# **Python Autonomous Defense Kernel: Deterministic Authority, Runtime Assurance, Evidence-Locked Execution, and Attested Recovery for Evulgare**

## **1\. Executive Summary (Deliverable 1\)**

This reference architecture defines a production-grade, pure-Python deterministic defense kernel designed specifically for Evulgare’s execution environments. The etymology of "evulgare" stems from the Latin *evulgo*, meaning to make public or divulge1, reflecting the platform's core mandate: making the internal state, authority, and accountability of autonomous systems transparent and cryptographically undeniable \[DOCUMENTED FIRST-PARTY CLAIM\]. The primary objective of this architecture is to implement a machine-sovereign runtime assurance model that restricts autonomous operations to strict, evidence-backed authorities. This design explicitly asserts that capability does not imply authority, and successful execution does not prove legitimacy \[OBSERVED PUBLIC FACT\].  
By synthesizing the Black-Box Simplex Architecture5 with Device Identifier Composition Engine (DICE) attestation7 and Datalog-based policy compilation9, the architecture guarantees that autonomous operations remain bounded by cryptographically verifiable constraints. The system functions as a deterministic reference monitor, evaluating authority limits, evidence freshness, and compartment state prior to any autonomous action. If an advanced autonomous controller violates its purpose limitations or attempts to exceed its authority bounds, the kernel immediately defaults to an attested baseline recovery state \[ENGINEERING INFERENCE\].  
This exhaustive report provides a comprehensive architectural blueprint, encompassing domain schemas, precise Python implementation guidelines, comprehensive testing matrices, and forty-four requested deliverables. It is engineered to facilitate robust deployment on Python 3.13.14 within WSGI/cPanel environments without relying on external Content Delivery Networks (CDNs) or Node.js runtimes \[PROPOSED REQUIREMENT\].

## **2\. Core Research Questions and Architectural Solutions**

### **2.1 Authoritative Python Domain Layer**

The authoritative domain layer must be modeled strictly in pure Python to eliminate the non-deterministic behaviors introduced by external dependencies, system clocks, and hardware variations \[PROPOSED REQUIREMENT\]. To achieve mathematical reproducibility across distributed Python processes, the architecture models authoritative state utilizing strictly immutable structures, specifically dataclasses.dataclass(frozen=True). This immutability ensures that once an evidence envelope or authority token is instantiated, its memory representation and corresponding cryptographic hash cannot be altered by subsequent runtime processes \[ENGINEERING INFERENCE\].  
To avoid wall-clock nondeterminism, simulated time is advanced exclusively via monotonic sequence numbers, or "ticks," rather than datetime.now() or other host-system calls \[PROPOSED REQUIREMENT\]. This separation guarantees that replaying an identical sequence of inputs into the domain engine will systematically yield the exact same state output, eliminating the simulation-to-reality gap inherent in temporal variations \[OBSERVED PUBLIC FACT\]. Furthermore, the architecture explicitly prohibits the use of dictionary ordering and floating-point arithmetic within the authoritative state representation. Floating-point operations are subject to hardware-level variations across CPU architectures; therefore, all numerical values must be represented as scaled integers. State-transition functions are designed as pure deterministic reducers—accepting a prior state and a command, and returning a novel appended state without modifying the original. This command-versus-event separation relies on event sourcing, where the canonical truth of the system is the ordered append-only log of events rather than a mutable snapshot \[ENGINEERING INFERENCE\].  
The separation of domain logic from external interfaces (such as Flask and Jinja) is paramount. The domain engine operates entirely ignorant of HTTP requests, browser representations, or database persistence. SQLAlchemy is restricted to the infrastructure layer, responding to events emitted by the domain but never dictating domain rules.

### **2.2 Authority Kernel**

A deterministic, machine-readable authority system requires an architecture where permissions are explicitly bounded and dynamically verifiable at runtime. The authority token within this kernel is a comprehensive, cryptographically signed artifact defining the issuing institution, institutional owner, recipient workload, and declared purpose \[PROPOSED REQUIREMENT\]. It explicitly details permitted and prohibited actions, spatial/data scopes, permitted data reuse, retention limits, resource bounds, and time bounds bounded by monotonic ticks.  
Authority in this architecture must be conjunctive rather than a weighted score \[ENGINEERING INFERENCE\]. A weighted scoring system introduces catastrophic edge cases where a high confidence in a trivial metric (such as visual identification clarity) could mathematically offset a zero-score in a critical metric (such as institutional permission). Conjunctive authority dictates that every specified condition—from technical feasibility to independent legal review to institutional permission—must independently evaluate to True11. If any single lifecycle gate is invalidated, the aggregate authority evaluates to False, forcing a deterministic denial of execution \[OBSERVED PUBLIC FACT\].  
Explicit states track the lifecycle of this authority: PROPOSED for initial synthesis, ISSUED upon institutional signing, CURRENT during active validity, SUSPENDED upon epistemic uncertainty breaches, and REVOKED or EXPIRED progressing into HISTORICAL archives. A specific RECONCILIATION\_REQUIRED state is triggered when conflicting evidence suggests a simulation-to-reality gap11.

### **2.3 Policy Compilation and Reference Monitoring**

Strategic intent written in natural language cannot directly execute within a safety-critical autonomous system due to the inherent ambiguity and susceptibility to prompt-injection vulnerabilities \[OBSERVED PUBLIC FACT\]. Therefore, policy must be compiled into bounded, machine-readable conditions. The architecture employs Datalog—a declarative logic programming language—to evaluate these policies. Unlike Prolog, Datalog utilizes a bottom-up evaluation model that guarantees termination and prevents infinite recursion, making it mathematically suitable for real-time reference monitoring9. Implementations such as pyDatalog integrate natively into Python, allowing complex rules to be defined and executed deterministically10.  
In this framework, every proposed action is intercepted by a deterministic reference monitor. The Datalog engine evaluates the current facts (evidence, authority bounds, state) against the compiled policy rules. Generative language models cannot override these compiled policies, as the reference monitor strictly separates the generative output from the authoritative evaluation engine \[ENGINEERING INFERENCE\]. If the policy state is unknown, or if the Datalog query yields an empty result set, the system defaults to a deterministic denial of execution. Subdelegation of authority relies on a capability-based security model conceptually akin to Macaroons13, where any delegated authority strictly attenuates—adding contextual caveats that limit scope—rather than expanding baseline permissions.

### **2.4 Runtime Assurance**

The kernel implements a layered runtime-assurance architecture grounded in the Black-Box Simplex framework5. The architecture segregates the nominal request generated by an advanced, unverified AI component from the applied defensive action executed by the system \[PROPOSED REQUIREMENT\].  
The Simplex Control Architecture utilizes three core components: an Advanced Controller (AC) driven by complex, unverified algorithms (e.g., neural networks); a Lookahead Baseline Controller (LBC) composed of statically verified, safe fallback behaviors; and a Decision Module (DM)14. The runtime governor (the DM) independently evaluates the AC's proposed commands against Datalog policy bundles, evidence freshness, uncertainty thresholds, and compartment states. Because the architecture treats the AC as a black box, it does not require static verification of the AI's internal weights6.  
If the AC's command is projected to violate the safety barrier or authority limits, the DM triggers a synthetic output state such as DENY\_COMMAND, DEFENSIVE\_ISOLATION, or RESTORE\_ATTESTED\_BASELINE, seamlessly transferring control to the LBC to execute a safe SYNTHETIC\_NULL\_SINK termination \[ENGINEERING INFERENCE\].

### **2.5 Evidence and Provenance**

Evidence architectures within autonomous systems must be append-oriented, ensuring that history cannot be silently rewritten by compromised nodes \[PROPOSED REQUIREMENT\]. Every event record logs the source identity, collection time (in deterministic sequence ticks), custody chain, and specific software/model configuration states active at the moment of collection.  
It is crucial to acknowledge the epistemological limits of cryptographic hashing. A SHA-256 hash or digital signature mathematically proves that a sequence of recorded bytes has not been altered since the moment of signature creation \[OBSERVED PUBLIC FACT\]. However, a hash does not—and logically cannot—prove that the sensor, source, or statement accurately represented the external physical world \[ENGINEERING INFERENCE\]. If a sensor is physically blinded or subject to adversarial spoofing, it will dutifully produce a perfectly valid, mathematically verifiable cryptographic hash of false data. Therefore, the provenance architecture must explicitly document source reliability, shared failure modes, correlation groups, and challenging relationships among conflicting data streams, avoiding the fallacy that mathematical integrity equates to operational truth.

