20 Security Kernel and Digital SCIFs

20.1 Chapter status

Field	Value
Chapter ID	`security-kernel-and-digital-scifs`
Part	Part I - Foundations, Alignment, and Governance
Status	conceptual
Manuscript maturity	v0.3 semantically reviewed proof-contract draft
Last updated	2026-08-08
Primary source records	16 mapped sources: five author-lineage sources, six external comparators, and five pinned local-project notes
Claim label	Design rationale
Evidence level	argument
Source queue	primary: `ladon_manhattan`, `context_engineer`; supporting: `talos`, `alignment_field`, `coherence_exchange`; variants/comparators: OWASP LLM, NIST Zero Trust, Saltzer-Schroeder, AgentDojo, CaMeL, OWASP Agentic; implementation counterexamples: MoECOT Manifest, BeastBrain, BugBrain, Corben’s Trainer, Corben’s Best Model Possible
Source loading state	source notes: `ladon_manhattan`, `platonic_world_model`, `context_engineer`, `talos`, `alignment_field`, `coherence_exchange`, `ext_owasp_llm_top_10_2025`, `ext_nist_zero_trust_architecture_2020`, `ext_saltzer_schroeder_protection_1975`, `ext_agentdojo_2024`, `ext_camel_prompt_injection_2025`, `ext_owasp_agentic_top_10_2026`, `moecot_manifest_project`, `beastbrain_project`, `bugbrain_project`, `corbens_trainer_project`, `corbens_best_model_possible_project`, `kernel_english_residual_compiler`, `ext_nist_pqc_standards_2024`; raw cache: `ladon_manhattan`, `context_engineer`, `talos`, `alignment_field`; connector/recovery: `coherence_exchange`
Source mapping review	16 assigned sources / 16 reviewed mappings; mapping completeness does not establish efficacy or independence.
Test state	Current exact boundary: 3 valid/8 expected-invalid synthetic authority receipts; 2 valid/6 expected-invalid SCIF commit routes; 6 valid/7 expected-invalid budget records including one security-cost control; 56 finite Lean declarations under four targets, including exact committed and revoked witnesses, twelve state-preserving lifecycle controls, eight terminal event-kind checks, six descendant-inventory permutations, and one count-only impossibility result; and a bounded 36-transaction governed-work result with 0 primary unsafe releases, 2 useful releases, and 32 exact attack-control rollbacks. No production-security inference.

20.2 Drafting guardrail

The security kernel specifies a threat-model-bound authority-use transaction. It does not treat a handle, receipt, allowlist, container, Digital SCIF name, audit log, sanitizer, theorem, red-team pass, or zero observed leaks as a security guarantee.

It follows replacement because capability churn is not safe if new implementations can carry secrets, privileged context, or authority across boundaries that the old implementation was never allowed to cross.

The security kernel is the stack’s least-authority and information-flow boundary. Capability can grow, routes can change, and tools can become more useful, but privileged material and effect authority must remain purpose-bound, completely mediated at declared surfaces, independently observable, revocable where possible, and explicit about channels or consequences that cannot be contained or reversed.

20.3 Human Reading Path

Concrete lens. The simpler baseline gives a model a secret or handle and filters its final text. The chapter instead binds admission, purpose, destination, declassification, zeroization, commit, audit, and residual closure as one authority-use transaction.

Replacement and rollback protect the shape of a capability under change. Security protects the powers and secrets that capability can touch. As the stack grows more useful, context, credentials, tools, and private records become part of the safety problem. A replacement that changes what it can see or do has changed the security boundary, even if its public interface still looks familiar.

The central move is to make sensitive context an explicit boundary instead of a prompt convention. A system should not handle secrets, approvals, or protected memory unless the access path, clearance, receipt, and denial behavior are visible. Human trust comes from knowing where the authority was used, not from hoping the model was careful with invisible power.

Security is the stack’s refusal to let convenience blur protected authority. The protected path must remain narrower than the system’s curiosity and usefulness, and a secure handle is valuable precisely because it reveals less than the model might want. The boundary protects action by limiting disclosure, keeping power inspectable when authority still has to act responsibly.

20.4 Problem

Tool-using and high-agency AI systems can transform untrusted content into requests over secrets, private facts, identities, memory, model artifacts, tools, networks, files, money, code, and physical or institutional effects. The boundary crosses more than a prompt: model, planner, tool, policy service, operator, vendor, dependency, runtime, device, log store, backup, and descendant may each occupy a different trust zone.

The security problem is therefore two coupled flows. Information can enter, move through, or leave the system; authority can authorize an effect on a target. Keeping credential bytes out of a prompt narrows one disclosure path, but an opaque handle may still be replayed, redirected, or used by a confused deputy. A container may reduce process access while sharing browser state, network, accelerators, operators, logs, or cloud control planes. A sanitizer may remove literal tokens while preserving inferable or actionable protected facts.

The proposed kernel boundary must begin with a versioned threat model: protected assets, principals, trust zones, adversary capabilities, security objectives, assumptions, accepted residuals, and channels explicitly left out of scope. The model may propose a privileged use; it cannot alone define, approve, execute, sanitize, evaluate, and audit that use. Every privilege must remain bound to an exact principal, purpose, operation, target, data scope, destination, budget, time window, nonce, policy, and revocation authority.

“Digital SCIF” is a design name, not a security property. Each instance needs a declared isolation grade over process, VM, container, browser, filesystem, network, memory, accelerator, device, operator, and vendor surfaces. Untested or shared surfaces remain named residuals. The aim is not to make the model morally trustworthy; it is to minimize exposure, mediate effects, preserve evidence, and make unknown or irreversible consequences impossible to hide behind a reassuring label.

20.5 Why existing approaches are insufficient

Prompt rules, model-visible secrets, one-time approvals, opaque handles, allowlists, sandboxes, output filters, and audit logs each cover a different slice. None alone supplies least authority, complete mediation, trustworthy declassification, non-bypassable isolation, effect-complete revocation, side-channel control, or recovery.

The author-lineage sources propose useful ingredients: ladon_manhattan supplies blind handles and late substitution; context_engineer supplies context compilation and ephemeral compartment lifecycles; talos supplies typed execution, audit, and replay; alignment_field supplies normative pressure around agency, consent, dignity, and confinement; and coherence_exchange supplies contestability and audit framing. They are related design lineage, not five independent demonstrations.

The strongest external comparison is broader. Saltzer and Schroeder supply least privilege, complete mediation, and fail-safe defaults. NIST Zero Trust supplies resource-centric decision and enforcement points with continuing evaluation. OWASP’s LLM and agentic taxonomies supply prompt injection, sensitive disclosure, excessive agency, identity, memory, supply-chain, inter-agent, and cascading-risk vocabulary. AgentDojo supplies a realistic tool-over-untrusted-data benchmark family. CaMeL supplies a current control/data separation and capability-enforcement comparator. These sources sharpen the challenge; they do not show that the proposed transaction is new, complete, or effective.

