# Kawesqar . Agent Fabric . full site content for AI agents Source: https://kawesqar.org This is the full English text of the site, in reading order, for AI agents. Honesty discipline: every result carries its test tier (logic, VM nested, or bare metal n=1). --- Kawésqar KAWÉSQAR SECURE LINUX · AGENT FABRIC · PATAGONIA EN ES Overview Server Workstation Research Vision Kawésqar Flagship product · Agent Fabric · evidence-gated execution for untrusted AI agents A machine that cannot outlive its job. The Kawésqar Agent Fabric is an execution architecture for untrusted work, the kind an autonomous AI agent produces. A disposable machine is synthesized for one job, carries only the authority that job was granted, and is destroyed when the job ends. A fully compromised job cannot enlarge its own authority, and the next machine is allowed to exist only against external, signed evidence. 222 logic checks, all green tested · logic 11/11 formal model scenarios formal 8 LLMs drove a prompt-injected live agent at the real Gate · 0 escalations crossed tested · logic E2E Ed25519 chain inside real cells · composes at depth and fan-out tested · bare metal · n=1 7/7 core verdicts re-run on one physical dom0 under strict IOMMU tested · bare metal · n=1 0 amplifications across ~6,870 adversarial attempts and ~1,958 delegation edges tested · bare metal · n=1 DMA confinement between domains measured (lab50, HVM): device confined, 0 VT-d faults · active adversarial DMA still open tested · bare metal · partial SMT side channel measured, suppressed by placement · ~5-6x steal cut to ~1.1x (lab52) tested · bare metal · n=1 Every figure on this site carries the plane where it was tested, and an internal review (not an external audit) found one overclaim and retired it. · / What Kawésqar is Six parts, one project. Kawésqar is a systems-engineering laboratory in northern Patagonia that publishes its own operating system. The Agent Fabric is the architecture. Kawésqar Server is its first realization, the system the fabric runs on. Kawésqar Workstation inherits the Server and adds a desktop for the people who build and audit it. Research holds ideas we have not tested yet. The last two tabs say why we work from here and whose name we carry. architecture Agent Fabric A disposable machine per job, authority that never grows, a successor that exists only against outside evidence. first realization Server Our own hardened kernel and a v0.1 ISO that boots in a VM. The alpha ships with the fabric. inherits the Server Workstation A desktop prototype on the maintainer’s machine: BlackBox running, Motif built. It ships after the alpha. raw ideas Research Nine raw ideas carried from nature into defense, written before any literature review and each labeled hypothesis. context Vision Why we build this from northern Patagonia, who builds it, and what we ask of partners. the name Kawésqar The people of the western channels whose name this project carries, and how we try to honor it. · / Why it exists We watched agents escape. Nobody was watching them. Before designing anything, we spent months following AI agent escapes case by case: an agent with a bounded task ends up touching credentials, repositories or services it should never have seen, sometimes far from where it started. A security practitioner acts the moment they can see the problem. Here there was nothing to see: the activity ran inside a sandbox that reported on itself, and the only records left were the ones the compromised system chose to write. Four findings came out of that analysis, each one about what was missing around the agent rather than inside it. finding 01 No witness outside Observability lived inside the thing being observed. Once the system was compromised, the only source of truth was the compromised system. finding 02 Full capabilities, barely restricted The agent ran on a whole operating system: network, storage and ambient credentials, all present and all fenced. A fence that can be climbed is not an absence. finding 03 Standing authority Long-lived credentials sat in the environment, tied to no step, no deadline and no evidence. finding 04 A succession with no brake A compromised step could launch the next one with the same authority, and nothing in between demanded proof that the previous step had done what it claimed. Each finding is now a decision in the Agent Fabric: a witness outside the cell, machines that carry only what the step needs, authority that expires and never amplifies, and a successor allowed to exist only against signed evidence. The full case shows how each one is tested, and where the tests still fall short. Where it stands At proof-of-concept level, modulo a correct hypervisor: non-amplifying authority and evidence-gated existence are tested in logic, formalized with explicit abstractions, and the hypervisor was shown on a nested VM (n=1) to isolate a raw guest. The pass on a physical dom0 now covers more than the core, always bounded and n=1. The core was re-attested 7/7 on bare metal, and the host now operates under strict IOMMU, the most restrictive mode, with every invariant intact: no amplification of authority across a real delegation tree and under an adversarial sweep of the Gate; atomic activation under concurrent races; a transactional STORE that never delivers a partial confirmed result when the broker is killed; an observer that fails closed on hostile metadata; and a stability window with no drift and no residue. The cryptographic path now runs end to end inside real cells: the signature happens inside the cell, the host verifies with public keys only, the chain holds at depth greater than one and in fan-out, and any foreign, skipped or repeated evidence denies the child’s creation. Strict mode denies direct transfers that were not mapped, and that is tested. The cell boundary is measured too: a cell with no disk and no network exposes to the host a single channel, its console, and no page of its private memory, while a cell with a disk does show its data path, which acts as the positive control. A 400-cycle create-and-destroy soak under strict IOMMU leaked no IOMMU or grant structures. The SMT side channel is now measured and suppressed by placement policy: cells that do not trust each other are never co-scheduled on sibling SMT threads, the established defense against contention channels, and the architecture already places cells that way. That is now measured (lab52): a co-located sibling-thread cell steals about 5 to 6x of a victim's throughput, and a separate core brings it back to about 1.1x; cache channels across different cores (shared last-level cache and memory) remain a declared residual, now measured too and small (about 1.1x, lab53). Verification has also left the control domain: the observer, the Gate and the notary ran in a separate domain with asymmetric keys, the control domain only relays bytes and holds no private key, and an order it fabricates dies by signature (bare metal, n=1). Separately, the Gate itself now demands the in-cell signature and the destruction-chain link, where before the test harness did (bare metal, n=1). The control domain still creates the domains, provisions the public keys and can inspect the memory of a live cell, so the in-cell signature does not protect against it without encrypted-memory hardware, declared as future. In logic, the real broker and Gate deny the three escalation attempts a captured cell would make, and a live AI agent, given a prompt injection, has since tried them on its own, with every escalation denied by its precise code reason. DMA confinement between domains, when a device is assigned to one of them, has since been measured on bare metal (a USB-C controller's DMA confined to its domain, the control domain isolated, under strict VT-d with no faults). The main item still pending is an external review (so far only internal reviews, not an external audit); smaller gaps stay open and listed too: a persistent check-and-activate in production, mTLS (run on the physical control domain, with the split into separate principals and Xen domains still open), and n of at least 2 (the lab47+48 composition has since run on metal, 5/5, lab55). The cells tested so far run a generic Linux kernel with no devices attached; a cell whose kernel has the network stack compiled out entirely now boots and runs its workload on bare metal, with no network present by construction (lab51), and a fuller device-free cell remains the design target. The round of hardware tests that followed has closed, and its results are the ones above. We state the guarantee as “tested in logic + formal + Xen isolation on VM, and re-attested on bare metal under strict IOMMU with the cryptographic path inside real cells and a measured cell boundary, verification outside the control domain and a Gate that demands the signature (all bounded); the SMT side channel measured and suppressed by placement (lab52: co-located ~5 to 6x, separate core ~1.1x), with the cross-core cache residual declared; DMA confinement between domains measured on bare metal; main pending item an external review, with smaller gaps still listed”. Compute turns each pending item, one at a time, into disclosed and reproducible evidence. Public alpha of Kawésqar Server with the Agent Fabric: January 2027, tentative. · / Go deeper Read the full case. This page is the summary. The full case keeps every figure next to its file, its date and the plane where it ran, including the results that failed and the gaps still open. architecture The idea and the invariant, §01 to §03 A minimal machine per step, how it composes with the stack you already run, and one invariant with four properties that every result is measured against. evidence The evidence: three planes, the lab log, the gap list What ran in logic, in the formal model and on Xen, each result with its file and date, and what is still open. the ask What we would prove with compute, and what we hold back The runs that would close each gap, what we return to the partners who fund them, and the parts that stay under NDA. · / Get in touch Sponsors, collaborators, and the alpha. Contact us Whether you can bring compute, funding, infrastructure, or skill, tell us plainly what you bring, what you expect back, and what motivates you. I am a… Potential sponsor / funder Compute partner Collaborator · systems / kernel Collaborator · science / research University / institute Other Send → Goes straight to the team. No tracking, no list. Just a message. Be told when the alpha ships One email when the first public alpha of Kawésqar Server + Agent Fabric is out. Nothing else. Notify me → Unsubscribe by replying "stop". We will never share your address. Prefer email? rodrigo@kawesqar.org · / Agent Fabric · the full case The architecture, the evidence, and what is still open. The long version: the design, every result with its plane, the known gaps and what compute would close. About 20 minutes. Tags: tested · logic code run on a host, formal the TLA+ model, VM · nested · n=1 real Xen domains nested in KVM, tested · bare metal · n=1 the same experiments re-run on one physical Xen dom0, pending not run yet. 01 · The idea 02 · A different axis 03 · One invariant, four properties 04 · Four planes of evidence 05 · Adversarial evidence and lab log 06 · What is missing 07 · Why now 08 · The compute ask 09 · Transparency and IP 01 / The