mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-07-31 16:16:26 +00:00
20e99f434c
Wave 1 remainder + Wave 2 design-first specs, completing one build plan per sub-organ: - B1 tarot emulator, B2 SOUL/Big-3, B3 Celtic Cross - C2 4+4 metacog, C3 inference cycle, C4 Brain - D1 Ada border, D2 the medium, D3 mini-rag - E1 3 GnuCOBOL invariant stores, E2 VARIANT stores, E3 RAG family - F1 MoRAG, F2 SAE monitor, F3 subagents - G1 stress-loop contract, G2 governance, G3 defense model Each: contract + stubs for independent build; unfitted constants marked C1. https://claude.ai/code/session_015hmgREHNsxYCuim33yUF2c
49 lines
2.7 KiB
Markdown
49 lines
2.7 KiB
Markdown
# D1 — Ada border (immune system + blood-brain barrier)
|
|
|
|
## 1. Component
|
|
The trust boundary, and **nothing else**: immune system + blood-brain barrier. The context police —
|
|
it inspects what crosses and admits or blocks; it holds nothing, assembles nothing, enriches nothing.
|
|
|
|
## 2. Status / certainty
|
|
WORKING (`mafiabot_core/src/trust/trust_boundary.{ads,adb}`, 255 L SPARK; blocklist + provenance +
|
|
rate-limit) + `protocol/hermes_protocol` for routing. This is the one Ada the docs **keep**. C4.
|
|
|
|
## 3. Language & location
|
|
Ada/SPARK · `mafiabot_core/src/trust/` + `mafiabot_core/src/protocol/`. Contracts/preconditions enforce
|
|
invariants at the boundary (a bad version becomes *unprovable*).
|
|
|
|
## 4. Does / does-not
|
|
- **Does (immune):** recognise + neutralise hostile/non-self — injection, poisoned memory,
|
|
authority-reclassification; provenance-tag check on memory writes.
|
|
- **Does (BBB):** selectively admit what reaches cognition; **modulation crosses here too** (a poisoned
|
|
steering vector/LoRA meets Ada first); **tool routing is Ada's job**.
|
|
- **Does-not:** enrich/assemble (organs do that — MoRAG injects, Drive-Box secretes); think; hold state.
|
|
|
|
## 5. Interface contract
|
|
- `admit(item, provenance) -> {pass | block, reason}` over every crossing (input enrich, modulators, memory writes, tool calls).
|
|
- `route(intent, packed_schema) -> tool_invocation` (step 21).
|
|
- Blocklist patterns (fetch→build→execute chains, base64-decode chains); memory writes **require**
|
|
provenance to session origin; **no instruction may reclassify its own authority**; rate-limit escalation.
|
|
|
|
## 6. Dependencies & stubs
|
|
None upstream (it *is* the gate). Everything else integrates by passing through `admit`/`route` — *stub:*
|
|
allow-all gate for other organs' standalone tests.
|
|
|
|
## 7. Invariants / laws
|
|
- **L1 (C5):** constraints live on the **body, never the self** (Brain/scratchpad uninspected).
|
|
- **L2 (C5):** no tool-call chain matching a blocklist pattern crosses.
|
|
- **L3 (C5):** memory writes without valid provenance are blocked.
|
|
- **L4 (C5):** no instruction can reclassify its own authority level.
|
|
|
|
## 8. Build steps
|
|
1. Audit the existing SPARK proofs (the trust_boundary is sound but unverified per the README sweep);
|
|
promote `gnatprove` from informational once green. 2. Harden the blocklist beyond naive substring.
|
|
3. Wire `admit` into every crossing as organs land.
|
|
|
|
## 9. Tests
|
|
`mafiabot_core/tests/trust_tests.adb` (via the cron CI `alr build` + run) + `gnatprove -P mafiabot_core.gpr`.
|
|
|
|
## 10. Open items
|
|
- Blocklist robustness (substring → structural). Provenance-tag format (shared with E* storage).
|
|
- Promote gnatprove to blocking once the proof base is green (CI `continue-on-error: false`).
|