One — Engineering
Deep Dive
Protocol · Product · System,
on the NVIDIA stack

Contents

How to read this

This is the builder's document behind the strategy. It assumes the reader has shipped silicon, runtimes, and rack-scale systems, and wants the actual design: message shapes, decision functions, lifecycle sequences, failure behavior, and the acceptance demo for every milestone. Where our published technical specification already fixed a design (control/data-plane split, PCHP types, the tail-tolerant executor, the 60-second budget), this document extends it onto the NVIDIA stack rather than restating it. Where a schema or flow is proposed joint work, it is labeled exactly that — nothing unimplemented is dressed as shipped.

NVIDIA, DGX, Grace, Blackwell, Vera Rubin, NVLink, BlueField, ConnectX, NeMo, Nemotron, NemoClaw, NIM, Dynamo, CUDA, Jetson and related marks are NVIDIA Corporation's, used nominatively. Apple, Google, Red Hat, Starlink and other marks belong to their owners. hussh is independent and unaffiliated; we name a partner only once an agreement is executed.

System Overview

One protocol, one engine, one agent — deployed across three NVIDIA planes. The architecture separates a data plane (personal data read, transformed, stored — always on hardware the owner controls) from a control plane (grants, receipts, the transparency log, placement — small, auditable, carrying capabilities and proofs, never content).

The invariants (fixed before any integration)

• Locality. Default site of computation is the owned device; moving data is the expensive, risky operation. Remote compute is the exception, in a tenant the owner governs — never a new custodian.
• Legible consent. Every access emits a signed, content-addressed receipt and an entry in an append-only, hash-chained log the owner can read in full. Revocation is a first-class, low-latency operation, not a support ticket.
• Single-party sovereignty. One principal, no second reader — not the vendor, the advertiser, the model provider, or us.

PCHP at the Wire · SSH for humans, literally

SSH's contribution was a handshake so trustworthy that strangers' machines could speak safely. PCHP applies the pattern to personhood: no agent touches data, compute, or an actuator without a handshake that authenticates, authorizes, and leaves a proof. Six steps, every time:

The implemented types IMPLEMENTED · TESTED

Measured properties from the passing suite: tampering any receipt field breaks the signature; mutating any past log entry fails verify_chain(); withheld fields never reach the normalized picture; revoked or expired grants raise ConsentError before any fetch. A receipt proves a specific action over specific fields occurred — without disclosing the field values. Defaults are closed: a fresh device consents to nothing until the owner grants, item by item, in the Day-0 ceremony.

Transport & surface

PCHP rides the agent ecosystem's lingua franca: the platform exposes a Model Context Protocol surface, so any MCP-capable agent — the owner's, or a trusted partner's — reads the catalog, places consent-gated actions, and checks status. Our OpenClaw MCP server (14 tools) is shipped and in the registry today; agent-to-agent flows and human-authorized payment mandates carry the same receipt discipline. MCP SURFACE SHIPPED — and the spec stays open: we monetize the network, never the protocol.

Attestation-Bound Receipts · consent × confidential computing

The novel joint engineering: extend the receipt so it proves not only what was authorized, but where it ran — cryptographically, per job, across all three planes.

Flow on a burst job

• Before any ciphertext leaves the household, the control plane requests attestation evidence from the target — NVIDIA confidential computing report on Hopper/Blackwell-class GPUs in the data center; Secure Enclave assertion on-device; device-key assertion on edge nodes.
• The verifier checks measurement against an allow-list of known-good runtimes (the NemoClaw/One Engine build actually deployed), then — and only then — releases the job's ephemeral data key (§08).
• The completed job's receipt embeds the report hash and verifier countersignature: one record now answers the compliance question in full — this job ran inside the enclave it claimed, on the fields it was granted, under this owner's consent, at this position in an unbroken chain.

Why this matters commercially as well as technically: it converts a stack of compliance PDFs into a query the owner can run — the enterprise version (§05 of "The Fourth Utility") of the household promise, and a capability no cloud-custody architecture can honestly offer.

