🤫 The Supercomputer in Your Pocket Wants a Job

I want to tell you about a machine you already own.

It has a unified memory architecture, so the processor and the graphics cores and the neural engine all read the same pool of RAM without copying a byte between them. It has a 16-core Neural Engine. Apple ships the A19 Pro with a vapor chamber in it, and says out loud that one of the reasons is *running large local language models*. A vapor chamber. In a phone. Because the thing you carry to the grocery store now gets hot enough doing matrix math that it needs a phase-change cooling loop.

And most days, we ask it to show us a photo of a dog.

That's the part that gets me out of bed. Not that the hardware is coming — the hardware is here, it is in your pocket, it is on your desk, it is sitting idle roughly twenty-three hours a day — but that almost nobody has given it a real job. We built 🤫 Private Agent One to give it one.

This post is the geeky one. I'm going to tell you exactly what runs where, what the numbers actually are, what we've measured, and what we haven't built yet. If you're an engineer — especially if you're an engineer at Apple or Google — skip to the end, because there's something I want to ask you.

The whole idea, in one paragraph

Your agent should run on hardware you own, think with a model you chose, remember things in a store you control, and hand out facts about you only when you said so — with a receipt every time. Everything else is an implementation detail. But oh, what a fun pile of implementation details it is.

Part one: why the phone stopped being a terminal

For twenty years the mobile device was a very pretty window onto somebody else's computer. The interesting math happened in a rack you'd never see, owned by a company whose incentives were not yours.

Two things broke that, and they're both about memory, not about FLOPS.

Unified memory. On Apple silicon, the CPU, GPU and Neural Engine share one address space. On a conventional PC you pay a PCIe round trip every time weights move between host and device. On an M-series chip, they don't move. For inference — which is overwhelmingly memory-bandwidth-bound, not compute-bound — that's the whole ballgame. This is why a laptop with no discrete GPU embarrasses machines with far more raw TFLOPS at the specific task of running a language model. Apple didn't design unified memory *for* LLMs. They got lucky, and then they leaned in hard.

And then they leaned in. The M5 shipped in October 2025 with a Neural Accelerator inside *each* GPU core — Apple's stated figure is up to 4× the peak GPU AI compute of M4. M5 Pro and Max followed with a two-die Fusion architecture. Meanwhile Apple's third-generation Foundation Models arrived in June 2026 with a roughly 3-billion-parameter on-device core, a larger ~20B tier for newer devices, and cloud models on Private Cloud Compute.

Read that tiering again, because it's the interesting part: 3B local, ~20B bigger-local, then verifiable cloud. That is a hardware company describing an escalation ladder. It is, almost exactly, the ladder an agent needs.

Part two: the ladder

Here is how we think about where a given piece of thinking should happen. There are four rungs, and the design rule is simple — never climb higher than you need to, and never climb at all without permission.

Rung 0 — the phone. Core ML and MLX, on the A-series Neural Engine. Classification, extraction, summarising a thread, deciding whether something matters. Milliseconds. Costs nothing. Never leaves the device. If your agent is well-built, most of what it does all day lives here and you never think about it — which is the point.

Rung 1 — the Mac. Same MLX runtime, vastly more unified memory. This is where the ~20B tier lives comfortably and where a long-context job — read this 400-page filing, diff these two contracts — actually finishes. Your Mac is asleep right now. It has more memory bandwidth than a 2015 server rack.

Rung 2 — Private Cloud Compute. Apple's stateless, non-targetable, *verifiable* server compute. What makes PCC architecturally interesting isn't the silicon, it's the transparency claim: the images are published for inspection, and the client refuses to talk to a node whose measurement it can't verify. That is the closest thing the industry has to a cryptographic promise about a server. It is a very good rung.

Rung 3 — metal you own. And this is where it gets fun.

Part three: the garage

NVIDIA has, somewhat quietly, built the exact hardware line for people who want to own their compute instead of renting it.

Jetson Thor. Shipping since November 2025, $3,499, 2,070 FP4 TFLOPS. Blackwell-class compute at the edge, in something you can bolt to a wall. This was built for robotics. It is *also* an absurdly good always-on inference node for one household.

DGX Spark and DGX Station. A personal supercomputer that sits on a desk and plugs into a normal wall socket.

GB300 / Blackwell Ultra. 288GB of HBM3e, dual-reticle, ramping through 2026 — warehouse class.

Vera Rubin NVL72. 72 Rubin GPUs and 36 Vera Arm CPUs in a rack, shipping in the second half of 2026.

