Allodial Furnace

Specification and evidence

Written for a CIO, a security officer, a facilities engineer and a records officer.

Sizes and specifications

Three sizes, named in rated kilowatts, because that is how a boiler is sold and because computing heat is produced at a coefficient of performanceHeat delivered per unit of electricity consumed. A heat pump moves heat rather than making it, so its figure is above one. of one — so a single number describes the electrical draw, the thermal output, and a fair proxy for capacity.

Measure	Furnace 2kW	Furnace 7kW	Furnace 70kW
Typical siting	One building, one or two departments	A civic center or campus building	A central facility for a whole organization
Rated thermal output	2.34 kW	7.09 kW	70.04 kW
Heat delivered	7,982 BTU/h	24,174 BTU/h	238,985 BTU/h
Electrical service	20 A, 208–240 V single-phase per feed	30 A three-phase 208 V	300 A three-phase 208 V
Water consumed	Zero	Zero	Zero
Form factor	Cabinet	Cabinet	Single rack

The computed power chain

Every figure derives from part-level power draw rather than estimate, and the chain runs end to end. Change a component and everything downstream moves.

Measure	2kW	7kW	70kW
Component-level DC load	2,199 W	6,660 W	65,840 W
AC input, what the branch circuit sees	2,339 W	7,085 W	70,043 W
Facility design load	2,573 W	7,794 W	77,047 W
Current per phase at 208 V	7.2 A	21.9 A	216.0 A
With continuous-load factor	—	27.3 A	270.0 A
Minimum breaker	20 A single-phase per feed	30 A	300 A
Redundant supply loading, surviving feed	73.3%	74.0%	73.2%

Dual feeds are standard. Our rule is that the surviving feed carries full load at or below 85% continuous, and the check is a live calculation in the specification rather than a note, so a change that breaks it fails loudly.

Thermal

Measure	2kW	7kW	70kW
Captured into the liquid loop (design)	63%	76%	77%
Coolant flow at 18 °F rise	0.55 gal/min	2.0 gal/min	20.3 gal/min
Coolant flow at 36 °F rise	0.29 gal/min	1.0 gal/min	10.1 gal/min

The smallest unit captures least to liquid because its pumps, fans and board are a larger share of a small load. If a site needs a higher fraction, the lever is plating more components — a configuration conversation, not a limit.

The useful delivery range is set by what the building wants: space heating typically 95–115 °F, domestic hot water 120–140 °F. A lower return is still useful behind a heat pump, which is how most retrofits will take it. Usefully, a warmer return removes more heat per unit of flow and raises the cooling efficiency ceiling, so tuning for recovery does not cost efficiency.

How the thermal model is validated

Grounded in cited material constants — copper conductivity, specific heat and density of water — and proves both halves of the path: conduction from the die through the cold plate stack, and first-law capture into the coolant. Condensation, coolant chemistry and cooling failure are modeled explicitly: supply water is held above the plant roomThe mechanical room in a building that houses its boiler, water heaters and pumps. dew pointThe temperature below which moisture in the air condenses on a surface. so no surface can condense; conductivity, galvanic compatibility between dissimilar metals and leak-before-damage are stated design conditions; loss of cooling has a bounded survival window rather than an optimistic assumption.

Our direct-liquid cooling overhead reference is 1.187. For context, and these are pinned constants in our own model with sources and retrieval dates: the 2025 industry survey average is 1.54, one hyperscaler's 2024 fleet figure is 1.09, and the best-measured supercomputer is 1.03. We are better than the industry average and we are not better than a hyperscaler's fleet. Anyone telling a commission that a small distributed machine beats a purpose-built facility on cooling overhead is misleading them. Our argument is that we consume no water, take no land, need no construction, and give the heat back — none of which a hyperscaler can offer at all.

Security architecture

Attestation

The machine produces a signed attestationA signed statement, produced by the hardware, of exactly what software is running on it. describing exactly what is running on it. The verifier that consumes it fails closed: it returns a trusted verdict only when the certificate chain, the signature, the expected measurements and the freshness check have all passed. Sealing is correct by construction — there is no path that seals data to an unattested key. A chained verdict requires every stage trusted, so no skipped or compromised layer can produce a trusted chain.

