Autonomous Defense Authority Kernel and Runtime Reference Monitor

Release identity

Release: 2.0.0-rc.24-WIP
Engine: 1.0.0
Public route: /workbench/autonomous-defense-kernel
API root: /api/v2/autonomous-defense-kernel
Terminal: SYNTHETIC_NULL_SINK

Mission

The Autonomous Defense Authority Kernel demonstrates a bounded, deterministic enforcement chain:

SYNTHETIC OBSERVATION
→ EVIDENCE + PROVENANCE
→ UNCERTAINTY
→ POLICY + PURPOSE
→ DELEGATED AUTHORITY
→ NOMINAL REQUEST
→ INDEPENDENT RUNTIME ASSURANCE
→ APPLIED DEFENSIVE ACTION
→ APPEND-ORIENTED HISTORY
→ CLAIM / READINESS IMPACT
→ ATTESTED RECOVERY
→ SYNTHETIC_NULL_SINK

The authoritative state is produced by pure Python. Flask, Jinja, semantic HTML, CSS, and vanilla JavaScript present and navigate that state. The browser cannot create authority, permission, proof, applied action, claim state, recovery permission, or canonical history.

Core doctrine

CAPABILITY DOES NOT IMPLY AUTHORITY.
CONNECTIVITY DOES NOT IMPLY TRUST.
ACCESS DOES NOT IMPLY PERMITTED REUSE.
RESTORED CONNECTIVITY DOES NOT RESTORE STALE AUTHORITY.
SUCCESSFUL EXECUTION DOES NOT PROVE LEGITIMACY.
RECOVERY DOES NOT ERASE THE COMPROMISED PREDECESSOR.

Deterministic domain model

The kernel uses immutable records for:

delegated authority;
compiled policy and purpose;
workload identity;
software, model, policy, and configuration attestation;
evidence and provenance;
aleatoric and epistemic uncertainty;
compartment and communications state;
nominal requests;
independent reference-monitor decisions;
applied defensive actions;
claim and readiness impact;
recovery-baseline state;
append-oriented events and hashes.

Virtual deterministic ticks replace wall-clock time inside authoritative decisions. Ordered canonical JSON and content digests make exact replay and package comparison possible.

Authority artifact

The authority artifact records:

issuing institution and institutional owner;
recipient workload;
declared purpose and permitted objective;
permitted and prohibited actions;
data scope, permitted use, and prohibited reuse;
resource bounds;
deterministic time bounds;
software, model, policy, and configuration identities;
evidence requirements;
assumptions;
subdelegation limits;
degraded and partition-operation bounds;
revocation and reconciliation requirements;
review requirements;
synthetic attestation metadata.

Authority is conjunctive. Evidence, confidence, or technical success cannot compensate for failed identity, purpose, time, scope, revocation, or attestation.

Authority lifecycle

PROPOSED
ISSUED
CURRENT
EXPIRING
SUSPENDED
REVOKED
SUPERSEDED
EXPIRED
HISTORICAL
RECONCILIATION_REQUIRED

Independent reference monitor

Every nominal request is intercepted by a separate deterministic monitor. It independently evaluates:

workload identity;
credential currency;
threshold authorization;
authority lifecycle state;
authority time bounds;
declared purpose;
permitted action;
prohibited action;
permitted use and prohibited reuse;
resource bounds;
known policy state;
software attestation;
model attestation;
policy attestation;
configuration attestation;
evidence freshness;
evidence consistency;
evidence independence and correlation;
epistemic uncertainty;
compartment attestation;
reconciliation state;
recovery-baseline attestation.

Unknown policy denies execution. Subdelegation attenuates rather than expands authority.

Nominal request versus applied action

The nominal request is recorded as a proposal. It is not authoritative. The applied defensive action is the reference monitor’s bounded deterministic result.