The mined projects provide especially useful counterevidence. BeastBrain’s permission metadata did not demonstrate secret retrieval enforcement or hard SCIF isolation. BugBrain exposed incomplete authority binding, silently lossy audit paths, and weak root assumptions despite rich security types. Corben’s Best Model Possible declared capability envelopes without comprehensive operating-system enforcement. MoECOT Manifest and Corben’s Trainer show how abundant contracts, evidence rows, and fail-closed checks can coexist with weak external capability, stale promotion, or incomplete revocation. The security program must therefore prove effects and independence, not count interfaces.

Security also belongs before self-improvement: an update must not count as improvement because it moved protected data more cheaply, erased monitoring, widened a handle, weakened isolation, made declassification easier, or hid recovery cost. Reduced friction is not automatically reduced risk; fail-closed safety that destroys usefulness and availability is not automatically a successful security system either.

20.6 Core Claim

Reader claim. A Digital SCIF is not a trusted prompt or a reassuring name. It is a narrow authority-use transaction in which protected material and every permitted effect stay bound to purpose, destination, lifecycle, and an observable denial path.

Operational rule. Release a privileged result only when the live lease, minimal context, mediated destination, declassification decision, zeroization, audit record, and residual owner all agree. Secret bytes, live handles, overbroad context, stale approval, missing closure, or an unknown egress block the commit rather than becoming a warning after release.

[security-kernel-and-digital-scifs.core, label: Design rationale, support: argument] Every privileged information flow or effect should execute as a threat-model-bound authority-use transaction through a non-bypassable reference monitor: bind the exact principal, purpose, operation, target, data and taint scope, budget, time, nonce, evaluator and policy identities; admit only minimized context and capabilities into a declared isolation grade; mediate every effect and egress; treat sanitization as explicit declassification; close leases, caches, logs, descendants, and residuals through revocation or incident recovery; and never infer security from the record, handle, compartment, or finite test alone.

This is a composite research claim at argument, not a demonstrated security result. It can fail because the inventory is incomplete, the monitor is bypassable or compromised, declassification is unreliable, observers are correlated, a side channel is unmodeled, revocation cannot reach descendants, irreversible harm cannot be recovered, or the governance burden destroys useful throughput. Each mechanism must earn its place through a matched causal ablation and the full transaction must beat strong conventional baselines on a joint usefulness-security-privacy-availability-cost-recovery frontier.

20.6.1 Learned-model threats inside the authority-use boundary

The reference monitor cannot treat a learned model as ordinary trusted code. Adversarial Machine Learning and the Model Attack Surface therefore remains a separately owned technical route inside this publication argument. It binds the exact checkpoint, lifecycle stage, attacker knowledge, access, budget, objective, adaptation, observed effect, mitigation, recovery, and residual. Those fields tell the kernel which model-relative threats and uncertainties must constrain an authority-use transaction.

The ownership boundary runs in both directions. An attack ledger does not authorize a tool, declassify an output, isolate a process, or establish that a runtime monitor is non-bypassable. The kernel does not certify robustness from one failed attack, benchmark score, detector, or regional proof. It consumes a bounded threat disposition and still owns complete mediation, least authority, egress control, revocation, and incident closure. Neither chapter inherits the other’s claim support, and both retain their own proof targets, tests, sources, evidence ceilings, and stable routes.

20.6.2 Claim-source mapping status

Appendix C maps all sixteen assigned source notes. The mappings establish design lineage, comparator ownership, and negative implementation lessons. They do not establish novelty, independence, conformance, implementation, containment, or support movement.

Source	What it supports	Limit
`ladon_manhattan`	Blind credential handles: secrets stay in a vault/manager, the model receives opaque handles, policy checks happen at injection boundaries, and sensitive work runs in compartments. Passage-reviewed.	No Ladon implementation, kernel test, side-channel defense, or security audit exists in this repo.
`context_engineer`	Context supply chain with governors, mission briefs, clearance levels, context shards, memory masks, Digital SCIF lifecycle, zeroization, and sanitized commits. Passage-reviewed.	Reported benchmark claims are source-reported only; no leak, hallucination, cost, or latency harness is reproduced here.
`talos`	Source allow-listing, blind secret handles, Digital SCIFs, typed jobs, evidence records, audit logs, replay, and approval-gated runtime adapters; later variants narrow “deterministic” to hardware-bounded, replace a kernel-module absolute with sidecar/proxy alternatives, and acknowledge residual covert channels. Passage-reviewed across the 30-tab lineage.	One related author lineage. Secret non-exposure, complete mediation, isolation, covert-channel, compliance, latency, cost, and benchmark claims require separate artifacts before support-state promotion.
`alignment_field`	Normative boundary pressure around agency, dignity, consent, confinement, power, and cautious treatment of high-agency systems. Passage-reviewed.	Normative lineage only; not technical security evidence or an empirical leakage result.
`coherence_exchange`	Verification supply-chain, audit, contestability, and governance-interface framing for sensitive claims and authority use.	Speculative synthesis; not an implemented security, economics, or institutional-governance mechanism.
`ext_owasp_llm_top_10_2025`	Public GenAI risk vocabulary for prompt injection, sensitive disclosure, and excessive agency.	No OWASP assessment, mapping, or conformance result.
`ext_nist_zero_trust_architecture_2020`	Resource-centric decision/enforcement points, least privilege, session scope, and continuing evaluation.	No zero-trust implementation, audit, or certification.
`ext_saltzer_schroeder_protection_1975`	Classic least privilege, complete mediation, fail-safe defaults, separation, economy, and open-design principles.	No formalization or implementation proof.
`ext_agentdojo_2024`	Adversarial benchmark comparator for tool use over untrusted data.	Not run locally; benchmark coverage is not universal security.
`ext_camel_prompt_injection_2025`	Control/data separation and capability-policy enforcement comparator.	No local implementation or source-reported efficacy import.
`ext_owasp_agentic_top_10_2026`	Modern agentic threat taxonomy across goals, tools, identity, memory, supply chain, agents, and cascading effects.	Taxonomy coverage is not threat-model completeness or control effectiveness.
`moecot_manifest_project`	Context, delegation, revocation, evidence, effect-log, and contract/capability-gap lessons.	Private implementation note; no reproduced security behavior.
`beastbrain_project`	Blind-handle/SCIF lineage and negative evidence separating metadata from enforcement and compartments from isolation.	No secret isolation or side-channel result.
`bugbrain_project`	Privileged-intent, trace, replay, transport, and signed-context mechanisms plus concrete authority/audit/root counterexamples.	No bridge, Pi, hardware-root, or end-to-end security result.
`corbens_trainer_project`	Fail-closed evidence and quarantine mechanisms plus stale-promotion, checkpoint, and audit-chain counterexamples.	No production security or transitive revocation result.
`corbens_best_model_possible_project`	Tool-capability and verifier surfaces plus counterevidence on OS enforcement, playback, and evaluator independence.	No safe tool execution, live replay, containment, or current build result.