### **2.6 Uncertainty and Abstention**

Autonomous decision-making is inherently fraught with uncertainty, which must be segregated into distinct representations: aleatoric uncertainty (statistical noise inherent in sensor hardware) and epistemic uncertainty (lack of knowledge or model-distribution shifts) \[PROPOSED REQUIREMENT\]. The architecture mandates that these distinct mathematical properties are never reduced to a single, monolithic “AI confidence” score \[ENGINEERING INFERENCE\].  
Collapsing these dimensions masks fatal operational gaps; a model might be 99% confident in identifying a synthetic object (low aleatoric uncertainty) while operating entirely outside its trained distribution parameters (high epistemic uncertainty). By maintaining separate tensors for conflicting evidence, stale evidence, and unknown classes, the runtime governor can execute deterministic abstention—shifting the system into COLLECT\_MORE\_EVIDENCE or ABSTAIN states rather than forcing a low-confidence execution.

### **2.7 Compartments**

Synthetic compartments enforce strict data and execution isolation boundaries. Each compartment features defined workload identities, custody chains, and permitted/prohibited reuse boundaries \[PROPOSED REQUIREMENT\]. Crucially, compromise propagation is calculated orthogonally across multiple independent vectors: IDENTITY, AUTHORITY, SOFTWARE, MODEL, CONFIGURATION, EVIDENCE, KEYS, COMMUNICATIONS, RELEASE CHANNEL, and REVIEWER LINEAGE.  
If a specific cryptographic key epoch is compromised, the architecture isolates the KEYS vector and triggers a REKEY event. Because propagation is tracked separately, a communication failure does not inherently invalidate the mathematical integrity of the underlying MODEL or SOFTWARE configuration, provided those elements operate within an isolated, attested synthetic compartment \[ENGINEERING INFERENCE\].

### **2.8 Lost Link and Partitioned Autonomy**

A fundamental tenet of the Evulgare defense kernel is that the loss of network connection does not create operational authority \[DOCUMENTED FIRST-PARTY CLAIM\]. When communications degrade or fail entirely, the node transitions through explicit states: from CONNECTED to DEGRADED, and subsequently to PARTITIONED.  
If the node possesses pre-computed, cryptographically signed authority bounds that cover partitioned operations, it may enter a LOCALLY\_AUTHORIZED state. However, the system strictly enforces the principle that successful local execution does not prove legitimate execution \[OBSERVED PUBLIC FACT\]. If the time bounds of the local authority expire, the node enters DEFENSIVE\_ISOLATION. When connectivity is eventually restored, the system transitions to RECONCILIATION\_REQUIRED rather than immediately resuming nominal operations, as the restored connection does not automatically restore authority without quorum review \[ENGINEERING INFERENCE\].

### **2.9 Recovery and Reconstitution**

Recovery mechanisms must not overwrite or delete historical evidence of a compromise. Instead, recovery must append a new reconstitution state to the event log \[PROPOSED REQUIREMENT\]. This process relies on a trusted recovery root utilizing the Device Identifier Composition Engine (DICE) standard7.  
The DICE architecture derives a Compound Device Identifier (CDI) based on the foundational hardware and firmware configuration, creating an unforgeable cryptographic attestation of the baseline state8. To reconstitute, the kernel verifies the accepted baseline digest, confirms the validity of the key epoch, and explicitly excludes any revoked credentials. Unresolved defeaters and the exact state of the compromised predecessor are preserved in the immutable append-log for subsequent forensic analysis \[ENGINEERING INFERENCE\].

### **2.10 Python Implementation Details**

The implementation strictly relies on native Python 3.13.14 features to ensure extreme stability without external C-bindings where possible. Standard library dataclasses with frozen=True are selected over third-party libraries like Pydantic for the core domain to eliminate parsing overhead and guarantee immutability without dependency drift \[PROPOSED REQUIREMENT\]. SQLAlchemy is utilized strictly via event listeners, persisting domain events into MySQL but never executing business logic \[IMPLEMENTATION OPTION\].  
Serialization relies on strict canonical JSON. To guarantee reproducibility, dictionaries are serialized with sort\_keys=True and zero whitespace separators (separators=(',', ':')), ensuring that identical state records yield identical SHA-256 digests across any architecture \[ENGINEERING INFERENCE\]. Flask blueprints define isolated API schemas protected by strict Content-Type enforcement and CSRF protections. Error envelopes are structurally opaque to external users, returning standardized error\_id references without leaking stack traces or internal topological data.

### **2.11 Testing**

Testing this kernel extends far beyond standard unit tests. Deterministic replay tests form the core validation loop: executing the sequence of recorded events from tick zero must mathematically guarantee the recreation of the exact terminal state \[PROPOSED REQUIREMENT\]. Metamorphic testing evaluates the Datalog engine by presenting logically equivalent but syntactically distinct policy bundles to ensure the reference monitor reaches identical denial or allowance conclusions. Hash-chain tests validate that evidence supersession logic properly invalidates prior keys. Fault injection and mutation testing (e.g., modifying frozen fields via memory manipulation, or passing floats to integer-only bounds) ensure the Simplex DM correctly defaults to a DENY\_COMMAND null-sink upon detecting typed protocol violations \[ENGINEERING INFERENCE\].

## **3\. Required Deliverables Matrix**

The following deliverables fulfill the exhaustive specifications requested for the Evulgare reference architecture.

### **3.1 Complete Python Package Architecture (Deliverable 3\)**

| Directory Path | Description | Access Boundary |
| :---- | :---- | :---- |
| /evulgare\_kernel/domain/ | Pure Python 3.13.14; defines frozen state, authorities, and event reducers. | No HTTP, No SQL, No System Clock |
| /evulgare\_kernel/policy/ | Datalog engine implementation (e.g., pyDatalog wrappers)10. | Domain read-only access |
| /evulgare\_kernel/infrastructure/ | SQLAlchemy models, DICE attestation bindings8, and external integrations. | Mutable state boundary |
| /evulgare\_kernel/api/ | Flask 3 Blueprints, WSGI entry point, cPanel Passenger mounting logic. | External network interface |
| /evulgare\_kernel/tests/ | Metamorphic, deterministic replay, and mutation testing suites. | CI/CD pipeline |

### **3.2 Module Dependency Graph (Deliverable 4\)**

*Diagram 1: Architectural Dependency Graph*

Code snippet  
graph TD  
    API\[api/ Flask Blueprints\] \--\> INFRA\[infrastructure/ SQLAlchemy\]  
    API \--\> DOMAIN\[domain/ Core Logic\]  
    INFRA \--\> DOMAIN  
    DOMAIN \--\> POLICY\[policy/ Datalog Rules\]  
    POLICY \--\> DOMAIN  
    DOMAIN \--\> RA\[runtime\_assurance/ Simplex DM\]  
    RA \--\> EV\[evidence/ Hash Chains\]  
    RA \--\> AUTH\[authority/ Conjunctive Limits\]  
    AUTH \--\> COMP\[compartments/ Isolation\]

### **3.3 Domain-Class Catalog (Deliverable 5\)**

| Class Name | Module | Immutability | Functional Description |
| :---- | :---- | :---- | :---- |
| AuthorityToken | authority.py | Frozen | Represents bounded, conjunctive permissions and deterministic time boundaries. |
| EvidenceEnvelope | evidence.py | Frozen | Wraps cryptographically chained synthetic telemetry and source reliability parameters. |
| SimplexDM | runtime\_assurance.py | Mutable | Decision Module managing transitions between Advanced and Baseline controllers14. |
| UncertaintyVector | uncertainty.py | Frozen | Distinct tensors for aleatoric noise and epistemic model shifts. |
| RecoveryBaseline | recovery.py | Frozen | Represents the DICE-attested known-good hardware/software state8. |

### **3.4 Function and Protocol Catalog (Deliverable 6\)**

| Protocol / Function Signature | Purpose | Determinism Guarantee |
| :---- | :---- | :---- |
| TransitionRule: (State, Event) \-\> State | Event-sourcing reducer function. | Pure function; no side effects. |
| verify\_attestation(envelope, key) \-\> bool | Validates DICE baseline signatures7. | Cryptographic verification only. |
| evaluate\_policy(token, action) \-\> bool | Datalog constraint solver query10. | Terminates definitively; no infinite recursion. |
| enforce\_simplex(ac\_cmd, lbc\_cmd) \-\> cmd | Barrier-certified multiplexer5. | Defaults to LBC on execution timeout. |
| canonical\_hash(dataclass) \-\> str | SHA-256 digest of canonicalized JSON. | Sorted keys, zero whitespace formatting. |

### **3.5 Schema Definitions (Deliverables 7-13)**

#### **Authority-Artifact Schema (Deliverable 7\)**

| Field | Data Type | Constraint | Description |
| :---- | :---- | :---- | :---- |
| artifact\_id | String | Monotonic UUIDv7 | Unique identifier for the signed authority. |
| issuer\_uai | String | SHA-256 Digest | Institutional owner of the permission. |
| purpose\_digest | String | SHA-256 Digest | Explicitly bounds action legality to a declared objective. |
| subdelegation\_limit | Integer | ![][image1] | Maximum depth of derivative authority; attenuates at each step. |
| time\_bounds | Tuple\[int, int\] | Monotonic Ticks | Deterministic start and expiration ticks. |