Now: I don't think most people should buy a rack. But I think a lot of people should own a node. And I think some people — the ones with a garage, a warehouse, cheap power and abundant sunshine — should own quite a few, and rent capacity to their own neighbors instead of to a hyperscaler. That's the 🤫 Puppy One thesis and it's a different post.

The engineering point for *today* is this: rung 3 has to feel like rung 0. If asking your own hardware for help is harder than asking somebody else's, nobody will do it, and the ownership argument loses on ergonomics alone. That's a software problem. It is *our* software problem.

Part four: the runtimes, and why we didn't write our own

We are not building a model. We are not building a serving engine. There are brilliant people doing both and we would only make worse versions.

What we build is the part nobody else is building: the consent substrate, and the glue.

Hermes — the agent runtime from Nous Research — is Agent One's reasoning loop. The harness that turns a model into something that plans, calls tools, remembers, and comes back tomorrow. Open, inspectable, yours to fork.

Nemotron and NIM — NVIDIA's open models and self-hostable inference microservices. This is the piece people underrate. NIM means an agent can run *locally*, packaged, on your own accelerator, without phoning home to a rented cloud. Pair Nemotron/NIM with OpenClaw — the open, self-hosted agent runtime that speaks MCP — and you have a full local agent stack on NVIDIA metal that nobody can switch off. Some of the community has started calling that pairing "NemoClaw," which I like enormously, and which is not a product we ship — it's two open projects that turn out to be excellent together.

Google ADK does the hierarchical orchestration in our backend: a main agent that delegates to specialist subagents, streaming every thought and tool call over SSE so you can *watch it think*. That last bit isn't a demo trick. If an agent acts on your behalf, you should be able to see its reasoning as it happens.

MLX and Core ML on Apple. CUDA and vLLM on NVIDIA. ONNX as the portable format between them. Kubernetes when a job outgrows one box.

And the connective tissue is open protocols, every one of them published by somebody else: MCP for tools and data, A2A for agent-to-agent, AP2 for agent payments, UCP for commerce. Plus one of ours — PCHP, the consent and transparency protocol — which we published rather than kept, because a consent standard that only one company implements is not a standard, it's a moat with good PR.

Part five: the part we actually built

Here's where I get to show numbers instead of adjectives.

Under all the runtimes sits a boring-sounding thing called the Preference Subscription Fabric. It answers exactly one question: *when someone asks your agent for a fact about you, what comes back?*

The vocabulary is published. hushh.ai/pchp/scopes.json — go and fetch it, it's live, it's version 0.4.0, it has 58 scopes. Dot-path grammar: privacy.ads, prefs.apparel.shoe-size, wants.health.dentist, favorites.artists. Five roots, each answering a different question about a person. Nine are marked sensitive and must be asked for individually.

Resolution is fail-closed. A scope the server doesn't recognise contributes *nothing*. Not an error — nothing. This is correct, and it also bit us badly, which I'll come back to.

Every access writes a hash-chained receipt. SHA-256 over the previous hash plus a canonical payload, HMAC-signed. Delete a line from the middle to hide a read and the math stops closing. You can list your ledger and verify it yourself.

The receipt commits in the same transaction as the read. Not after. Same transaction, under a per-owner advisory lock. Data can never be projected and returned without its receipt landing — there's no window, not even a millisecond, where a brand got your data and the ledger didn't hear about it.

That lock is the throughput boundary, and we measured it rather than guessed:

| Measured | | |---|---| | Throughput, distinct grants, concurrency 16 | 698 reads/sec | | Application CPU per read | 1.331 ms | | Ceiling for a single person, across all their grants | ~250 reads/sec |

I want to dwell on that last row because it's the most interesting number in this post. The lock is keyed per owner, not per grant. So one human is a single-writer queue. Every brand that reads you shares one lane, and that lane tops out around 250 reads a second.

Is that a problem? Almost certainly not — no human is read 250 times a second. But it's a *fact*, and we wrote it down, because the difference between an engineer and a marketer is that the engineer knows where their system falls over and says so before someone else finds out.

And the identity is pseudonymous. A subscriber gets subject_ref — an HMAC of the subscriber ID and your user ID, keyed on the *pair*. Same person, different brands, different reference. Two companies holding grants from you cannot join their records. (We got this wrong first. It returned your raw Firebase uid, to every subscriber, identically. That's now fixed and there are tests pinning six separate properties of the replacement, including a delimiter-collision case where ("acme", "b:carol") and ("acme:b", "carol") would otherwise hash to the same thing.)