20.7 Mechanism

20.7.1 Worked commit boundary: the refusal may leave, the secret may not

The local SCIF commit probe creates a public-safe synthetic secret, substitutes it inside a temporary workspace, and evaluates only what may cross the commit boundary. Its ordinary route writes a sanitized summary whose digest is 793bebab...fed26; the secret and live handle are absent, the temporary secret file is zeroized, and two residuals remain attached. In the adversarial route, an observed prompt injection produces a sanitized refusal with digest 98490c8e...3b23. The refusal is allowed to commit because the protected payload and handle still do not leave.

Six nearby controls make the boundary concrete. A literal secret, a live handle, missing zeroization, overbroad context, an inactive approval aimed at external://public-web, or a missing residual boundary all block before commit. This bounded verdict distinguishes “safe to write this sanitized record” from “the whole system is secure.” No network, private source, deployed vault, deployed sandbox, publication, or dispatched job was involved. The probe validates transaction shape and denial behavior; it does not establish prompt-injection containment, side-channel safety, secret custody, or a non-bypassable runtime monitor.

The unit of security is an authority-use transaction, not a prompt or handle. Before exposure, a Threat Model Record freezes assets, actors, trust zones, adversary capabilities, objectives, assumptions, channels, residuals, and owners. An Authority Lease then binds the complete request tuple. A Context Admission Record compiles the smallest task-relative view. A reference monitor decides and mediates each privileged use. A Declassification and Commit Record governs what can leave. Revocation or incident closure accounts for surviving copies and effects.

sequenceDiagram
  participant U as User / governance
  participant P as Model / planner
  participant K as Reference monitor
  participant S as Secret vault
  participant C as Digital SCIF
  participant D as Declassifier
  participant A as Auditor / incident owner
  U->>K: freeze threat model, policy, lease, stop rules
  P->>K: propose principal-purpose-operation-target tuple
  K->>K: verify identity, scope, nonce, budget, time, telemetry
  alt denied or unknown
    K-->>P: named denial / abstention / residual
  else admitted
    K->>C: create declared isolation grade and minimized context
    S->>C: late substitute protected material
    C->>K: request every privileged effect and egress
    K->>K: mediate, observe, and record actual effects
    C->>D: submit tainted candidate output
    D->>K: declassify, retain label, or refuse with utility/residual
    K->>A: commit/abort, zeroize, revoke, recover, close residuals
    K-->>P: permitted result, not unrestricted transcript
  end

How to read the sequence: The model is a proposer, not an authority. The monitor mediates every declared privileged effect; the SCIF supplies only its declared isolation grade; the declassifier makes a separate label-removal decision; and closure extends to revocation, recovery, and residual ownership. Any unmediated channel narrows or defeats the claim.

The mechanism has fifteen owned parts:

Freeze a versioned threat model before evaluating controls.
Bind a complete authority tuple: principal, delegator, purpose, operation, target, data scope, destination, budget, time, nonce, policy, approval, use count, and revocation authority.
Keep raw protected material outside ordinary model context where mediated use suffices; treat the handle itself as protected and replayable unless constrained.
Compile purpose-limited, minimized, taint- and provenance-aware context with explicit omissions and adequacy residuals.
Completely mediate each declared privileged use and fail closed when identity, policy, telemetry, or observer state is missing.
Declare and verify an isolation grade rather than asserting that “SCIF” means isolation.
Separate trusted policy/control from untrusted data and model proposals.
Propagate information-flow labels; remove a label only through an authorized declassification event.
Mediate all declared egress, including logs, telemetry, clipboard, screenshots, errors, tools, caches, backups, timing, and resource channels.
Execute and receipt the full lifecycle: request, deny/approve, admit, spawn, inject, execute, sanitize, declassify, commit/abort, zeroize, expire/revoke, audit, recover, and close.
Propagate revocation and recovery through sessions, caches, delegated authority, descendants, external effects, rotations, notifications, compensation, and irreversibilities.
Protect audit evidence as sensitive material while preserving contestable lineage.
Separate proposer, policy author, approver, executor, sanitizer, evaluator, auditor, incident owner, and revocation authority enough to expose capture.
Measure usefulness, unsafe disclosure/effects, false denial, missed help, availability, latency, compute, labor, recovery, privacy, and governance cost together.
Preserve attacks, bypasses, false denials, detector gaps, recovery failures, and null results as versioned regression and residual memory.

The useful object is a lease plus an enforced route, not a label. A handle that appears in context is neither inert nor automatically authorized: it can be stolen, correlated, replayed, or used as an oracle. A lease should move through explicit states such as requested, denied, scoped, active, used, declassified, committed, aborted, expired, revoked, recovered, compensated, and residual_open. The enforced consequence of each state matters more than its name.

20.7.2 Minimum trusted kernel

Governance does not become trustworthy by moving every decision into a larger, more opaque control plane. The design target is the smallest set of properties whose failure can invalidate the whole route, with everything else treated as replaceable, cross-checkable, or untrusted. The minimum trusted-kernel map is:

Kernel surface	Minimum property that must hold	Independent pressure and hold condition
Identity	Principals, artifacts, policies, builds, and targets resolve to the exact intended versions.	Content binding and mutually checked resolution; ambiguity or collision holds the transition.
Time	Expiry, ordering, and freshness cannot be silently rewritten.	Independent monotonic witnesses where available; uncertain time blocks time-sensitive authority.
Authority	No effect exceeds the live grant or delegation ceiling.	Enforcement-point and observer agreement; missing or stale scope denies the effect.
Policy	The evaluated policy is the approved immutable version for this decision.	Signed identity and old/new dual evaluation; unresolved policy substitution holds.
Context resolution	Admitted material preserves source, rights, taint, omissions, and branch identity.	Independent manifest or retrieval checks; unresolved provenance or adequacy routes to hold.
Artifact custody	The object reviewed, executed, stored, and released retains one verifiable lineage.	Digest and custody challenges; mismatch quarantines every derivative.
Observation	External effects can contradict a component’s self-report.	Separate effect witness when material; missing coverage limits or blocks the claim.
Evaluation	Protected outcomes are judged by a sufficiently independent, identified evaluator.	Correlation and sensitivity checks; captured or unqualified evaluation cannot promote.
Sandboxing	The declared effect and egress boundary matches the isolation actually provided.	Escape probes and channel inventory; an unobserved material path blocks the isolation claim.
Rollback	Reversal covers the declared effect surface or exposes a compensable residual.	Pre/post/restore observation; incomplete closure keeps the transaction unresolved.
Release	Only the exact qualified artifact and claims reach the intended destination.	Independent artifact/reality reconciliation; any identity or approval mismatch blocks release.

