sovm protocol family

Category: Experimental

SSP/1 · SOP/1

Status: specification, no released implementation

Abstract

Storage never implies access.

sovm replicates a dataset across machines under a single trust authority and keeps it encrypted so that the machines carrying it cannot read it — and neither can any third party. Its preferred live transport substrate, iroh, finds peers by public-key identity, traverses NATs where possible and falls back to encrypted relays. Privacy is not a feature here; it is the constraint the rest of the design bends around.

Status
Specification. No released implementation.
SOP/1
Frozen architecture baseline, ten open decision gates.
SSP/1
New specification, conformance corpus pending.
Transport
iroh over QUIC; NAT traversal and encrypted relay fallback.
Primitives
MLS (RFC 9420), COSE (RFC 9052), Parquet.
Figure 1
Figure 1: Storage does not imply access. The relay path carries ciphertext only.

Any dataset that must outlive one machine needs replicas. Most systems make you choose between cheap replicas and safe ones.

Replicas are only affordable if they can be cheap and untrusted, and they are only safe if holding the bytes conveys no ability to read them. sovm separates “who stores this” from “who can read this”, and neither set is inferred from the other.

Under the hood it is two protocols sharing one substrate. SSP/1 synchronizes small mutable state — configuration, catalog metadata, entity records — and supplies identity, trust and policy. SOP/1 carries high-volume data as encrypted immutable objects.

Ciphertext is the object

Encrypted Parquet with encrypted footers, so a holder learns neither contents nor schema, column statistics or row counts. Plaintext exists only as transient state on an authorized machine.

Storing is not reading

A machine can hold a complete replica while being cryptographically unable to decrypt any of it. Untrusted storage is a first-class participant.

Standard cryptography

Group membership and key distribution use MLS (RFC 9420); records and signatures use COSE (RFC 9052). Nothing bespoke to audit.

No coordination for writes

Machines produce data while disconnected and publish on reconnect. No master node, no global sequence number, no agreement between peers on the write path.

The transport finds the path

iroh dials by public-key endpoint identity, tries direct QUIC paths, hole-punches through NATs where possible and falls back to encrypted relays when direct connectivity fails.

Compute goes to the data rather than the data to the compute.

The valuable remaining corpus is private, continuously generated and siloed: behavioural traces, sensor observations, access histories and decisions made by humans and agents. Nobody hands it over, because using it currently means surrendering custody of it.

To be clear about the boundary: sovm does not make a model private. It provides no differential privacy and no secure aggregation, and a node that trains must decrypt.

No export step

SOP objects are encrypted Parquet — once decrypted by an authorized node they feed Arrow, polars, DuckDB and standard loaders directly, column pruning intact. No duplicate “ML copy” for governance to lose track of.

Reproducible by construction

An object’s identifier is the hash of its exact encrypted bytes. A training run pins its input set by hash; a later run can prove it used the same data.

Verifiable provenance

Every object carries an immutable producer signature — “this came from that node” is cryptographic, not a database field somebody could have edited.

Selective access

The encrypted catalog carries time ranges and value bounds, so a training set is selected on those and only matching objects are decrypted.

Federated training is the natural shape

Scope and placement are already separate, and an aggregator can carry traffic it cannot read.

4.1 Personal

A private data lake with one reader: you.

Imagine holding the file Google keeps on you, joined to the file Meta keeps on you, joined to everything neither of them has: your messages, location, health, finances, reading, device access and the decisions your agents make on your behalf. Now answer the only question that matters — where would you dare to put it?

Not in a bucket you rent. Not behind a provider’s recovery key. sovm’s answer is that the lake replicates across your own machines, and any capacity you rent holds ciphertext it cannot read. Local-first by construction; hyperscalers optional and blind. A subpoena served on a storage host produces encrypted objects and nothing to decrypt them with, and the CLOUD Act reaches provider-held data, not keys the provider never had.

The point of assembling it is that an assistant can finally reason over the whole record. The model comes to the data, on hardware you control, instead of the data being surrendered to whoever is running the model.

The honest boundary

One authority holds the keys, and that authority can be a person or a household. Lose the key material and the backups, and the lake is gone — see 6.

4.2 Enterprise

A data plane laid over the network you already have.

Large organizations do not have one network; they have decades of them, plus acquisitions, plus regions that legally cannot pool their data. sovm is an overlay: it does not ask for a flat network, a central cluster or a migration. Its preferred iroh substrate finds peers across NATs, uses direct paths where possible and relay-assisted paths where necessary. Nodes replicate encrypted objects across whatever connectivity exists, including links that are metered, intermittent or one-way.

The shortest description is a child of Tailscale and Databricks — the former’s “connect the estate without re-architecting it”, the latter’s “tables and files people can actually query”. Objects are encrypted Parquet, so once an authorized node decrypts, DuckDB, polars and Arrow read them directly. Lakehouse semantics proper are the next specification revision, not a shipped claim.

It is also the sanctioned answer to shadow IT. A team can stand up a proof of concept against real data inside the trust boundary, with one explicit and auditable export boundary rather than silent background replication — and platform teams can revoke a node as an MLS membership operation when the experiment ends. Prove the value before committing the budget.

5.1

AI training data

Private behavioural, sensor and access histories from humans and agents that must stay in their owner’s custody while remaining trainable on.

5.2

Edge and IoT

Gateways collect while disconnected, links are metered and unreliable, history lands somewhere that must not read it.

5.3

Self-hosted and personal

Replicated across your own devices instead of a provider’s.

5.4

Research datasets

Confidentiality obligations met while still replicating for durability.

5.5

Small-team operational data

Stays inside a trust boundary and survives any single machine failing.

5.6

Archival to untrusted storage

Including rented capacity, with cryptographic rather than contractual assurance.

Being explicit about this matters more than the feature list.

The mesh spans one trust authority. It is not a protocol for sharing data between mutually distrusting parties, and it does not provide collaborative multi-writer editing semantics.

Note — Revocation does not reach back

A machine that was authorized cannot be made to forget what it already read. Revocation stops future access only.

Note — Metadata still leaks

Storage providers observe object sizes and transfer timing. Traffic analysis is reduced, not eliminated.

Note — No recovery key

If the trust authority loses its key material and its backups, the data is gone. That is the design, not a gap in it.

Note — Not shipped

Neither layer has a released implementation. SOP/1 is a frozen architecture baseline with ten open decision gates; SSP/1’s conformance corpus does not exist yet.