One private agent running across an iPhone, a Mac, a desk-sized NVIDIA box, and a rack in a data center — with a consent handshake on every hop between them. A research dossier and a technical essay.
Author and researcher.Founder of hussh (HushOne, Inc.), under Hushh Technologies Corporation. Previously General Manager of AI Infrastructure at Google Cloud, running TPU and GPU Products & Engineering; AI/ML platforms at Microsoft on Azure ML; and Splunk before that.
This paper is published in two parts. Part I is a research dossier — annotated bibliography, technical synthesis, open problems, the evaluation landscape, a multi-year research agenda, and a steelman of the skeptics. Part II is the technical essay reproduced below, in the author’s first-person voice.
Confidence conventions are carried from the dossier. Vendor-published figures are attributed to the vendor. Where a claim could not be corroborated, the paper says so rather than rounding it up — including about our own internal runtimes.
In 2021 my family got hit by identity theft. Social Security numbers, bank accounts, driver’s licenses, all of it. We lost millions. And here is the part that still makes my jaw clench: nobody told us.People were reading and using my family’s most private data, and there was no moment — not one — where anyone asked, or even notified us.
That is the bug. Not a software bug — a civilizational bug. So the founding principle is embarrassingly simple: if anyone reads your private data, you must be notified. Consent is always required. Your data, your business.
That principle isthe product. Everything technical below is just me being a nerd about how to make it real on today’s hardware.
One is your private agent. Not ours — yours. The design rules are stubborn on purpose.
BYOA — bring your own AI, API, computer, system
One does not trap you on somebody's cloud. You point it at the models and machines you trust.
Your phone number is your identity
Not an ad ID, not an email you will abandon. The thing you already are.
Full CRUD rights on your own data
Create, read, update, delete. Radical, I know.
And PCHP — the Personal Consent Handshake Protocol. I keep calling it hu_ssh: SSH, but for humans. A secure handshake for your life. Every data flow gets a handshake, a consent, and a receipt.
Under the hood two personas do the work, but you only ever talk to One. Kai is the intelligence and orchestration brain — good at money and logistics and getting things done. Nav is the privacy guardian, standing at the door checking every consent before anything moves. Kai wants to be helpful; Nav makes sure helpful never means creepy. You see One. They argue backstage so you do not have to.
Modern personal compute is not one machine — it is a ladder. The whole trick is running each piece of a task on the rung where it belongs, with a consent gate on every rung change.
Rung 1The iPhoneApple Neural Engine + Foundation ModelsA ~3B-parameter on-device foundation model. Apple splits the transformer so the last ~37.5% of layers reuse the first block's key/value cache and drop their own K/V projections - Apple reports this reducing KV-cache memory by 37.5% and improving time-to-first-token - plus 2-bit quantization-aware training.
30 tok/s · ~0.6 ms/token to first token
Source: Apple Machine Learning Research, measured on iPhone 15 Pro[1,2,3,4]
What runs here: Intent parsing, PII redaction, consent cards, on-device search over the Vault. The things that must be instant and must never leave.
Rung 2A Mac with a lot of unified memoryMLXThe home supercomputer nobody realizes they own. MLX uses the unified-memory architecture so CPU and GPU share one pool zero-copy, with lazy evaluation that fuses ops before anything runs and 4-bit quantization built in.
M5 Max: up to 128 GB @ 614 GB/s · M3 Ultra: 512 GB
What runs here: The heavy thinking. Still on your metal, still in your house.
Rung 3An NVIDIA DGX SparkGB10 Grace-Blackwell, on the desk128 GB of coherent unified memory and roughly a petaFLOP of FP4. Single-stream dense 70B decode is bandwidth-bound - LMSYS measured Llama 3.1 70B FP8 at 803 tok/s prefill and 2.7 tok/s decode at batch 1, because 273 GB/s is the ceiling. For concurrent agentic work and fine-tuning it is a different machine entirely.
What runs here: Always-on agent jobs.
Rung 4A GB200 NVL72 rackFor when a task is genuinely enormous72 Blackwell GPUs and 36 Grace CPUs fused by NVLink into one accelerator with 13.4 TB of pooled HBM3e. Around 120 kW a rack.
What runs here: You do not own this. You escalate to it, briefly, only when the job earns it - and only after a consent gate says yes.
Here is the part I care about most. When a task moves from phone to Mac to Spark to cloud, it does not just move. Nav does a hu_ssh handshake at each boundary: what data, for what purpose, to which machine, for how long, revocable — and it writes a receipt.
Tool calls ride MCP, the Model Context Protocol — the thing that became the USB-C of agent tools, got an official registry, and was donated to a Linux Foundation body.[15,16,17] Payments, when an agent spends money, ride AP2-style signed mandates — Google’s Agent Payments Protocol launched with 60+ partners including Mastercard, PayPal and American Express, using cryptographically signed mandates backed by verifiable credentials.[18]
PCHP is the consent gate that sits above the tool call and beside the payment mandate. Sensitive tokens are tagged so they physically never cross a boundary they were not consented across. That is the whole game.