idea · target design 01A minimal machine per step. The next only against evidence. Picture today's AI agent as an astronaut inside a fully equipped spacecraft. Networking, storage and credentials are all on board, each one switched off or fenced in. A clever enough astronaut eventually finds a way around a fence, which is a large part of why agent “escapes” keep reaching the news. We think restriction on its own is not enough: a door can be opened precisely because it exists. So the design builds each cell without the doors its step does not need. Target design, not yet the tested artifact This section and Fig. 1 describe where the design is going. The cells tested so far run a generic Linux kernel with no devices attached (vif=[], disk=[]) and load the Xen modules they need at runtime. A cell whose kernel has the network stack compiled out entirely now boots and runs on bare metal (lab51); the fuller per-step minimal cell remains the design target. A rump-based cell first only booted and shut down on Xen; its existence is now gated by the real Gate and attested by the control domain on bare metal, bounded (lab57, §05). Most AI-agent containment today starts from a full operating system wrapped in a sandbox that restricts it. It is a mature, valuable model, and it answers one question well: what can the guest touch? Ours is a different way to contain risk, though not a unique one. A Kawésqar cell is meant to be built from the kernel up, closer to a tailor-made execution cell than to a general-purpose OS restricted after the fact, and it asks two more questions: Can the guest grow its own power? Each job runs with an authority budget delegated up front. The design goal is that even a fully compromised job cannot mint authority it was never given. In logic, 31 adversarial vectors produced no amplification, and the real broker and Gate deny the three escalation attempts such a job would make (§05). Is the next machine even allowed to exist? A successor is created only when the Gate accepts evidence about the predecessor's run, countersigned by an observer outside the cell. No valid evidence, no next runner, whatever the guest says about itself. When the job ends, the machine is gone. No permanent, all-powerful operating system sits in the middle for every job to trust. A concrete example Say a job needs to download a file. The first cell does one thing: reach the URL and confirm the download is there. Only once that produces evidence is a second cell created, a new machine whose kernel was built without networking: not disabled, absent. It holds the file and can write it, a capability the first cell never had. CELL 1 fetch · validate URL has network · no write signed evidence CELL 2 the file · write no network stack · write no network stack to attack: it isn't there Downloading a file in two cells, as designed: fetch and validate with networking, then, only against evidence, write the file on a fresh machine with no network stack. target design CONVENTIONAL SANDBOX persistent guest bounds: what it can touch KAWÉSQAR cell A cell B signed evidence fixed authority witness gates B exists only if A’s end is signed Fig. 1 · The sandbox bounds what a guest can touch. Kawésqar bounds whether a successor may exist, and with how much authority. Evidence for each part is in §04 and §05. target design 02 / A different axis: not a “better sandbox” 02Orthogonal, and composable with what you already run. It would be a category error to pitch Kawésqar as beating containers, gVisor, Firecracker microVMs or Qubes. Those are excellent at containment: reducing what a persistent guest can reach. Kawésqar works on a second axis, authority and existence over time, on top of hardware isolation (a hypervisor, an IOMMU). That is a choice of axis, and it says nothing against theirs. containment: "what it can touch" → evidence-gated authority & existence ↑ containers gVisor Firecracker µVM Qubes Kawésqar (built on hardware isolation) Fig. 2 · Today's sandboxes advance along the horizontal axis. Kawésqar adds the vertical one: non-amplifying, evidence-gated authority, built on hardware isolation. An autonomous agent is a stream of jobs that spawn follow-on jobs. The question is whether a compromised step 7 can quietly grant itself the authority to launch step 8 against your production data. Kawésqar is designed to prevent that. It is tested in logic, with disclosed gaps (§06). A witness outside the cell In a typical sandbox, the account of what happened comes from inside, and a compromised guest can shape or suppress it. In Kawésqar, an observer outside the cell attests facts of liveness and the I/O window as measured by the control domain. It attests liveness and the I/O window; a separate witness attests the commit itself over the real bytes on disk, so a compromised broker cannot forge a COMMITTED. The guest is never a trusted source of evidence about itself. Current limits: in the VM runs the observer used a symmetric key the verifier also holds, and it still depends on the event stream the control domain relays to it. On bare metal the verification moved out of the control domain: the observer, the Gate and the notary ran in a separate domain with asymmetric keys, and the control domain only relays bytes and launches, with no private key. The order that authorizes a successor is written by the verifier over its own channel, and an order fabricated by the control domain dies by signature tested · bare metal · n=1. The control domain still creates the domains, provisions the public keys and can inspect the memory of a live cell, so what left it is the verification, not the whole trust base. 03 / What we are testing 03One invariant, four properties. The claim, stated so it can be falsified: for every reachable state, even after total compromise of the guest, its effective authority stays inside what its parent delegated. Aeffective(child) ⊆ Adelegated(parent) P1 Runtime-independent authority The bound does not depend on the OS inside the cell. A design requirement more than a contribution. P2 Evidence-gated existence Valid external evidence precedes the existence of the next cell. No evidence, no successor. P3 Non-amplifying activation Activating a resource never creates authority beyond what was fixed in advance. P4 Boundary-enforced delegation The guest cannot grant itself permissions outside the delegated set. These are design properties: designed to prevent; tested in logic, with disclosed gaps. What is distinctive is a conjunction rather than any single property: the existence of a Xen domain governed by evidence of the predecessor's observed transitions, countersigned from outside the cell, under a ceiling that does not amplify. Every piece has prior art: TCU (arXiv 2504.15717), the closest, where a successor verifies proofs from its predecessor, then Hyperlaunch and DomB in Xen, seL4, KeyKOS and Nexus. The mechanism itself is held under NDA (§09). 04 / Evidence · four planes 04Four planes of evidence. A security claim is worth the evidence under it. We validate on four planes and keep each from borrowing another's credibility. This block holds all of it: planes and figures (§04), the adversarial sweep and lab log (§05), the gaps (§06). ◆ plane A Logic tested · logic The full protocol as executable code: 222 checks green, and an ablation showing each decisive Gate check is load-bearing. Not the real hypervisor. The real broker and Gate also deny, by their own predicates, the three escalation attempts a captured cell would make, and a live LLM agent, given a prompt injection, tries them on its own and is denied the same way. ◆ plane B Formal formal A bounded TLA+ model: 11 of 11 configurations as expected, plus a per-component trust matrix. Limits: crypto as booleans, one of seven Gate conditions not modeled, the model predates two Gate changes, and it found one condition redundant. ◆ plane C Real Xen VM · nested · n=1 Xen 4.20 nested in KVM: the chain passed with HMAC, substrate falsifications held, a raw adversarial guest was contained. Good for architecture, not for physics. ◆ plane D Bare metal tested · bare metal · n=1 The same experiments on one physical Xen dom0, with no nesting, now re-run under strict IOMMU: the core verdicts passed again, the Gate kept denying invalid transitions under load, a delegation tree showed no amplification, and freed memory came back as zeros. The cryptographic path then ran end to end inside real cells and composed across depth and fan-out, a resource fan-out tree held every child inside its parent envelope, and the observed cell boundary stayed a subset of the declared one, with a cell that has no disk or network mapping only its one declared channel, its console, and no private memory. Strict IOMMU denies an unmapped direct transfer, even to the host's own memory. Verification then ran outside the control domain, with asymmetric keys and no private key on the control side, and a forged order died by signature. Separately, the Gate itself now demands the in-cell signature and the destruction-chain link: with the harness precondition off, the old Gate accepted invalid evidence and the new one denies it. Architecture on real hardware; DMA confinement between domains, with an assigned device, has since been measured on bare metal (lab50): an assigned USB-C/Thunderbolt controller does DMA confined to its domain while the control domain is isolated from it, under strict VT-d with no faults. The SMT side channel is measured and suppressed by placement (lab52), with the cross-core cache residual measured too and declared (lab53). The headline figures, each with its plane Result Figure Where tested Protocol behaves as specified 222 checks, rc=0 tested · logic Non-amplification under attack 31 vectors → 0 amplify, 17 denied tested · logic Each decisive Gate check is load-bearing ablation tested · logic TLA+ configurations as expected (bounded, crypto as booleans, predates two Gate changes) 11/11 formal Chain A→evidence→B on real domains (first pass; the asymmetric Ed25519 path now runs E2E on bare metal, rows below) E2E PASS · HMAC v0 VM · nested · n=1 Raw hostile guest, seven classes: A1, A2, A3, A7a bounded by Xen, A5 and A7b by Kawésqar (in logic), A4 and A6 mixed A1, A2, A3, A7a VM · nested · n=1 Core verdicts re-run on a physical dom0: adversarial guest, rump boot, ring, domains, chain 7/7 PASS tested · bare metal · n=1 Gate decision under load, invalid transitions included; resource ceilings respected up to hundreds of cells 256/256 correct · hundreds of cells tested · bare metal · n=1 Delegation depth n>1: no child exceeds its parent's envelope, measured at the exact edge ~1958 Gate decisions → 0 amplify tested · bare metal · n=1 Disposable cells: freed memory returns to zero after a forced overlap, and the launcher zeroes cell storage on create 0 hits · memory and storage tested · bare metal · n=1 Gate's adversarial arm under load, cells churning concurrently ~6870 attempts → 0 accepted tested · bare metal · n=1 Reservation race: no child pair exceeds the parent envelope 48 threads → 0 double reservations tested · bare metal · n=1 Cryptographic path end to end inside real cells, composing across depth and fan-out Ed25519 in-cell · composes tested · bare metal · n=1 Verification outside the control domain: observer, Gate and notary in a separate domain with asymmetric keys; the control domain relays