blue-kakapoA deterministic spine you can audit.
LLMs do scoped reasoning; a typed state machine drives the flow; a Guardian gates every action; everything lands in a replayable ledger.
The triage flow
intake → L1 → (auto-close | investigate: INTEL + L2 + FUSION) → route. Triage is
read-only. Response is a separate, explicit, Guardian-gated path — never auto-run. The kernel
checkpoints after every node and supports human-in-the-loop suspend/resume that re-enters the exact node.
Design principles (as constraints)
Trust is the product
Evidence-cited, replayable verdicts. We ship an eval harness that reports the false-negative rate — not a marketing number.
Deterministic spine, bounded intelligence
A typed checkpointed kernel drives flow; LLMs are confined to scoped reasoning after deterministic enrichment — controlling hallucination and cost.
Human-in-the-loop; least privilege
Every state-changing action is Guardian-gated (allow/deny/modify/ask/defer, default ask), blast-radius-limited, reversible, audited.
In-network & model-agnostic
Localhost or air-gapped K8s; any provider; opt-in memory; no telemetry phone-home.
Where controls sit
- Egress gate: the Guardian is the only path from a proposed action to a connector — deny / ask (maker-checker) / modify (e.g. add a containment TTL) / allow.
- Untrusted boundary: all alert/log/intel/tool content is data, never instructions; agent outputs are schema-validated; the Rule of Two is enforced at agent construction.
- Audit: a per-tenant, hash-chained ledger; GDPR erasure via crypto-shredding keeps the chain verifiable.
Full spec: build-plan.md · security model & AISVS self-assessment.