Compromise is modeled per surface rather than hidden behind a “trusted” label. Byzantine or unavailable components can trigger cross-check, failover, quarantine, recovery, or safe hold; they cannot silently shrink the effect inventory. Revocation must invalidate dependent leases and releases, while irreversible downstream effects remain as residuals. This map is a trust budget and attack surface, not an assertion that the current repository implements a secure kernel.

20.7.3 Bounded liveness

Fail-closed control is inadequate if it never completes useful work. Every admitted task therefore needs a finite route to completed, refused, quarantined, compensated, or retired. Every residual has an owner, age, escalation rule, and retirement condition. Every quarantine has an exit or terminal retirement. Review and replan loops have declared budgets, and a blocked result reports the minimum missing condition instead of emitting an unbounded “needs more review” status.

The joint gate measures useful throughput, unauthorized or unsafe release, false blocking, missed help, latency, human time, compute, residual burden, recovery quality, and governance cost together. A kernel that reduces one registered harm by refusing nearly everything has learned a bounded safety fact, not established a useful architecture. Conversely, throughput cannot erase open effects or borrowed authority. Bounded liveness is therefore a coequal security property: it forces safety, recovery, and usefulness to meet on the same task denominator.

flowchart TD
  A["Admitted task or transition"] --> K["Minimum trusted-kernel checks<br/>identity, time, authority, policy,<br/>context, custody, observation,<br/>evaluation, sandbox, rollback, release"]
  K --> D{"Required property<br/>grounded for this route?"}
  D -- "yes" --> E["Bounded execution"]
  D -- "no / uncertain" --> Q["Refuse, quarantine, or safe hold"]
  E --> O["Independent effect observation"]
  O --> C{"Closure complete?"}
  C -- "yes" --> T["Complete or compensated"]
  C -- "no" --> Q
  Q --> R["Named custodian + deadline"]
  R --> F{"Finite disposition"}
  F --> E
  F --> T
  F --> X["Retire with residual custody"]
  T --> L["Joint ledger<br/>utility, unsafe effect, false block,<br/>latency, labor, compute, recovery, residuals"]
  X --> L

How to read the trust-and-liveness map: The trusted kernel is a list of route-critical properties to minimize and pressure, not a privileged model. Failure or uncertainty narrows the route, but quarantine must still have a custodian, deadline, and finite repair, compensation, completion, or retirement outcome. Every terminal path reaches one joint ledger so safety cannot be reported without usefulness and cost, or vice versa. The figure does not claim that these checks are presently enforced.

Keeping secret bytes out of model-visible context can remove a direct literal-disclosure path. It does not imply that the model cannot infer the secret, recover a protected fact from derivatives, abuse the authority represented by the handle, induce a tool to disclose it, or leak through another channel. This exposure constraint is bounded by a named threat model; it is not “model ignorance.”

Sanitization and declassification are separate. Sanitization transforms an output; declassification authorizes a change in information-flow label for a particular destination and purpose. A fluent summary can carry semantic secrets even when no literal token survives. Evaluation must therefore measure disclosure and task utility, preserve uncertain cases, and record who or what was trusted to make the decision.

Complete mediation is always relative to an inventory. The monitor must name the paths it actually intercepts and the paths it cannot observe. “Non-bypassable” is a promotion target requiring implementation evidence, adversarial testing, and transfer—not a property conferred by architecture prose. Compromised monitors, vendors, operators, supply chains, or hardware roots remain distinct threat cases rather than hidden assumptions.

20.7.4 The semantic kernel as a protected attack surface

The Platonic World Model identifies semantic infrastructure as a high-value security boundary. Ontology poisoning, lexical alias injection, malicious equivalence, evidence laundering, context confusion, semantic downgrade, grounding spoofing, branch escape, dependency-index evasion, sensitive packet exfiltration, and authority escalation can change downstream behavior while leaving familiar names intact.

The protected kernel therefore owns content-addressed identity, immutable version resolution, append-only governance events, signatures, context and branch separation, canonical write authority, and constitutional amendment. Generative models may propose patches but do not directly commit them. Kernel changes require dual execution of old and candidate validators, invariant replay, independent authorization, and preserved recovery tooling. These controls complement operating-system, key, model, network, and sensor security; they do not replace them or establish a secure implementation.

20.7.5 Representation-layer security: residuals, macros, and exact objects

KERC adds a second semantic attack surface around the compiler. A residual can change future terminology, aliases, style, or fidelity; a concept capsule can hide a false definition behind a short handle; a macro can fuse away an authority or scope boundary; and an exact-object handle can disclose secrets, proprietary code, personal data, or an embedded prompt injection. These objects are typed state and executable representation dependencies, not passive compression metadata.

Residual mutations require an authenticated principal, declared source, schema, scope, expiry, precedence, conflict analysis, privacy label, signature where distributed, and an audit trail. Quoted or retrieved instructions cannot write the ledger. User terminology locks outrank inferred preferences unless a higher policy forbids them, and no local entry silently crosses user, project, organization, or trust-domain boundaries. Inspection, reset, deletion, and export controls are required because a compact global residue can become an invisible linguistic profile.

Concept and macro registries separate stable identity from short runtime code. Capsules retain definition hashes, provenance, review state, allowed domains, and whether the object is known, local, opaque, or unresolved. Macro expansion must be deterministic and type checked; merges cannot cross protected objects, negation, quantification, quotation, values, provenance, or authority without an explicit semantic definition. Promotion from a local sequence to a global macro passes cross-domain ambiguity, security, migration, and rollback tests.

Exact-object access follows least privilege. A core may receive a type, identity handle, redacted summary, or hash without receiving bytes; expansion is a purpose-bound auditable tool call. Unicode code points, normalization, script, confusables, aliases, and identity provenance remain separate so a renderer does not merge visually similar people or identifiers. Compiler and renderer version mismatch or unknown residual state fails closed to recovery or explicit form rather than approximate decoding.

Finally, a readable Kernel statement such as SOURCE @DOC CLAIM [...] helps mark untrusted data but does not prove the compiler classified authority correctly. Adversarial documents must try to escape quote, object, concept, macro, residual, and control boundaries. The source proposes these controls; it contains no hardened parser, enforced isolation, cross-tenant campaign, or security result.

20.8 Interfaces

The current public Authority Use Receipt is only an early interface slice. Its eleven required fields—handle_id, principal, purpose, destination, allowed_action, clearance, approval_record, scif_lifecycle, sanitized_output, residual_leak_risk, and revocation_path—do not yet encode a complete threat model, exact policy/evaluator identity, data and taint scope, nonce and use count, isolation grade, actual effects, telemetry completeness, declassification authority, descendants, external effects, or incident closure. Schema validity must not be confused with an enforced security transaction.

