Every genome carries variants nobody can yet interpret. SovereignDNA is the private agent you run that tells you what your variants mean today and collaborates — without your DNA ever leaving your device — to drive the world's Variants of Unknown Significance toward zero. Only DP-noised aggregates ever cross the boundary.
A Variant of Uncertain Significance (VUS) is a genetic change that's been observed but can't yet be called disease-causing or benign. They are the single largest category in ClinVar — and they hit under-represented ancestries hardest, because reference databases don't include enough of their populations. That gap is exactly what a global, privacy-first network can close.
Drive the global count of Variants of Unknown Significance toward zero. SovereignDNA can't unilaterally reclassify a variant — that authority stays with expert panels. What it can own is the rate-limiting input to that authority: ancestry-diverse evidence at scale, produced without anyone surrendering their genome.
Sources: NAR Genomics & Bioinformatics 2024 (lqae154) · AJHG 2023 "Will VUS still exist in 2030?" · bioRxiv 2026 (MAVE groups) · Nature Communications 2025 / Sci Rep 2025 (ancestry gap). Figures are point-in-time — ClinVar and gnomAD grow continuously.
Millions of people have a genome export and almost no trustworthy local tooling. SovereignDNA is a desktop app that turns that file into a private, agent-driven workbench. Computation stays on your device by default — and when you opt in, your agent contributes privacy-protected evidence to a network that resolves VUS. Every skill is both an insight for you and a sensor for the mission.
A Tauri + Rust desktop app with a local SQLite store and a local LLM. Whole genomes stream in at a flat, size-independent peak-RAM — imported once, never uploaded.
110 sandboxed analysis skills — ancestry, traits, carrier status, pharmacogenomics, rare-variant reports — run locally in a WASM sandbox with no network or filesystem egress.
A consent & privacy ledger logs every outbound action. Egress::assert_public_only refuses genotypes by construction — raw DNA can't leave, even by mistake.
Opt in and your agent joins a differentially-private federated network. It contributes ancestry-stratified frequency and phenotype signal — DP-noised aggregates only — that helps resolve variants someone else is worried about.
"Your CYP2D6 diplotype suggests altered metabolism of drug X." "This variant is common in your ancestry." Real, local insight you run the agent for today.
The same local computation emits a privacy-protected statistic that, through the federated round, becomes evidence toward an ACMG code for some uncertain variant.
A catalogue of on-device analysis skills. Every one runs in the WASM sandbox and is also a network sensor: the strongest are ancestry/frequency skills (the #1 reclassification lever) and self-verifiable traits (the cleanest genotype↔phenotype ground truth). Health-relevant skills are informational — confirm with clinical-grade testing.
Eye color, taste, lactose, alcohol flush. You can confirm the real phenotype — the cleanest labels the network can get.
Biogeographic + fine-scale ancestry — the prerequisite for ancestry-stratified allele frequencies, the #1 benign-reclassification lever.
CFTR, HBB, G6PD, HFE — actionable, confirmable carrier status with large ancestry frequency gaps.
T2D, CAD, breast-cancer and more — honest exposed bands with transferability caveats, never fake percentiles.
CYP2C19/2D6, warfarin, statins, HLA drug-reaction — a confirmed drug response is a real-world functional phenotype.
Personal VUS report, BRCA/Lynch, novel-variant flagging — the WGS tier where actual rare VUS live and get discovered.
Vitamin D, B12/folate, iron, caffeine — biomarker self-report becomes a quantitative genotype↔phenotype signal.
ACTN3 power/endurance, VO2max, injury lean — self-reported athletic phenotype at scale.
Chronotype, caffeine-sleep. Heavily caveated (directional / speculative), exposed-bands only.
HLA typing, CCR5-Δ32, secretor status — very ancestry-variable HLA frequencies + disease/drug associations.
Rarity score, genome sonification, kinship matching — grows the network and unlocks family co-segregation (PP1/BS4).
Ranked by user value × feasibility × VUS-yield. ✓ shipped marks skills already prototyped. Each pairs an insight for you with its contribution to resolving uncertain variants.
Full 110-skill catalogue and evidence mapping available to members and in the design docs. Skills are labelled solid / directional / speculative for honesty.
Better genomics needs more data — but nobody should have to hand over their genome to get it. SovereignDNA computes an update locally, differential privacy noises it, secure aggregation masks it, and only the combined, DP-noised aggregate is ever revealed. This is not slideware: a real multi-node round already runs on managed infrastructure and provably refuses to leak.
