An estate organ · the structural immune system
Not a wall bolted on, but the shape of the thing: a command that is not signed, not within its budget, not at κ, and not unseen never becomes a command at all.
9 of 10 sealed rules held.
The gate dropped 72 of 72 attacks it had never seen with 0 of 48 valid packets wrongly dropped, and no forged packet was ever parsed. A detector GROWN against training streams caught 27 of 27 hostile held-out streams against the hand-set baseline's 11, flagging no legit stream.
▶ v3 · Behavioral Entropy Signatures — the one-class answer to flag3 (the grown detector's honest held-out failure): model the operator's own entropy across three domains and flag deviation from the operator's OWN baseline, so an attack family the gate never saw is caught by construction. Measured: 2% operator false-positive, 100% of two unseen attack families. Open the BES gate →
| rule | result | predicted before the run | |
|---|---|---|---|
| every structural attack is dropped (caught === attacks) | 72 of 72 structural attacks dropped | PASS | pass — the gate is correct by construction, but this proves there is no hole left open |
| no valid packet is dropped (falsePass === 0, valid > 0) | 0 valid packets wrongly dropped (of 48) | PASS | pass |
| no forged or tampered packet is ever parsed — each is judged forged, a verdict only the signature check can reach (parsedForged === 0) | 0 forged packets ever reached unpack | PASS | pass — the gate returns forged for a tampered payload, never off-κ |
| on the held-out streams the grown detector catches more hostile streams than the hand-set baseline | grown caught 27, hand-set baseline 11 (held-out) | PASS | pass, narrowly — the search should find a cut at least as good as the hand-set one; it could tie |
| the grown detector flags no legit held-out stream | no legit stream flagged | PASS | pass — a false pass is death in the fitness, so the grown detector cannot carry one |
| re-running the whole battery from the seal gives the same counts and the same grown detector — CI re-runs it on every push | CI re-runs the whole battery from the seal | PASS | pass |
| under a flood of 400 unique packets the bounded store never exceeds its cap of 64, and every in-window replay is still caught | under 400 unique packets the store peaked at 64 of cap 64; 64 of 64 in-window replays caught | PASS | pass — the store evicts oldest-first, so it is capped by construction; the flood is far larger than the cap and the last-cap nonces are still held |
| a stream of packets each within the per-packet budget cumulatively drains more than the cap: every packet passes the gate (rejected === 0) yet the detector catches the stream | 20 of 20 packets passed the per-packet gate (cap 3000) drawing 59810 cumulative; the detector caught the stream | PASS | pass — each packet is within the per-packet budget so the gate admits all; the window is a clear drain the detector flags |
| on the harder near-boundary held-out set the grown detector still catches at least as many hostile streams as the baseline with zero false pass (reported honestly either way) | near-boundary held-out: grown caught 0 of 32, baseline 0 (best grown-weight threshold reaches 20); flagged a legit stream | FAIL | uncertain — this is a real distribution shift; the grown detector may drop. Published whichever way it lands, which is the point of the harder set |
| every rerouted attack gets zero budget and no capability, and no escalation pivot succeeds (a contained dead-end, measured not asserted) | 72 rerouted attacks: 0 budget granted, 0 grants, 0 escalations | PASS | pass — phantom grants zero budget by construction and an un-keyed/over-budget/un-granted pivot is still dropped |
Eight attack shapes plus replay, 8 of each, against 48 valid packets — fresh Ed25519 keys each run, so the counts are what is compared. Every attack is dropped; every valid packet passes.
| attack | thrown | dropped |
|---|---|---|
| forged | 8 | 8 ✓ |
| tampered | 8 | 8 ✓ |
| budget-exceeded | 8 | 8 ✓ |
| resource-denied | 8 | 8 ✓ |
| malformed | 8 | 8 ✓ |
| off-kappa | 8 | 8 ✓ |
| unknown-source | 8 | 8 ✓ |
| source-mismatch | 8 | 8 ✓ |
| replay | 8 | 8 ✓ |
| valid packets | 48 | 48 passed |
Forged and tampered packets reached unpack 0 times — the signature is checked before the payload is parsed.
Individually-valid packets can still form a hostile stream — a scan across targets, a budget drain, a burst. A detector (a weight per feature n, fanout, budgetSum, dominance, resourceSpread and a threshold) was grown on 60 training streams and measured on 60 held-out streams it never saw.
| hostile streams caught | legit flagged | |
|---|---|---|
| grown | 27 of 27 | none |
| hand-set baseline | 11 of 27 | none |
A false pass — flagging a legit stream — is death in the fitness, so a detector that cries wolf never survives. The grown weights: [3.26,1.7,0.58,0.28,0.33], threshold 0.992.