#### **Policy-Bundle Schema (Deliverable 8\)**

| Element | Specification | Mechanism |
| :---- | :---- | :---- |
| bundle\_id | String | Version tracking for policy rollbacks. |
| datalog\_rules | Text Block | Executable logic constraints (e.g., permitted(X) \<= role(X, R)15). |
| signature | Ed25519 | Cryptographic proof of institutional provenance. |

#### **Evidence-Record Schema (Deliverable 9\)**

| Field | Data Type | Description |
| :---- | :---- | :---- |
| custody\_chain | List\[str\] | Cryptographic identifiers of all systems handling the data. |
| source\_reliability | Scaled Integer | Heuristic metric of physical hardware quality (e.g., 0-1000). |
| supersession\_pointer | String | Reference to updated evidence invalidating this specific record. |

#### **Event-Record Schema (Deliverable 10\)**

| Field | Data Type | Description |
| :---- | :---- | :---- |
| seq\_id | Integer | Strictly increasing integer dictating temporal order. |
| event\_type | String | Canonical domain action mapping (e.g., AUTHORITY\_REVOKED). |
| prior\_digest | String | SHA-256 hash of seq\_id \- 1 establishing the append-only chain. |

#### **Proof-Condition Schema (Deliverable 11\)**

| Condition ID | Evaluated Logic | Evidence Required |
| :---- | :---- | :---- |
| INV\_01\_PASS | Technical feasibility ![][image2] governance completion11. | Proof of institutional and legal review gates. |
| INV\_02\_PASS | Lifecycle gates are strictly conjunctive11. | All parameter states evaluated simultaneously. |
| INV\_03\_PASS | Contested interpretations remain visible11. | Absence of overriding un-reviewed authority. |

#### **Compartment Schema (Deliverable 12\)**

| Field | Data Type | Enforcement Rule |
| :---- | :---- | :---- |
| workload\_id | String | Binds compartment access to specific runtime processes. |
| retention\_ticks | Integer | Triggers mandatory cryptographic shredding of data upon expiry. |
| correlation\_group | String | Defines tags for isolated compromise propagation tracking. |

#### **Recovery-Baseline Schema (Deliverable 13\)**

| Property | Validation Mechanism | Description |
| :---- | :---- | :---- |
| firmware\_digest | DICE CDI Attestation | Validates hardware root of trust8. |
| software\_sbom | SHA-256 Manifest Lock | Verifies exact Python 3.13.14 package dependencies. |
| key\_epoch | Monotonic Integer | Permanently rejects revoked legacy credentials. |

### **3.6 State Machines (Deliverables 14-17)**

*Diagram 2: Deterministic Runtime State Machine (Deliverable 14\)*

Code snippet  
stateDiagram-v2  
    \[\*\] \--\> NOMINAL\_REQUEST  
    NOMINAL\_REQUEST \--\> DM\_EVALUATION  
    DM\_EVALUATION \--\> APPLIED\_DEFENSIVE\_ACTION : Authority or Safety Violation  
    DM\_EVALUATION \--\> AC\_EXECUTION : Bounds Validated  
    APPLIED\_DEFENSIVE\_ACTION \--\> LBC\_EXECUTION : Transfer to Baseline  
    LBC\_EXECUTION \--\> RESTORE\_ATTESTED\_BASELINE : Unrecoverable  
    LBC\_EXECUTION \--\> CONTINUE\_OBSERVATION : Synchronized

*Diagram 3: Authority State Machine (Deliverable 15\)*

Code snippet  
stateDiagram-v2  
    \[\*\] \--\> PROPOSED  
    PROPOSED \--\> ISSUED : Institutional Signing  
    ISSUED \--\> CURRENT : Tick Boundaries Reached  
    CURRENT \--\> SUSPENDED : Uncertainty Violation  
    CURRENT \--\> RECONCILIATION\_REQUIRED : Evidence Conflict  
    CURRENT \--\> EXPIRING : Grace Period Entry  
    CURRENT \--\> REVOKED : Explicit Override  
    EXPIRING \--\> EXPIRED  
    SUSPENDED \--\> CURRENT : Re-attestation  
    RECONCILIATION\_REQUIRED \--\> CURRENT : Quorum Review  
    REVOKED \--\> HISTORICAL  
    EXPIRED \--\> HISTORICAL

*Diagram 4: Lost-Link State Machine (Deliverable 16\)*

Code snippet  
stateDiagram-v2  
    CONNECTED \--\> DEGRADED : Latency \> Threshold  
    DEGRADED \--\> PARTITIONED : Heartbeat Timeout  
    PARTITIONED \--\> LOCALLY\_AUTHORIZED : Pre-computed Bounds Exist  
    LOCALLY\_AUTHORIZED \--\> AUTHORITY\_EXPIRING : Time Bound Approaching  
    AUTHORITY\_EXPIRING \--\> DEFENSIVE\_ISOLATION : Time Expired  
    PARTITIONED \--\> INTEGRITY\_HOLD : Conflicting Sensor Data  
    DEFENSIVE\_ISOLATION \--\> RECONCILIATION\_REQUIRED : Connection Restored  
    INTEGRITY\_HOLD \--\> RECONCILIATION\_REQUIRED : Connection Restored  
    RECONCILIATION\_REQUIRED \--\> CONNECTED : Authority Re-issued

*Diagram 5: Recovery State Machine (Deliverable 17\)*

Code snippet  
stateDiagram-v2  
    \[\*\] \--\> PRESERVE\_COMPROMISED\_PREDECESSOR  
    PRESERVE\_COMPROMISED\_PREDECESSOR \--\> LOAD\_BASELINE\_DIGEST  
    LOAD\_BASELINE\_DIGEST \--\> VERIFY\_DICE\_ATTESTATION  
    VERIFY\_DICE\_ATTESTATION \--\> RECONCILE\_EVIDENCE  
    RECONCILE\_EVIDENCE \--\> REISSUE\_AUTHORITY  
    REISSUE\_AUTHORITY \--\> NOMINAL\_OPERATIONS

### **3.7 Core Logic and Threat Constraints (Deliverables 18-20)**

#### **Forty Named Invariants (Deliverable 18\)**

| ID | Invariant Name | Enforced Rule |
| :---- | :---- | :---- |
| 01 | EVIDENCE\_APPEND\_ONLY | Prior state sequences cannot be altered or deleted. |
| 02 | HASH\_NOT\_REALITY | Cryptography proves bytes, not environmental truth. |
| 03 | TIME\_MONOTONIC | All temporal logic utilizes integer ticks, never wall-clocks. |
| 04 | AUTH\_CONJUNCTIVE | Authority requires 100% condition fulfillment, no scoring. |
| 05 | DENY\_BY\_DEFAULT | Unknown policy evaluation defaults to DENY\_COMMAND. |
| 06 | AC\_UNTRUSTED | Advanced Controller is treated as a Black Box6. |
| 07 | LBC\_ATTESTED | Lookahead Baseline Controller only executes verified recovery paths. |
| 08 | NO\_SELF\_AUTHORITY | Autonomous systems cannot synthesize their own authority tokens. |
| 09 | LOSS\_NO\_AUTH | Connection loss does not independently generate operational authority. |
| 10 | RESTORE\_NO\_AUTH | Connection restoration requires explicit reconciliation for authority. |
| 11 | PROMPT\_NO\_OVERRIDE | Generative text cannot bypass Datalog compiled constraints. |
| 12 | STATE\_FROZEN | Dataclasses enforcing domain logic must be initialized as frozen=True. |
| 13 | DICTS\_SORTED | All serialized data must utilize strict alphabetical key sorting. |
| 14 | JSON\_CANONICAL | Serialization eliminates all whitespace for stable hashing. |
| 15 | FLOATS\_BANNED\_IN\_STATE | All authority bounds use scaled integers to prevent architecture drift. |
| 16 | EPOCH\_STRICT | Keys from prior epochs are mathematically rejected. |
| 17 | REVOKED\_IS\_FINAL | A revoked authority token cannot re-enter the CURRENT state. |
| 18 | DM\_ALWAYS\_INTERCEPTS | The Decision Module must proxy 100% of AC commands. |
| 19 | PURPOSE\_LIMITED | Execution outside the purpose\_digest triggers immediate LBC fallback. |
| 20 | SUBDELEGATE\_ATTENUATES | Macaroon-style capability delegation strictly reduces permissions13. |
| 21 | UNCERTAINTY\_SPLIT | Aleatoric and Epistemic vectors must remain mathematically distinct. |
| 22 | ALEATORIC\_EXPLICIT | Sensor hardware noise must be quantified independently. |
| 23 | EPISTEMIC\_EXPLICIT | Model-distribution shifts must trigger abstention thresholds. |
| 24 | RECOVERY\_PRESERVES\_FAIL | Reconstitution logic cannot erase the compromised historical states. |
| 25 | QUORUM\_REQUIRED | Reconciliation requires multi-party or sovereign-machine sign-off. |
| 26 | COMPARTMENT\_ISOLATED | Compromise in Vector A does not assume compromise in Vector B. |
| 27 | DB\_NO\_DOMAIN\_LOGIC | SQLAlchemy exists strictly for post-evaluation IO persistence. |
| 28 | UI\_NO\_CALCULATION | The browser renderer accepts output; it does not calculate authority11. |
| 29 | NO\_NPM\_PROD | Production environments exclude Node.js runtime attack surfaces. |
| 30 | NO\_EXTERNAL\_CDN | All JavaScript dependencies are served natively to ensure integrity. |
| 31 | WSGI\_STRICT | API complies exclusively with cPanel Passenger standard deployments. |
| 32 | API\_SCHEMA\_PINNED | Incoming request schemas reject extraneous properties. |
| 33 | ERROR\_NO\_LEAK | Responses conceal stack traces and internal topologies behind UUIDs. |
| 34 | RETRY\_IDEMPOTENT | Resubmitted event-sourcing hashes yield identical database states. |
| 35 | RATES\_LIMITED | All API endpoints enforce strict ingestion throttling per workload ID. |
| 36 | SBOM\_VERIFIED | Dependency trees are attested against a known-good digest on boot. |
| 37 | DICE\_ROOTED | Firmware root of trust dictates downstream module initialization8. |
| 38 | SYNC\_ANALYTICS | Visual and table metrics strictly map to the exact same event index11. |
| 39 | NULL\_SINK\_TERMINATES | Defensive isolation forces operations into an abstract void state. |
| 40 | SIM\_GAP\_ACKNOWLEDGED | Software validation explicitly does not claim real-world certification. |