Raw DNA never leaves your device — only DP-noised aggregates cross the boundary. A "clear gradient" update is refused at the device boundary. In the live network, that refusal probe passed.
A Rényi (ε, δ) accountant bounds each contribution: gradients are L2-clipped and Gaussian noise is added before anything is shared, with a tracked, provable privacy budget.
Bonawitz pairwise additive masking means no party — not even the coordinator — sees any single device's update. The masks cancel exactly, leaving only a DP-noised sum.
A real 3-node round ran on GKE Autopilot on Jul 17, 2026 — the aggregator reported ROUND OK with a DP-noised, secure-masked aggregate. Image fl-node:0.1.1, commit 72abe32.
Every network signal climbs an L0→L4 evidence ladder. These are gates, not scores — nothing skips a rung, and new evidence can send a candidate back down. Only L4 items are ever called a "proposed reclassification", and even then it's a submission to expert panels, never a verdict.
Whole-genome files run 1–100+ GB. The old importer loaded the entire file into RAM. We rebuilt it as a constant-memory stream: file → parser → SQLite, in bounded batches. Run it below — the payload streams live from this site's Cloudflare Worker (synthetic data).
The product is built on four grant phases, each shipping as green, reviewable pull requests against the public repo. Each card links its PRs on abhilashi/sovereign-dna.
Stream a whole genome (23andMe / AncestryDNA / VCF) → SQLite at a flat, size-independent peak-RAM via a GenomeParser streaming trait and 50k-row transactional batches. Local-first Tauri workbench.
Hardcoded analyses become signed skill manifests executed inside a wasmi WASM sandbox (empty linker → no network, no filesystem egress), distributed through a content-addressed skill registry.
User-created agents plus an auditable consent / privacy ledger. Egress::assert_public_only refuses genotypes by construction; consent is revocable and gates every outbound action.
DP-noised, secure-masked model updates aggregate across nodes with a Rényi (ε,δ) accountant and Bonawitz masking. A live 3-node round ran on GKE (Jul 17, 2026). Synthetic data only — real-genome FL is legally gated.
// The streaming contract every parser implements (Phase 1) pub trait GenomeParser { fn parse_streaming( &self, reader: &mut dyn BufRead, // 256 KiB buffered — never the whole file sink: &mut dyn SnpSink, // each variant emitted as it is read ) -> Result<ParseSummary>; } // The boundary the whole platform is built around (Phase 3 & 4) Egress::assert_public_only(&payload)?; // genotypes refused by construction let share = dp.privatize(update)?; // L2-clip + Gaussian noise (Rényi ε,δ) let masked = bonawitz.mask(share); // masks cancel → only a DP-noised aggregate crosses
Trust is not a promise — it's a log. Every outbound action is recorded with what left the machine, where it went, and why. Raw genotypes never appear; federated shares are DP-noised aggregates only. (Sample data shown below.)
| Time | Action | What left the device | Raw DNA? | Destination |
|---|---|---|---|---|
| Loading ledger… | ||||
The four grant phases are built. Next, the roadmap re-aims that engine at the North Star: turn every skill into a privacy-preserving VUS probe, prove the network is calibrated on already-resolved variants, then — only behind the legal gate — pilot on real genomes. Each step follows the same discipline: feature-flagged off by default, synthetic data only, until sign-off.
Streaming ingest, WASM skill sandbox, consent ledger, and DP + secure-aggregation federated learning — live on synthetic data.
First probe = ancestry-bucketed allele frequency (powers BA1/BS1/PM2), then case-control association — same tested crypto, new payloads. Design target.
Time-travel backtest on already-resolved ClinVar variants with proper scoring rules. Zero legal exposure, maximum credibility — the license to scale.
Only after DPIA + independent audit + ε-budget sign-off + IRB + a ClinGen/clinical partner for the L4 human gate. Candidates submitted as proposed evidence, never verdicts.
SovereignDNA is free and open-source at its core. Membership funds the mission and unlocks priority early-access to new formats, skills and research agents. Checkout is handled by the live AllScale payment rails — pay by card, Apple Pay, Google Pay or crypto, settled in USDC.
Secure hosted checkout on dash.thebeastagi.com/pay. Nothing is charged until you confirm on AllScale. Crypto payments settle on-chain and are final. Pricing shown on the membership page is placeholder and adjustable before public launch.
Be first to run sovereign, on-device genomics. No spam, no data collection — just an email so we can invite you.