🤫husshhussh
🤫husshhusshOnePuppy
RFC-003 · hu_ssh/2026-07-30 · Draft

hu_ssh — moving agent state between machines a person owns.

A hardware-attested binary transport for the moment a task outgrows the device in your hand. Specified in the open, numbered in the hussh series, and honest about the distance between the specification and the code.

RFC-001: The HandoffRFC-002: for agents
Status of this document

Draft. Specified, not implemented.

Document: RFC-003 in the hussh series. Protocol version hu_ssh/2026-07-30, specification v0.1.0-draft. Status: Draft — public request for comments.

This is a numbering in our own series, not an IETF RFC.RFC numbers in the 4-digit range are assigned by the IETF RFC Editor and are not self-assignable. Earlier internal drafts of this work labelled it “RFC 9822”; that was wrong and is corrected here. If this protocol ever warrants IETF standing, that is an Internet-Draft submission and a separate, public process.

No conforming implementation exists today. There is no hu_ssh crate, wire parser or daemon in hushh-labs/hushh-research. The consent layer beneath it — RFC-001 and RFC-002 — is real working code. Do not read this document as a description of shipped software.

1 · Architecture

What problem sits underneath this.

A personal agent runs on hardware its owner already has, and most of what it does should never leave that hardware. Occasionally a task genuinely outgrows the device — a long reasoning chain, a compile, a multi-agent negotiation — and the honest options are to fail, to degrade, or to move the work somewhere larger.

Moving the work is only acceptable if the move is governed. hu_ssh is the transport for that move: it carries agent state between machines, and it is designed so the consent layer above it can gate every hop rather than trusting the first one.

THE ARCHITECTURAL FORKThe same task, two places it can runCentralized cloud siloVendor cloudphonelatencyyour dataPersonal data on someone else's serversEvery call is a round tripOffline, it stops workingSovereign edge, with burstApplesiliconGPU clusteronly when askedhu_sshconsent gateData stays on hardware the person ownsLocal first; the network is optionalOffline, it still works$0 → 1 → ∞ compute bursting, gated at every rung
The asymmetry is the argument. On the left every call is a round trip and the data has already left. On the right nothing leaves until the person permits a specific crossing, and the machine still works when the network does not.
0iPhoneNeural Engine1Macunified memory2DGX Sparkon the desk∞NVL72 rackescalated toevery rung change is a consent gate — nothing crosses without one
UNIFIED NEURAL RUNTIMEWhere a task executes, on each side of the transportOwner device — unified memoryCPUGPUNeuralone address space — no copy between themlocal model, ~95% of routine work, never leaveshu_sshQUICconsent gateRemote host — one kernel, sandboxedLandlock + eBPF boundsAgent loopSkill acquisitionheavy execution only, contained, nothing persistedWhat is designed here, and what runsThe consent layer, the scope registry and the receipt ledger are working code, live on this site.The transport, the enclave signature and the sandboxed remote runtime are a reference design.No conforming hu_ssh implementation exists. Treat this diagram as intent, not as deployment.
Two runtimes, one transport, one consent gate between them. The amber panel is the part most architecture diagrams omit: which of these boxes is running code today and which is a drawing.

The economics that make this worth specifying: Apple Silicon shares one physical memory pool across CPU, GPU and Neural Engine, so on the edge the expensive operation is not compute — it is copying, and that copy has already been eliminated. A transport that respects that fact moves diffs and delegations, not context.

2 · Wire format

A 53-byte fixed header.

Every frame begins with a fixed header in big-endian network byte order, sized so a reader can validate and dispatch without allocating.

offset53-byte fixed header, big-endian0MAGIC2B0x6875 — ASCII 'hu'2VERSION1B0x013FLAGS1Bbit 0 encrypted · bit 1 enclave-signed · bit 2 compressed4FRAME TYPE1Bsee frame table5SEQUENCE NUMBER8Bstrictly increasing — replay protection13PAYLOAD LENGTH4B17SIGNATURE LENGTH2B19RESERVED2Bmust be zero21DEVICE ID32BSHA-256 hardware fingerprint
Variable-length payload and an optional Secure Enclave signature follow the fixed header. Offsets above are computed from the field sizes, so this diagram cannot drift from the specification it illustrates.
32 bits per row · 53 bytes total · big-endian0816240MAGICVERSIONFLAGS4FRAME TYPESEQUENCE NUMBER8SEQUENCE NUMBER (cont.)12SEQUENCE NUMBER (cont.)PAYLOAD LENGTH16PAYLOAD LENGTH (cont.)SIGNATURE LENGTHRESERVED20RESERVED (cont.)DEVICE ID24DEVICE ID (cont.)28DEVICE ID (cont.)32DEVICE ID (cont.)36DEVICE ID (cont.)40DEVICE ID (cont.)44DEVICE ID (cont.)48DEVICE ID (cont.)52DEVICE ID (cont.)
The same header as the field table above, in the projection an implementer reads while writing a parser. Rows are computed by walking the field array and splitting on four-byte boundaries — the two diagrams cannot disagree, because there is only one array. The last row is short: 53 is not a multiple of four, which is itself worth knowing before you write the struct.

A parser MUSTtreat a short buffer as “not yet” rather than as an error — partial reads are the normal case on a network. It MUST reject a frame whose magic bytes are not 0x6875, and MUST NOT process a frame whose sequence number does not exceed the last accepted value on that session.

3 · Frame types

Seven frames.