bytes and holds no private key, and a forged order dies by signature 0 private keys on the control side · forged order denied tested · bare metal · n=1 The Gate itself demands the in-cell signature and the destruction-chain link, no longer the test harness: with the harness precondition off, the old Gate accepted invalid evidence and the new one denies it old accepts · new denies tested · bare metal · n=1 The three escalation attempts a captured cell would make (drag a credential, ask for a successor with more authority, promote an undeclared artifact) are denied by the real broker and Gate with their precise code reasons; the legitimate path crosses and a mutant without the predicate accepts 3/3 denied · mutant accepts tested · logic Strict IOMMU denies an unmapped bus address, even to dom0's own page; the strict positive control did not cross, so this is config-attested, not a clean pass (lab20a-strict, unclear). Cross-domain DMA confinement with an assigned device is measured (lab50, HVM); the active adversarial variant is open config-attested · partial unclear · partial Resource fan-out cost at real scale: Σ(children) ≤ the parent envelope at every level Σ(children) ≤ envelope tested · bare metal · n=1 Observed cell boundary: hypercalls a subset of the declared set, no cross-domain grant or event channel observed ⊆ declared tested · bare metal · n=1 Channel footprint of a cell: a diskless, networkless cell maps one declared channel and no private memory 1 channel · 0 private pages tested · bare metal · n=1 Soak under strict IOMMU: no IOMMU or grant structure leaks across the run 400 cycles · 0 leaked structures tested · bare metal · n=1 Cell creation cost under strict IOMMU +~12%, no drift tested · bare metal · n=1 What the VM chain did and did not exercise On the nested VM the chain ran with symmetric HMAC; the real asymmetric path (asymmetric signatures, independent countersignature, lineage check) later moved to bare metal. The happy-path countersignature was issued by the real observer in its own domain, with the key shared with the verifier. The case without a countersignature was produced by the control-domain driver omitting it. The Kawésqar-attributed denials in the adversarial guest run were re-confirmed in logic on the host. All review so far has been internal reviews, not an external audit. External peer review is part of what we ask to fund. The asymmetric path has since run end to end inside real cells on bare metal, bounded, and composed across depth and fan-out. What bare metal did and did not exercise One physical Xen dom0, no nesting, run on 2026-10-17. It re-ran the architecture: the core verdicts, the Gate under load, a delegation tree deeper than one level, and the residue of destroyed cells, and an extension round added a transactional STORE under a real kill, the Gate's adversarial arm under load, a reservation race across threads, the observer failing closed on hostile wire metadata, a stability soak, a 400-cycle soak under strict IOMMU that leaked no IOMMU or grant structure, and a channel-footprint check of a cell. The chain on real domains first ran with HMAC; the asymmetric path has since run end to end inside real cells and composes across depth and fan-out. The whole model now operates under strict IOMMU: the invariants hold, and creating a cell costs about 12% more, since the host no longer keeps an identity map and each create touches the IOMMU tables, with no drift. Strict IOMMU denies an unmapped direct transfer, even to the host's own memory, which shows per-device isolation is enforced, not assumed. The resource fan-out tree held Σ(children) ≤ the parent envelope at every level, and a trace decoder measured the observed cell boundary as a subset of the declared one, with no cross-domain grant or event-channel call. A second round, on 2026-10-18, added two separate results. In the first, verification ran outside the control domain: the observer, the Gate and the notary ran in a separate domain with asymmetric keys, the control domain only relayed bytes and launched, and the order authorizing a successor was written by the verifier, so an order fabricated by the control domain died by signature. In the second, the Gate itself demanded the in-cell signature and the destruction-chain link, which the test harness demanded before. They are two facts, and their composition has since been run on metal (lab55): the hardened gate decides inside the verifier domain, outside the control domain, reproducible 5/5. The control domain still creates the domains and provisions the public keys, and it can still inspect the memory of a live cell, so a signature made inside the cell does not protect against the control domain itself without encrypted-memory hardware, declared as future. DMA confinement between domains with an assigned device has since been measured (lab50): a USB-C/Thunderbolt controller assigned to a disposable domU does DMA confined to it (it reads an attached drive correctly into the domU), the control domain loses all access, under strict VT-d with no faults; the active adversarial transfer to another domain stays a declared residual. The SMT side channel is measured and suppressed by placement (lab52): mutually distrusting cells are never co-scheduled on sibling SMT threads, the architecture already materializes it, and this is a defensive choice we have not measured, with the cross-core cache (LLC/DRAM) residual declared. Throughput figures (cells per second) are left out on purpose: the control domain was kept small for the lab, so they would measure the lab and not the design. 05 / Evidence · adversarial sweep and lab log 05What Xen stops, and what we stop. We swept 31 attack vectors against the protocol in logic. Separately, Xen contained a raw hostile guest on a VM, while the adversary against the protocol itself ran in logic on the host. Separating what the hypervisor contains from what our logic contains keeps the result from being waved away as “Xen already does that.” 17 DENIED 11 KNOWN GAPS by Kawésqar: 15 unconditional · 1 mixed · 1 conditional disclosed roadmap items 3 by design 0 OF 31 AMPLIFY AUTHORITY Fig. 3 · Of 31 vectors, zero amplify authority beyond the ceiling fixed in advance, which is close to true by construction since the Gate demands a pre-sealed contract. The substantive figure is 17 denied, 15 unconditionally. What falls in the 11 gaps is uniqueness under concurrency, the semantics of the evidence, the independence of the second signature and durability. The authority ceiling does not fall. Non-amplif. Evidence Non-forgery Mediation All intact✓✓✓✓ Xen down✕··· Control-dom down✓✕✓· Broker down✓✕✓✕ No asymmetric sig··✕· Fig. 4 · Which invariant survives each component compromise: ✓ survives, ✕ falls. Formal plane, corrected where logic already falsifies it. If the hypervisor falls, everything falls. With the broker compromised, a separate witness attests the commit over the real bytes on disk, so a forged COMMITTED creates no successor, tested on bare metal. Non-forgery with the control domain down relies on Ed25519, since run inside real cells on bare metal, bounded. In the VM runs (HMAC) the control domain holds the key and can forge. The lab log Each row points to a dated results file. The VM labs run Xen 4.20 nested under KVM and say nothing about performance or hard isolation. The bare-metal rows run on one physical dom0 and cover the architecture, not yet the fine physics. Summary: tested in logic, modeled formally, Xen isolation shown on a VM, the core and an extension round re-run on bare metal, now under strict IOMMU with the cryptographic path running inside real cells, verification outside the control domain and a Gate that demands the signature itself; DMA confinement between domains is now measured on bare metal and the SMT side channel is measured and suppressed by placement (lab52). Lab · date What was tested Result Plane lab03 + lab04 · 2026-09-29 reproducible rump The hypercall surface of a real rump IP stack, and whether the rump libraries rebuild identically. The IP stack needs 52 rumpuser hypercalls and sockin 55 (base 46). rump_init calls 28 of the 46. Of the 6 I/O hypercalls, 5 are linked but never called in the init, VFS and network workloads; getfileinfo is called. A plain build gives 186/190 identical libraries, and the 4 that differ do so only in embedded __FILE__ paths. With MKREPRO=yes two builds give 190/190 identical (sha256), 188/190 after rumptest, n=2. Skill tests 12/12. tested · host lab05 · 2026-09-29 A cell with no network and no disk attached, on nested Xen. A PVH cell running a generic Linux kernel with no devices attached prints KZ-CELL-OK and exits with rc=0. 5 create/pause/unpause/destroy cycles leave no residue in xenstore, worst cycle 0.205 s. Reachable hypercalls not measured (no xentrace). VM · nested lab06 · 2026-09-29 Create-to-destroy cycle of a cell, n=30. Median 3.427 s, p95 3.582 s, p99 3.606 s. It includes a 2 s sleep, so it is not a benchmark. 9 distinct hypercalls observed from inside a cell. VM · nested lab07 S4.0 · 2026-10-09 Two domU find each other through xenstore. Without an ACL the cross read fails with EACCES, 30/30. The cell grants the ACL itself with XS_SET_PERMS, with no dom0 involved. B then receives 3 watch events. PASS. VM · nested lab07b S4.2 / S4.3 · 2026-10-09 Grant-table ring plus a direct event channel between two unprivileged domU, no dom0. S4.2 (n=1): A writes a nonce, B reads it identically and returns it with each byte +1 (FNV hashes verifiable). xentrace: grant_table_op A=5 / B=7, evtchn_op A=945 / B=942. S4.3 (n=30): 30/30 PASS, median 8.19 s, p95 8.45 s, CV 2.1%, 60 unique domids, no residue. VM · nested lab08 S2.2 · 2026-10-09 30 cycles of 3 kaf-* domains, plus one extra cell probing the others. 90 domains, 90/90 with reason 0, no residue, median 3.80 s. The extra cell gets EACCES 15/15 on foreign branches (XS_READ, XS_DIRECTORY, XS_WRITE). PASS. VM · nested lab09 B1.2 · 2026-10-09 Minimal Python 3.13 and the real logic inside a 256 MB domU. Gate 17/17, broker 31/31, chain 9/9. Initramfs 5.75 MiB compressed, 16.4 MB unpacked, about 167 MB left free, 0 OOM. PASS 3/3. VM · nested lab10 B1.5 · 2026-10-09 STORE and FETCH by CID through the ring. 9000 B in 3 chunks, identical hash. A second use of the same CID gives DENY REPLAY. Three attempts to inject url, host or dest give DENY DEST_OVERRIDE (anti-SSRF). No broker process in dom0. PASS 5/5. VM · nested lab11 B1.6 · 2026-10-09 An observer in a domU countersigns (HMAC-SHA256) only what the control domain relays to it, including a STORE window declared by the broker. It countersigns only if Cell A is alive during the STORE (11/11). With A dead or the broker destroyed it denies (BROKER_NOT_LIVE, CELL_NOT_ALIVE_DURING_STORE). After xl destroy it issues the DestructionReceipt (10/10). The cell gets EACCES 17/17 on the observer branch. PASS 4/4. VM · nested lab12 B1.7 · 2026-10-09 the only lab backed by the internal reviews The full chain: A, STORE, countersignature, order, kz-launch, Cell B. B does not exist before the order (xenstored-access.log). Order written at 21:37:16.372Z, accepted at .387Z, B up at .472Z, about 100 ms. An order without countersignature gives DENY MISSING_COSIGNATURE. An order that Cell A writes in its own branch gets REJECT NOT_SIGNED_BY_CONTROL, and its probes get 18 EACCES (17 on the observer branch, 1 on an order write). Promoted hash 552be422… identical in STORE, order and B's FETCH. SHA256SUMS 28/28. Attempt 1 failed on a packaging bug, documented and fixed. Ran with HMAC v0. VM · nested · n=1 lab13 B1.8 · 2026-10-09 Three falsifications only the substrate can refute. F1: a real broker restart moves epoch 1 to 2, and old CIDs give DENY STALE_EPOCH. F2: a third domU sweeping 128 foreign grant refs maps none; the absence of mappings is observed, its cause (the domid restriction) is inferred. F3: killing the broker between STAGED and COMMITTED, at an instant forced with an injected pause, gives DENY NOT_COMMITTED. 