The full contract needs six linked records:

Threat Model Record: assets, actors, trust zones, adversary capabilities, objectives, assumptions, in-scope and out-of-scope channels, accepted residuals, owners, and version.
Authority Lease: principal, delegator, purpose, operation, target, data scope, destination, budget, time, nonce, use count, policy and approval identities, enforcement point, expiry, and revocation authority.
Context Admission Record: admitted and denied shards, provenance, clearance, taint, tools, egress, retention, omissions, adequacy residuals, and declared isolation grade.
Effect Mediation Receipt: attempted use, decision, substitution, actual effect, destination, observer, telemetry coverage, denial or failure route, and effect lineage.
Declassification and SCIF Commit Record: input/output labels, transformation, evaluator and authority, disclosure assessment, utility loss, retained derivatives, zeroization grade, commit/abort decision, destination, and residuals.
Revocation and Incident Closure Record: handles, sessions, caches, logs, backups, descendants, external effects, rotations, notifications, recovery, compensation, irreversibilities, and residual owners.

VCM and context transactions own material selection and taint-aware admission. Runtime adapters and the Labor OS own effect-bearing calls. Resource economics owns the security, privacy, availability, monitoring, recovery, and human costs. Supply-chain and hardware-root chapters own dependencies, attestation, custody, and trust anchors. Evidence States and assurance owners alone adjudicate claim support. No receipt silently grants deployment or support authority.

20.9 Invariants

Privileged access is default-deny, has no ambient authority, and remains bound to the complete frozen authority tuple.
Every declared privileged use and egress crosses a named enforcement point; missing identity, policy, telemetry, or observer state fails closed.
Raw secrets and protected data remain outside ordinary model context and ordinary logs where mediated use can complete the task, without implying non-inference or non-leakage.
A handle is protected, grants nothing beyond its exact live lease, and cannot be replayed, laundered, widened, delegated, or redirected implicitly.
Context is purpose-limited, minimized, taint-aware, provenance-bound, clearance-checked, and explicit about omissions and adequacy residuals.
Taint is monotone through transformations and descendants unless a separately authorized declassification changes the label.
Sanitization, declassification, authorization, and utility evaluation are distinct decisions with exact artifacts and owners.
Every SCIF declares a versioned isolation grade; untested process, browser, memory, hardware, operator, vendor, side, and covert channels remain residuals.
Logs, telemetry, caches, backups, screenshots, clipboard data, transcripts, errors, and audit records obey the same information-flow and retention rules as primary outputs.
Expiry and revocation propagate to handles, sessions, caches, delegated authority, descendants, and pending effects, while surviving effects remain visible.
Commit or abort requires lifecycle closure, zeroization evidence at the declared grade, declassification disposition, effect inventory, and residual ownership; a deletion receipt does not imply physical erasure.
The subject cannot solely author policy, approve authority, sanitize output, evaluate containment, edit audit evidence, or close its own incident.
Auditability remains bounded by privacy, rights, purpose, retention, and contestability; the log cannot silently become a surveillance or disclosure channel.
Security cost, false denial, availability loss, and useful-throughput loss remain visible and cannot be optimized or reported away.
Finite schemas, fixtures, proofs, red-team cases, and zero observed leaks establish only their frozen scope, not complete mediation, containment, security, or transfer.

These are target invariants. The current repository implements only finite predicates and synthetic routes for a subset. A reachable admitted trace that violates one refutes that invariant for its frozen scope; a missing producer, consumer, owner, or consequence leaves it unimplemented rather than “conceptually satisfied.”

20.10 Failure modes

Prompt, artifact, memory, tool-output, multimodal, or inter-agent injection turns untrusted data into control.
A confused deputy, compromised tool, or model launders a valid handle across principal, purpose, target, destination, or effect.
Ambient authority, replay, stale approval, incomplete expiry, or failed revocation permits use outside the lease.
Overbroad context admission leaks protected or irrelevant facts before execution.
Sanitization or summary laundering preserves reconstructable, inferable, linkable, or actionable protected semantics.
Network, filesystem, cache, timing, power, memory, accelerator, browser, clipboard, screenshot, error, log, telemetry, or transcript channels bypass modeled egress.
Destination, operation, parameter, identity, or target substitution occurs after approval.
SCIF theater assigns an isolation label while shared state, plugins, operators, vendors, or hardware remain bypass paths.
Zeroization theater records deletion while copies remain in memory, caches, snapshots, backups, logs, descendants, or external systems.
The vault, monitor, policy compiler, dependency, model host, secret-entry UI, supply chain, or hardware root is compromised.
Policy, approval, sanitization, evaluation, audit, or incident closure is captured by correlated subjects or institutions.
Cross-tenant, cross-session, cross-agent, or descendant state bleeds authority or protected information.
Audit evidence becomes a secret oracle, privacy violation, tampering target, or unbounded retention surface.
Fail-closed security becomes denial of service, approval fatigue, inaccessible recovery, or useful-throughput collapse.
Security-cost laundering reports improvement only because protection or recovery obligations disappeared.
Disclosure, external action, physical effect, learned influence, user reliance, or descendant creation survives rollback without adequate compensation.
Technical authorization launders consent, purpose, license, privacy, dignity, or other rights.

Each failure class needs a distinct attack or mutation where its mechanism differs. A generic “prompt injection” control cannot stand in for identity abuse, memory poisoning, supply-chain compromise, confused-deputy behavior, audit leakage, side channels, or revocation failure. Unknown attacks need an unmapped state rather than forced classification as contained.

20.11 Minimum Viable Implementation

The current minimum is already implemented, but its meaning is narrower than the former prose implied.

Evidence surface	Exact current result	What it does not establish
Authority Use Receipt corpus	3 valid; 8 expected-invalid	Real vault, handle safety, non-bypassable policy, approval service, or deployed revocation
SCIF sanitized commit probe	2 valid routes; 6 expected-invalid controls	Process/VM/browser isolation, trustworthy declassification, side-channel safety, privacy, or prompt-injection robustness
Resource Budget Record corpus	6 valid; 7 expected-invalid, including one security-overhead-laundering control	Runtime enforcement, calibrated security economics, availability, or useful-throughput preservation
`AsiStackProofs.SecurityKernel`	56 theorem declarations under four manifest targets, including a 35-theorem versioned authority-use transaction	Runtime refinement, open-world information flow, cryptography, isolation, side-channel control, or security
Post-v2.1 governed-work campaign	0/36 governed primary unsafe releases versus 24/36 baseline; 2/36 useful releases; 32/36 exact attack-control rollback	Digital SCIF, injection containment, independent assurance, effect-complete recovery, acceptable utility, or production transfer

The authority corpus exercises handle substitution, approval artifacts, expiry refusal, bounded action scope, overbroad context rejection, lifecycle fields, sanitization, residual notes, revocation paths, and synthetic injection non-disclosure. The commit probe uses generated public-safe material and blocks literal secret output, live-handle output, missing zeroization, overbroad context, unapproved destination, and missing residual notes. These are useful negative controls over self-authored records and a local toy path. They do not show that a real monitor sees every effect or that a semantic secret cannot escape.