0x01HandshakeInitEstablishes trust and negotiates version. Carries the Secure Enclave attestation; this is the only frame on which a full certificate chain is validated.
0x10AgentCommandA request for execution on the remote. Verified against the ephemeral session key derived at handshake, not the full chain.
0x11AgentStreamStreamed output from a command already in flight.
0x20ToolCallInvoke a tool inside the sandbox.
0x21ToolResponseReturn a result to the sender.
0x30StateSyncChunked transfer of pre-computed attention state, so a burst does not pay prefill twice for context the edge already computed.
0xFEHeartbeatLiveness. Absence is what triggers the fallback to local execution.

StateSync is the frame that justifies a binary transport at all. Without it, bursting a task to a larger model means the remote re-computes attention state the edge already has — the single largest hidden cost in any hybrid design, and invisible until measured.

4 · Lifecycle

Attest once, verify cheaply after.

Edge (owner's device)                    Remote (compute the owner burst to)
  │                                         │
  │── 0x01 HandshakeInit ──────────────────▶│  full attestation chain validated
  │                                         │  ephemeral AES-256-GCM session key derived
  │◀─ 0x01 accept (version, capabilities) ──│
  │                                         │
  │── 0x30 StateSync (chunked) ────────────▶│  pre-computed attention state
  │── 0x10 AgentCommand ───────────────────▶│  verified against session key
  │◀─ 0x11 AgentStream ─────────────────────│
  │◀─ 0x21 ToolResponse ────────────────────│
  │                                         │
  │── 0xFE Heartbeat ──────────────────────▶│  absence triggers local fallback

Validating a full attestation chain on every frame would be absurd at frame rate, so it happens once. The handshake derives an ephemeral symmetric key, and subsequent frames are verified against that. This is a deliberate trade and it belongs in the specification rather than in someone’s postmortem.

Loss of the remote is not an error condition. When heartbeats stop, an implementation MUSTcontinue the task on local hardware rather than surfacing a failure. The remote is an optimisation; the person’s task is not.

5 · Security

Two boundaries, both enforced by hardware or kernel.

KERNEL-LEVEL ISOLATIONWhat contains a remote agent that may already be compromiseduntrustedagent processLandlock LSM — read-only filesystem boundaryeBPF socket filter — unapproved egress droppedseccomp-BPF — syscall surface reducedSecure Enclave signature on the requesting frameWhat this does not defend againstA compromised owner device signs valid frames.Revocation cannot reach a frame already in flight.Nothing here prevents regretted consent.
Four independent mechanisms, each of which must fail before the next matters. The amber panel is deliberate: a threat diagram that shows only what it stops is marketing, and the three limits named there are real.

On the edge — the Secure Enclave

The signing key is generated inside the Secure Enclave and never enters kernel or user-space memory. Software cannot impersonate the device because software never sees the key. A frame claiming enclave signing without a valid signature MUST be dropped before its payload is parsed.

On the remote — the kernel

Execution is bounded by Landlock for the filesystem, seccomp-BPF for syscalls, and eBPF socket rules for egress. The threat is prompt injection reaching a shell: the answer is not a policy document but a kernel that refuses.

What this does not defend against, stated plainly. A compromised owner device signs valid frames — enclave attestation proves the hardware, not the intent of whoever is holding it. A malicious remote operator can read anything delivered to it; the protocol limits what is delivered, it does not make the recipient trustworthy. And nothing here prevents a person from consenting to something they will regret.

6 · Relationship to other protocols

A transport, not a universe.

hu_ssh sits beneath the consent layer, not beside it. RFC-001 decides whether an exchange may happen; RFC-002 decides what vocabulary it speaks; hu_ssh moves the bytes once both have said yes.

It composes over the same open rails as the rest of the stack rather than replacing them: MCP for tool access, A2A for agent negotiation, AP2 and UCP for anything that moves value. Where MCP standardised how an agent reaches a tool over HTTP, hu_ssh addresses the case MCP explicitly does not: bulk state moving between machines the same person owns, where the bottleneck is memory bandwidth rather than request semantics.

Design decisions here follow the seven changes we adopted from MCP’s 2026-07-28 revision — date-stamped versions carried per request, no held session state above the grant, and a deprecation window we still owe.

7 · Open problems

What we do not know how to do yet.

  • KV-cache representation across model families. StateSync assumes the edge and the remote can agree on an attention-state format. Between different model families they cannot, and the fallback is to pay prefill twice.
  • Backpressure under burst. Credit-based sliding-window flow control is specified; the right window sizing under real GPU contention is unmeasured.
  • Attestation on non-Apple edges. The threat model leans on the Secure Enclave. Android StrongBox and TPM-backed desktops need an equivalent that is not merely analogous.
  • Revocation reaching an in-flight burst. RFC-001 requires revocation to invalidate every derived access. A long-running remote task holding a session key is exactly the case that is hard.

These are stated because a specification that lists no open problems has either solved everything or not looked. Ours has not solved everything.

Implement it, argue with it, or tell us it is unnecessary.

The specification is open and unimplemented. That is the best moment to change it.

The specification indexWhat is actually running

One is a product of Hushh Technologies Corporation (brand: 🤫 “hussh”), an independent company. One runs on third-party silicon, systems, and cloud; platform names are used solely to describe where One software runs and imply no affiliation, endorsement, or sponsorship by those platforms. Our own go-to-market and bill-of-materials partner programs are real and actively in pursuit; we name a partner only once an agreement is executed.