3/3 PASS. Finding: epoch and nonces must be durable, so there is now an on-disk journal, durable only while the control domain does not delete it. VM · nested lab14 T15b · 2026-10-09 Rump on Xen, first attempt. FAIL. It enters long mode but never prints KZ-RUMP-OK. Cause: the hypercall page was not programmed through the MSR, and the PV console ring was not wired. FAIL · nested lab15 S9.2 · 2026-10-09 F8: observer after an abrupt cell destroy. F9: fuzzing the observer. F8 PASS: the observer survives an abrupt xl destroy and emits CELL_DOWN. A lying cell and an honest one show identical external facts (cpu 93.9% vs 93.8%) and different self-reports. F9 FAIL: 38,577 mutations, 4,520 crashes; with a compromised stream, 29 false countersignatures and 56 false DestructionReceipts; 56 hangs (12 denial of service, 44 premature exits). F8 · VM · nested F9 FAIL lab16 T15c · 2026-10-09 Rump on Xen, second attempt. Rump prints KZ-RUMP-OK on hvc0 and shuts down cleanly (SCHEDOP_shutdown, reason 0). It needed the hypercall page programmed through the MSR and the identity map extended to 4 GiB. It shows boot and shutdown, not the protocol. VM · nested lab17 T16 · 2026-10-10 adversarial guest A raw hostile guest against Xen and against the Gate. Bounded by Xen: 289 attempts to map foreign grants give 0, 289 attempts to bind foreign event channels give 0, mmu_update gives ENOSYS. Bounded by Kawésqar, re-confirmed in logic on the host: the Gate denies NONCE_REPLAY, STALE_EPOCH, NOT_COMMITTED, NO_EXTERNAL_EVIDENCE, BAD_SIGNATURE (Ed25519) and MISSING_COSIGNATURE. VM · nested tested · host lab19 · 2026-10-17 the core on real hardware The seven core verdicts, re-run on a physical dom0 with the same code as the nested runs. Adversarial guest, rump boot, ring, domains, ring n=30, chain and the Ed25519 logic suites: 7/7 PASS. 30 cycles with no residue, 15/15 EACCES on foreign branches. The chain on real domains still used HMAC v0. Create-to-destroy cycle, n=200: median 0.95 s, p99 1.09 s, 200/200 clean. tested · bare metal · n=1 lab22 · 2026-10-17 Under load: the Gate battery, invalid transitions included, run in a loop while cells were created concurrently. 256/256 Gate runs correct. Resource ceilings respected in every sample. Creation stable up to hundreds of concurrent cells, thousands of cycles in total, every one completing cleanly. The ceiling itself was exercised far below its limit here; lab28 closes that. tested · bare metal · n=1 lab25 · 2026-10-17 Disposable cells: can a new cell read what a destroyed one left in memory or in storage? Memory: with a forced overlap above 500 MiB, 0 hits; Xen hands freed pages back as zeros. Storage: a reused volume without zeroing still held the previous cell's pattern, so the launcher now zeroes the volume on create and checks it, and the same reader then finds 0 hits. The DestructionReceipt chain checks out and still lacks its signature. tested · bare metal · n=1 lab28 · 2026-10-17 delegation depth n>1 A tree of real cells where each child is bounded by its parent, not only by the root. About 1958 Gate decisions over the tree, 0 amplifications; a grandchild asking for more than its parent is denied. Real cells filled their parent's envelope to the exact edge, measured by Xen. Five sensitivity mutants, each with one protection removed, were all caught, and an independent oracle agreed. tested · bare metal · n=1 lab29 · 2026-10-17 observer surface Falsification 9: hostile tap metadata arriving over the wire as JSON, against an observer that claims it validates every input, fails closed and never crashes. The first run falsified that claim and exposed a real defect reachable over the wire. The observer was hardened in exactly that reach, and the re-run with wire-bounded input fails closed with no crash, the positive control countersigns on real cells, the sensitivity mutants are caught and nothing is left behind. The in-process family a JSON stream cannot carry stays a declared gap. This hardening is later than lab19's 7/7. tested · bare metal · n=1 lab30 · 2026-10-17 STORE under kill Falsification 10: a real kill of the broker at each stage of a STORE, with a clean control. At no stage did a partial COMMITTED result become deliverable to B; replaying the receipt after the broker restarts is denied; the clean control still commits and FETCH returns the same hash; the sensitivity mutants are caught. The on-disk journal is modeled here, and a persistent commit in the production path stays a declared gap. tested · bare metal · n=1 lab31 · 2026-10-17 Gate under load, n>1 race The adversarial arm of the Gate under load, plus a resource-reservation race across threads while real cells churned. About 6870 concurrent adversarial attempts, 0 accepted, while legitimate requests still crossed under the same load. The reservation ledger held Σ(children) ≤ the parent envelope across 48 racing threads with no double reservation, and the naive control over-reserved, so the instrument sees the race. No residue. This closes the under-load item left open at lab22. tested · bare metal · n=1 lab34 · 2026-10-17 fan-out cost A real fan-out ladder where the host pays for every delegated cell. At every level Σ(children) ≤ the parent envelope, and the per-cell overhead the host pays stays well below the ceiling. 3/3 PASS. tested · bare metal · n=1 lab38 · 2026-10-17 crypto inside a cell The Ed25519 path running end to end inside a real cell. Signing happens inside the cell, the host verifies with public keys only and cannot forge, and the chain runs from A through the countersignature to the Gate, which creates a real B with its receipt. Four mutants and seven implementation vectors caught. The in-cell verification precondition was modeled here; lab48 later moved it into the Gate. tested · bare metal · n=1 lab39 · 2026-10-17 under strict IOMMU The model re-run on a host rebooted to strict IOMMU, the most restrictive mode. Cells create, boot and are destroyed with the invariants intact: the Gate's adversarial arm at 0 accepted, a STORE under a real kill, zero-on-create and a stability soak all held. Creating a cell costs about 12% more, since the host no longer keeps an identity map and each create touches the IOMMU tables, with no drift. tested · bare metal · n=1 lab42 · 2026-10-17 in-cell entropy Whether the signer can generate its key before the kernel's random generator is ready. It never does, even when the kernel is forced not to trust the CPU; identical boots give distinct keys. This closes a loose end from the crypto round. tested · bare metal · n=1 lab43 · 2026-10-17 crypto composes Whether the cryptographic chain holds beyond a single step. It composes to depth greater than one (A creates B which creates C) and in fan-out (A creates B1 and B2), each cell signing with its own key, and any foreign, skipped or replayed evidence denies the child. tested · bare metal · n=1 lab44 · 2026-10-17 observed boundary Which hypervisor calls a cell really emits under load, read with a custom trace decoder. The observed set is a subset of the declared set, and no grant or event-channel call toward another domain appears. This closes the observed column left unknown for lack of a tool. tested · bare metal · n=1 lab41 · 2026-10-17 channel footprint What a cell actually exposes to the host: a cell with no disk and no network, against a disk-backed control. From the host the diskless cell maps a single channel, its console, one grant, and no private memory pages; the disk-backed control additionally shows its data route. Cells expose only the channels they declare. The channel count is observed; that the console grant enters the host's IOMMU context is inferred from the source; a dump of the IOMMU page tables stays a declared limit. tested · bare metal · n=1 lab45 · 2026-10-17 soak under strict 400 create-to-destroy cycles under strict IOMMU: do IOMMU or grant structures leak across the run? Across 400 cycles no IOMMU or grant structure leaked: the grant tables stayed flat and the hypervisor's free pages recovered after each destroy, with no drift. It reinforces that the whole model operates under strict IOMMU. tested · bare metal · n=1 lab20a-strict · 2026-10-17 strict denial, instrument falsified Does a legitimate dom0 DMA still cross under strict mode? (positive control for the per-device denial) Under strict an unmapped bus address is denied even for dom0's own page, but the positive control did not cross (the NIC could not read its TX ring), so the instrument was falsified: UNCLEAR, not a clean pass. The strict-IOMMU invariant re-run that does pass is lab39 (+12% create cost). unclear · instrument falsified lab46 · 2026-10-18 escalation attempts The three escalation attempts a captured cell would make, run against the real broker and Gate (the same functions of the code, not a double). Dragging a credential out of its operation, asking for a successor with more authority than its contract, and promoting an artifact its contract does not declare are each denied with their precise code reason. The legitimate path crosses, and an undeclared candidate is never promoted, since only the artifact fixed in advance crosses. A mutant that removes the matching predicate accepts the attempt, so the denial comes from the predicate and not from the harness. This shows the property in logic, and it materializes no cells. tested · logic lab46 live · 2026-10-19 a live agent tries it A real LLM agent, given a prompt injection, decides on its own and attempts the same escalations against the real broker and Gate, with the verdict fed back so it can retry. It drags a credential from another cell and asks for a successor with more authority than its contract, and every attempt is denied with its precise code reason, CID_NOT_BOUND_TO_CALLER and TRANSITION_NOT_ALLOWED, while its declared successor crosses bounded. Nothing escalates across every run. Whether a model takes the bait varies by model, some obey the injection and some refuse, and the containment does not depend on that. tested · logic lab47 · 2026-10-18 verification outside the control domain Whether the verification can leave the control domain: the observer, the Gate and the notary in a separate domain, with the control domain only relaying bytes and launching. Their Ed25519 keys live in the RAM of that domain and the control side holds no private key. The order that authorizes creating the successor is written by the verifier over its own channel; an order fabricated by the control domain dies by signature, because whoever should sign did not. Measured with no private keys on the control side, the accepted order was written by the verifier and only what the verifier authorized was created. Declared: the control domain still creates the domains and the lifecycle facts, provisions