One Engine — Placement · where a job runs, and why

Placement is a scheduling decision, not dogma. The engine scores each task against five inputs and selects the lowest rung that satisfies all constraints — because every rung climbed is data moved, and moving data is the risk.

Failure behavior — measured, not asserted IMPLEMENTED · TESTED

The fetch stage talks to sources we do not control, so it runs a deadline-aware, tail-tolerant executor: deadline propagation, bounded concurrency, full-jitter backoff, per-source circuit breakers, graceful partials. Measured, from the suite: with one source deliberately hung 5.000s against a 1.000s stage deadline, the pipeline returned in 1.004s with a correct picture from the 2 healthy sources, the hung source cleanly marked degraded, and the transparency log holding exactly 2 entries — no receipt for data never accessed. Sixteen tests across consent, log, pipeline, and executor: all passing. Bounded latency with honest degradation beats unbounded waiting, on every plane.

The Personal Plane · the resident agent on Spark and Station

Above anything else, this. NVIDIA's own materials position Spark as a complete platform for local autonomous agents built for always-on workloads, and ship NemoClaw in DGX OS for secure private assistants. The personal plane makes that hardware somebody's.

Resident architecture — the Ultra runtime port ROADMAP · WORKSTREAM W1

• Substrate. DGX OS + NemoClaw as the secure always-on base; One Engine and Agent One as a resident service above it — the same layered split as our shipping Apple-native build, one codepath apart (RHEL variant for enterprise racks).
• Models. FP4-quantized open weights within 128GB unified memory on Spark (NVIDIA rates the class to ≤200B parameters); Station's 748GB coherent memory admits trillion-parameter-class residents. BYOA holds: the owner brings any model; the consent fabric doesn't care whose weights think.
• Serving. TensorRT-LLM / NIM microservices for the local endpoints; every tool call passes the §02 handshake; withheld fields never enter a prompt.
• Envelope. Always-on means power honesty: the engine schedules heavy passes against the device's thermal and energy state (the e term in place()), and the PWS-1 meter (§11) makes the cost visible instead of vibes-based.

Day 0, unchanged by heavier iron

Every Ultra ships the White-Glove Human-First install: a person delivers it; the consent ceremony sets every permission to the owner's choice, item by item from closed defaults; the first fetch runs live in about a minute (§11's budget); and the install isn't done until the owner can drive it alone. Until the Linux runtime port ships, Ultra machines run under hussh-managed infrastructure — labeled honestly, with the full experience delivered the moment the port lands. The defining demo — one connected account to a full financial picture with a dollar figure attached, on-device — is IN DEVELOPMENT · THE CRITICAL PATH; we show it before we sell on it.

Personal Post-Training · intelligence per dollar, N = 1

NVIDIA's thesis: post-training is continuous, the central workload of the agentic era, and the driver of intelligence per dollar. The household is that loop at its smallest and most private — the model that serves one family, refined by that family's corrections, on silicon that family owns.

The loop, engineered ROADMAP · WORKSTREAM W5

• Why adapters, not full fine-tunes: Station-class memory admits large residents, but the loop's economics want small, frequent, reversible updates — an adapter per domain (money, health, home), each revocable like any grant, each auditable in the log.
• Why verifiable rewards: the reward channel is the value channel; tying it to outcomes the owner can verify keeps the loop aligned with the household, not with usage metrics. The transparency log doubles as the training ledger — what the model learned from is a query, not a mystery.
• Where NVIDIA compounds it: NeMo RL/Gym turn the loop into repeatable infrastructure rather than bespoke code; Vera-class CPUs' RL-sandbox throughput and Rubin's training efficiency lower the cost of every point of intelligence a family builds into their own agent.

The Edge Plane · garage-grid node anatomy

The letter's north star, engineered: Puppy machines in garages and warehouses, linked over LEO transport, sited where power is cheap and the sun is abundant — owned by their hosts, metered by the handshake.

