Ladon & The Manhattan Protocol

Original Corben Sorenson paper published as part of The ASI Stack source and lineage library.

Author

Corben Sorenson — original collaborator credits preserved in the manuscript

Published

July 31, 2026

← Corben Papers and Architecture Sources

Original paper, not rewritten book prose

This page publishes Corben Sorenson’s original source manuscript so readers can inspect the ideas that preceded or informed the living book. The text may contain historical terminology, claims, confidence, citations, or implementation status that the book later narrows, revises, tests, or rejects. Publication here establishes provenance and access—not correctness, novelty, replication, or support-state promotion.

Publication and provenance

Field	Record
Source ID	`ladon_manhattan`
Source class	`author_security_architecture`
Library class	`technical_specification`
Manuscript date	2026-07-31
Inventory updated	2026-07-31
Exact published-source SHA-256	`57d415f70ed6128b3d408ae1f56030aeeec72a13930d6cd890c24c640e7e6763`
Exact published-source bytes	8,945
Exact source text	Download/view the tracked Markdown source
Book’s source note	Read the bounded mining note
Authorship and collaborator credits	Preserved from the exact original manuscript; this library wrapper does not replace or simplify them.
Rights	No new license grant. Corben Sorenson’s rights are reserved; collaborator, quotation, source-title, and third-party rights remain with their holders.

Current publication boundary. Archived author paper; its claims retain the status and limits stated in the paper and do not inherit the living book’s current evidence state.

HTML presentation note. The HTML page normalizes line endings and trailing whitespace, preserves explicit Markdown hard breaks, and demotes manuscript headings beneath the page title. The digest above applies to the linked exact source text, not to this presentation wrapper.

Where this paper enters the living book

System Boundaries and Authority, Moral Uncertainty, Value Conflict, and Contestable Governance, Stable Capability Fields, Security Kernel and Digital SCIFs, Context Transactions, Snapshots, Mounts, and Taint, Runtime Adapters, Tool Permissions, and Human Approval, Personal Compute Hives and Federated Edge Intelligence

Original manuscript

This is the standalone technical whitepaper for Ladon and the Manhattan Protocol. It extracts the security architecture from BeastBrain v4.0 and expands it into a comprehensive cybersecurity specification. This document allows these systems to be implemented as an independent security layer for any high-agency AI system, not just BeastBrain. ________________

Ladon & The Manhattan Protocol A Kernel-Level Security Architecture for High-Agency Artificial Intelligence Version: 1.0 (Standalone Specification) Date: January 28, 2026 Classification: Cybersecurity / AI Alignment / Kernel Architecture ________________

1.0 Executive Summary: The Agency Paradox As Large Language Models (LLMs) evolve from passive chatbots into active agents, a critical security paradox emerges: The Agency Paradox. * To be useful, an AI Agent requires access to the user’s digital life (Banking, Email, Cloud Infrastructure, SSH Keys). * To be safe, an AI Agent cannot be trusted with the raw credentials for these services, as it is susceptible to prompt injection, jailbreaking, and stochastic leakage. Current solutions (Environment Variables, .env files, or storing keys in the context window) are catastrophic failures. If an agent can “read” the key to use it, it can be tricked into outputting it. Ladon and the Manhattan Protocol resolve this by introducing a Blind Execution Architecture. We move the concept of “Secret Management” out of the AI’s user-space and down into the Operating System kernel (Ring 0). The Core Thesis: The AI should possess the Right to Use a credential, but never the Knowledge of the credential itself. ________________

2.0 System 1: The Ladon Secret Manager Reference Myth: Ladon, the hundred-headed dragon who sleeplessly guarded the Golden Apples of the Hesperides. Ladon is not a password manager app; it is a Kernel-Level Enclave. It exists to create a hard air-gap between the AI’s cognitive processes (which are prone to hallucination and manipulation) and the user’s cryptographic identity. 2.1 The Hesperides Vault (Ring 0 Storage) Secrets are never stored in the application’s heap memory. Upon boot, Ladon utilizes hardware-backed security modules (Intel SGX, ARM TrustZone, or Apple Secure Enclave) to pin secrets in a reserved memory page accessible only to the kernel. * Memory Isolation: The memory pages containing secrets are marked PROT_NONE for all user-space processes, including the AI itself. Any attempt by the AI to read this memory results in an immediate SIGSEGV (Segmentation Fault). 2.2 The Handle System (Blind References) When the AI needs to interact with a secure service, Ladon provides it with a Handle—a semantically meaningless token that represents the capability. * The Secret: sk_live_51Mz… (The actual Stripe API Key) * The Handle: ladon://stripe_master_key The AI “reasons” using the handle. It writes code, generates plans, and formulates HTTP requests using the string ladon://stripe_master_key in the header fields. To the AI, the handle is the key. It has no concept of the underlying string. 2.3 The Golden Interface (Trusted UX) A major vector of attack is the UI itself. If the AI renders the interface where the user types a password, the AI can “read” the keystrokes or the DOM. Ladon introduces the Golden Interface: a hardware-composited OS overlay. 1. Freeze: When a secret is required, the OS pauses the AI’s rendering pipeline. 2. Overlay: A secure window, rendered directly by the kernel’s display driver (bypassing the window manager), appears. 3. Input: The user enters the secret. The kernel captures the input, encrypts it immediately, and passes a Handle back to the AI. 4. Resume: The AI is unpaused, now holding the handle, having never seen the input. ________________