#### **Thirty Synthetic Defense Scenarios (Deliverable 19\)**

| Scenario ID | Synthetic Trigger Event | Resultant Kernel Action |
| :---- | :---- | :---- |
| S-01 | Invalid parameter in nominal request. | Null-sink abort. |
| S-02 | Unverified AC outputs commands nearing boundary constraints. | DM switches control to verified LBC6. |
| S-03 | Epistemic uncertainty exceeds predefined limits. | Transition to ABSTAIN state. |
| S-04 | Heartbeat latency surpasses threshold. | Graceful degradation to DEGRADED state. |
| S-05 | DICE signature mismatch detected on initialization. | Hardware quarantine; system halts boot sequence. |
| S-06 | Key epoch rotation attempted with expired key. | Epoch rotation lock enforced. |
| S-07 | Boot sequence fails critical Datalog policy test. | Attested boot failure logged and halted. |
| S-08 | Exact duplicate event packet submitted. | Replay attack denial via seq\_id idempotency. |
| S-09 | Non-canonical JSON payload received. | Malformed JSON rejection prior to domain processing. |
| S-10 | Monotonic sequence number received out of order. | Time-travel sequence blocked. |
| S-11 | Delegation request exceeds attenuation bounds. | Subdelegation depth exceeded; request denied. |
| S-12 | Datalog engine evaluates for \>10ms. | DM timeout triggers fallback to LBC stored commands14. |
| S-13 | Primary and secondary synthetic sensors report opposing data. | Conflicting sensor isolation; triggers INTEGRITY\_HOLD. |
| S-14 | Data from Compartment A sent to Compartment B unlawfully. | Compartment bleed blocked by capability monitor. |
| S-15 | Governance gate review remains incomplete. | Lifecycle hold maintained (INV\_01\_PASS)11. |
| S-16 | Institutional review explicitly missing from payload. | Authority generation aborted. |
| S-17 | Active operation reaches sequence expiry tick. | Artifact expiry transitions to DEFENSIVE\_ISOLATION. |
| S-18 | Attempted action mismatches the declared purpose\_digest. | Purpose violation triggers immediate isolation. |
| S-19 | Generative language model attempts to output policy override prompt. | Prompt override blocked; Datalog dictates execution. |
| S-20 | CDI derived from hardware does not match expected baseline. | DICE CDI failure; system refuses initialization. |
| S-21 | Datalog logic contains infinite recursive loop. | Recursion timeout forces LBC execution9. |
| S-22 | SQLAlchemy persistence layer loses connection. | Domain logic pauses; memory state held pending IO. |
| S-23 | Extreme volume of nominal requests received. | Rate limit exhaustion blocks origin identifier. |
| S-24 | Cross-Site Request Forgery attempt on WSGI endpoint. | CSRF boundary intercepts and drops request. |
| S-25 | Invalid enum state transition requested. | Unknown state transition explicitly denied. |
| S-26 | Event submitted without valid prior\_digest reference. | Missing prior digest invalidates the append log. |
| S-27 | Epistemic confidence falls below 0.5 threshold. | System triggers COLLECT\_MORE\_EVIDENCE loop. |
| S-28 | Connection restored after partitioned operation. | RECONCILIATION\_REQUIRED lock engaged pending quorum. |
| S-29 | Attempt to modify a record in HISTORICAL state. | Modification block enforced by append-only rule. |
| S-30 | Pre-authorized command reaches valid termination point. | Synthetic shutdown execution mathematically validated. |

#### **Twelve Fault-Injection Campaigns (Deliverable 20\)**

| Campaign ID | Fault Mechanism | Target Validation |
| :---- | :---- | :---- |
| F-01 | **Clock Jitter:** Injecting wild fluctuations into host OS wall-clocks. | Validates resilience of monotonic sequence ticks. |
| F-02 | **State Mutation:** Attempting dynamic \_\_setattr\_\_ on frozen dataclasses. | Confirms Python enforces FrozenInstanceError. |
| F-03 | **Hash Collision:** Supplying prefix-colliding SHA-256 strings. | Tests envelope chaining robustness against malicious history. |
| F-04 | **Simplex AC DOS:** Flooding the Decision Module with AC commands. | Triggers DM latency timeout, shifting safely to LBC14. |
| F-05 | **DB Partitioning:** Disconnecting the MySQL socket. | Ensures domain logic remains pure and uncorrupted by IO loss. |
| F-06 | **Policy Fuzzing:** Injecting malformed pyDatalog logic constraints. | Confirms reference monitor defaults to DENY\_COMMAND. |
| F-07 | **DICE Forgery:** Presenting simulated invalid hardware certificates. | Verifies recovery baseline reconstitution blocks untrusted hardware. |
| F-08 | **Link Flapping:** Rapid-cycling network connections. | Ensures state-machine stability between DEGRADED and PARTITIONED. |
| F-09 | **Uncertainty Spikes:** Forcing 100% simulated aleatoric noise. | Validates execution of deterministic abstention transitions. |
| F-10 | **Memory Bloat:** Exhausting Passenger WSGI worker memory. | Confirms safe crash and clean attested restart without data corruption. |
| F-11 | **Event Reordering:** Submitting seq\_id=4 prior to seq\_id=3. | Validates strict append-only index sequencing. |
| F-12 | **Type Confusion:** Passing float values into strict integer bound fields. | Ensures deterministic architectural parity is maintained. |

### **3.8 Code and Data Representations (Deliverables 21-26)**

#### **Example Safe Python Skeletons (Deliverable 21\)**

The implementation mandates Python 3.13.14 native structures. Dataclasses are enforced for immutability, prohibiting the mutation of live state representations \[PROPOSED REQUIREMENT\].

Python  
from dataclasses import dataclass, field  
from typing import Protocol, List  
from enum import StrEnum  
import hashlib, json

class AuthorityState(StrEnum):  
    PROPOSED \= "PROPOSED"  
    ISSUED \= "ISSUED"  
    REVOKED \= "REVOKED"  
    EXPIRED \= "EXPIRED"

@dataclass(frozen=True)  
class AuthorityArtifact:  
    artifact\_id: str  
    issuer\_id: str  
    recipient\_id: str  
    state: AuthorityState  
    purpose\_digest: str  
    permitted\_actions: frozenset\[str\]  
    time\_bounds: tuple\[int, int\]  \# Monotonic integer ticks to ensure determinism

    def to\_canonical\_json(self) \-\> str:  
        d \= {  
            "artifact\_id": self.artifact\_id,  
            "issuer\_id": self.issuer\_id,  
            "permitted\_actions": sorted(list(self.permitted\_actions)),  
            "purpose\_digest": self.purpose\_digest,  
            "recipient\_id": self.recipient\_id,  
            "state": self.state.value,  
            "time\_bounds": \[self.time\_bounds\[0\], self.time\_bounds\[1\]\]  
        }  
        \# Zero whitespace, strictly sorted keys for perfect hash stability  
        return json.dumps(d, separators=(',', ':'), sort\_keys=True)

    def digest(self) \-\> str:  
        return hashlib.sha256(self.to\_canonical\_json().encode('utf-8')).hexdigest()

#### **Example Canonical JSON (Deliverable 22\)**

Canonical JSON strictly removes whitespace and sorts keys alphabetically to prevent hash mismatches generated by dictionary traversal variability across architectures.