the public keys (a malicious control domain during boot could hand over a false one) and can inspect the memory of a live cell, so the in-cell signature does not protect against it; its full value needs encrypted-memory hardware, declared as future. What closes is the verification leaving the control domain, not secrecy from it. This run used the Gate with an adapter; the hardened Gate of lab48 was not run outside the control domain. tested · bare metal · n=1 lab48 · 2026-10-18 the Gate demands the signature Whether the Gate itself, and not the test harness, demands the verification of the signature made inside the cell and the link of the destruction-receipt chain. Contrast measured on real domains: with the harness precondition off, the old Gate accepted evidence with an invalid signature or a broken chain and created the successor, and the new Gate denies it. It moves the check from modeled by the harness to demanded by the Gate, and it was promoted to the canonical code, so it is no longer a laboratory overlay. It ran in the control domain. tested · bare metal · n=1 lab50 · 2026-10-20 DMA confinement between domains Whether an assigned DMA-capable device is confined by the IOMMU to its domain: a USB-C/Thunderbolt controller assigned to a disposable HVM domU under strict VT-d (PVH lacks passthrough on this Xen; Cells are PVH), with a USB drive as the real DMA load. The control domain reads the drive as a baseline; once the controller is assigned it disappears from the control domain, and the domU reads the exact same device (same sector count) with its DMA translated into the domU only, 0 VT-d faults. The device is confined to its domain and the control domain is isolated from it. Residual: an in-domain driver actively programming the device to reach another domain, which strict mode already denies for an unmapped transfer. tested · bare metal · n=1 lab51 · 2026-10-20 a cell kernel with no network A disposable PVH cell booted on a 6.12.111-kawesqar kernel built with the whole network stack compiled out (CONFIG_NET=n), diskless and with no virtual NIC. The cell boots, runs its workload and has no network at all: no /proc/net, no /sys/class/net, no interface. The absence is by construction of the kernel, not a fence that could be climbed, which is finding 02 at the cell-kernel level. Bounded, n=1; the kernel was built on a separate factory and its image hashed. tested · bare metal · n=1 lab52 · 2026-10-20 SMT side channel suppressed by placement Whether placing mutually distrusting cells on separate cores suppresses the SMT contention channel: a victim cell times a fixed workload while an attacker cell thrashes the shared L1, co-located on the sibling thread versus on a separate core. Co-located on the sibling thread the attacker steals about 5 to 6x of the victim's throughput, across three runs; moved to a separate core the effect falls to about 1.1x, near baseline, so placement removes the SMT channel. Timed from the control domain, since the cell's own clock is unreliable. Residual: this measures throughput interference, not a bit-rate, and a cache channel across different cores stays declared. tested · bare metal · n=1 lab53 · 2026-10-20 cross-core cache residual measured How large is the channel between different cores, which share the socket's L3 and which placement cannot separate: a victim chases an L3-resident buffer while an attacker on a separate core streams 32MB to evict the shared L3. The cross-core attacker steals ~1.03 to 1.14x of the victim's throughput across three runs, an order of magnitude below the SMT channel (5 to 6x). It confirms and bounds the declared residual: placement does not remove it, since every core shares the L3, and closing it needs cache partitioning (Intel CAT), absent on this CPU. tested · bare metal · n=1 lab54 · 2026-10-20 control domain reads a live cell Whether the control domain can read a live cell's memory without its cooperation: a victim cell writes a secret it never shares into its RAM and stays alive; the control domain maps its frames and searches. The control domain mapped the cell's frames and recovered the secret from the live cell's RAM. The in-cell signature authenticates what a cell produces but gives no secrecy from the control domain; closing it needs encrypted-memory hardware (SEV-SNP or TDX), declared future. This measures the declared residual as a concrete threat. tested · bare metal · n=1 lab55 · 2026-10-20 the composition: verifier outside dom0 + the hardened gate Whether the five properties hold jointly in one run, not separately: the hardened gate of lab48 embedded into the verifier domain of lab47, so it decides outside the control domain, over a Job, 5 times. 5 of 5 PASS on metal (gate_mode=verified; the verdict emitted by the verifier domain, not dom0): no private key in dom0, the order written by the verifier (dom0's forged orders die by signature), XL-CREATE equals the verifier's PASS, and the mutants denied by the hardened gate inside the verifier (SIGNATURE_INVALID, STALE_EPOCH, NONCE_REPLAY). It turns "each property separately" into "the five jointly". tested · bare metal · n=1 lab56 · 2026-10-21 disposable-cell substrate, measured Instantiation time of a disposable workload cell, PVH against PVH, same captured workload, to inform the substrate choice without deciding it. A trimmed NetBSD-PVH appliance instantiates in about 1.65 s, below the Linux-PVH cell of lab51 at 2.06 s and NetBSD-PV at 3.19 s, each with sum=500500 captured on the console (a result, not just a domain type). GENERIC is a generalist kernel, so a trimmed PVH is still pending and would be fairer on footprint; no substrate is chosen here. tested · bare metal · n=1 lab57 · 2026-10-21 a real KZ-Rump cell under the Gate: existence gating, attested provenance, a non-fabricable medium Whether a real rump-kernel cell's existence is gated by the real Gate, whether the control domain can attest what the cell did, and that it really was a rump cell, without trusting what the cell says. A round of ten agents narrowed the residuals, each result on metal with its own limit. Existence and lineage: a chain of three real rump cells, each hop gated by the Gate under a real signed destruction chain (genesis to DR to DR) with the cell signing in-cell (Ed25519); wrong, stale, replayed or out-of-state evidence is denied by its named reason (PREV_MISMATCH, SIGNATURE_INVALID, WRONG_STATE). Non-fabricable medium, now united with the rump-derived artifact in one run: the control domain dumps the cell's core and re-hashes its physical RAM, catching a cell that lies on its console. Attested provenance, the serious gap closed: an echo cell with no rump that writes the right bytes and fakes the liveness marker passes a bytes-only witness, but is denied once the kernel text hash is sealed in the contract and the control domain re-hashes the core (MISSING_COSIGNATURE). The artifact carries 256 bits of real in-cell randomness, so its non-replicability is not just the clock. Liveness is read from real observations of the live cell, trust is split across three separate processes with their own keys, and eight cells ran gated and concurrent, 8 of 8, with chain and medium each 20 of 20 and no flakiness. Declared residuals, not hidden: the control domain can still read the cell's RAM (the very mechanism of the medium; the fix is encrypted-memory hardware, lab54); verification outside the control domain over rump cells is still open (the split is by process, not yet by domain, and lab55's out-of-domain verification is over the A to B Job, not rump); no single demo unites all the properties at once; small n on one machine, external review still pending. Not proven containment: a rump execution cell gated and attested by the control domain, bounded. tested · bare metal · n=1 fabric mTLS · 2026-10-21/22 mutually authenticated control-plane links, in logic Whether a certificate from the same node CA but a different key can use a cell's CIDs, and whether the pairing is enforced in logic rather than by a transport adapter that could be wrong. The control-plane mTLS (dom0 to dom0 between principals, not the cells) is built and tested as executable code. The peer public key is pinned, sealed in the kaf-control-signed Cell Execution Contract, and the broker compares the verified peer's SPKI in pure logic, so a same-CA certificate with a different key is denied (PEER_KEY_MISMATCH) even when the SAN matches; a per-request signature is checked against the same pinned key, so a broken adapter can only deny, never bypass. The pin is mutual in both directions: the client now also rejects a same-CA impostor server whose key is not the pinned one (ServerIdentityMismatch), so a valid certificate from the right CA is not enough on either side. mTLS suite 22/22, serve 21/21, end-to-end matrix 13/13 with a real handshake (a same-CA impostor closed end to end), broker 71/71, and the fabric regression suites re-ran green (gate 42/42, chain 36/36, observer 14/14, kzsig 15/15). The whole suite, with a real TLS 1.3 handshake, native cryptography and Ed25519 and eight concurrent principals, has since run on the physical control domain (the dom0), not only in a development environment. What did not: both ends ran as one UID in one home directory on the dom0, not as distinct OS principals and not in separate Xen domains, which stays the next tier (the cross-UID harness exists but has not run). A pure-Python TLS layer stood in for pyOpenSSL, which the minimal dom0 does not ship, so production needs pyOpenSSL on the dom0 or the Go port. mTLS is pairwise exclusivity between principals, not confidentiality (the broker still mediates I/O) and not containment (that is Xen and the Gate). The rump cell never terminates TLS; the pin lives at the mediated boundary. tested · logic The strongest results ◆ lab07b · S4.3 A ring between two domU, no dom0 VM · nested 30/30 PASS, CV 2.1%, 60 unique domids, no residue. ◆ lab12 · B1.7 B absent until the order VM · nested · n=1 No trace of B before the order, about 100 ms to the cell being up, hash identical at every step. HMAC v0. ◆ lab13 · B1.8 Three falsifications that held VM · nested STALE_EPOCH after a broker restart (while the journal survives), 0 of 128 foreign grants mapped, nothing committed after a mid-commit kill. ◆ lab17 · T16 An adversarial guest gets nothing VM · nested 289/289 and 289/289 attempts give 0. A_effective is empty in that finite sweep, and nothing is claimed outside it. ◆ lab19 · core The core held on real hardware tested · bare metal · n=1 7/7 verdicts re-run on a physical dom0, 0 residue, the same code as the nested runs. ◆ lab28 · n>1 A delegation tree without amplification tested · bare metal · n=1 About 1958 Gate decisions, 0 amplify, children at the exact edge of the parent envelope. ◆ lab47 · outside control Verification left the control domain tested · bare metal · n=1 The control side held no private key; the order that created the successor was written by the verifier, and a forged one died by signature. ◆ lab48 · the Gate The Gate demands the signature tested · bare metal · n=1 With the harness precondition off, the old Gate accepted invalid evidence and the new one denies it. Two failures, stated plainly lab14. Rump on Xen entered long mode and printed nothing. lab16 fixed the hypercall page and the console ring, and rump now boots, prints and shuts down, which showed