The finance moment
You connect Gmail. One reads what is already in your inbox — statements, bills, subscriptions — and builds a picture of your financial life from it. Every read fires a consent handshake and leaves you a receipt. No mystery. No “some partner accessed your data.” We have not published a time-to-result or a savings figure for this, because we have not measured one.
Family logistics
“One, sort out the week.” It reconciles calendars, flags the school thing that collides with the flight, drafts the messages — on-device where it can, escalating only the heavy reasoning to the Mac, never shipping the kids' schedule to a stranger's cloud.
Health
The most sensitive material stays on Rungs 1 and 2. A summary of a lab result never has to leave your Secure Enclave to be useful to you.
Negotiating with brand agents
A brand's agent asks your agent a question. One answers under your rules, with a consent receipt — and if there is value exchanged, you are the one who gets paid. Your agent negotiates; you own the transcript.
I am allergic to vaporware, so here is the ledger.
The consent layer is genuine working code in hushh-labs/hushh-research: a substantial Python package under consent-protocol/hushh_mcp covering agents, an ADK bridge, and consent services, plus an OpenClaw/ClawHub plugin surface. The specific tool and test counts quoted in earlier drafts of this paper are not restated here, because we could not verify them against the repository at time of publication.[27]
pchp.js is live sitewide on this domain as the consent surface, bridged into Google Consent Mode v2 with all four signals defaulting to denied. Signed, TTL-capped consent tokens and a hash-chained receipt ledger back the Agent One path.[25]
hu_ssh is published as a specification and a reference design. There is no hu_ssh implementation in hushh-research today - no Rust crate, no wire parser, no server daemon. The file paths that appeared in earlier drafts of this essay described an intended layout, not files you can clone, and have been corrected. We would rather be argued with about the design than credited for code that does not exist.
The lineage is real and public - NVIDIA's NemoClaw is an open-source reference stack orchestrating OpenClaw and naming Hermes among its runtimes. Our internal configuration of them has no canonical published spec yet, and this paper deliberately does not describe one.[26]
WWDC 2026. Apple shipped Foundation Models, a Core AI framework, and Dynamic Profiles, and doubled down on Private Cloud Compute — whose five guarantees (stateless computation, enforceable guarantees, no privileged runtime access, non-targetability, verifiable transparency) are close to a values statement I would tattoo on the company.[22,21,20]
Google UCP and AP2. Cryptographically signed mandates under agent commerce — here is exactly what my agent may spend, on what, for how long. That is the consent-layer positioning PCHP has been about from day one.[19,18]
When Apple and Google independently build the fences, it is a good sign the fence company has a business.
If you are at Apple: the Foundation Models framework, Core AI, and PCC are the best on-device privacy substrate ever shipped. Let us put a real consent handshake on top of it, so users get notified and get to decide, every time.
If you are at Google or NVIDIA: MCP, AP2/UCP, NeMo, NemoClaw, DGX Spark — you built the rungs of the ladder. Let us standardize the consent gate between the rungs, so a personal agent can run across all of it without a single unconsented byte.
And if you are a builder with an iPhone, a Mac, and maybe a little Grace-Blackwell brick on your desk: you already own a supercomputer. Point your own agent at it. Make it ask permission. Make it leave receipts.
That is it. That is the weekend project. Turns out the hard part was never the FLOPS. It was the manners.
Your agents. Yours to own.
— Manish
Every performance figure on this page is a number someone else published, attributed above to the party that measured it — Apple Machine Learning Research for the on-device model, LMSYS Org and NVIDIA for DGX Spark, Apple’s own tech specs and Newsroom for the Mac tier, and vendor specifications for the NVL72 rack. None of them are our own end-to-end measurements of a shipped hussh system. When we have those, we will publish them with the methodology and the harness, including the runs that disappoint us.
The dossier that backs this essay carries per-claim confidence tags and a full citation trace. Claims we could not corroborate — including the internal specifications of our own Hermes and NemoClaw configuration — are marked as such rather than presented as settled.
RFC-001: The Handoff · RFC-002: for agents · The Personal Knowledge & World Model · PCHP in production
Primary sources: the vendor's own specification, the paper itself, the protocol's own documentation. Each was opened and read, and the line under each link says what that source actually establishes, not what this essay wishes it established.
The protocol is open. The reference work is public. Bring your own agent, your own keys, and your own machines.
🤫 One is made by Hushh Technologies Corporation, an independent company. We name the hardware and clouds One runs on to say where it runs. None of them endorse us, and we call a company a partner only once the agreement is signed.