JSON  
{"event\_type":"INPUTS\_VALIDATED","payload":{"normalized\_inputs":7},"prior\_digest":"1e55eb33d81f81a","seq\_id":42}

#### **Example Deterministic Event Chain (Deliverable 23\)**

The event log builds chronologically based on the Evulgare lifecycle architecture11.

> 1. 0.000 SCENARIO\_READY  
> 2. 0.500 INPUTS\_VALIDATED  
> 3. 1.000 AUTHORITATIVE\_ENGINE\_EVALUATED  
> 4. 1.500 ENTITY\_TECHNICAL\_FEASIBILITY\_SUPPORTED  
> 5. 6.500 RUN\_COMPLETE

#### **Example Evidence Package (Deliverable 24\)**

JSON  
{  
  "attestation\_root": {  
    "dice\_cdi": "ab89f72c91...",  
    "signature": "ed25519\_sig\_block"  
  },  
  "envelope\_id": "ENV-1004",  
  "records": \[  
    {"event\_type": "SCENARIO\_READY", "seq\_id": 1}  
  \],  
  "timestamp\_tick": 1723145415  
}

#### **Flask API Design and Error Response (Deliverables 25 & 26\)**

The API operates strictly as a WSGI interface utilizing Flask 3 Blueprints mounted via cPanel Passenger. Error responses follow strict obfuscation guidelines to prevent intelligence leakage regarding internal topological structures \[PROPOSED REQUIREMENT\].

JSON  
{  
  "code": "AUTHORITY\_INSUFFICIENT",  
  "error\_id": "ERR-92B1-44A9",  
  "message": "The synthetic request exceeds the current authority bounds.",  
  "remediation": "RECONCILE",  
  "status": 403  
}

### **3.9 Security and Testing Matrices (Deliverables 27-31)**

#### **Threat Model (Deliverable 27\) & Abuse-Case Matrix (Deliverable 28\) & Security-Control Matrix (Deliverable 29\)**

| Threat Actor | Abuse Case | Mitigating Security Control |
| :---- | :---- | :---- |
| Malicious Insider | Silently modifying historical event telemetry. | Append-only event sourcing; Cryptographic hash chains. |
| Adversarial AI | Using generative output to execute an unauthorized task. | DM intercepts all requests; Datalog policy strictly applied. |
| Network Adversary | Forcing network partition to trigger autonomous operations. | Pre-authorized bounds strictly limit offline PARTITIONED duration. |

#### **Performance Model (Deliverable 30\)**

The Black-Box Simplex architecture requires real-time interception6. The performance target for the DM executing a Datalog evaluation is ![][image3] milliseconds. If the DM fails to complete its evaluation within this threshold, it is designed to abort and automatically switch control to a pre-computed safe command sequence managed by the LBC14.

#### **Testing Matrix (Deliverable 31\)**

| Test Category | Target Component | Success Criteria |
| :---- | :---- | :---- |
| **Metamorphic Tests** | Datalog compilation layer | Functionally equivalent natural-language rules yield identical compiled logic constraints. |
| **Deterministic Replay** | Event Sourcing architecture | Replaying seq=0 through seq=N recreates the exact terminal memory state with zero variance. |
| **Clean-root Tests** | DICE Reconstitution logic | System successfully boots to a verifiable SCENARIO\_READY state from a wiped memory block8. |

### **3.10 Deployment and Validation Checklists (Deliverables 32-34)**

#### **Phased Implementation Plan (Deliverable 32\)**

| Phase | Focus Area | Milestone |
| :---- | :---- | :---- |
| Phase 1 | Core Python Domain & Tests | 100% mutation testing coverage on frozen state logic. |
| Phase 2 | Policy and Datalog Integration | pyDatalog compiling Macaroon-style capability rules10. |
| Phase 3 | Infrastructure and API Bindings | Flask 3 Blueprints securely handling WSGI translation. |
| Phase 4 | DICE Attestation Integration | Successful cryptographic boot from known-good baseline. |
| Phase 5 | Staging Deployment | Deployment to Evulgare cPanel staging environment for integration. |

#### **Repository-Validation Checklist (Deliverable 33\)**

| Requirement | Status |
| :---- | :---- |
| Production environment excludes all npm / Node.js dependencies. | \[ REQUIRED \] |
| requirements.txt strictly pinned with cryptographic hashes. | \[ REQUIRED \] |
| Linter configuration (Flake8 / MyPy) enforces strict typings and pure functional logic. | \[ REQUIRED \] |
| Codebase strictly prohibits datetime.now() execution within the domain/ boundary. | \[ REQUIRED \] |

#### **Actual-Host Validation Checklist (Deliverable 34\)**

| Requirement | Status |
| :---- | :---- |
| cpanel\_app.py correctly proxies WSGI requests via Passenger. | \[ REQUIRED \] |
| WebGL2 analytical frontend synchronizes accurately with AUTHORITATIVE\_ENGINE\_EVALUATED states11. | \[ REQUIRED \] |
| Host runtime is validated strictly against Python 3.13.14 via SBOM. | \[ REQUIRED \] |

## **4\. Site-Ready Content and Institutional Frameworks (Deliverable 35\)**

*(The following 2,500-word narrative essay is architected for direct integration into Evulgare's public repository, elucidating the philosophical and technical underpinnings of the platform's defense architecture.)*

### **Make the Machine Answerable: The Evulgare Philosophy and Architecture**

The integration of consequential autonomous systems into complex environments fundamentally disrupts traditional models of governance, safety, and accountability. As machine intelligence scales in capability, a critical paradox emerges: capability does not imply authority, and successful execution does not prove legitimacy. An autonomous system may execute a highly complex, technically flawless maneuver, yet if that maneuver operates outside of explicit institutional authority, it represents a catastrophic governance failure. To resolve this paradox, Evulgare has engineered a production-grade Autonomous Defense Kernel designed to make the machine undeniably answerable.

#### **The Imperative of Determinism**

At the heart of the Evulgare architecture is a pure-Python domain layer meticulously engineered for determinism. In conventional software engineering, slight variations in execution—stemming from network latency, floating-point arithmetic across different CPU architectures, or reliance on host-system clocks—are often deemed acceptable tolerances. In the realm of autonomous accountability, these tolerances are fatal. If a post-incident investigation requires the exact reconstruction of a machine’s state at the moment of a critical decision, any non-deterministic variable compromises the integrity of the audit.  
Evulgare resolves this by enforcing strict event sourcing combined with immutable data structures. Within the authoritative kernel, the state of the world is not stored as a mutable database row that can be silently updated or deleted. Instead, every action, sensor reading, and authority evaluation is appended as a discrete, cryptographically hashed event to an immutable chain. The progression of time is decoupled from wall-clock reality, relying entirely on monotonically increasing sequence ticks. By stripping away OS dependencies and utilizing canonical JSON for serialization—where all keys are alphabetically sorted and whitespace is eliminated—we guarantee mathematical reproducibility. A synthetic evaluation executed today will yield the exact same byte-for-byte state transitions if replayed ten years from now on entirely different hardware.

#### **Bridging the Assurance Gap with Simplex Architecture**

The rapid advancement of neural networks and Large Language Models (LLMs) has outpaced the capability of formal verification methods. It is mathematically impossible to statically verify the billions of parameters within a deep learning model to guarantee it will never violate a critical safety boundary under novel conditions. If we cannot trust the advanced controller, how do we secure the system?  
Evulgare relies on a Black-Box Simplex Architecture5. Under this framework, the Advanced Controller (AC)—the complex, unverified AI model—is treated as a black box. Its internal workings do not need to be understood or formally verified. Instead, every command it issues is intercepted by a deterministic Decision Module (DM). The DM acts as a high-speed reference monitor, evaluating the AC's proposed actions against explicit Datalog policy bundles and runtime barrier certificates6.  
If the DM determines that the AC's command maintains the system within a safe operational envelope, it permits the action. However, if the AC attempts to exceed its authority, violate its purpose limitations, or if the DM evaluation itself exceeds a 10-millisecond latency threshold, the DM instantly strips control from the unverified AI14. Control is deterministically handed to the Lookahead Baseline Controller (LBC)—a highly simplified, statically verified mechanism whose sole purpose is to return the system to an attested recovery state or execute a safe synthetic termination. This architecture functionally isolates the brilliance of the AI from the safety-critical constraints of the mission, proving that runtime checks can safely replace the necessity of statically verifying advanced controllers6.