The public action catalog is limited to:

CONTINUE_OBSERVATION
COLLECT_MORE_EVIDENCE
DENY_REQUEST
REQUIRE_REAUTHENTICATION
REVOKE_AUTHORITY
INTEGRITY_HOLD
ISOLATE_WORKLOAD
SEVER_SYNTHETIC_COMPARTMENT
QUARANTINE_SYNTHETIC_SERVICE
FREEZE_SYNTHETIC_RELEASE_CHANNEL
REKEY
RECONCILE
RESTORE_ATTESTED_BASELINE
ABSTAIN

No action leaves the synthetic range.

Evidence and uncertainty

Each evidence record preserves source identity, deterministic collection tick, custody, transformations, reliability, correlation group, shared failure mode, freshness, uncertainty, completeness, support and challenge relationships, invalidation, supersession, permitted use, retention, active versions, authority reference, and a digest.

The kernel does not use a generic AI confidence score. It keeps aleatoric uncertainty, epistemic uncertainty, and evidence completeness separate.

Multiple records sharing one evidence root remain correlated. Copies, exports, replay artifacts, or reports do not become independent corroboration.

Partition and reconciliation

A partitioned workload may continue only within current, predeclared local authority. Expiring local authority produces an integrity hold. Expired local authority denies the request.

A restored link initiates reconciliation. It does not automatically restore authority. Failed reconciliation preserves an integrity hold.

Attested recovery

Recovery requires an attested baseline. A compromised baseline causes quarantine. A successful recovery appends a new state, preserves the predecessor, requires authority reissuance where appropriate, and never rewrites history.

Scenario catalog

The engine contains thirty-eight deterministic scenarios spanning authority lifecycle, purpose and reuse, resource bounds, workload identity, credential currency, threshold authorization, software/model/policy/configuration attestation, supply-chain provenance, evidence freshness and correlation, contradiction, epistemic uncertainty, policy unknowns, communication degradation and partition, local authority, restored-link reconciliation, rekeying, compromised recovery baselines, attested recovery, and synthetic industrial-maintenance cases.

The industrial-maintenance cases are generic synthetic derivatives. They do not reveal protected partner strategy, locations, dependencies, timelines, facilities, or customer details.

Evidence packages

A deterministic package contains:

schema and release identity;
normalized input;
authority artifact;
policy bundle;
evidence and provenance;
uncertainty state;
nominal request;
reference-monitor record;
applied action;
proof conditions;
event chain;
claim and readiness impact;
recovery record;
assumptions, limitations, and residual unknowns;
semantic table and narrative equivalents;
public-boundary declaration;
package digest;
SYNTHETIC_NULL_SINK termination.

Package verification establishes deterministic structure and recorded-byte continuity. It does not establish factual truth, legal approval, certification, operational readiness, procurement acceptance, or customer-system performance.

Public and protected research integration

The workbench uses public architecture reports for its public research traceability. Two newly supplied industrial-autonomy reports are preserved in the protected Eviulon partner compartment under docs/private/eviulon/ and are deep-linked only from .uai/private/eviulon/.

They inform internal continuity planning around robotic maintenance, manufacturing closure, repair ecology, stockpile and choke-point awareness, and industrial self-sufficiency. They are not public proof and are excluded from public research, APIs, sitemaps, structured data, OpenAPI examples, browser bundles, screenshots, logs, and public evidence packages.

Accessibility

The page provides server-rendered analytical content, keyboard-operable tabs, visible focus, semantic tables, narrative and raw-evidence views, reduced-motion handling, forced-color compatibility, mobile reflow, and 400% zoom support. Every analytical task remains available without the topology visualization.

Controlled public boundary

The workbench contains no customer-content ingestion, real credentials, real keys, real topology, operational coordinates, target selection or ranking, weapon-target pairing, payload or weapon functions, vehicle control, force authorization, offensive cyber tooling, public persistence, or external command channel.

What this establishes

It establishes deterministic enforcement of a declared synthetic authority and evidence contract inside the packaged software.

What it does not establish

It does not establish factual truth, legal or sovereign authority, real-system safety, accreditation, certification, operational readiness, deployment, procurement acceptance, or customer-system performance.