Personal Knowledge Model (PKM) Upgrade Rehearsal
Public concept page defining the zero-information-loss upgrade and rehearsal framework for Hussh Personal Knowledge Models (PKM), framed on Hussh's control-plane posture.
TL;DR: Your Personal Knowledge Model rides on storage that keeps ciphertext only, a working copy inside your own pod and the durable truth as your own encrypted log in your own cloud. The PKM Upgrade Rehearsal framework is a strict, validation-driven protocol that verifies and guarantees zero information loss across version transitions, schema migrations, and projection updates, all without Hussh ever holding your holdings in the clear.
Relations
Core Concept
The Personal Knowledge Model (PKM) is the persistent memory and structural foundation for your Hussh private agent, One. As the underlying schemas, contract versions, and readable projection engines evolve, the PKM Upgrade Rehearsal protocol ensures that every structural transition happens seamlessly, securely, and with zero information loss.
The guiding principle of the PKM upgrade lifecycle is preservation and provable correctness. Before any upgraded schema or model projection is promoted, it must be programmatically proved that every historical record is safely decrypted inside the boundary that already holds the keys, transformed, re-encrypted, and verified with no drop in fidelity.
Where Your Knowledge Model Actually Lives
Hussh is the control plane, not the custodian of your holdings. One runs in your own pod, a small container in your own cloud (BYOC), with the keys that unlock it held on your own device (BYOK). Hussh operates that pod on your behalf but holds none of your information.
Your knowledge model rides on storage that keeps ciphertext only. There are two shapes of it, and they are both yours:
- A working copy lives inside your own pod, so One can read and reason over your records at conversational speed.
- The durable truth is your own encrypted log in your own cloud, unlockable only with material that never leaves your device.
Plaintext exists only inside your pod and on your device. Everything Hussh and the network see is encrypted. There is no Hussh vault of your information and no Hussh backup-of-record. The control plane keeps only public metadata (an identifier and the pod's public key), relays sealed ciphertext between parties, and authorizes consent through PCHP.
Why the Rehearsal Matters Under This Model
Because the durable backup is your own encrypted log and not a Hussh-held copy, an upgrade cannot be treated as a routine server-side migration. The records being upgraded are unreadable to the control plane by design, so the transformation has to be proved correct inside the boundary that already holds the keys, then written back as ciphertext to the log that is yours.
The rehearsal is how that promise is kept without ever asking you to trust a plaintext detour through Hussh. Every historical record is walked through the upgrade in a controlled dry run, the results are validated against the original corpus, and only a fully passing rehearsal clears the real transition.
Key Architectural Principles
- Zero-Loss Guarantee: No record, transaction context, or personal preference is ever abandoned or silently deleted during an upgrade. If an item cannot be confidently mapped to the upgraded schema, it is quarantined securely rather than dropped.
- Idempotent Replay: All upgrade, migration, and reconciliation routines are fully idempotent, so they can be run repeatedly in any environment without introducing drift or duplicate entries.
- Audit-Gated Promotion: Version transitions are gated by a comprehensive series of automated checks. Promotion to production requires full-suite validation across historical corpora, storage layers, and client interfaces.
- Sovereign Key Continuity: Throughout the upgrade sequence, your private keys stay strictly on your own device. They are never exposed to the control plane, to intermediate servers, or to logs. The material that unlocks the durable log never leaves your device, before, during, or after a rehearsal.
What This Means for You
This is what "Own your AI. Own your data. Own your compute." looks like at the level of your memory itself. Your knowledge model is upgraded in place, provably and losslessly, while remaining encrypted end to end and anchored to a durable log that only you can open. Consent stays explicit and scoped: each exchange of your records rides a single-use, signed, revocable grant through PCHP. Hussh is the enabler for the exchange and the operator of the machinery, never the holder of what is exchanged.