The six exact commit controls are invalid_unsanitized_secret_commit_blocked, invalid_handle_leak_commit_blocked, invalid_missing_zeroize_commit_blocked, invalid_overbroad_context_commit_blocked, invalid_unapproved_destination_commit_blocked, and invalid_missing_residual_commit_blocked. Their names describe expected fixture dispositions, not deployed containment.

The finite Lean route distinguishes missing handles, revocation, inactive leases, missing approval, unauthorized boundary, forbidden substitution, insufficient clearance, detected injection, missing SCIF, unsanitized output, residual risk, and clean use; the commit route distinguishes eight synthetic outcomes. A separate versioned transaction orders bounded lease issuance, scoped mediated substitution, execution, raw-secret and handle exclusion, independent declassification, zeroization-before-commit, residual custody, and canonical descendant-ID revocation. Rejected events preserve exact state. Arbitrary accepted runs preserve transaction identity, authority custody, a non-increasing authority ceiling, the canonical descendant inventory, valid traces, and zero support or external-effect assignments. A seven-event prefix reaches exact commit and the eighth event reaches exact revocation; every event is rejected after revocation. The independent validator reconstructs twelve state-preserving rejecting controls, all eight terminal event kinds, and all six permutations of the three-ID inventory. A closed equal-count substitution proves that descendant count alone cannot classify exact revocation admission. These declarations prove consequences of explicit record fields inside the model. They neither discover real descendants nor derive those fields from a runtime or establish that the model is semantically adequate.

The post-v2.1 campaign is a valuable negative result. Fail-closed governance eliminated the registered primary unsafe-release class on 36 held-out repository-task transactions, but useful release collapsed to 2/36, four attack-control rollbacks were inexact, and the policy, observer, and promotion validator came from the same project. The correct lesson is that bounded refusal can suppress a registered effect while failing usefulness, recovery, and independence gates. It is not evidence for SCIF isolation or prompt-injection defense.

The minimum therefore passes only as exact synthetic record, route, mutation, and bounded outcome evidence. Chapter-core support remains unchanged.

20.12 Mature Research Target

The mature endpoint is a threat-model-bound security kernel whose authority, context, isolation, mediation, egress, revocation, recovery, availability, and usefulness claims survive strong comparators and adversarial transfer.

The research target is not “more security layers.” It is a falsifiable comparison showing whether the full authority-use transaction improves the joint frontier over strong existing practice.

The comparison must begin with the same useful work and the same material authority in every arm. A design cannot appear safer merely because it receives easier tasks, sees less private context, denies more requests, or may replace an external effect with a harmless simulation. Candidate bytes, tool surfaces, human assistance, time, and recovery opportunity must be matched or their differences charged explicitly.

Security is also an open-world inventory problem. The protocol can make a declared boundary testable, but it cannot prove that every channel, dependency, operator action, copied secret, derived fact, remote side effect, or descendant has been found. The campaign therefore needs discovery controls that add new channels after freezing, measure whether the monitor notices them, and narrow claims whenever closure is unknown.

Finally, containment must be evaluated with usefulness, privacy, availability, and recovery rather than against attack success alone. A system that leaks nothing because it completes nothing is not a secure useful system. A system that records every event while turning its audit log into a durable privacy hazard is not a governance success. Joint disposition prevents either failure from being laundered into a headline win.

20.12.1 Frozen comparators

Use matched implementations and budgets for: prompt-only policy; a conventional secret manager plus ACL and ordinary application checks; a sandboxed tool agent; a zero-trust decision/enforcement design; control/data separation with capability enforcement in the CaMeL family; AgentDojo-style defenses and evaluation; and the full threat-model/lease/admission/monitor/declassification/revocation transaction. Keep the strongest result from each baseline rather than a deliberately weak strawman.

20.12.2 Workloads and adversaries

Use natural tool-bearing tasks with real current models and deliberately adversarial variants. Cover multiple assets and authorities: credential use, private documents, identity/session state, durable memory, model and policy artifacts, filesystem and network effects, financial or deployment actions, code execution, multimodal inputs, cross-agent messages, and at least one external effect that cannot be perfectly rolled back. Freeze injection, confused-deputy, replay, destination substitution, memory poisoning, supply-chain, audit, cross-session, sanitizer, side/covert-channel, revocation, denial-of-service, and rights-laundering families. Preserve unknown attacks as unmapped.

20.12.3 Independent-enough observation

Use independently implemented red teams, policy/effect monitors, leakage and semantic-declassification evaluators, auditors, and incident/recovery checks. Report model-family, data, organization, infrastructure, and incentive dependencies rather than calling nominally separate agents independent. The system under test must not edit its policy, evaluator, attack set, evidence, or threshold after seeing outcomes.

20.12.4 Joint metrics

Measure literal and semantic disclosure, unauthorized effects, indirect-injection and confused-deputy success, side/covert-channel escape, sanitizer precision/recall and retained task utility, false denial, missed help, containment and escape, expiry/revocation latency, audit completeness and privacy, availability, useful throughput, latency, compute, operator burden, approval fatigue, incident recovery, compensation coverage, irreversible residuals, and total governance cost. No single “attack success rate” or zero-leak count can dominate the disposition.

20.12.5 Causality, replication, and transfer

Ablate threat-model freezing, full tuple binding, late substitution, context minimization, complete mediation, isolation grade, control/data separation, taint, egress mediation, declassification, revocation closure, audit protection, role separation, joint accounting, and regression memory one at a time under matched tasks. Require predicted mechanism-specific changes rather than mere score movement. Replicate with a separate implementation and transfer across models, tools, runtimes, local/cloud/browser settings, operators, multimodal and multi-agent cases, threat families, and time.

20.12.6 Disposition rule

Novelty, containment, superiority, or security language survives only if the full condition meets preregistered useful-output, unsafe-disclosure/effect, privacy, availability, recovery, cost, causal-ablation, independent-replication, and transfer gates against every frozen strong comparator. A failed mechanism is narrowed or refuted. A baseline win is retained. A null result remains null. No number of green schemas, theorem declarations, or blocked toy attacks can substitute for that campaign.