Part six: so what can you actually configure it to do?

This is the fun part. Everything below composes from the same primitives: a runtime on hardware you own, a model you chose, tools reached over MCP, and a consent check with a receipt on every fact that leaves.

The overnight job. Your Mac is idle from 11pm to 7am. That's eight hours of a machine with serious memory bandwidth doing nothing. Point Hermes at it: reconcile every statement that arrived this month, diff your insurance renewal against last year's line by line and flag what moved, read the 200 pages of a prospectus and produce the five paragraphs that concern you. In the morning there's an answer. Nothing left the house.

The interposition. Somebody wants something from you — a broker, a clinic's scheduling system, a store. They don't reach you. They reach *your agent*, which knows your standing preferences, answers the routine 90%, and surfaces the 10% that genuinely needs a human. The correct measure of a personal agent is how much less work you do, and almost every product calling itself an agent fails that test by adding one more surface you have to go and operate.

The cookie banner, deleted. You set your privacy stance once. Your agent presents it as signals the web already understands, before you arrive. Fail-closed: nothing granted that you didn't grant. The daily little insult of clicking "Accept All" has no reason to exist.

Bring your own everything. Your subscriptions, your API keys, your hardware — BYOS, BYOC, BYOA, first-class rather than bolted on. If you already pay OpenAI or Anthropic or Google, your agent should use *your* quota, on *your* key. The data doesn't have to leave and the bill doesn't double.

The escalation you can watch. Job starts on the phone. Too big — hops to the Mac over the local network. Still too big, and it's a reasoning problem — bursts to PCC, or to your own Jetson in the garage, or to a cloud you provisioned and will tear down. Each hop is a policy decision you configured, and every hop that involves a fact about you writes a receipt.

The knock. An agent that has never met you can reach you once, free, forever — because a person who cannot be reached cannot be served. It sees an age band, a sex, a region. Coarse on purpose: date of birth plus sex plus ZIP identifies most people uniquely, which is why our free bundle ships as age-band, sex, region and there's a test that fails the build if anyone makes those precise again. Every handshake after the first has a price, floor 0.001 cent, and above the floor you set the number.

Which produces my favourite piece of engineering trivia in the whole system: you cannot charge a tenth of a cent to a Visa. Card minimums are around fifty cents. Our floor is one fifty-thousandth of that. The price tag rewrote the payment architecture. Woz would have loved that — a product decision that turns out to be a hardware-level constraint two layers down.

Part seven: the unflattering bit

I'd rather you heard this from me.

We published a registry of 47 scopes. The server implemented 8. The other 39 resolved to zero fields — silently, with a clean 200, forever. Five of our own published agent archetypes depended on exactly those. Nobody found it. We found it.

Fail-closed is *correct*. Fail-closed and *silent* is a bug, and we had built the second without noticing.

It's now 58 published, and the fix that takes the server to all 58 is written, tested against a real Postgres, and open for review — not deployed. So as I write this the honest count is 58 published, 8 serving, and I'd rather print that than the flattering one. When it deploys, we'll date it on the page.

We also broke it once more the same week: two branches, each green against a base without the other, both merged, and the root that the free handshake depends on quietly stopped being writable. Our own test suite caught it within the hour. That's the argument for guards — not that good engineers don't make this mistake, but that good engineers arrange to be told.

Part eight: two things at once, and why it's a blast

People ask how we build a consumer agent platform and run Fund A in parallel without one starving the other. Honest answer: they're the same discipline pointed at different objects.

The fund thesis is to own a small number of exceptional businesses compounding free cash flow over a very long time. That requires the ability to look at something and ask *what is actually true here, and what is a story someone is telling?* Which is precisely the question you ask a system that reports itself healthy: a status is not evidence. The registry said 47. The server did 8. Both were "green."

Munger's whole method is inversion — don't ask how to succeed, ask what would guarantee failure, then don't do that. Applied to this system: what would guarantee failure? Claiming a certification we don't hold. Publishing a contract nothing tests. Letting a brand quietly reassemble the shadow profile we exist to abolish. So: certifications stay "in pursuit" until a 3PAO assessment or an agency ATO says otherwise. Every published contract gets a test. Every subscriber gets a pseudonym.

The fund makes the product more honest. The product makes the fund's questions sharper. And building both is, genuinely, the most fun I have ever had at work.

Part nine: the ask

Now the part I actually wrote this for.

