Agent One is interposed, not a destination. It is delegated to. It absorbs the interface burden so the person does not have to.

The test on every feature: does this do work for the person, or hand them more work? A search box the person must drive is a destination. An agent that is told what someone needs and handles the rest is the product.

Douglas Engelbart’s 1968 demonstration is remembered for the mouse and hypertext. But the point was the name of the program it came from: “Augmenting Human Intellect.” Not replacing. Not simulating. Augmenting. A person, larger. That is the assignment; we are just the ones holding it now.

Two

The joy of making the hardware do the thing

There is a pure thrill in making hardware do something it was never theoretically supposed to do — like routing zero-copy tensor memory from an iPhone’s Unified Memory Architecture straight into a network socket bound for an NVIDIA cluster.

Woz’s video circuit worked because he noticed the machine already had, idle and unused, exactly the capability he needed. Apple Silicon’s unified memory is that same gift in plain sight: CPU, GPU and Neural Engine share one physical pool of RAM. No PCIe host-to-device copy. Roughly 150 GB/s on a phone, 800+ GB/s on an Ultra.

Most software reads that as “the phone is fast now.” It is far more interesting than that. It means the expensive operation in a hybrid local/remote AI system is not compute — it is copying. And Apple already deleted the copy.

Once you see it that way the design falls out on its own. The edge holds the state; the network carries only what is irreducible — the diff, the delegation, the result. The protocol’s job is not to move a person’s life to a datacenter. It is to move as little as possible, as rarely as possible, and to be honest about it when it does.

Three

Why a protocol, and not a product

Vint Cerf and Robert Kahn could have made TCP/IP a product. Tim Berners-Lee could have made the web a product; CERN put it in the public domain in 1993, and he argued for that. Lynn Conway, with Carver Mead, turned VLSI chip design from a priesthood into something you could teach — and the fabless semiconductor industry grew in the space that opened. Grace Hopper built the first compiler on the conviction that programming should be legible in something closer to English.

The largest value in this field has always been created by people who hand other people the means of computation and then get out of the way.

So hu_ssh is an open protocol, and a third scheme in a family of three: mcp:// for context and tool bindings, a2a:// for agent negotiation and delegation, and hu_ssh:// for zero-trust, hardware-attested binary transport. Three layers, three jobs, no overlap.

Barbara Liskov spent a career making precise the idea that a good abstraction is a promise about forgetting: if a component honours its contract, you never open it again. A versioned 50-byte binary header is a thing you can stop thinking about. A vendor’s REST endpoint, with its pricing changes and deprecation notices, is a thing you must think about forever.

Four

Measure first — the Jeff Dean lens

Jeff Dean and Sanjay Ghemawat are on our list not for any one system but for a habit of mind: get the number before the opinion, let physical layout follow the shape of the query, and after an incident study the failure geometry rather than just the fix. Applied here, that habit produces the whole routing decision.

[ User Input / Sensor Context Stream ]
                 |
                 v
   +-------------------------------------------+
   | Is Task Executable On Local Apple Node?    |
   +---------------------+---------------------+
             |                       |
            YES                      NO  (heavy compute / high validation)
             v                       v
 +------------------------+   hu_ssh   +------------------------------+
 | Apple Silicon MLX      |  QUIC pipe | NVIDIA DGX Spark Cluster     |
 | - Zero-copy UMA        | =========> | - NemoClaw OpenShell Sandbox |
 | - Metal Perf Shaders   | (UDP 8022) | - Kernel Landlock + eBPF     |
 | - Sub-10ms Attn Cache  |            | - Hermes Self-Improving Loop |
 +------------------------+            +------------------------------+

The branch is arithmetic, not ideology. If the work fits in unified memory, doing it locally is strictly better on every axis at once — latency, cost, privacy, offline resilience. You only pay the network when the network buys you something.

And the same lens immediately surfaces the two problems a less careful design finds in production instead. KV-cache paging: if the local model bursts a task to a 70B model, the cluster re-hydrates attention state from scratch, paying full prefill for context the edge already computed — so streaming pre-computed KV-cache vectors has to be a first-class frame type (StateSync, 0x30), not a payload afterthought. Backpressure: under burst load, sandboxes bottleneck on GPU allocation, and no flow control turns that into memory exhaustion — hence credit-based sliding windows in the Rust parser.

Neither will ever appear on a landing page. Both are the difference between a demo and a system.

Five

Code like bacteria — the Karpathy lens

Andrej Karpathy appears on our gratitude page as a teacher our founder learns from daily, and the lesson we took most literally is about module shape: prefer small, self-contained code someone could lift out without importing your whole world. Build the coordinated backbone only where complexity demands it. Test it against the artifact — here is the entire wire format.