Multi-tenant separation

Proven across five axes simultaneously: distinct identity, distinct attested key, a distinct accelerator partition per tenant, both sides confined from network egress, and no shared writable storage. Separation is mutual rather than one-directional and is verified against the real implementation.

One consequence shapes sizing: in the confidential configuration each accelerator is an independent isolated slot, so a model must fit on a single card. That is a real constraint, and it is also why per-department isolation is strong — every card is independently walled off rather than sharing a fabric with its neighbors.

Audit and records

Every determination records the model identity, the configuration it ran under, the typed values extracted, the rule-set version applied, the citations, and the outcome or refusal. The log is append-onlyA record that can be added to but not edited or deleted., hash-chainedEach record carries a cryptographic digest of the one before it, so altering one entry breaks every entry after it., resident in your database, and exports in full. A separate disclosure registerA log of reads of regulated data, recording who read what and under which authority. accounts for every regulated read before the data is served, so "who looked at this record, under what authority" has an answer written at the time rather than reconstructed later.

Prompts and outputs are becoming public records in their own right, and at least one state now requires retaining an AI-generated first draft with a full audit trail.

Identity and cryptography

Federates to the directory you already run over SAMLA standard that lets staff sign in to one system with the accounts another system already issues. or OIDCOpenID Connect, a standard that lets staff sign in to one system with the accounts another system already issues., so staff keep existing accounts and you do not operate a second identity system. Machine identity and record signing use hybrid signatures across three independent schemes including the NIST post-quantumCryptographic schemes designed to stay secure against an attacker with a quantum computer. standards.

Stated precisely: our cryptographic policy enforces an approved-algorithm subset so a non-approved choice cannot be selected. It is not itself a validated module under FIPS 140-3The U.S. federal standard for testing and validating cryptographic modules., and we say so rather than letting you assume otherwise. Where a validated module is a hard requirement, the architecture accommodates it — a validated vendor operating system runs inside the enclaveA hardware-isolated region of a machine whose contents the software outside it cannot read. where regulated data lives, with our platform on the management planeThe part of a system used to maintain it — firmware, patches and health telemetry — as distinct from the part holding the records. outside it. Bring your specific control language and we will answer against that arrangement.

Compliance posture

Architected around the CJIS personnel rule. The administer-without-reading split exists because criminal justice information rules reach people, not only data. CJIS itself is not yet in our regulatory catalog, along with IRS Publication 1075 and StateRAMP, and we will not claim coverage we have not completed.

Mapped and proven total coverage exists for the NIST AI Risk Management Framework, SOC 2, ISO 27001, ISO 42001, HIPAA and GDPR, within a closed taxonomy of 86 regimes. Coverage certificates are constructed only when every control in the catalog is cited by signed evidence; a gap returns the list of uncovered controls rather than a certificate.

For a US county, the three that matter are the NIST AI RMF mapping, the audit log built for state public-records law, and the personnel architecture above.

NIST AI RMF
SOC 2
ISO 27001
ISO 42001
HIPAA
GDPR

Acceptance gates we underwrite

Two hardware acceptance tests in our own procurement specification are unusual, and we include them because we can underwrite what they test for.

Bitwise reproducibility. Identical results across repeated runs, across devices, and across a cold power cycle, with clocks pinned throughout. We hold the arithmetic half as machine-checked proof — 145 theorems across the correctly-rounded square-root family in single and double precision, covering existence, uniqueness, boundary, interior and normal cases. Stated precisely, because the precision is the point: we prove the arithmetic is uniquely specified; the acceptance test proves the assembled system delivers it. Reduction order, atomics and power-state variation are the systems half, tested rather than asserted.
Per-device isolation, demonstrated rather than described. In a single boot with the intended configuration applied, a dump showing every accelerator in its own hardware isolation group, alongside a passing peer-to-peer benchmark. If isolation had to be weakened to pass the benchmark, the groups merge and the gate fails.

For a buyer processing benefits records, "the same input produces the same output, provably, and we fail our own acceptance test if it does not" is a claim very few vendors can make.