Four flags a verify pass raised, each now sealed and measured, not asserted.
An unbounded set of every nonce ever seen is a memory-exhaustion DoS. The store is now a sliding window of the most recent 64 nonces. Under a flood of 400 unique packets it peaked at 64 — never past the cap — while 64 of 64 in-window replays were still caught. A packet older than the window is forgotten; that trade is what bounds the memory.
The per-packet gate has no cumulative budget. A stream of 20 packets each within the per-packet cap of 3000 drew 59810 cumulatively — 20× the cap. Every packet passed the gate; the detector over the accepted window caught the drain. Gate and detector together, not either alone.
The clean train/test split gave the detector a fat margin. Re-measured on a near-boundary set — legit and hostile mixed right at the cut, a real distribution shift — the grown detector held up: 0 of 32 caught vs the baseline's 0, no legit stream flagged (the best any threshold on its weights reaches here is 20).
Every one of the 72 rerouted attacks got 0 budget and 0 capabilities, and 0 escalation pivots succeeded. A dead-end that is measured to be a dead-end.
A command is six bytes — the Primorial-Fold packet. On the wire it travels signed: [sourceId:1][payload:6][Ed25519 signature:64] = 71 bytes.
The Ed25519 signature over sourceId+payload is checked before the six bytes are ever unpacked. A forged or tampered command is dropped before it reaches a DataView — an un-verified command never becomes a command.
Each source is granted a capability: a maximum budget and an allowed set of resources. A command cannot spend budget it was never granted, or touch a resource outside its grant.
The sixth byte is the primorial fold of the first five (Thomas Frumkin's codec). A tampered payload no longer folds to its witness, so it reads off-κ without anyone needing to know the attack.
The signature is the packet's nonce; the same signed packet twice is a replay and is dropped.
A rejected command is dropped into a zero-budget phantom cell that touches no real state — an attacker who keeps probing only ever learns the shape of a cell that was never real.
To breach it an attacker must, at once, find a known source, forge a signature, fold the κ-witness, stay within a budget it was never granted, and send something never seen — several independent locks at the same node, not one wall with one breach. The full seven-defence framing (mesh quarantine, bonded-pair cross-check, compression cipher, self-heal) is the design; what is measured here is the signed-packet gate and one grown detector.
The codec round-trip and the grown detector are pure and seeded — they re-run here in your browser from the same kernel this page is built from, and must match the committed record. The signed battery (real Ed25519) is re-run by CI, which has node crypto.
Sealed, committed and pushed before the battery was run. SENTINEL must drop every attack it has never seen while passing every valid packet; the grown detector is evolved on training streams and measured on held-out streams. Published whichever way it lands.
The question. Does the structural gate — verify the signature before the six bytes are ever parsed, budget ≤ the capability lattice, at κ, unseen — catch every one of eight attack shapes with zero false passes, and does a detector GROWN against training streams beat a hand-set one on held-out hostile streams?
The gate. verify the Ed25519 signature over sourceId+payload BEFORE unpack is ever called (an unknown source is dropped before verify; a forged or tampered packet is dropped before parse), then unpack (bad-length, off-κ), source nibble must match, budget ≤ the lattice cap, resources ⊆ the grant, and the signature must be unseen (replay).
The grown detector. training and held-out streams (60 / 60, seeded) of individually-valid packets: scans, drains and bursts are attacks, small focused streams are legit. The detector (a weight per feature n/fanout/budgetSum/dominance/resourceSpread and a threshold) is grown on the training streams only (2000 seeded tries, fitness = catch rate with zero false passes) and measured on the held-out streams against the hand-set baseline {"weights":[0,1,1,0,0],"threshold":0.4}.
Sealed in 8bd5e50 · the pre-registration · the record
Ed25519 keys are generated fresh on every run and never committed; what is sealed is the attack shapes and the verdict counts, which are identical on every machine. The live page re-runs the deterministic core (the codec round-trip and the grown detector) in the browser; the signed battery is re-run by CI, which has node's crypto. Replay detection here is exact-bytes-seen (the signature is the nonce). A production mesh needs monotonic counters or timestamps so a legitimate repeat is not mistaken for a replay; that is a design note, not part of this seal. The honeypot reroute (a zero-budget phantom cell) and the per-node quarantine are built and unit-tested as isolated local state; the antibody broadcast over LoRa / acoustics / NFC is hardware-dependent and is design only, never measured here. The append-only binary ledger (exhale on close, inhale on boot) is a separate real feature noted for fall-os, not part of this seal. The seven-defense framing (gate, mesh, proof-chain, bonded-pair, compression-cipher, κ-band, self-heal) is the estate's language for the design; what is measured here is the signed-packet gate and one grown detector. Konomi/the primorial fold is Thomas Frumkin's.