0                   1                   2                   3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   MAGIC (2B)  | VERSION (1B)  |   FLAGS (1B)  |  FRAME TYPE   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                       SEQUENCE NUMBER (8B)                    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                       PAYLOAD LENGTH (4B)                     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     SIGNATURE LENGTH (2B)     |         RESERVED (2B)         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                     DEVICE ID SHA-256 (32B)                   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                     PAYLOAD DATA (Variable)                   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                 SEP SIGNATURE DATA (Variable, Optional)       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Fifty fixed bytes. You could implement a reader for that in an afternoon, in any language, without asking us for anything. That is the bar. Claude Shannon taught the field that a channel is a mathematical object with a capacity you can reason about; the least we can do is make ours small enough to hold in your head.

impl HuSshFrame {
    pub fn parse(buf: &mut BytesMut) -> Result<Option<Self>, &'static str> {
        if buf.len() < HEADER_FIXED_SIZE {
            return Ok(None);          // not enough bytes yet - come back
        }

        if [buf[0], buf[1]] != HU_SSH_MAGIC {
            return Err("Invalid magic bytes");
        }

        let payload_len = u32::from_be_bytes([buf[15], buf[16], buf[17], buf[18]]) as usize;
        let signature_len = u16::from_be_bytes([buf[19], buf[20]]) as usize;
        let total_len = HEADER_FIXED_SIZE + payload_len + signature_len;

        if buf.len() < total_len {
            return Ok(None);
        }

        buf.advance(2); // Skip magic
        let version = buf.get_u8();
        let flags = buf.get_u8();
        let frame_type = FrameType::try_from(buf.get_u8())?;
        let sequence_num = buf.get_u64();
        // ... device id, payload, signature
    }
}

Notice what parse returns: Result<Option<Self>>. Three outcomes, all explicit. This is a valid frame. This is not enough bytes yet. This is garbage. Partial reads are the normal case on a network, not an error, and the type says so. Tony Hoare called the null reference his billion-dollar mistake; the cheapest possible tribute is an Option where you meant one.

Six

Trust without trusting the wire

The problem is old and it is solved. Diffie and Hellman showed in 1976 that two parties can agree a shared secret over a completely public channel. Rivest, Shamir and Adleman made it practical. Shafi Goldwasser, with Micali and Rackoff, formalised the zero-knowledge proof: you can demonstrate something is true while revealing nothing beyond its truth.

Sit with that one. You can prove a thing without surrendering the thing. Every consent receipt and every scoped grant in this product is that idea applied to ordinary life.

[ Apple Secure Enclave ]                        [ Linux Kernel Host ]
+------------------------+                      +------------------------+
| Ephemeral SecP Keypair |                      | eBPF Socket Filter     |
| Hardware Root Cert     | -- Attestation -->   | Landlock Read-Only FS  |
+------------------------+                      | Seccomp Syscall Filter |
                                                +------------------------+

The private key is generated inside the Secure Enclave and never enters iOS kernel or user-space memory — software cannot spoof it because software never sees it. On the other side the sandbox is bounded by the kernel itself: Landlock restricts the filesystem, seccomp-BPF filters syscalls, eBPF blocks unauthorised egress. Not a policy document — a kernel that refuses.

There is a real cost, and it belongs in public rather than in someone’s postmortem: validating a full X.509 attestation chain per frame would be absurd at frame rate. So attestation happens once, at HandshakeInit, and derives an ephemeral AES-256-GCM session key that makes later frames cheap to verify. A deliberate trade, made with eyes open.

Seven

The Margaret Hamilton clause

Leslie Lamport’s contribution, at bottom, is that in a system with no global clock “what happened first” is not a fact you look up — it is something you must construct. Hence the sequence number in bytes 5–12 of every frame. A distributed system that cannot order its own events is not a system; it is a rumour.

But the deeper lesson is Margaret Hamilton’s. Three minutes before the Eagle landed, the guidance computer threw a 1202 alarm. It was overloaded. And it did not crash — her team had built priority scheduling, so under overload the system shed lower-priority work and kept doing the landing. The astronauts landed on a computer that was, at that moment, gracefully failing.

// FALLBACK: Execute natively on Apple Silicon via MLX
do {
    for try await chunk in await self.localMlx.streamInference(prompt: prompt) {
        continuation.yield(chunk)
    }
    continuation.finish()
} catch {
    continuation.finish(throwing: error)
}

When the network dies, the agent does not show an error and does not spin. It quietly moves the work onto the silicon in the person’s hand and keeps going. The person may never learn anything happened. That is the correct outcome — and it is why the cluster is a nice-to-have while the person’s Tuesday is not.

Radia Perlman’s spanning-tree algorithm belongs in this lineage: her whole contribution was letting a network route around its own failures without a human noticing. The highest compliment you can pay infrastructure is that nobody thought about it.