3.0 System 2: The Manhattan Protocol Reference: The Manhattan Project (Compartmentalization and Secrecy). If Ladon is the “Vault,” the Manhattan Protocol is the “Clean Room” where work gets done. It is a strict protocol for Context Engineering and Ephemeral Execution. 3.1 The Context Engineer The Context Engineer is a middleware module that sits between the AI and the Network Interface Card (NIC). It acts as the “Man-in-the-Middle” for the organism’s own thoughts. The Substitution Workflow: 1. Draft: The AI generates an HTTP request containing a handle: 2. HTTP POST /v1/charges Authorization: Bearer ladon://stripe_master_key 3. 4. 5. Intercept: The Manhattan Protocol intercepts this syscall at the kernel boundary (socket.write). 6. Lookup: The kernel verifies the AI’s permissions table. Does ProcessID: 104 have the right to use ladon://stripe_master_key? 7. Injection: If authorized, the kernel swaps the handle for the real key inside the socket buffer. 8. HTTP POST /v1/charges Authorization: Bearer sk_live_51Mz… 9. 10. 11. Transmission: The packet leaves the NIC. The AI’s memory still contains only the handle. 3.2 The Digital SCIF (Sensitive Compartmented Information Facility) For tasks that require computation on secrets (e.g., signing a crypto transaction or decrypting a file), simple substitution is not enough. The secret must exist in memory for the CPU to process it. For this, we spin up a Digital SCIF. A Digital SCIF is an ephemeral, isolated container process with strict lifecycle rules: 1. Spawn (The Airlock): A new process is forked. It has zero network access and no shared memory with the main AI agent. 2. Inject (Memory Masking): Ladon maps the secret page into the SCIF’s address space. This is the only time the secret exists in user-space. 3. Execute (The Task): The specific signing function runs. It produces a non-sensitive output (e.g., the signed transaction hash). 4. Wipe (The Burn): Before the process terminates, the memory is overwritten. * Technique: We use the Rust zeroize crate which utilizes core::ptr::write_volatile and atomic compiler fences to ensure the compiler does not “optimize away” the zeroing operation. 5. Return: The SCIF dies. The signed hash is returned to the main AI. Code snippet sequenceDiagram participant AI as AI Agent (User Space) participant CE as Context Engineer (Middleware) participant LD as Ladon (Kernel Ring 0) participant SC as Digital SCIF (Isolated)

AI->>CE: Request: "Sign Transaction" + `ladon://wallet_key`
CE->>LD: Request SCIF Allocation
LD->>SC: Spawn Process + Map `wallet_key`
AI->>SC: Send Transaction Data (Payload)
SC->>SC: Sign(Payload, Key) -> Signature
SC->>SC: explicit_bzero(Key)
SC->>LD: Process Terminated
LD->>CE: Return Signature
CE->>AI: Return Result

Figure 1: The Manhattan Protocol Lifecycle. The secret never touches the AI or the Context Engineer. 3.3 Side-Channel Defenses On modern Unified Memory architectures (like Apple Silicon), shared cache lines present a risk. A malicious AI could potentially “time” the CPU cache to guess the key being used by the SCIF. * Cache Partitioning: The Manhattan Protocol utilizes Page Coloring (on supported hardware) to ensure the SCIF uses distinct L2/L3 cache sets from the main AI process. * Execution Jitter: Random NOOP instructions are injected into the SCIF’s execution stream to obfuscate power analysis signatures. ________________

4.0 Implementation Specifications 4.1 The Ladon Rust Crate (ladon-rs) The reference implementation is written in Rust for memory safety. Rust // The Handle Structure pub struct LadonHandle { id: Uuid, label: String, // e.g., “stripe_prod” // The actual secret is NOT in this struct. }

// The Injection Interface (Kernel Side) unsafe fn inject_into_socket(socket_fd: c_int, handle_id: Uuid) -> Result<()> { let secret = secure_enclave::retrieve(handle_id)?; let payload = format!(“Authorization: Bearer {}”, secret);

// Write volatile prevents compiler reordering
std::ptr::write_volatile(socket_buffer, payload.as_bytes());

// Immediate cleanup
zeroize::Zeroize::zeroize(&mut secret);
Ok(())

}

4.2 Security Theorems 1. The Ignorance Theorem: Because the AI model’s context window never contains the bit-sequence of the key, no amount of “Prompt Engineering” or “Jailbreaking” can force the AI to output the key. It cannot reveal what it does not know. 2. The Ephemerality Theorem: Secrets exist in user-space memory only during the microsecond of SCIF execution. The window of opportunity for a RAM dump attack is statistically negligible. ________________

5.0 Conclusion Ladon and the Manhattan Protocol represent the necessary evolution of cybersecurity for the Age of Agency. By moving trust from the “Application Layer” (where the AI lives) to the “Kernel Layer” (where the AI cannot reach), we enable powerful, autonomous agents that can wield the “Golden Apples” of our digital lives without ever being tempted to eat them.