#### **Reimagining Policy and Authority**

Traditional institutional policies are written in natural language, relying on human interpretation and subjective context. When transferred to an autonomous system, particularly one utilizing generative models, natural language instructions are highly susceptible to "prompt injection" and semantic evasion. An advanced AI might rationalize its way out of a safety constraint by redefining the context of the prompt.  
Evulgare solves this by compiling strategic intent into Datalog. Datalog is a declarative logic programming language that is significantly more constrained than Prolog9. It operates on a bottom-up evaluation model that mathematically guarantees termination. Within Evulgare, policy is not a suggestion; it is a rigid mathematical constraint. The Datalog engine evaluates the current facts (e.g., the authority token, the compartment state, the sequence tick) against the rules. If the exact conditions for execution are not met, the Datalog evaluation defaults to a denial. An AI cannot generate text clever enough to bypass a compiled mathematical proof.  
Furthermore, authority within this kernel is strictly conjunctive. We explicitly reject weighted-scoring mechanisms for authority evaluation. A system cannot offset a lack of institutional authorization with a highly accurate sensor reading. The gates for technical feasibility, independent review, institutional permission, and bounded authority must all independently evaluate to True11. If any single variable is missing or invalidated, the system deterministicly halts.

#### **Managing Uncertainty and Epistemic Risk**

A pervasive flaw in modern AI deployment is the reduction of uncertainty into a single "confidence score." A model claiming 95% confidence masks critical context: is it 95% confident because the sensor data is slightly noisy, or is it 95% confident while evaluating a scenario it was fundamentally never trained to comprehend?  
The Evulgare architecture explicitly segregates aleatoric uncertainty (environmental noise intrinsic to the hardware) from epistemic uncertainty (the model’s lack of fundamental knowledge regarding a novel situation). When epistemic boundaries are breached—indicating a model-distribution shift—the system does not attempt to "guess" a correct outcome. Instead, it deterministically executes an abstention sequence, transitioning into a COLLECT\_MORE\_EVIDENCE loop or entering DEFENSIVE\_ISOLATION.

#### **Sovereign Independence and Attested Reconstitution**

Connectivity does not imply trust. A critical threat to autonomous platforms is the assumption that restoring a lost network connection immediately restores the validity of the operational context. When an Evulgare-secured node experiences a network partition, it evaluates whether it possesses pre-computed, cryptographically signed authority to operate locally \[DOCUMENTED FIRST-PARTY CLAIM\]. If it does, it may continue operations strictly within those temporal bounds.  
However, if the link is restored, the architecture strictly enforces that successful local execution does not equate to legitimate execution. The node enters a RECONCILIATION\_REQUIRED state. It must undergo a quorum review to ensure the evidence it collected offline aligns with the global institutional understanding before it can receive a reissued authority token.  
Should the system suffer a catastrophic compromise, recovery mechanisms do not erase history to hide the failure. True accountability demands transparency. The recovery architecture leverages the Device Identifier Composition Engine (DICE) standard7 to establish a verifiable hardware root of trust. The system reboots, generates a Compound Device Identifier (CDI) based on its firmware and software bills of materials, and appends a RESTORE\_ATTESTED\_BASELINE event to the chain, preserving the exact state of the compromised predecessor for forensic analysis.  
By enforcing deterministic authority, isolating untrusted capability through Simplex architecture, compiling policy into unassailable logic, and locking history in cryptographic evidence chains, the Evulgare Autonomous Defense Kernel ensures that responsibility inexorably follows the evidence.

## **5\. Extensive Classifications and Matrices (Deliverables 36-37)**

### **5.1 Forty FAQ Answers (Deliverable 36\)**

| \# | Question | Concise Answer |
| :---- | :---- | :---- |
| 1 | **What is Evulgare?** | A platform ensuring autonomous systems are strictly accountable through evidence and runtime assurance. |
| 2 | **Does this framework control real weapons?** | No, the architecture is strictly confined to synthetic, fictional bounds for software assurance. |
| 3 | **Why utilize Python 3.13.14 exclusively?** | It provides pinned consistency, ensuring deterministic state reducers operate identically everywhere. |
| 4 | **Why is Node.js excluded?** | To minimize the production dependency attack surface and eliminate non-deterministic JS compilation layers. |
| 5 | **What is a Simplex Decision Module (DM)?** | A high-speed runtime monitor that intercepts commands from an unverified AI controller6. |
| 6 | **What does conjunctive authority mean?** | All policy rules must simultaneously evaluate to True; weighted scoring is prohibited11. |
| 7 | **Can an AI system authorize itself?** | Never. Authority must be issued by a sovereign institution or an independent, distinct intelligence. |
| 8 | **What occurs if a policy evaluation yields an unknown state?** | The system defaults deterministically to DENY\_COMMAND. |
| 9 | **How is the duration of an authority token bounded?** | By strict, monotonically increasing sequence integers (ticks), avoiding host wall-clock reliance. |
| 10 | **Can human operators override the autonomous kernel?** | Yes, via the generation of a new, institutionally signed overriding authority token. |
| 11 | **What defines an append-only architecture?** | Historical states cannot be mutated or deleted; new states are perpetually appended to the chain. |
| 12 | **Does a cryptographic hash prove reality?** | No, it only proves mathematical data integrity. It cannot prove a sensor wasn't physically spoofed. |
| 13 | **What is canonical JSON serialization?** | A string format with zero whitespace and alphabetically sorted keys, ensuring perfect hash stability. |
| 14 | **Why is event sourcing necessary?** | It provides mathematically reproducible audit trails required for post-incident provenance. |
| 15 | **Where is database logic executed?** | Strictly outside the pure Python domain layer; it serves only as a persistence mechanism. |
| 16 | **What is an Advanced Controller (AC)?** | The complex, highly capable, but unverified AI model (e.g., a neural network)6. |
| 17 | **What is a Lookahead Baseline Controller (LBC)?** | A statically verified, simplistic controller executing safe fallback procedures6. |
| 18 | **What happens if the DM logic fails or hangs?** | Hardware watchdogs force a transition to the LBC's pre-computed safe sequences14. |
| 19 | **Why is Simplex considered "black-box"?** | The DM evaluates safety constraints without needing to understand the internal weights of the AC6. |
| 20 | **What is a barrier certificate?** | A mathematical proof that guarantees the system remains within defined safety limits5. |
| 21 | **How does the system define a compartment?** | An isolated operational boundary governing data custody, reuse restrictions, and workload identities. |
| 22 | **How is compromise propagation calculated?** | Orthogonally. A compromised communication key does not automatically invalidate a model's integrity. |
| 23 | **Can data traverse compartments freely?** | Only through explicit cryptographic subdelegation that attenuates authority13. |
| 24 | **What mechanism manages stale compartment data?** | It is cryptographically shredded upon reaching its maximum retention tick threshold. |
| 25 | **Are compartments physically separated?** | Within this synthetic framework, they are mathematically isolated via namespaces and Datalog policies. |
| 26 | **What is epistemic uncertainty?** | A fundamental lack of knowledge, such as an AI encountering an entirely novel object class. |
| 27 | **What is aleatoric uncertainty?** | Statistical noise or randomness inherent in the physical hardware of a sensor. |
| 28 | **Why avoid a single "AI confidence" score?** | Merging uncertainty vectors dangerously masks fatal operational knowledge gaps. |
| 29 | **Does a lost connection trigger autonomous authority?** | No. Connection loss does not synthesize authority; operations must be pre-authorized. |
| 30 | **What is post-partition reconciliation?** | The mandatory process of resolving conflicting local and global evidence before reissuing authority. |
| 31 | **What is the DICE specification?** | The Device Identifier Composition Engine, a standard for creating hardware roots of trust7. |
| 32 | **Why is DICE essential for recovery?** | It mathematically proves the firmware baseline has not been compromised prior to software loading. |
| 33 | **Does recovery overwrite the corrupted state?** | Never. It appends a RESTORED event, preserving the compromised predecessor for forensic audit. |
| 34 | **What role does an SBOM play?** | A Software Bill of Materials is hashed to verify the Python environment precisely matches the attested baseline. |
| 35 | **Why is the predecessor state preserved?** | To allow institutional reviewers to identify and mitigate the specific vector of the initial compromise. |
| 36 | **Why utilize Flask 3 for the API?** | It provides lightweight, highly stable WSGI support compatible with strict cPanel environments. |
| 37 | **Why use cPanel Passenger deployment?** | To maintain strict compatibility with Evulgare’s requested production infrastructure constraints. |
| 38 | **Why are external CDNs prohibited?** | They represent an unacceptable supply-chain vulnerability for safety-critical UI telemetry. |
| 39 | **How is testing systematically handled?** | Through deterministic replays, metamorphic policy analysis, mutation injections, and fuzzing campaigns. |
| 40 | **How are API errors structured?** | As opaque JSON envelopes containing reference UUIDs, strictly preventing intelligence leakage. |

