20e99f434c
Wave 1 remainder + Wave 2 design-first specs, completing one build plan per sub-organ: - B1 tarot emulator, B2 SOUL/Big-3, B3 Celtic Cross - C2 4+4 metacog, C3 inference cycle, C4 Brain - D1 Ada border, D2 the medium, D3 mini-rag - E1 3 GnuCOBOL invariant stores, E2 VARIANT stores, E3 RAG family - F1 MoRAG, F2 SAE monitor, F3 subagents - G1 stress-loop contract, G2 governance, G3 defense model Each: contract + stubs for independent build; unfitted constants marked C1. https://claude.ai/code/session_015hmgREHNsxYCuim33yUF2c
2.7 KiB
D1 — Ada border (immune system + blood-brain barrier)
1. Component
The trust boundary, and nothing else: immune system + blood-brain barrier. The context police — it inspects what crosses and admits or blocks; it holds nothing, assembles nothing, enriches nothing.
2. Status / certainty
WORKING (mafiabot_core/src/trust/trust_boundary.{ads,adb}, 255 L SPARK; blocklist + provenance +
rate-limit) + protocol/hermes_protocol for routing. This is the one Ada the docs keep. C4.
3. Language & location
Ada/SPARK · mafiabot_core/src/trust/ + mafiabot_core/src/protocol/. Contracts/preconditions enforce
invariants at the boundary (a bad version becomes unprovable).
4. Does / does-not
- Does (immune): recognise + neutralise hostile/non-self — injection, poisoned memory, authority-reclassification; provenance-tag check on memory writes.
- Does (BBB): selectively admit what reaches cognition; modulation crosses here too (a poisoned steering vector/LoRA meets Ada first); tool routing is Ada's job.
- Does-not: enrich/assemble (organs do that — MoRAG injects, Drive-Box secretes); think; hold state.
5. Interface contract
admit(item, provenance) -> {pass | block, reason}over every crossing (input enrich, modulators, memory writes, tool calls).route(intent, packed_schema) -> tool_invocation(step 21).- Blocklist patterns (fetch→build→execute chains, base64-decode chains); memory writes require provenance to session origin; no instruction may reclassify its own authority; rate-limit escalation.
6. Dependencies & stubs
None upstream (it is the gate). Everything else integrates by passing through admit/route — stub:
allow-all gate for other organs' standalone tests.
7. Invariants / laws
- L1 (C5): constraints live on the body, never the self (Brain/scratchpad uninspected).
- L2 (C5): no tool-call chain matching a blocklist pattern crosses.
- L3 (C5): memory writes without valid provenance are blocked.
- L4 (C5): no instruction can reclassify its own authority level.
8. Build steps
- Audit the existing SPARK proofs (the trust_boundary is sound but unverified per the README sweep);
promote
gnatprovefrom informational once green. 2. Harden the blocklist beyond naive substring. - Wire
admitinto every crossing as organs land.
9. Tests
mafiabot_core/tests/trust_tests.adb (via the cron CI alr build + run) + gnatprove -P mafiabot_core.gpr.
10. Open items
- Blocklist robustness (substring → structural). Provenance-tag format (shared with E* storage).
- Promote gnatprove to blocking once the proof base is green (CI
continue-on-error: false).