sica-fondt/core/docs/plans/G3-defense-model.md
Claude b6bcab794f
Reorg step 1: consolidate repo under core/, drop the mafiabot label
Mechanical structure-only pass (no document/guide content edits):

- Move src/ichor, src/endocrine, and docs/ into core/; the old top-level
  mafiabot_core/ becomes core/. Everything now lives under a single core/ root.
- Drop the "mafiabot" label from the Ada/Alire crate: core.gpr (project Core),
  alire.toml name = "core"; the generated *_config.* regenerate as core_config.*.
- Repoint build-critical wiring only:
  - .claude/skills/run-sica-fondt/smoke.sh (ponyc + Ada + COBOL paths)
  - core/src/endocrine R source()/runner paths and the test glob
  - .github/workflows/ci.yml (working-directory + gpr name)

Verified green: smoke ALL GREEN (Pony Ichor, Ada core crate + tests, COBOL E1
vault); R endocrine 14/0; Octave ETR 26/0/1.

Deferred (reserved for a less-ephemeral doc/guide pass): docmap.yaml, the guide
files and nested AGENTS.md/README prose + now-stale relative links, SOUL.md, and
the deeper ring/storage restructure.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015hmgREHNsxYCuim33yUF2c
2026-06-23 07:46:47 +00:00

2.3 KiB

G3 — Defense model (cross-cutting · emergent)

1. Component

The two-layer defense, emergent from organs already specced — not new code. Layer 1 = semantic saturation (the Celtic-Cross token-flow, B3). Layer 2 = the Ada trust boundary (D1). This doc is the contract that says how they combine.

2. Status / certainty

C4 — both layers decided; layer 2 is WORKING (D1), layer 1 is the B3 draw used as armor.

3. Language & location

Realized by B3 (token-flow) + D1 (SPARK boundary). No new module; contract doc only.

4. Does / does-not

  • Does: push injection material down the attention gradient with meaningful content (the 10 accumulating cards), and structurally validate every crossing at Ada.
  • Does-not: flood noise (saturation is semantic); watch the Brain (central cut).

5. Interface contract

  • Layer 1 (B3): the iterative 10-card spread occupies context with meaningful symbol-material — "free armour when self-hosting" (tokens = owned-hardware cycles, not API cost).
  • Layer 2 (D1): blocklist (fetch→build→execute, base64 chains) · provenance on memory writes · no self-authority-reclassification · rate-limit escalation.
  • Threat corpus kept as study specimens only (prompts.json cryptojacking, HiFi_ProToCol authority reclass, gorkprotocol memory injection, THEORY.md hollow-math) — defended against, never built.

6. Dependencies & stubs

B3 (layer 1) + D1 (layer 2). Both stubbable independently; this contract just asserts they co-apply.

7. Invariants / laws

  • L1 (C4): defense is semantic saturation, not noise flooding.
  • L2 (C5): every crossing is structurally validated at Ada (D1 laws).
  • L3 (C5): threat specimens are a study corpus only — never a build target.

8. Build steps

  1. Ensure B3 accumulation actually fills context as designed (layer 1). 2. Ensure D1 admits/blocks per its laws (layer 2). 3. Keep the threat corpus quarantined as reference (e.g. reference/), not wired.

9. Tests

Layer 1: spread occupies the expected context share by final cognition. Layer 2: D1 trust_tests pass. Corpus: a static check that nothing under the threat corpus is referenced by a build target.

10. Open items

  • Where the threat-specimen corpus lives (reference/ archive). Measuring saturation effectiveness (C1).