Support tiers

Sealed. No vendor network access at all. Signed update bundles arrive on removable media and your staff apply them, with an offline tool that verifies the signature chain. For air-gapped and criminal-justice-adjacent deployments.
Attested (default) We update the management plane over an authenticated channel you can revoke. No data-plane access, ever, and the architecture proves it.
Operated. Attested, plus named staff holding current background clearance, plus an emergency access path requiring your approval, time-limited, recorded to your log.

Updates

Everything shipped is a signed bundle — platform images, weights, configurations, rule sets, modules — each with a version, a hash and a signature, installing only if the signature verifies against a key in the machine's trust storeThe set of signing keys a machine accepts as genuine.. Rings rather than fleet-wide pushes. A/B partitions with automatic rollback on a failed health check. The customer holds the trigger even on the Attested tier.

We built the offline path first, because it is the only answer that survives "what happens when the network is down."

A model change is a major change: full acceptance run, new identity record, re-tested configuration, never riding along with a routine patch. You are told before and after. You can decline and stay put — a machine running last year's qualified model is a supported configuration. If it were not, we would have quietly sold you a subscription.

What the specification does not yet contain

We would rather you hear this from us than find it.

Outlet water temperature is not yet specified. capture fractionThe share of a unit's heat output that reaches the liquid loop rather than the surrounding air., flow and temperature bounds are computed; delivery temperature is an open product decision pending a reference building.
The heat-rejection path for the case where the building will not take the heat — high summer with no hot water demand, or the leak-isolation valve closing — is specified as a requirement and not yet priced. Every cost figure understates by that amount, in a known direction, and it appears on the quotation rather than in a footnote.
Roughly 11–13% of the bill of materialsThe itemized list of parts behind a unit's cost. has no vendor quotation behind it. A formal request for quotation is the instrument that closes this.
There is no measured serving throughput for this hardware. The only card-level measurements we hold are from February, on a small model, taken before the caching layer existed. Proven-consistent simulation is not measurement. We will not quote a performance figure until it is measured and independently reproducible, and we would rather lose a deal on that than win one and be wrong.
Break-even against a cloud subscription. On our own analysis it lands between roughly 170,000 and 1,480,000 tasks per month depending on which cloud price you benchmark against, and a composite 500,000-resident city generates roughly 76,000 government transactions per month across every function we have studied. Most US cities are below that band. This is why we do not sell on cost per query. Ask us for the full model.

Pricing

Quoted per configuration. Accelerator count, memory, heat-rejection arrangement and installation all vary by site. A specification pack returns a quotation with every line sourced and dated, and every estimated line marked as estimated.

Ask us — and ask every vendor — for the upgrade path and residual value position in writing before a capital vote. Computing hardware depreciates faster than the schedules public bodies normally use, and "what happens when it's obsolete in three years" is a fair question with no comfortable answer.

Terms

coefficient of performance: Heat delivered per unit of electricity consumed. A heat pump moves heat rather than making it, so its figure is above one.
plant room: The mechanical room in a building that houses its boiler, water heaters and pumps.
dew point: The temperature below which moisture in the air condenses on a surface.
attestation: A signed statement, produced by the hardware, of exactly what software is running on it.
append-only: A record that can be added to but not edited or deleted.
hash-chained: Each record carries a cryptographic digest of the one before it, so altering one entry breaks every entry after it.
disclosure register: A log of reads of regulated data, recording who read what and under which authority.
SAML: A standard that lets staff sign in to one system with the accounts another system already issues.
OIDC: OpenID Connect, a standard that lets staff sign in to one system with the accounts another system already issues.
post-quantum: Cryptographic schemes designed to stay secure against an attacker with a quantum computer.
FIPS 140-3: The U.S. federal standard for testing and validating cryptographic modules.
enclave: A hardware-isolated region of a machine whose contents the software outside it cannot read.
management plane: The part of a system used to maintain it — firmware, patches and health telemetry — as distinct from the part holding the records.
trust store: The set of signing keys a machine accepts as genuine.
capture fraction: The share of a unit's heat output that reaches the liquid loop rather than the surrounding air.
bill of materials: The itemized list of parts behind a unit's cost.