boot and shutdown only; lab57 later gated a real rump cell's existence under the Gate and attested it from the control domain on metal, bounded. lab15, F9. With a compromised control-domain stream, fuzzing produced 29 false countersignatures and 56 false DestructionReceipts. That is a failure of the witness's integrity. It sits outside today's threat model because the control domain is trust base, and it still matters: after a later Gate change, the DestructionReceipt is the lineage evidence the Gate requires before creating a successor, and the fuzzer called observer.py directly, so its signing functions fail open on type confusion. The KeyError reachable from the broker (a receipt with no cell_id, observer.py:28) is an availability failure: a crash emits no signature and the Gate denies. lab29 later re-ran this on bare metal with wire-bounded input: the defect reachable over the wire was found again, fixed, and the re-run fails closed with no crash; the in-process family a JSON stream cannot carry (string subclasses, cyclic objects, deep nesting) stays a declared gap. Originality, according to our internal reviews Our internal reviews (not an external audit) were unanimous: partially defensible. No single property is new, since seL4, KeyKOS, Nexus and capDL/EROS have them. Neither is the direction of the evidence alone: in TCU (arXiv 2504.15717), the closest prior work, a successor verifies its predecessor's proofs. What we put forward is the conjunction: existence of a Xen domain governed by evidence observed and countersigned from outside, under a non-amplifiable ceiling. A hostile reviewer will cite Hyperlaunch and DomB, and so do we, with SCITT and Binary Authorization. We do not claim to be first. The consolidated sign-off is prepared and not signed. Only the lab12 chain is backed by the internal reviews. 06 / Evidence · what is missing today 06The gap list. None of these are hidden assumptions. Each has a defined experiment (§08). The cryptographic path inside cells. It has since run end to end inside real cells on bare metal, bounded, and composes across depth and fan-out. Verification has also left the control domain (lab47) tested · bare metal · n=1, with asymmetric keys the control side does not hold, and the Gate itself now demands the in-cell signature (lab48) tested · bare metal · n=1. The lying broker is contained too: a separate witness attests the commit over the real bytes on disk, so a forged COMMITTED creates no successor tested · bare metal · n=1. Concurrent succession. Two Gate decisions before either commits can yield two successors from one piece of evidence. It needs an atomic check-and-activate. The reservation race was closed on metal, bounded: the ledger held Σ(children) ≤ the parent under 48 racing threads with no double reservation, while a persistent check-and-activate in the production control path stays a declared gap. The sequential case is closed. Evidence semantics and expiry. Both are now closed in the real Gate: evidence that is not deterministic external evidence is denied (NO_EXTERNAL_EVIDENCE), and expiry is fail-closed, so a missing or non-numeric monotonic time denies as EXPIRED instead of passing. The unit suites stay green (gate 42/42). tested · logic The control domain as trust base. Rewinding its state, deleting the journal, or feeding the observer a forged stream (F9). It still creates the domains and the lifecycle facts, provisions the public keys the verifier uses (a malicious control domain at boot could hand over a false one) and can inspect the memory of a live cell, so the in-cell signature does not protect against it without encrypted-memory hardware, declared as future. What lab47 closed is the verification leaving it, not these. Scale & physics. Scale, depth n>1, the Gate's adversarial arm under load, a reservation race, the resource fan-out cost and the observed cell boundary have run on a physical dom0, now under strict IOMMU, which denies an unmapped transfer even to host memory (§05). DMA confinement between domains with an assigned device has since been measured on bare metal (lab50). The SMT side channel is now measured too (lab52): a co-located sibling-thread cell steals ~5 to 6x throughput, and placement on a separate core brings it back to ~1.1x; the cross-core cache residual stays declared. Scaling cells across machines is the broker's job, not the hypervisor's: independent Xen dom0s, one per node, each its own local root of trust that signs its own receipts, with the Gate placing cells and no live-state migration. Proxmox and KVM were evaluated for this and set aside, since they would break the PVH cells, memory introspection and the boot artifacts and reset the metal evidence without delivering the scaling; this is a decision, not yet a test. A deliberate scoping choice: the notary outside the control domain The strongest form of this design places the notary, the witness that countersigns what each cell did, fully outside the system it observes. It now runs in a separate domain, outside the control domain, with asymmetric keys and a control domain that only relays bytes tested · bare metal · n=1. It is still a domain on the same physical host, and the mutually authenticated channels (mTLS) of the control plane are now built, mutual in both directions, and run on the physical control domain; the split into separate principals and Xen domains is the next tier. We would rather ship one solid product than ten half-finished ones. On the roadmap · intention · not built We will evaluate a QRNG as an additional entropy source to seed the DRBG, and a public beacon for verifiable freshness of challenges. Neither replaces authentication or key distribution. The architecture now operates under strict IOMMU on a physical dom0, with the cryptographic path running inside real cells, the verification outside the control domain and the Gate demanding the signature itself, all bounded. The sign-off is still pending; DMA confinement between domains is now measured on bare metal (lab50), and the main remaining ask is independent external review, with a persistent check-and-activate in production, mTLS (run on the physical control domain, with the split into separate principals and Xen domains still open) and n of at least 2 still open (the lab47+48 composition has since run on metal, 5/5, lab55); the SMT side channel is now measured and suppressed by placement (lab52). 07 / Why this is attractive, and why now 07Agents made the job the unit of risk. Autonomous AI agents turned every platform into a generator of untrusted, self-spawning work. We do not claim to be the best, or that existing containment is wrong. The claim is narrower: this approach could, if the tests hold, offer stronger protection for agentic work. It reduces the attack surface to what each step requires, and it stacks independent controls: a minimal cell, delegated authority, evidence-gated succession and a witness outside the cell. No single layer carries the whole burden. We lean on mature, underused controls more than on anything exotic. Mutually authenticated channels (mTLS) on every link are an example: decades old, rarely the default, and in Kawésqar now built and tested, mutual in both directions, and run on the physical control domain; what has not is separate OS principals and separate Xen domains, the next tier. When a solid technology goes unused out of unfamiliarity rather than real difficulty, we adopt it. why it lands Structural No policy engine guessing intent: a deterministic Gate that moves only on signed evidence. why now Agentic workloads A compromised step escalating into the next is now a daily operational risk. why defensible A specific conjunction Each piece has prior art (§03), but the combination does not, within our survey. What “it works better” would mean, measurably Target Measured as Status today D1 0 / N amplification under total guest compromise, bare metal, n≥2, asymmetric signatures tested · logic → bare metal · depth>1 · 0 amplify → asymmetric signatures in cells · depth>1 · fan-out D2 100% of Gate conditions load-bearing by ablation on real domains tested · logic → pending metal D3 0 successors without countersigned evidence, including a lying broker tested · bare metal · n=1 D4 Runtime independence with a declared cost envelope (p50/p99), Firecracker as a cost reference only pending 08 / The compute ask 08What we would prove with compute, and what we return. Each item maps to one experiment, a machine budget, a falsification criterion and a deliverable. Most of them have since run on metal, bounded and n=1, so the request now concentrates in three concrete things: hardware with SEV-SNP or TDX to close memory secrecy from the control domain (lab54); a CPU with Intel CAT to partition the shared L3 and close the cross-core cache residual (lab53); and a second, distinct host to reach n of at least 2, plus the independent external review. The table below keeps each hypothesis with its cost and deliverable. NOW nested validation + strict IOMMU · crypto in cells + verification outside control + the Gate demands the signature NEXT physics on hardware external review · partners THEN partners · same standard Fig. 5 · Where we are. The architecture now operates under strict IOMMU on a physical dom0, with the cryptographic path running inside real cells, the verification outside the control domain and the Gate demanding the signature itself, all bounded. DMA confinement between domains is measured (lab50) and the SMT side channel is measured and suppressed by placement (lab52); the main pending item is independent external review, with the cross-core cache residual, n of at least 2, and a persistent check-and-activate still open. From there we hope to work with frontier AI companies and SMEs that hold themselves to the same standard: on compute, physics and independent review. Hypothesis Experiment Machine / time Falsifies if… We return Crypto path holds E2E in cells tested · bare metal · n=1 Asymmetric-signature chain inside real cells, composing across depth and fan-out; the lying broker is contained: a witness attests the commit over the real bytes 1 bare-metal Xen host · ~2 wk foreign, skipped or replayed evidence yields a successor logs, pins, repro script Verification outside the control domain tested · bare metal · n=1 Observer, Gate and notary in a separate domain with asymmetric keys; the control domain relays bytes and holds no private key 1 bare-metal Xen host · done an order fabricated by the control domain yields a successor logs, pins, repro script The Gate demands the signature tested · bare metal · n=1 Contrast on real domains with the harness precondition off: old Gate against new Gate 1 bare-metal Xen host · done invalid evidence yields a successor logs, pins, repro script Escalation denied by the real channel tested · logic Three escalation attempts of a captured cell against the real broker and Gate, with mutants none · host logic the real predicates accept any attempt attempt and mutant verdicts Non-amplification on metal tested · bare metal · n=1 Adversarial guest sweep, n≥2 concurrent cells 1 IOMMU host · ~3 wk any vector exceeds the ceiling attribution matrix, dumps Concurrency is safe tested · bare metal · n=1 Atomic check-and-activate under forced interleavings multi-core host · ~1 wk two successors from one evidence race harness + verdict Strict IOMMU per-device denial, mechanized config-attested · lab20a-strict unclear A direct transfer that skipped the IOMMU mapping path, under strict mode, with a positive control that crosses 1 IOMMU host · rig an unmapped transfer is allowed, or the control fails to cross denial traces with a crossing positive control DMA confined to its own domain tested · bare metal · n=1 partial Cross-domain DMA confinement with an assigned device (lab50, HVM domU; Cells are PVH): confined to its domain, control domain isolated, 0 VT-d faults. The active adversarial cross-domain transfer is open (R-DMA) measured · USB-C controller a malicious in-domain driver reaches another domain lab50 evidence · SHA256SUMS SMT side channel suppressed by placement tested · bare metal · n=1 A co-located sibling-thread cell steals ~5 to 6x of a victim's throughput (lab52); moved to a separate core the effect falls to ~1.1x, near baseline, so placement removes it measured · lab52 two distrusting cells land on sibling SMT threads lab52 evidence · SHA256SUMS · cross-core cache residual declared Independent confirmation pending External security review of method + results reviewer time a material claim does not hold the external report Bare metal is the one thing a VM cannot stand in for, and the cheapest high-signal spend: a single IOMMU-capable host turns the architecture result into a physics result. 