Anatomy of a grid node

Grid liquidity runs in closed loops we control both sides of — the first federated garage node, then one campus loop (idle cluster nights as supply, researcher burst as demand), then One power users, then the open market. Watt Score certification stays firewalled from the resale P&L (church/state); the catalog's honest 0/100 starting position fills from live routed jobs, never vendor claims. GRID: ROADMAP · SEQUENCED AFTER THE CRITICAL PATH

The Data Center Plane · governed surge, keys never persisted

The rack is rented capability, never a custodian. A burst exists for exactly as long as its job, inside a tenant the owner governs, and leaves nothing behind but a receipt.

Burst lifecycle — the full sequence DESIGNED · NOT YET WIRED (W4)

What the household actually sends

Honest job shapes, not hypotheticals: corpus-scale re-embedding after a big grant change; a long-context synthesis exceeding resident memory; the quarterly adapter consolidation; a practice's multi-client batch under each client's own grants. Rack-scale exists because these are real — and NVIDIA's delivered-FLOPs discipline (world-record MoE pre-training on GB300 NVL72; NVLink-5's 1.8 TB/s per GPU; 97%+ scaling efficiency to 1,024 GPUs; throughput still compounding from software alone) is why the surge tier's unit economics keep improving on silicon already in the fleet.

The Identity Fabric · HusshID × spaceID × SPIFFE

Three identities, three jobs, one chain of custody for every action in the system.

Every receipt binds all three: principal (HusshID), node (spaceID), workload (SVID), plus the attestation evidence of §03. That quadruple is the full answer to the only question that matters in agentic security — who authorized what code to do what, where, to whose data — as a single signed record.

Design note: the phone number is the natural key because it is the key the world already banks personal data against — the point is to invert who controls it, not to invent a new namespace nobody indexes on.

Threat Model, Three Planes

Not claimed — stated so trust is earnable

• An attacker with persistent code execution on an unlocked owner device is outside the model; we reduce blast radius (Enclave keys, least-scope grants) but claim no immunity.
• FedRAMP High authorization is in pursuit and never stated as held.
• The 60-second live first-fetch against real sources — the demo that defines the product — is in active development; we show it before we sell on it. Honesty about the boundary is part of the specification.

Metrics & SLOs · delivered, not peak

The 60-second first-fetch budget (TARGET — instrumented, so the number is measured, not asserted)

Handshake overhead (design targets)

The consent fabric must be invisible at human timescales: grant resolution and receipt signing are budgeted to sub-perceptual overhead per action, log appends are asynchronous off the hot path, and chain verification is an owner-initiated O(n) audit, not a per-action cost. These are TARGET figures under instrumentation — published as measurements only when they are measurements, in the same discipline as everything else on this page. What is already measured: the executor's bounded-latency behavior (§04) and the integrity properties of the receipt/log suite (§02) — sixteen tests, passing.

The Engineering Program · every milestone is a demo

Sequencing is governed by the critical path — the live 60-second first-fetch — and the operating gates (G0 first-dollar unblock; G1 matched-book until brokerage GMV proven; G2 runtime attach before channel scale; G3 external PCHP behind its review gate; G4 market-data only after liquidity). The ask is unchanged from the letter, now with an engineering shape: a joint pod on W1–W2, a GTC demo slot for the §05 demonstration, Alliance sponsorship for W3 — one conversation, one pilot, one garage.

Sources

NVIDIA primary materials (July 2026; retrieved Aug 3, 2026): Open Secure AI Alliance (blogs, Jul 27) · Vera Rubin intelligence-per-dollar post-training (blogs, Jul 17) · Agent Toolkit + PhysicsNeMo/CUDA-X (newsroom, Jul 26; Omniverse libraries Jul 20; Jetson Thor Jul 15) · GB300 NVL72 MoE world record (developer blog, Jul 21) · DGX Spark product page (NemoClaw, always-on local agents; retrieved Aug 3).

hussh canon: Personal Supercomputing Infrastructure — Technical Specifications (rev 2026-06-12, including all measured results and implemented types cited herein) · One Puppy Partner Master Pack · the open letter (hushh.ai/one/nvidia) · "The Fourth Utility" (rev 2026-08-03) · compute flywheel & Puppy 100 canon (wiki, Jul 2026).