SovereignClaw

SovereignClaw OS: The Zero-Trust, Self-Evolving Personal AI on NVIDIA and Nebius

Comment

Authentication

To authenticate use username-owner, password-owner

Inspiration

Today's commercial AI assistants suffer from two fatal architecture flaws: they are passive web chat interfaces that cannot safely execute code, and they harvest sensitive user data on centralized corporate clouds. When users share code, emails, or financial plans, their private context is exposed to adversarial prompt injection attacks and unauthorized data exfiltration.

We were inspired by the NVIDIA x Nebius Global AI Hackathon (Personal AI Track) to ask: What if you could own your entire personal AI operating system on open infrastructure?

We built SovereignClaw OS—a truly sovereign, always-on personal operating intelligence powered by NVIDIA Nemotron models served on Nebius Token Factory, protected by a zero-trust local privacy enclave and hardware-isolated execution boundaries.

What it does

SovereignClaw OS is a self-evolving personal operating system designed for privacy, task execution, and proactive workflow planning:

  • Zero-Trust Threat Defense & PII Redactor: Incoming instructions and untrusted content are scanned locally in $t < 20\text{ ms}$. The injection engine evaluates adversarial confidence: $$P(\text{threat} \mid x) = \max_{p \in \mathcal{P}} \text{Sim}(x, p)$$ where instructions with $P(\text{threat}) \ge \tau_{\text{threshold}} = 0.40$ are quarantined before reaching the cloud. Private secrets (tokens, keys, emails) are replaced with cryptographic enclave handles: $$\mathcal{E}(s) = \text{EnclaveToken}(\text{HMAC-SHA256}(s, K_{\text{local}}))$$
  • Isolated Code & Tool Execution: Instead of hallucinating numerical calculations, SovereignClaw delegates quantitative analysis to an isolated sandbox with strict resource limits: $$\text{RAM} \le 256\text{ MB}, \quad t_{\text{CPU}} \le 3.0\text{ s}, \quad \text{Output} \le 64\text{ KiB}$$ For portfolio workflows, it computes verifiable Sharpe ratios and volatility: $$\mathbb{E}[R_p] = \sum_{i=1}^n w_i R_i, \quad \sigma_p = \sqrt{\sum_{i=1}^n w_i^2 \sigma_i^2}, \quad \mathcal{S} = \frac{\mathbb{E}[R_p] - R_f}{\sigma_p}$$
  • Cognitive Tri-Memory Engine:
    1. Associative Knowledge Graph: Encoded as semantic triples $\mathcal{T} = \langle s, p, o, \mathcal{C} \rangle$ with confidence score $\mathcal{C} \in [0, 1]$.
    2. Episodic Timeline: Chronological event log $\mathcal{H} = {e_1, e_2, \dots, e_m}$ with sentiment valence tracking.
    3. Procedural Tool Forge: Self-synthesized, reusable Python skills compliant with the Nous Hermes tool specification.
  • Daily Planner & Task Optimization: Organizes priorities, evaluates deadline risks, and allocates deep-work blocks with opt-in NVIDIA model reasoning.
  • Always-On Background Proactivity: Runs background workers that perform overnight memory consolidation, proactive daily briefings, and tool health audits.
  • Human-In-The-Loop (HITL) Action Gates: Destructive commands (file deletion, database purges) trigger cryptographic authorization gates before any execution can proceed.

How we built it

  • Inference & Models: Served through Nebius Token Factory (https://api.tokenfactory.nebius.com/v1) using NVIDIA open source models including nvidia/NVIDIA-Nemotron-3-Nano-30B-A3B and nvidia/Nemotron-3-Ultra-550b-a55b.
  • Frontend & Visual Cockpit: Next.js 16 with Turbopack, React 19, and Tailwind CSS, featuring an emerald-accented Command Cockpit, live Directed Acyclic Graph (DAG) execution telemetry, and dark/light mode.
  • Zero-Trust Firewall: Custom local security scanner with regex-based PII masking, token substitution, and prompt injection filters.
  • Sandboxed Execution: Network-isolated process execution sandbox enforcing seccomp system-call filters and strict resource bounds: $$\text{RLIMIT_AS} = 268{,}435{,}456\text{ bytes (256 MB)}, \quad \text{RLIMIT_CPU} = 3\text{ seconds}$$
  • Local Persistence: Atomic single-file JSON persistence engine (SOVEREIGN_DATA_DIR) ensuring persistent memories, skills, and settings survive server restarts without database lock overhead.

Challenges we ran into

  1. Model Catalog & Namespace Normalization: Nebius Token Factory serves Nemotron models under clean nvidia/ prefixes (e.g., nvidia/NVIDIA-Nemotron-3-Nano-30B-A3B). Initial requests with nested namespaces returned $404\text{ Not Found}$ errors. We engineered an automated model normalization layer that maps model tiers dynamically to active Nebius endpoints: $$\text{Namespace}(M) = M \setminus {\text{"nebius/"}}$$
  2. Safe Code Execution vs. Host Security: Balancing real Python execution with zero-trust safety. We enforced sandboxed bounds with disabled network egress, memory limits, and timeouts so the agent can run quantitative calculations without exposing the host operating system.
  3. Data Sovereignty with Cloud Inference: Ensuring the cloud model receives enough context to reason effectively without leaking personal data. We implemented an enclave proxy that strips secrets into local memory handles before dispatching requests to Nebius.

Accomplishments that we're proud of

  • 100% Real Live NVIDIA Inference on Nebius: Successfully verified live completions with sub-second time-to-first-byte over high-performance Nebius Token Factory GPU infrastructure.
  • Full 13-Endpoint Automated Test Suite: Built an end-to-end verification suite (test_apis.mjs) covering memory persistence, skill synthesis, threat interception, and HITL authorization with a $100\%$ pass rate: $$\text{Success Rate} = \frac{13}{13} = 100\%$$
  • True Personal Data Sovereignty: All facts, episodic memories, and skills are stored locally on private disk storage with full user export and wipe capabilities.
  • Clean Execution DAG Telemetry: Every agent action displays its live pipeline stages: $\text{Perception} \rightarrow \text{Threat Scan} \rightarrow \text{Tri-Memory Traversal} \rightarrow \text{Nemotron Reasoning} \rightarrow \text{Sandboxed Execution}$.

What we learned

  • Tiered model orchestration significantly improves latency and cost efficiency: $$\text{Latency}{\text{triage}} \le 120\text{ ms} \ll \text{Latency}{\text{ultra}} \approx 3{,}500\text{ ms}$$ Fast Nemotron models handle immediate triage and validation, while larger reasoning models handle complex planning and code synthesis.
  • Zero-trust architecture must be applied at the edge: sanitizing prompts and redacting PII before inference is far more effective than trying to filter model output after the fact.
  • Real agentic value comes from verifiable action: giving the model access to an isolated runtime turns a conversational chatbot into an actionable personal operating intelligence.

What's next for SovereignClaw

  • Local Edge Enclave (NVIDIA RTX / TensorRT-LLM): Support hybrid edge-cloud routing where fast triage runs locally on NVIDIA RTX hardware, escalating complex DAG planning to Nebius Cloud.
  • Multimodal Perception: Integrate NVIDIA Nemotron Vision models (Nemotron-3.5-Super-VL) for direct document, architecture diagram, and screenshot auditing.
  • Peer-to-Peer Enclave Sync: End-to-end encrypted synchronization across personal mobile and desktop devices without central cloud relay servers.

Built With

Share this project:

Updates

Submission history