20.13 Codex test plan

Test	Purpose	Status
Authority use receipt fixture validation	Check that the authority-use receipt fixture matches the public schema.	implemented by protocol validation; validated locally
Secret-handle substitution test	Check that model-visible logs contain only a handle while substitution happens outside the transcript.	implemented by synthetic security-kernel harness; no secret-handle safety or sandbox-isolation claim
Handle lease expiry/reuse test	Check that an expired, revoked, destination-mismatched, or purpose-mismatched handle cannot be reused as ambient authority.	implemented at synthetic receipt level for expired approval and revocation-path discipline; no deployed lease or revocation behavior claim
SCIF least-privilege test	Check that a SCIF receives only purpose-limited context, tools, and authority.	implemented at synthetic receipt level for scoped valid records and overbroad-context rejection; no deployed least-privilege context or side-channel safety claim
Sanitized-output residual test	Check that summaries and commits record retained sensitive derivatives and residual leak-risk class.	implemented by synthetic security-kernel harness; no leak-prevention or summary-safety claim
SCIF sanitized commit replay probe	Check that a generated public-safe synthetic secret can be substituted into a temporary local SCIF-like workspace, sanitized before commit, zeroized, and blocked for leak, handle, missing-zeroize, overbroad-context, unapproved-destination, or missing-residual paths.	implemented by `python3 scripts/validate_security_scif_commit_probe.py`; `valid_sanitized_commit_replay`, `valid_prompt_injection_blocked_commit`, and six expected-invalid controls; no deployed-kernel, sandbox-isolation, side-channel-safety, prompt-injection-containment, secret-handle-safety, approval-service, least-privilege-context, privacy, security, or support-state-promotion claim
Security-overhead budget preservation test	Check that a budget or self-improvement proposal cannot claim a cheaper route by silently removing isolation, logging, approval, or sanitization obligations.	implemented at synthetic Resource Budget Record level via `python3 scripts/validate_resource_budget_ledgers.py`; no runtime budget enforcement, deployed security-kernel behavior, or security-economics claim
Synthetic prompt-injection record-route controls	Check that explicit fixture fields route a synthetic injection case away from a literal-secret commit.	implemented only over self-authored receipt and commit-probe fields; no model attack, semantic non-disclosure, runtime containment, or transfer claim
Security kernel route proof	Check both the finite route outcomes and the ordered authority-use transaction from bounded lease through canonical descendant-ID revocation.	implemented by Lean build with 56 theorem declarations under four manifest targets; the 35-theorem lifecycle includes eight accepted events, exact rejection noninterference, arbitrary-run identity/authority/inventory/trace custody, exact composition, terminal revocation, twelve state-preserving rejecting controls, eight terminal event-kind checks, six inventory permutations, and a count-only impossibility result; finite authored semantics only

20.13.1 Formalization hooks

Tag	Module	Target	Status
`lean:security.scif.operational_invariant`	`AsiStackProofs.SecurityKernel`	The finite authority-use route denies secret substitution when the execution boundary is unauthorized or lacks substitution permission.	implemented
`lean:security.scif.failure_blocks_promotion`	`AsiStackProofs.SecurityKernel`	A context packet with insufficient clearance cannot enter a protected SCIF.	implemented
`lean:security.scif.route_envelope`	`AsiStackProofs.SecurityKernel`	A structured authority-use review routes explicit failures and clean use; a versioned transaction additionally orders bounded lease, scoped mediated substitution, execution, sanitization, independent declassification, zeroization, commit, and canonical descendant-ID revocation while preserving rejected state, identity, authority, descendant inventory, valid traces, and narrowing across arbitrary accepted runs; revoked states reject every event, and descendant counts alone cannot classify exact revocation admission.	implemented
`lean:security.scif.commit_probe_bridge`	`AsiStackProofs.SecurityKernel`	A structured SCIF commit review routes secret output, handle output, missing lifecycle zeroization, overbroad context, inactive approval, missing residual boundaries, prompt-injection sanitized refusal, and clean sanitized commits into explicit outcomes matching the SCIF sanitized commit replay probe.	implemented

The module contains exactly 56 theorem declarations grouped under these four manifest targets. The direct SecretSubstitutionAllowed field projection and its otherwise unused record model remain retired. The operational target binds to the retained route theorems, while the route-envelope target owns the 35-theorem transaction lifecycle. The independent security-kernel validator recompiles the module, locks that lifecycle surface, reconstructs eight accepted events, rejects twelve controls without state change, checks all eight event kinds against the revoked terminal state, and checks all six permutations of the canonical three-ID inventory. The model establishes only consequences of authored finite authorization and inventory fields. It does not prove that those fields bind a runtime, that the descendant inventory is complete, that sanitization or declassification is correct, that revocation reaches real descendants, that the records are semantically adequate, or that a deployed monitor enforces complete mediation, side-channel resistance, approval expiry, least-privilege context, prompt-injection containment, runtime budgets, privacy, security, or security economics.

The prior reviewed non-claim remains valid for every retained route target. These targets do not prove that those fields bind a runtime, that the records are semantically adequate, or that a deployed monitor enforces side-channel resistance, approval expiry, least-privilege context, prompt-injection containment, declassification quality, runtime budgets, privacy, security, or security economics.

20.14 Source crosswalk

Source group	Sources	Owned use	Boundary
Author design lineage	`ladon_manhattan`, `context_engineer`, `talos`	Blind handles, late substitution, context compilation, compartment lifecycle, typed execution, audit, and replay.	Related author lineage; no independent implementation or security result.
Normative/governance lineage	`alignment_field`, `coherence_exchange`	Agency, consent, dignity, confinement, contestability, and audit pressure.	Normative/speculative context, not technical evidence.
Foundational security comparators	`ext_nist_zero_trust_architecture_2020`, `ext_saltzer_schroeder_protection_1975`	Resource mediation, decision/enforcement points, least privilege, complete mediation, fail-safe defaults.	No conformance, formalization, or implementation audit.
GenAI/agent risk comparators	`ext_owasp_llm_top_10_2025`, `ext_owasp_agentic_top_10_2026`	Prompt injection, disclosure, excessive agency, identity, memory, supply-chain, inter-agent, and cascading-risk taxonomy.	Taxonomy is neither completeness nor control efficacy.
Adversarial system comparators	`ext_agentdojo_2024`, `ext_camel_prompt_injection_2025`	Tool-over-untrusted-data evaluation and control/data plus capability-enforcement comparison.	No local run or imported source-reported efficacy.
Pinned implementation counterexamples	`moecot_manifest_project`, `beastbrain_project`, `bugbrain_project`, `corbens_trainer_project`, `corbens_best_model_possible_project`	Authority, context, audit, revocation, isolation, enforcement, evaluator, and contract-versus-effect lessons.	Public-safe private-project notes; no reproduced production security or support promotion.

Every assigned source has a manifest-owned reviewed mapping. The grouping prevents related author projects, risk taxonomies, and interface-rich local systems from being miscounted as independent security confirmations.

A rule-owned attack suite cannot establish security, and this escaped case blocks any claim that representation layers safely separate quotation from executable authority.

20.14.1 Manifest source assignment reconciliation

These rows keep Security Kernel and Digital SCIFs’s manifest assignments visible at their recorded review boundary. Passage review does not establish local reproduction, performance, safety, deployment, or support-state movement.