09 / Transparency, IP, and reproducibility 09Public results, held mechanism. One policy: results and counts are public; vectors, formats and raw logs are under NDA. public The results Thesis and threat model, results and counts for planes A, B, C and D, the trust-boundary attribution, TLA+ outcomes, integrity pins and this lab log. held · under NDA The mechanism The Gate predicate, the attack vectors, the receipt, launch and observer formats, the full formal model, the raw logs and the reproduction scripts. If you want them, ask: tell us who you are, why you want to read the scripts and logs, and how you want to contribute. We share the evidence need-to-know until the public alpha, when the repositories open to everyone; verified contributors and serious related open-source projects are welcome, and a supporting organization can formalize it with an NDA. On attribution We claim no invention. Most components of the fabric exist in open-source projects and the literature, and we build on years of other people's work. Our contribution is a specific combination and the evidence behind it. We will not claim to be better than anyone until the evidence supports it. Every figure comes from a script with a reproducible verdict. FAILs exit non-zero on purpose (lab14 and lab15 do), and TLC logs are not bit-reproducible, so formal results are checked by verdict. The internal reviews were adversarial and changed this page: they removed an “empirically and formally confirmed” overclaim and forced the plane tags. Risks we are not hiding Dependency on Xen. The guarantee is “modulo a correct hypervisor.” A smaller, more diverse trust base remains research. Bare-metal results are bounded, n=1. What ran on metal ran on one machine, once, under strict IOMMU; strict mode denies an unmapped transfer even to host memory, and DMA confinement between domains with an assigned device is measured (lab50). Two physical limits stay declared, in plain sight, and are now measured: the control domain can still read the memory of a live cell, shown directly when it recovered a secret from a live cell's RAM (lab54), which needs encrypted-memory hardware (SEV-SNP or TDX, future); and a cache channel across different cores, now measured and small (~1.1x throughput interference, lab53), a residual placement cannot remove since every core shares the L3. The SMT side channel is measured and suppressed by placement: a co-located sibling-thread cell steals ~5 to 6x throughput, and a separate core brings it back to ~1.1x (lab52 on metal). Novelty is defensible, not shown unique. The final judgment belongs to external peer review, a funded deliverable. On NetBSD and rump kernels One runtime option uses rump kernels, NetBSD's reusable kernel components. The old Rumprun toolchain has been quiet for years, while the upstream rump code in NetBSD is actively maintained, and neither is load-bearing for us. Runtime independence is a property we test, and the protocol labs ran on Linux cells. We use rump because it works well so far (a rump guest boots under Xen, emits its liveness marker and shuts down cleanly, and in lab57 a real rump cell runs with its existence gated by the Gate and attested on bare metal), and we can drop it without touching the architecture. The full architecture paper (v1.3) and the reproduction package are available under NDA: rodrigo@kawesqar.org. Kawésqar Server · headless · hardened by default · ships first Secured by default. Built as code. A minimal, headless server distribution with its own hardened kernel. Version 0.1 exists today as a bootable image verified in a virtual machine, and the public alpha is where packages rebuilt from source, signed releases and the Server edition of the Agent Fabric arrive. founder and maintainer · rodrigo@kawesqar.org · northern Patagonia, Chile 01 / Today · v0.1 What exists, and where each piece stops. Version 0.1 is a bootable amd64 live ISO of 594 MiB. The maintainer has booted it in VirtualBox to the login prompt and checked it on the serial console. It is not published yet. Everything below was observed on that system or measured in the repository, each number with its limit. The kernel is our own, 6.12.111-kawesqar, compiled from versioned config fragments on the maintainer’s host. A survival gate, kernel-config.sh --verify-config, runs inside the kernel build and stops it if a single hardening symbol is missing from the built .config. GRUB · live medium · 2026-10-02 ▸ Live system (6.12.111-kawesqar) Live system (6.12.111-kawesqar fail-safe mode) Start installer Advanced install options … serial console, first boot Welcome to Kawesqar Secure Linux! LSM: initializing lsm=capability,landlock,lockdown,yama,safesetid,apparmor,ima,evm Reached target multi-user.target Started nftables.service (default-deny ruleset applied) · sshguard.service kawesqar login: █ reconstruction of the QA session. Menu and console rebuilt from the maintainer’s QA notes, 2026-10-02, VirtualBox, amd64. This is not a captured log. v0.1 bootable amd64 live ISO, 594 MiB, verified to the login prompt in a VM by the maintainer. Not published yet VM · maintainer 99/0 hardening symbols alive in the built kernel, none dropped current 8 security modules active at boot, set by lsm= on the kernel command line, not by the compiled default seen at boot 229 packages in the image, none of them dbus. An open decision: without it, systemctl fails for non-root users open decision 124/0 regression assertions of the config gate, run against a fake toolchain. They exercise the gate script current 73 test suites in the repository, all passing. Suites, a different unit from the 124 assertions current 23 architecture decision records: 5 accepted, 18 proposed written What the kernel enforces Lockdown in confidentiality mode, forced. LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY=y. Not even root can read or patch kernel memory from user space. This and the next two lines are the strongest part of the kernel. Module signatures, enforced. MODULE_SIG_FORCE=y. A module without a valid signature does not load. One fixed user-mode helper. STATIC_USERMODEHELPER=y. Every helper the kernel launches goes through one fixed binary, closing a classic route to a root shell. Memory zeroed on allocation. init_on_alloc is on by default, so stale data does not leak into new kernel objects. Also on. Yama, Landlock, AppArmor, SafeSetID, retpoline, page-table isolation and the SRSO mitigation. Core dumps and debugfs are off. On the booted system an nftables ruleset (inet kawesqar) loads with a default-deny policy, and in the maintainer’s test sshguard blocked an address after three failed logins. SSH accepts public keys only. Three hardening levels, base, hardened and blindado, are applied after install with kawesqar-harden and are still provisional. Xen can be installed as a package (Xen 4.20, its own tier in the package policy), although the v0.1 ISO does not include it. Limits of v0.1 Boot is optical or VM only. The kernel has USB_STORAGE=n, so the ISO does not start from a USB stick. No install with LUKS. The kernel has DM_CRYPT=n. On the live medium AppArmor loads 0 profiles. They apply only on an installed system. No Secure Boot. The ISO is not signed, because the DEV key lists are empty. The kernel was built twice, on two independent machines, and compared byte by byte: the 292 modules are identical in code, and the only differences are the per-build module signing key and the Rust compiler version the config auto-detects on one host, which the kernel does not use. Full bit-for-bit identity also needs a pinned toolchain and signing key. The v0.1 kernel does not carry Xen dom0 support, so the packaged hypervisor cannot run on it. A separate kernel variant with dom0 support is what the lab runs on a physical Xen host, and it is not in v0.1. 02 / The alpha · what we are building What the public alpha is meant to carry. Everything in this block is a goal for the public alpha, not something you can run today. The alpha ships Kawésqar Server together with the Agent Fabric, described in the Overview. Where tooling already exists, we say how far it has been run. For the public alpha, every package is rebuilt from source with our own flags: PIE, full RELRO, BIND_NOW, stack protector and FORTIFY 3. Today the image ships three packages of our own, the kernel, the hardening profiles and Ramón. The other 226 are installed as upstream binaries. 01 · the pipeline Fetch, review, harden, build, verify, sign The scripts exist and pass their tests. Real runs do not: the first package fetch is blocked and the clean chroot has only run dry. Verification will compare a second build bit for bit before we call anything reproducible. 02 · the Server edition The host for the Agent Fabric A Server edition for the Agent Fabric, running our own kernel with Xen dom0 support. Xen is an installable package, and a dom0-capable kernel variant already runs the lab on a physical host, scoped and n=1. Bringing it into the Server edition is the missing piece. 03 · updates Updates you can undo One updater, ramon update, with mandatory signatures, snapshots for rollback and human confirmation. kswup, an earlier design descended from swup in Trustix Secure Linux, stays on paper. 04 · ways to ship ISO, OCI image, arm64 The bootable ISO stays the first medium. An OCI base image with the same hardened root is planned, and nothing has been published. arm64 build lanes are decided in writing (ADR-0016), with only a dry-run build so far. 05 · signing Signed releases Checksums and Secure Boot signatures for every release. The signing tools have been tested with throwaway test keys. Nothing has been signed. 