Eight

Never infer what you were not told

This is the section we would keep if we had to delete every other one.

Judea Pearl won the Turing Award for making causality tractable — for insisting on the difference between seeing and doing. Karen Spärck Jones gave retrieval the idea of inverse document frequency, and also said computing is too important to be left to men. Fei-Fei Li built ImageNet and then spent years arguing for human-centered AI.

Today a thousand brands each assemble their own shadow profile of the same human. None of it is visible to them. None of it is theirs. All of it is inferred — stitched from behaviour, bought from brokers, guessed. The person is modelled constantly and consulted never.

We are building the inversion: one canonical, self-owned profile the person publishes and the world subscribes to. Granular read access, per field and per subscriber, revocable, with a receipt for every access.

Two rules, neither negotiable. Never infer what the person has not told us. Never let a subscriber read a field they were not granted. A profile that guesses is a shadow profile with better manners.

The starting point is chosen carefully: privacy preferences. Not the most interesting field, but the one preference every website, app and brand on earth already legally needs. The door is already open. Walk through it, then work outward into the ordinary texture of a life — the food, the clothes, the perfume, the cars, the music, the teams and characters, the games, the work someone does and the work they like to do, the reading they choose. Everything that makes someone specifically themselves rather than a demographic.

Nine

24/7/366, on what the person already owns

The agent is always on. One user. Ideally on their own computer and their own infrastructure, using their own existing subscriptions. Which is why these are native capabilities rather than integrations bolted on later:

Because the work runs on hardware the person owns, with credentials the person holds, the data does not have to leave and the bill does not have to double. That is the technical spine under Own your AI. Own your data. Own your compute.

We are Google-first and Gemini-first: day zero has to work for someone arriving with a Google account and nothing else. And we support every open model that meets or exceeds the standards the open-source community itself sets for safety and trust. These are not in tension — the default must work before the user has done anything; the open ecosystem is what they graduate into when they want the whole stack in their own hands.

Eleven

What we have measured, and what we have not

Charlie Munger’s test — is it honest, rational, a genuinely good idea rather than a clever one — applies hardest right here, so let us be exact. The figures below are design targets and reference-architecture projections, derived from published characteristics of the underlying components. They are not end-to-end benchmarks of a shipped production system under real load, and we are not going to present them as though they were.

When we have reproducible end-to-end benchmarks we will publish them with the methodology and the harness, including the runs that disappointed us. A team that only reports its good days eventually gets believed on none of them.

The same candour applies to compliance. We are pursuing FedRAMP High and DoD Impact Levels, and we treat the NIST 800-53 High controls as always-on. We are in pursuit— we hold no certification until a 3PAO assessment or an agency ATO says otherwise, and we will not write the sentence that implies we do. “In pursuit” is a complete sentence.

On readiness: MLX execution, QUIC transport, the Rust wire parser, Landlock and eBPF sandboxing, and the Secure Enclave are each production-ready as components. The end-to-end integrated system is in build, and is not shipped.

Twelve

The pledge

We keep a page of people we are grateful to, and it is not decoration. Fifty-four computer scientists: the founders — Turing, Ada Lovelace, Shannon, Hopper, von Neumann, McCarthy. Thirty-three Turing laureates — Knuth, Dijkstra, Ritchie, Thompson, Liskov, Lamport, Cerf, Kahn, Berners-Lee, Kay, Frances Allen, Goldwasser, Backus, Wirth, Hoare, Milner, Cook, Karp, Yao, Rivest, Shamir, Adleman, Diffie, Hellman, Pearl, Codd, Gray, Stonebraker, Brooks, Sutherland, Engelbart, Tarjan, Hopcroft. The AI pioneers — Hinton, Bengio, LeCun, Fei-Fei Li, Karen Spärck Jones. The systems builders — Jeff Dean, Sanjay Ghemawat, Torvalds, Margaret Hamilton, Radia Perlman, David Patterson, Stroustrup, Guido van Rossum, Lynn Conway, Anita Borg.

Not one of them is affiliated with us. Not one has endorsed us. We name them because their work is public, because we build on it daily, and because the correct response to receiving something enormous for free is to say so out loud and then pass it on.

Woz gave away the schematic. Berners-Lee gave away the web. Conway gave away the method. Hopper gave away the compiler. Cerf and Kahn gave away the protocol carrying this sentence to you. hu_ssh is our attempt to add one small link to that chain, and to be worth the company.

Thirteen

Come build it

Personal AI computing should not belong to centralized walled gardens. It belongs to individuals who own their hardware, run their own agents, and control their data.

The person is in the middle of the circle. Everything we build is measured by whether it makes their day lighter — without ever asking them to pay for it with money, attention, or the details of their life.

Let us make agents truly useful by making them run seamlessly on the supercomputers of today, including the one already in someone’s pocket. 🤫