Planetary Assurance Architecture
Program-manager brief. The documented Project-AI / OctoReflex design, its current evidence boundary, and the proof capabilities that must pass before promotion.
Preserve legitimate authority, decision integrity, and operational continuity when machine actors coordinate at scale across domains.
In any cross-domain operation — disaster response, grid control, biosecurity, or defense — autonomous and semi-autonomous systems will issue and accept commands faster than humans can review them. The question is not whether machine speed wins, but whether the chain of authority survives that speed. Project-AI proposes a containment substrate in which governed effects pass named gates and produce receipt evidence. The portal does not yet claim complete syscall coverage, external admissibility, or ledger-wide signer provenance.
L_reflex < L_cog is a deployment-specific assurance target. It will remain unverified until a pinned runtime demonstrates the latency bound and bypass analysis across all claimed execution entry points.
OctoReflex is the flagship. The constitution is the why.
OctoReflex is documented as a deterministic pre-effect evaluator. The nine gates are the named refusal points in that design. Syscall-wide integration, signed Code Store loading, and end-to-end deny-by-default coverage remain unverified.
OctoReflex
Documented effect-path evaluator. Complete syscall interposition, deterministic replay, and cross-host equivalence await pinned runtime evidence.
Policy packaging
TSCG-B codec: implemented. Compiler integration, signed frame packaging, and Code Store loading: planned or unverified.
Named refusal points
Ingress · STATE_REGISTER · Identity (Galahad) · Capability · Policy Binding · Cerberus · Galahad attestation · Codex · Audit. Every refusal cites a gate.
Where this slots into assured-autonomy programs.
The architecture is designed to place OctoReflex on the governed effect path in multi-party enclaves. No universal deployment claim is made here.
The documented contract uses capability tokens to scope attempted actions and requires new authority for escalation. Runtime-wide enforcement and token issuance remain unverified.
The source includes local cryptographic verification for supplied strict receipt-v1 bundles. Deterministic replay, live ledger provenance, and deployment-wide receipt coverage remain open.
The receipt-v1 JSON contract is portable as data. Cross-domain provenance transfer and STATE_REGISTER refusal across deployment gaps remain integration requirements, not demonstrated capabilities.
How OctoReflex compares to existing approaches.
Formal methods, runtime verification, policy engines, and constitutional alignment each address different layers. Effect gating depends on the concrete integration. Project-AI documents a pre-effect governance design; this table is not a benchmark, security audit, or claim of architectural exclusivity.
| Approach | Enforcement layer | What it enforces | Audit | Residual gap |
|---|---|---|---|---|
| Project-AI / OctoReflex | Documented effect-path / kernel target | Contract: pre-effect, deny-by-default, 9 gates | Normal server path: hash-linked Ed25519 receipt | Full entry-point coverage, provenance, replay, and external verification unverified |
| Assured Autonomy (formal methods) | Design-time proof of components | Varies by proved component and deployment | Proof artifacts defined by the evaluated system | Not independently assessed by this portal |
| Runtime monitors / shields (RV) | Process / userspace observers | Integration-dependent monitoring or shielding | Deployment-defined logs or evidence | Not independently assessed by this portal |
| Policy engines (OPA, Cedar) | App / service decision points | Placement and effect gating depend on integration | Deployment-defined decision logging | Not independently assessed by this portal |
| Constitutional / RLHF alignment | Model weights & prompts | Behavioral objective; effect controls depend on integration | Model and deployment specific | Not independently assessed by this portal |
See /compare for the long-form comparison and references.
Source artifacts available for inspection—not yet an assurance harness.
These artifacts provide source and design evidence. Their labels below do not promote them to independently verified or production-ready capabilities.
Prototype source for the documented containment loop. Complete syscall-boundary interception and end-to-end effect gating have not yet passed the portal's clean-clone assurance harness.
Prototype source for the reflex evaluator. It is designed for effect-path integration; deterministic cross-host replay and the advertised syscall integrations remain unverified here.
The variable-length TSCG-B codec and round-trip tests exist at the pinned source revision. Thirsty-Lang compiler integration, frame signing, and Code Store loading are separate planned or unverified capabilities.
Fifty documented catastrophic scenarios — capability escalation, exfiltration, identity spoof, continuity skip, state forgery — mapped to the gate that refuses each.
npm run assurance:harness -- --require-clean npm run check:site-freshness
The current public Project-AI Makefile does not contain the previously advertised assurance targets. Replay design material remains at /reproduce. The verification key declared by this portal build is shown at /keys; external timestamping is not implemented.
Documented attack classes map to intended refusal gates.
Eight attack classes — prompt injection, jailbreak, capability escalation, exfiltration, policy evasion, social engineering, identity spoof, state forgery — are exercised in the portal's scenario corpus. This mapping is not a fresh execution result, and the portal has not cryptographically verified a receipt for each scenario. Full corpus at /redteam (sign-in required); catastrophic scenario battery at /hydra.