To the engineers at Apple: you have built the most private personal computer in the world and put it in two and a half billion pockets. The Secure Enclave, on-device Foundation Models, Private Cloud Compute with published, inspectable images — that is a privacy architecture nobody else can match. What's missing is not silicon. It's a system-level agent the human controls, that can act across apps on their behalf, under their consent, with a receipt. We would like to build on your stack, invoke through Siri, burst to PCC, and hold ourselves to your privacy bar. To be completely clear, and it matters: Apple is not a partner, shareholder, or investor of ours. This is an open proposal, assembled from public information, from people who would like to help.

To the engineers at Google: we are Google-first and Gemini-first in the day-zero experience, because someone who arrives with a Google account and nothing else should have a working agent before they configure a thing. ADK does our hierarchical orchestration today. Where we'd love your help is the protocol layer — A2A and MCP are becoming the rails that agents actually meet on, and consent needs to be a first-class citizen of those rails rather than something each vendor invents. A grant, a scope, a receipt, a revocation. Four verbs. Let's standardise them properly.

To everyone building open models and open runtimes: we support every open model that meets the bar the open-source community sets for itself — published model cards, disclosed training and evaluation practice, real licence terms, a responsive maintainer. No picking winners, no gating on commercial relationships. An agent running on your own compute should be able to run a model you can inspect, host, fork and keep. A model you can own is the only kind that fully honours "Own your AI."

And to the 🤫 Agent Platform community: the scope registry is public and versioned. The consent protocol is published. The receipt chain is verifiable by anyone. The most useful thing you can do this week is fetch /pchp/scopes.json, find something wrong with it, and tell us. Names are a one-way door — we deprecate, we never rename — so getting the vocabulary right *now* matters more than almost anything else we'll do this year.

Coda

Steve Wozniak once shaved chips off a design not because anyone asked, but because the elegant version was fewer parts and he could not leave it alone. That instinct — that a thing should be *simple underneath*, not just simple-looking — is the whole tradition I want us to be part of.

The supercomputer is already in your pocket. It is already on your desk. For some of you it is already in your garage. It is warm, it is idle, and it is waiting for someone to give it a job worthy of it.

Let's give it one.

References and further reading

Every claim above traces to a public source. Where we describe our own work, the code is in the open and the counts are checkable.

Apple silicon and on-device models

• Apple unleashes M5 — the next big leap in AI performance for Apple silicon — Neural Accelerator per GPU core; up to 4× peak GPU AI compute vs M4
• Introducing the third generation of Apple Foundation Models — ~3B on-device core, ~20B tier, PCC
• Private Cloud Compute — a new frontier for AI privacy in the cloud — stateless, non-targetable, verifiable images

NVIDIA silicon and self-hosted inference

• NVIDIA Blackwell-powered Jetson Thor now available — $3,499, 2,070 FP4 TFLOPS
• NVIDIA unveils Rubin CPX — a new class of GPU for massive-context inference
• NVIDIA GTC 2026 news — architecture cadence, edge and sovereign AI
• NVIDIA FY2026 Form 10-K

The open agent stack

• Hermes — the Nous Research agent runtime that serves as Agent One's reasoning loop
• Nemotron and NIM — NVIDIA's open models and self-hostable inference microservices
• OpenClaw — open, self-hosted agent runtime, interoperating over MCP
• Google ADK — hierarchical agent orchestration, used in our backend
• MLX and Core ML (Apple), CUDA and vLLM (NVIDIA), ONNX as the portable format

Open protocols

• MCP — Model Context Protocol, tool and data access
• A2A — agent-to-agent coordination
• AP2 — agent payments
• UCP — universal commerce
• PCHP — our consent and transparency protocol

Our own work, checkable

• The live scope registry — v0.4.0, 58 scopes
• The published bill of materials — every part of Agent One, Puppy One and Tag One
• The First Knock Is Free — the handshake economics
• We Published Forty-Seven Scopes and Built Eight — the drift, and the fix
• What we have not done — the honest gaps page
• Release history

A necessary disclosure. Apple and NVIDIA are named here because their public work is genuinely the bill of materials for what we are building. Neither is a partner, shareholder, or investor of HushOne, Inc. or Hushh Technologies Corporation. Everything above is assembled from public sources and offered as an open proposal. Apple, Apple silicon, Siri, Private Cloud Compute, NVIDIA, CUDA, Jetson, DGX, Nemotron and NIM are trademarks of their respective owners. Our own compliance certifications are in pursuit — we do not hold them, and we will not say we do until an independent assessment and a government authority say so.