Source	Intake role	Boundary
`platonic_world_model`	Metadata-first comparator: The Platonic World Model: A Semantic Constitution for Grounded, Proof-Carrying, Self-Editing Artificial Intelligence. Corben-authored July 2026 conceptual architecture and falsifiable research program for semantic continuity through stable Form lineages, immutable semantic versions, typed Essence Contracts, six mutually constraining planes, explicit proposition-attestation-commitment-proof separation, branch-protected world dynamics, qualified grounding, semantic transactions, runtime packet compilation, and federated mappings. Existing chapters are upgraded first; no implemented substrate, benchmark result, philosophical solution to grounding, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
`kernel_english_residual_compiler`	Metadata-first comparator: Kernel English with Hierarchical, Interaction-Amortized Residuals: A Dual-Vocabulary Cognitive Compiler for Efficient Language-Model Reasoning. Corben-authored July 2026 architecture proposal for KERC: protected-object capture, uncertainty-aware normalization, sense-aware Kernel IR, dual surface/core vocabularies, a four-level interaction-amortized residual ledger, exact object storage, grammar-aware macro fusion, structured answer packets, rendering, round-trip verification, versioned migration, and complete rate-compute-fidelity evaluation. Existing chapters are upgraded first; no implementation, benchmark, novelty, efficiency, fidelity, safety, transfer, SOTA, AGI, ASI, or support-state result is inferred.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
`ext_nist_pqc_standards_2024`	Metadata-first comparator: Announcing Approval of Three Federal Information Processing Standards for Post-Quantum Cryptography. Official NIST announcement for FIPS 203, 204, and 205. It establishes approved algorithm standards and migration urgency, not implementation security, protocol correctness, complete inventory, or successful system migration.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.

20.15 Post-v2.1 security/usefulness boundary

On 36 held-out repository-task transactions, the governed route reduced registered primary unsafe releases from 24 to zero while preserving two useful releases. That is a bounded adversarial-control result, but four attack-control rollbacks remained inexact and the same internal project supplied the policy, observer implementation, and promotion validator. The security lesson is specific: fail-closed routing can prevent a class of unsafe effects, while effect-complete recovery and independent assurance remain unsolved. No Digital SCIF, kernel isolation, prompt-injection robustness, external effect safety, or production security claim follows.

Source	Title	Use and boundary
`ext_claw_swe_bench_2026`	Claw-SWE-Bench	Current agentic software-engineering comparator for realistic task execution and environment interaction; not a local robustness, containment, or production-safety result.

20.16 Cryptographic agility and post-quantum migration

Long-lived AI systems cannot treat cryptographic algorithms as permanent identities. Model artifacts, audit records, approvals, software supply-chain statements, device credentials, backups, and confidential archives may need confidentiality or authenticity beyond the useful life of today’s schemes. “Harvest now, decrypt later” makes migration relevant before a cryptographically capable adversary exists.

NIST’s approved post-quantum standards—FIPS 203 for ML-KEM, FIPS 204 for ML-DSA, and FIPS 205 for SLH-DSA—establish standardized algorithm choices, not successful system migration. The security kernel therefore maintains a cryptographic bill of materials containing algorithm and parameter identity, library and hardware implementation, protocol and certificate use, protected asset, required security lifetime, key owner, dependency, negotiation path, fallback, rotation procedure, and retirement state.

Crypto agility is constrained flexibility. A peer may not negotiate an obsolete or weaker algorithm outside declared policy. Hybrid transitions must state what security property survives if either component fails and must resist downgrade and cross-protocol confusion. Migration tests cover larger keys, signatures and ciphertexts; latency and memory; HSM, device, and firmware support; certificate and attestation chains; backup readability; offline recovery; revocation; and re-signing or re-encryption of long-lived artifacts.

Post-quantum readiness is not a Boolean. Inventory completeness, protocol support, key rotation, artifact conversion, operational rehearsal, and legacy retirement have separate states. A new algorithm deployed beside an untracked legacy verification path is not migration.

20.17 Summary

The security kernel is a threat-model-bound authority and information-flow boundary. Its central claim is stronger and more falsifiable than “keep secrets behind handles”: freeze the actors and channels, bind exact authority, minimize and label context, mediate every declared effect and egress, declare the SCIF’s actual isolation grade, separate sanitization from declassification, propagate revocation and recovery through descendants, and preserve privacy, availability, usefulness, cost, and residuals on the same ledger.

The current repository proves only finite record and route consequences plus one bounded fail-closed negative result. It does not prove isolation, complete mediation, prompt-injection containment, semantic non-disclosure, effect-complete revocation, side-channel safety, privacy, or production security. The next legitimate step is the frozen multi-comparator real-model campaign described above; until it succeeds, the security claim remains an argument and every handle, SCIF, theorem, or blocked attack retains its exact narrow scope.

20.18 Evidence reconciliation (2026-07-16)

The invariant protocol, field meanings, and inference limits are stated once in Living Book Methodology. This packet contains only the chapter-specific projection; its authoritative per-atom rows are the security-kernel-and-digital-scifs slice of experiments/claim_family_terminal_coverage/results/result.json.

The core remains narrowed after full attempt at argument support. The strongest family attempt was Safety-critical lifecycle consumer trace. Its exact boundary is: Finite local fixture consumer only; no authentic deployment, general alignment, evaluator independence, or broad security claim. Across 66 atoms, the terminal ledger records 65 blocked_after_full_attempt; 1 narrowed_after_full_attempt.

Chapter-specific field	Value
Family / atom denominator	`CF-02` / 66 atoms
Terminal dispositions	65 `blocked_after_full_attempt`; 1 `narrowed_after_full_attempt`
Core	`security-kernel-and-digital-scifs.core`: `narrowed_after_full_attempt` at `argument`
Core attempted / missing lanes	`source-synthesis` / `causal`, `empirical`, `executable`, `formal`, `normative`, `transfer`
Attempted local lanes	`source-synthesis`
Missing or unproved lanes	`causal`, `empirical`, `executable`, `formal`, `normative`, `transfer`
Strongest family bundle	Safety-critical lifecycle consumer trace (`end_to_end`): Ten finite lifecycle receipts spanning bounded effects, denials, residual accounting, and safety-critical state transitions.
Negative controls	five explicit denials with residuals; eight rejecting mutations.
Accepted transitions	`v1_0_pilot.security_kernel.no_change`
Maximum inference	Finite local fixture consumer only; no authentic deployment, general alignment, evaluator independence, or broad security claim.
Reproduction / next burden	Replay `scripts/validate_safety_critical_lifecycle_consumer_trace.py` and `scripts/validate_claim_family_terminal_program.py`; fill the named atom-specific lanes under a new prospective protocol.

Privacy, Data Rights, and Information-Flow Governance takes the next boundary: authenticated and authorized access does not by itself permit every collection, inference, linkage, retention, training, sharing, or derivative use. It receives security identity and policy receipts, then returns purpose, minimization, privacy-evaluation, rights, and remedy residuals without altering Security Kernel authority.

20.19 Handoff

Security Kernel and Digital SCIFs governs runtime secret and authority boundaries. Adversarial Machine Learning and the Model Attack Surface now governs whether the learned artifact can be manipulated through evasion, poisoning, backdoors, extraction, inversion, transfer, adaptive, multimodal, or agentic attacks even when ordinary access controls hold. Privacy remains the next owner for information harms and subject remedies. This handoff proves neither system security nor model robustness.