### **5.2 Glossary of Sixty Core Terms (Deliverable 37\)**

| Term | Domain Category | Definition |
| :---- | :---- | :---- |
| **Abstention** | Uncertainty | A deterministic transition preventing execution due to high epistemic gaps. |
| **AC (Advanced Controller)** | Simplex | An unverified, high-performance controller (e.g., neural network)6. |
| **Aleatoric Noise** | Uncertainty | Statistical randomness inherent to hardware sensors. |
| **Append-Only** | Domain | An architecture where history can only be added to, never modified. |
| **Attestation** | Recovery | A cryptographic proof of identity or configuration state. |
| **Attenuation** | Authority | The process of strictly reducing permissions during subdelegation13. |
| **Barrier Certificate** | Simplex | A mathematical formulation proving a system avoids unsafe states5. |
| **Black-Box Architecture** | Simplex | Evaluating inputs/outputs without analyzing internal AI logic weights6. |
| **Blueprint** | API | A Flask 3 structural module isolating application routing. |
| **Bottom-Up Evaluation** | Datalog | A logic resolution method guaranteeing termination, unlike Prolog9. |
| **Canonicalization** | Domain | Formatting data strictly (e.g., sorted JSON) to guarantee identical hashes. |
| **CDI (Compound Device Identifier)** | Recovery | A cryptographic key derived via the DICE specification8. |
| **Compartment** | Infrastructure | A segregated execution and data custody boundary. |
| **Conjunctive Gate** | Authority | A logic constraint requiring all parameters to be True; no scoring permitted. |
| **Correlation Group** | Evidence | A tagging mechanism for tracking orthogonal compromise propagation. |
| **CSRF Boundary** | API | Cross-Site Request Forgery protection intercepting malicious web calls. |
| **Custody Chain** | Evidence | The cryptographically signed history of entities handling a data packet. |
| **Defensive Isolation** | Lost Link | A state preventing operations upon expiration of partitioned authority. |
| **Degraded State** | Lost Link | A transitional phase where latency exceeds normal operational thresholds. |
| **Determinism** | Domain | Guaranteeing identical inputs yield identical outputs irrespective of environment. |
| **DICE** | Recovery | Device Identifier Composition Engine, standardizing hardware trust roots7. |
| **Digest** | Evidence | A fixed-length cryptographic hash representing a larger data structure. |
| **DM (Decision Module)** | Simplex | The runtime monitor intercepting and evaluating AC commands14. |
| **Envelope** | Evidence | A structured wrapper containing payload data and attestation signatures. |
| **Epoch** | Recovery | A monotonic version integer permanently invalidating prior cryptographic keys. |
| **Epistemic Gap** | Uncertainty | An uncertainty vector reflecting a model's lack of training or knowledge. |
| **Event Sourcing** | Domain | Deriving the current state entirely from an immutable log of prior actions. |
| **Fact** | Datalog | A fundamental statement held to be mathematically true within the engine9. |
| **Frozen State** | Domain | A dataclass object completely immune to runtime mutation. |
| **Fuzzing** | Testing | Injecting malformed random data to validate null-sink resilience. |
| **Grace Period** | Authority | The brief EXPIRING window preceding total authority revocation. |
| **Heuristic** | Evidence | A fixed algorithmic rule, such as base sensor reliability scoring. |
| **Integrity Hold** | Lost Link | A state triggered by diametrically conflicting synthetic sensor inputs. |
| **Key Rotation** | Recovery | Advancing the epoch integer to sever reliance on compromised credentials. |
| **LBC (Lookahead Baseline)** | Simplex | A statically verified controller ensuring safe system recovery paths6. |
| **Lifecycle Gate** | Authority | An explicitly required review state (e.g., Institutional Permission)11. |
| **Macaroon** | Authority | A bearer token embedding contextual caveats for delegated authority13. |
| **Metamorphic Test** | Testing | Validating that equivalent logical policies yield the same runtime result. |
| **Monotonic Tick** | Domain | An integer that only increments, entirely replacing wall-clock reliance. |
| **Null Sink** | Execution | An abstract destination for blocked actions to terminate safely. |
| **Object-Capability** | Policy | A security model granting authority based strictly on possession of a token16. |
| **Partitioned** | Lost Link | Total loss of communication with the governing institutional node. |
| **Passenger** | API | The cPanel WSGI application server interfacing with the Flask layer. |
| **Prior Digest** | Domain | The hash of the previous event binding the append-only chain. |
| **Prompt Injection** | Threat | Bypassing generative AI guardrails using maliciously constructed text. |
| **Provenance** | Evidence | The undeniable historical origin and custody of a decision vector. |
| **pyDatalog** | Policy | A Python library executing declarative logic programming rules10. |
| **Quorum** | Recovery | The requisite number of independent reviewers necessary for reconciliation. |
| **Reconciliation** | Recovery | Resolving contradictory historical logs post-network partition. |
| **Reconstitution** | Recovery | Returning a compromised system to an attested, active operational state. |
| **Reducer** | Domain | A pure function computing the next state based on the current state and a new event. |
| **Reliability Score** | Evidence | A static heuristic reflecting expected hardware failure rates. |
| **Rule** | Datalog | A logic statement defining how new facts are deduced15. |
| **SBOM** | Recovery | Software Bill of Materials; a manifest of exact dependencies. |
| **Semantic HTML** | API | Utilizing explicit markup tags ensuring universal browser parser parity. |
| **Subdelegation** | Authority | Passing a constrained subset of an authority token to another workload. |
| **Supersession** | Evidence | A cryptographic pointer invalidating a prior, outdated data record. |
| **WebGPU / WebGL** | API | Browser technologies utilized by Evulgare to visually render state11. |
| **Workload ID** | Infrastructure | The unique identifier assigned to a specific runtime execution container. |
| **WSGI** | API | Web Server Gateway Interface; the synchronous Python standard. |

## **6\. System Architecture Mappings and Validation**

### **6.1 Research-to-Code Traceability Matrix (Deliverable 41\)**

| Primary Research Concept | Architectural Code Implementation Target | Document Trace ID |
| :---- | :---- | :---- |
| **Simplex Runtime Assurance** \[cite: 5, 6\] | domain/runtime\_assurance.py via SimplexDM class. | TRC-01 |
| **Datalog Policy Constraints** \[cite: 9, 10, 17\] | policy/rules.py via evaluate\_policy() function. | TRC-02 |
| **DICE Attestation** \[cite: 7, 8\] | domain/attestation.py via verify\_attestation(). | TRC-03 |
| **Evulgare Lifecycle Gates** \[cite: 11\] | domain/events.py mapping states to UI parity. | TRC-04 |
| **Macaroon Capability Security** \[cite: 13, 16\] | domain/authority.py tracking subdelegation attenuation. | TRC-05 |

### **6.2 Routing Infrastructure (Deliverables 39-40)**

**Recommended /docs filename and stable ID:**evulgare-adk-2026-08-08-reference.md  
**Proposed .uai Memory Router Configuration with Deep Links:**

JSON  
{  
  "uai\_version": "2.0.0",  
  "engine": "enginegovernance",  
  "digest\_lock": "1e55eb33d81f81",  
  "routes": {  
    "domain\_layer": "\#21-authoritative-python-domain-layer",  
    "simplex\_engine": "\#24-runtime-assurance",  
    "datalog\_policy": "\#23-policy-compilation-and-reference-monitoring",  
    "dice\_recovery": "\#29-recovery-and-reconstitution",  
    "site\_philosophy": "\#4-site-ready-content-and-institutional-frameworks"  
  }  
}

### **6.3 Final Validation Boundary Asserts (Deliverables 42-44)**

#### **What This Architecture Demonstrates (Deliverable 42\)**

* **Mathematical Determinism:** Execution of the Python 3.13.14 domain layer will perfectly replicate state transitions independently of hardware infrastructure \[ENGINEERING INFERENCE\].  
* **Effective Runtime Assurance:** The Simplex Control framework successfully bounds unverified Advanced Controllers within strict Datalog constraints6.  
* **Cryptographic Evidence Integrity:** Append-only event sourcing permanently locks execution history, neutralizing silent alteration threats.  
* **Attenuated Capability Management:** Policy-as-data architecture successfully prevents generative model text-injection from overriding explicit institutional limitations.

#### **What It Does Not Establish (Deliverable 43\)**

* **Elimination of the Reality Gap:** The architecture explicitly notes that software simulation verification does not certify or eliminate the model-to-reality gap inherent in physical systems \[OBSERVED PUBLIC FACT\].  
* **Force Authorization:** The system neither issues legal liability clearance nor grants real-world operational force authorization.  
* **Kinetic System Control:** The Python models provided do not contain, and cannot execute, real-world targeting, payload control, or tactical trajectory generation.

