The Grand Architecture of
Sovereign Computing

Computing has swung between the personal machine and the central mainframe for fifty years. What is different now is that both ends got extraordinary at the same time. The laptop on your desk will run a capable model without touching the network, and a rented cluster will do in a second what that laptop cannot do in an hour. The obvious thing to build sits between them.

The model we inherited does not sit between them. It puts a thin client at the edge and ships everything personal to somebody else's computer to be thought about. That is slow, because the round trip is real. It is fragile, because the copy outlives the purpose. And it quietly moves the centre of the system away from the person it is meant to serve.

What follows is the architecture we are building instead: 🤫 Private Agent One on the person's own silicon, the hu_ssh transport that carries work off the device when it has to leave, and a sandbox at the far end that assumes the agent asking might be wrong or compromised.

Identity starts at the hardware, not at a login

Most identity theft is a consequence of the bearer token. You authenticate somewhere central, a session token is minted, and from that moment the token is you. Steal it and you are the user, without ever touching the user's hardware. The whole apparatus rests on a secret that travels.

The Trusted Circle inverts that. Identity is anchored at the lowest level available, the private key held in the device's secure element, which cannot be exported and can only sign on the device it lives in. Authority radiates outward from the person: their hardware, then their agent, then whatever they have deliberately let in. Widening the circle is an explicit act with a scope attached, so there is no ambient permission for anything to harvest quietly in the background.

This is the same principle the consent registry enforces at the data layer, where every one of the 252 scopes carries a tier and an unknown scope is treated as the most sensitive tier we have. Fail closed, in both places, for the same reason.

The edge: unified memory is the whole argument

The reason a personal agent is viable at all is that Apple Silicon removed the copy. On a conventional discrete GPU the model weights live in system RAM and the maths happens in VRAM, so every tensor pays a crossing over the PCIe bus, in latency and in watts. On a unified memory architecture the CPU, GPU, and Neural Engine address one pool. A tensor the CPU produced is simply already there when the GPU wants it.

That single property is what turns a laptop into somewhere an always-on agent can actually live. Apple's MLX framework is built around it, with lazy evaluation so that a chain of array operations becomes one fused, scheduled computation at the moment something asks for the result rather than a sequence of allocations along the way.

Not measured by us. You will see specific throughput and tokens-per-second comparisons quoted for this hardware, including in our own earlier draft of this piece. We have not run those benchmarks on our own workload, so we are not going to repeat the numbers as though we had. The architectural claim, that eliminating host-to-device copies matters more than anything else at the edge, is the part we are willing to stand behind.

The transport: 53 bytes, and why the number is in the code

When a job outgrows the device, whether that is a large compile, a wide scrape, or a simulation over a big matrix, the agent bursts to a cluster. hu_ssh is the conduit, and it exists because neither obvious option fits. HTTP makes agents poll, which destroys continuity. SSH was designed for a human typing into a terminal, and carries connection overhead sized for that.

So hu_ssh is built on QUIC. One round trip to establish, zero on resumption, multiplexing native to the transport rather than bolted above it, and a connection identifier that survives a change of network. An agent that moves from wifi to cellular mid-burst keeps its stream.

The wire format

The fixed header is 53 bytes, big-endian, laid out for zero-copy parsing:

MAGIC is 0x6875, the ASCII "hu". SEQUENCE NUMBER is monotonic per stream, which is what makes replay detectable. PAYLOAD LENGTH begins at byte 13, SIGNATURE LENGTH at 17, and the DEVICE ID fingerprint occupies the final 32 bytes from offset 21.

Those offsets are not typed into this page. They are computed from the same field table the diagram above and the reference parser both read, and the reason for that is worth being blunt about.

The handshake

A HandshakeInitframe carries a digest signed inside the device's secure element with a key that has never been off the hardware. The cluster validates that signature against the registered public key before anything is scheduled, and discards frames that fail. The property this buys is narrow and worth stating precisely: it establishes that a request came from that physical device. It does not by itself establish that the person meant it. Intent is the consent layer's job, and it is a separate check.

The far end: assume the agent is wrong

Handing an autonomous agent the ability to run code on shared cluster hardware is the part of this design that deserves the most suspicion. A prompt injection, a confused model, or one poisoned dependency all end at the same place, which is arbitrary execution on a machine that is not yours. So the sandbox is designed as though that has already happened.

Filesystem access is confined with Landlock, so writes land only in an ephemeral working directory and the rest of the tree is unreachable rather than merely forbidden. The syscall surface is cut down with seccomp-BPF, so ptrace, unshare and unexpected execve are simply not available. Network egress is default-deny through eBPF filters, so the sandbox cannot become a staging post for reaching anything the user did not authorise.

In design. NemoClaw and the Hermes runtime are specified and partially built, not running in production today. The skill-synthesis pipeline, where a verified solution is saved as a reusable asset the agent keeps, is design intent. We are describing it here because the call to action below is real and a contributor should know exactly which parts are a specification and which are running code.

Why the split matters: a worked example

Consider an options overlay evaluated continuously. The heavy part is pricing a large matrix of contracts, which is exactly what a cluster full of tensor cores is for. The sensitive part is your actual balances, your risk tolerance, and the thresholds at which you would act.

Those two parts separate cleanly. Market parameters, strike prices, expiries, and implied volatilities go up to the cluster, because none of them are about you. The pricing surface comes back down. And the decision, the comparison of that surface against your real position and your real limits, happens on your device and nowhere else. The cluster does the arithmetic. It never learns the portfolio.

This is the general shape of the whole architecture, not a trick specific to finance. Send the part that is only maths. Keep the part that is only yours.

An open invitation

None of this should be one company's private stack. A transport that only we implement is not infrastructure, it is a proprietary protocol wearing an open licence. The specification is published, the wire format is above, and the reference parsers are in the deep dive.

The most useful contributions are unglamorous: implement the header in a language we have not covered and tell us where the specification is ambiguous, attack the sandbox profile and tell us what escapes, or read the handshake and tell us what it fails to prove. We would particularly welcome scrutiny from engineers at Apple, NVIDIA and Google, who have thought harder about this silicon than we have.

We are not claiming a partnership with any of them, and we do not have one. This is an open request for review, from people who would rather be corrected early than admired briefly.