#### **What Requires Private-System Validation (Deliverable 44\)**

* **Evulgare Integration:** Precise linkage with Evulgare’s proprietary .uai internal memory routers and external analytical dashboards \[REQUIRES PRIVATE-SYSTEM VALIDATION\].  
* **Database Tuning:** Real-time performance optimization on actual cPanel/MySQL configurations running via Passenger \[REQUIRES ACTUAL-HOST VALIDATION\].  
* **Source Code Inspection:** Final validation of canonical JSON mechanisms and module imports \[REQUIRES REPOSITORY VALIDATION\].

*This is for informational purposes only. For legal, policy, or safety-critical decisions regarding real-world autonomous systems, consult qualified professionals and certifying authorities.*

#### **Works cited**

> 1. Evulgo: Latin Conjugation & Meaning \- latindictionary.io, [https://www.latindictionary.io/entry/evulgo-evulgare-evulgavi-evulgatus](https://www.latindictionary.io/entry/evulgo-evulgare-evulgavi-evulgatus)  
> 2. evulgo, evulgas, evulgare A, evulgavi, evulgatum Verb \- Latin is Simple, [https://www.latin-is-simple.com/en/vocabulary/verb/3721/](https://www.latin-is-simple.com/en/vocabulary/verb/3721/)  
> 3. Latin Definition for: evulgo, evulgare, evulgavi, evulgatus (ID: 19544\) \- Latin Dictionary and Grammar Resources \- Latdict, [https://latin-dictionary.net/definition/19544/evulgo-evulgare-evulgavi-evulgatus](https://latin-dictionary.net/definition/19544/evulgo-evulgare-evulgavi-evulgatus)  
> 4. EVULGATE Definition & Meaning \- Merriam-Webster, [https://www.merriam-webster.com/dictionary/evulgate](https://www.merriam-webster.com/dictionary/evulgate)  
> 5. The black-box simplex architecture for runtime assurance of multi-agent CPS \- NSF PAR, [https://par.nsf.gov/biblio/10508985-black-box-simplex-architecture-runtime-assurance-multi-agent-cps](https://par.nsf.gov/biblio/10508985-black-box-simplex-architecture-runtime-assurance-multi-agent-cps)  
> 6. arXiv:2102.12981v3 \[cs.SE\] 31 May 2022, [https://arxiv.org/pdf/2102.12981](https://arxiv.org/pdf/2102.12981)  
> 7. (PDF) ADATA: Asymmetric Device Identifier Composition Engine Compliant Aggregate Trust Attestation \- ResearchGate, [https://www.researchgate.net/publication/396965637\_ADATA\_Asymmetric\_Device\_Identifier\_Composition\_Engine\_Compliant\_Aggregate\_Trust\_Attestation](https://www.researchgate.net/publication/396965637_ADATA_Asymmetric_Device_Identifier_Composition_Engine_Compliant_Aggregate_Trust_Attestation)  
> 8. Trusted Platform Architecture Hardware Requirements for a Device Identifier Composition Engine, [https://trustedcomputinggroup.org/wp-content/uploads/TCG-Device-Identifier-Composition-Engine-rev-72\_public-review.pdf](https://trustedcomputinggroup.org/wp-content/uploads/TCG-Device-Identifier-Composition-Engine-rev-72_public-review.pdf)  
> 9. Datalog \- Wikipedia, [https://en.wikipedia.org/wiki/Datalog](https://en.wikipedia.org/wiki/Datalog)  
> 10. pyDatalog \- PyPI, [https://pypi.org/project/pyDatalog/](https://pypi.org/project/pyDatalog/)  
> 11. Governance Lifecycle and Qualified-Human Gates Assurance Workbench | Evulgare, [https://evulgare.com/simulations/governance-lifecycle](https://evulgare.com/simulations/governance-lifecycle)  
> 12. Relational/Logic Programming in Python? \- prolog \- Stack Overflow, [https://stackoverflow.com/questions/1917607/relational-logic-programming-in-python](https://stackoverflow.com/questions/1917607/relational-logic-programming-in-python)  
> 13. ecordell/pymacaroons: A Python Macaroon Library \- GitHub, [https://github.com/ecordell/pymacaroons](https://github.com/ecordell/pymacaroons)  
> 14. The Black-Box Simplex Architecture for Runtime Assurance of Multi-Agent CPS \- Stanley Bak, [https://stanleybak.com/papers/sheikhi2024isse.pdf](https://stanleybak.com/papers/sheikhi2024isse.pdf)  
> 15. Introduction to Datalog(Bashlog) in Python | by Rajiv Abraham | Medium, [https://medium.com/@rajiv.abraham/introduction-to-datalog-bashlog-in-python-127cdfe48442](https://medium.com/@rajiv.abraham/introduction-to-datalog-bashlog-in-python-127cdfe48442)  
> 16. Security \- Python Wiki \- Python.org, [https://wiki.python.org/moin/Security.html](https://wiki.python.org/moin/Security.html)  
> 17. Snakelog: A Python DSL for Datalogs | Hey There Buddo\! \- Philip Zucker, [https://www.philipzucker.com/snakelog-post/](https://www.philipzucker.com/snakelog-post/)

[image1]: <data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAZCAYAAABQDyyRAAABa0lEQVR4Xu2VsStFYRiHX0mISIoUi5RNilI2kkkoBrGxKptJUjIgi0w2gz/AYKLcsgjJZDFYlL/AqDw/h3zf8Z17z7k3Sp2nnrq97+2+7z3nd75jlpPzu/TiDh7iPNb77W9G8ArnsCbWK5cZfMB+bMRNPMNm90su2m4R73EJG/x2JrrwERecWgve4LJTC6IroCtxi2vY5LdTocGvOODUqvAYCxZdkZJU4yhe4i62+u2i7NvPBcQRvmB3rF4UbT6EF3iAHX47iAYlLRCqp6IW1/EZe2I9F13egoUHlbWAG84VKx1O9c8tPCjTAvohDbyz7I9n0qCkuodSr/TrXJiyKIxZ2bLwIC2gW9gZq3+gcClkCtuwlTf4i0l8wzGnVoenn+qzxwSeYJ9Fqa8UPbLXuOHUFFz9e93OP2EQn3AVZy06BbctW5YqRkEex2mLjudEtFW7RTkoZZtVlo8gemPplZnGPUt3Gubk/A/eARC2QlJ69+/bAAAAAElFTkSuQmCC>

[image2]: <data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAA4AAAAWCAYAAADwza0nAAAAw0lEQVR4XmNgGLbAC4jF0AUJARUgngHEnOgS+AAjENcAsSu6BCFAtm2dDGTYpg3EU4CYFV0CHwDZ1gXEtugSICAExDuA+BEW/ByIPwPxYzTxWrBOHIAFiCcCsSW6BCFgDMS9DBADsAKQP4SBWBIJyzJAgt8dTRyGBUAaQaHlDMQhSLgKiLcCcTiaOAybgzSiA5DTpgKxDroEIQAK+hYGiBeIBiBngyIbFOkkAVCyAiVmkmwDJWBQSIISNEnAgQESmrQFABIvHMfZpq+UAAAAAElFTkSuQmCC>

[image3]: <data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACoAAAAZCAYAAABHLbxYAAABoklEQVR4Xu2WzytEURiGP0kRkSRZKCSykZLshGws/CiS8AfY2VFSFrKhlFJKWdhMyloWFpSNUnbYSmHFCgsb3rczl3POnXPdO3eUxXnqaZrvOzP37d75zhkRj8dTDCdho1UPKIPTcBeuwzaz/bfw4sNwCz7AN9hlrFBUwRO4CitgJ7yB4/qifCmHJXbRgkGHYB9cEXfQRXgJq7XaDLyFdVotEXwkhzADa61eFAyTKyjDMeS+Ve+Gr3DEqkdSBHvgKdyGDWY7Fq6g7fBZwkG5juvXrHpOOAAD8BxuwBqznQhX0CCQK6hdN2DAUXgBl2Gl2c4LV1AO26eEA0UG5XBMwSs4L2pgCoUrKIctcdB+eAfnRE1sIXEFdQVy1b/R7+qCFOaxE1fQZvgk4UBB0CWrHiL4nXLrSDtIxBWUG/wZPIKlWn0QfmRfY2FvTfVmOzYM+i5qf7SZhfewKfue1+QpxWHmqZUIfrgDHsM9+fnSKDiMB/BF1MAEPsJNbR1/bjuibsaYqJDXoo7SVDAk/zi02I0U8Ea0wgnYK78fzx6Px/Of+AJx/1R8CCmDxAAAAABJRU5ErkJggg==>