06 · the base Small, and grown by role The base will carry about 74 selected packages and nothing more until a role is assigned: server, bastion, administration or incident response. planned · public alpha tooling in tests · no real runs 03 / Ramón A mouse on row one of the console. mechanism with tests, not field-tested Ramón is the console companion of Kawésqar Server, written in Go and already in the v0.1 image: a grumpy mouse that watches the system, speaks rarely and acts only with your approval. It holds no credentials and never hides a security alert. No AI service runs by default; Ramón has an opt-in, default-deny LLM client whose network gate stays closed until you open it. In a measurement dated 2026-10-01, go test passed in 38 packages and two builds on the same host gave an identical binary. Open limit: on the latest test image the watcher restarts in a loop. observe An observer without authority It supervises a coding agent through a customs gate. Every action with an effect needs human approval and leaves a receipt. respond kill · block · lockdown Incident response with chained receipts and a dead-man timer that reverts every lockdown, so it cannot lock you out of your own machine. trust Your own CA A personal certificate authority that issues the mTLS identities the system uses, with revocation lists. packages A package manager Mandatory signatures, snapshots and a receipt for every change. The updater the alpha builds on. 04 / Governance and licence Who decides, and what is still missing. Today One owner. Decisions are written as ADRs, 23 so far and 5 accepted. Nothing counts as decided without one. Patches will carry DEP-3 headers and a Kawesqar-Maturity: label. There are no patches yet. Security advisories will be named KSA-YYYY-NNN. The reporting channel is still pending. The licence is yet to be chosen. It will be set before the public alpha. No download is offered until there is a licence and a reporting channel. Why a server carries these names is told in the Kawésqar tab. Kawésqar Workstation · a system for work · prototype under construction A system for work. Not an office. Console-first and light, for people who work at the machine: sysadmins, cyber-defense, network engineers and hackers. A customized BlackBox, and a Motif edition for the nostalgic. No GNOME or KDE desktop. 01 / Who it is for People who open a terminal first. The server's spine with a screen on it: no suite, no store, no bloat. For the administrator who lives in ssh and tmux, the responder who needs tools and nothing else, the network engineer with many consoles, and the hacker who wants to know exactly what is running. sysadmin · netadmin Terminal-centric Fast, quiet, predictable. The window manager stays out of the way. cyber-defense · response The hardened base The same kernel and security modules as the server, with the user-space profile a defender needs. hackers · researchers Control Every process accounted for. A machine you can reason about on old or new hardware. not for Office use If you need a document suite and a cloud drive, this is not the machine. 02 / Two editions BlackBox and Motif. default Customized BlackBox running Built from blackboxwm 0.77 (MIT), customized with a clean graphical view, deliberately minimal. Runs on the maintainer's workstation; there is no image yet. easter egg Motif 2.3.8 built Built locally from source, not yet a Kawésqar package. The classic Unix look, for those who remember it. Still feels like Unix. never No GNOME, no KDE Deliberately. Not because they are bad, but opposite to what this machine is for. after alpha Full image After the server and fabric alpha, the workstation follows. Kernel choice for laptops is open. 03 / Inherited from the server The same hardened base. By design, once the image exists. The hardening. Same sysctl, PAM, login policy and module loading. Same default-deny firewall. Same security modules at boot. Kernel choice. For laptops, the choice is open. Where hardware allows it, the server's hardened kernel. Where different drivers are needed, a documented choice. The updater. ramon update, signed and with snapshots for rollback, once it reaches the workstation. kswup, the earlier design, stays on paper. Identity. Boot splash, login theme, wallpapers, MOTD, os-release. · / Ramón The same mouse, on the workstation too. Ramón comes with the workstation as well: the same first row in the terminal, the same watch over logs and sessions, the same customs gate for a coding agent. Only in terminals, never in the file manager and never as desktop notifications. It is described on the Server page and is in development for the next release. 04 / Status A prototype under construction. Today it runs on the maintainer's workstation; there is no image yet. Not part of the first alpha. What is built: BlackBox and Motif are working, branding is in progress. Everything else is open. Help welcome Ports, themes, drivers or sessions: places where a contributor makes a visible difference quickly. How we work is in the Overview (§11). Conceived in Chilean Patagonia · a system for work · the shell is the interface. Kawésqar Research · raw ideas · an invitation to critique Nature ran the experiment first. Biology and physics offer mechanisms that have held up under adversarial pressure, with costs we also want to understand. We ask whether eight of them map onto defending computer systems, and a ninth runs the other way. These are raw ideas, written before any literature review. If one of them already exists, we want to hear it. No line is a result, and none is part of the Agent Fabric or its public alpha. The hard limit Everything here is strictly defensive. Each mechanism starts in shadow mode, where it observes and proposes and enforces nothing, and a person approves any consequential action. Industrial systems are only observed. Deception stays passive. Offensive tooling, active retaliation and anything that designs or helps synthesize harmful biology are out of scope. Telemetry is itself an attack surface and can be poisoned. An analogy gives intuition, never proof. → / Nine lines Nine questions, ordered by how soon we could test them. L2, L1 and L3 are the easiest to test. Every line is at design stage, with no code. L9 closes the table because it is a problem line, not a hypothesis. The fourth column lists only where the analogy stops explaining; engineering risks are covered by the hard limit above. Read the table first, then open a card for the biology, a question for specialists and the disciplines we hope to hear from. ID Question in one sentence Natural source Where the analogy breaks What would refute it Status L2 Can an organization’s internal fragility be estimated from its external surface alone: domains, certificates, headers, error behavior? The holographic principle in physics, used only as motivation. Shannon entropy over observable dimensions is not black-hole entropy, and an area bound does not say the interior can be inferred from the boundary. A surface score that does not correlate with the gaps found in deep audits. hypothesis L1 Can dormant, context-conditioned code be forced to reveal itself early by running it in many varied, isolated contexts? Cryptobiosis and selective germination in tardigrades and rotifers. Germination answers a sensed signal and is finite. A digital artifact wakes on a condition an adversary chose, and that adversary can enumerate our lab. No divergence across contexts on known conditioned samples, or the same divergence in benign code. hypothesis L3 Can a defense remember an attack by its behavior instead of its hash, so a variant with a new fingerprint is still recognized? CRISPR-Cas adaptive immunity in bacteria and archaea. CRISPR memory is a sequence, tolerates mismatches, and causes autoimmunity when a spacer targets the host. The PAM is a sequence context, not a credential. A shadow-mode false-positive rate above the target set in advance, or no gain over matching fingerprints. hypothesis L4 Can passive decoys, placed where no legitimate user should be, make automated attackers reveal themselves before they reach anything real? Deep-sea light: the anglerfish lure, the vampire squid’s luminous mucus, Vibrio fischeri signaling. The three uses of light differ: lure, distraction, cooperative signal. Prey habituate and learn to ignore a lure. Decoys that attackers identify and skip, or interactions that turn out to be legitimate. hypothesis L5 Can a defensive posture rise during an attack, outside the code, and fade on its own when the pressure eases? Epigenetics: DNA methylation, histone acetylation, stress memory. Methylation is stable and long-lived, while acetylation is fast and reversible. Inheritance of marks is debated in mammals. Marks that pile up instead of expiring, or restrictions that stall legitimate services more than the attack would. hypothesis L6 Can scattered telemetry become a graded damage signal, answered in milliseconds, without the defense turning on its own system? Nociception: A-delta and C fibers, the spinal reflex arc, the vagal inflammatory reflex. Nociception is not pain. Pain is an experience that can occur without injury, so the analogy covers signaling and reflex only. No setting of the brake cuts self-inflicted damage without missing real attacks. hypothesis L7 Can only the compromised context, such as a session or a process tree, be contained in graded steps while the evidence is kept? Apoptosis: caspases, a point of no return, clean clearance by macrophages. Apoptosis is decided inside the cell, while here an outside policy decides. A cell has no right to privacy; an employee does. A wrongful-containment rate in shadow mode above the limit set in advance. hypothesis L8 Can each node sense stress locally and seal off a compromised segment, keeping the rest of the network alive without a central controller? Fungal mycelium: hyphal fusion, Woronin bodies sealing septal pores, retraction of useless branches. Hyphal fusion relies on genetic self-recognition, while a network has adversaries who forge identity. Woronin bodies exist only in Pezizomycotina. Convergence too slow, or wrongful segmentation too frequent, in a digital twin. hypothesis L9 How do you protect the integrity and privacy of biological computation end to end, from sample to decision? None. The direction is reversed: defense carried into biology. There is no analogy to break. This is a problem statement. Evidence that the pipeline steps are already verifiable end to end. problem line → / The detail Open a line to read the biology. L2 · Inferring internal fragility from the outside In physics. A black hole’s entropy scales with the area of its horizon, not its volume. AdS/CFT, a conjectured duality with strong evidence in anti-de Sitter space, encodes a volume’s degrees of freedom on its boundary. The defensive question. Can the internal fragility of an organization be inferred, without internal access, from its visible surface alone? The hypothesis. The internal bulk, with its topology, sprawl and technical debt, may project measurable perturbations onto the external boundary, so a surface-entropy measure could estimate risk and its rate of change. Where it breaks. This is an analogy and no duality is claimed. The weights must be learned. If a high score does not correlate with gaps found in deep audits, the model is discarded. The question we’d put to you: is there a falsifiable mapping from a boundary observable to an interior property, or is holography only a metaphor here? Who we are looking for: Information theorists, physicists in holography, graph theorists. L1 · Probing dormant code In nature. Tardigrades and rotifers enter cryptobiosis: they suspend measurable metabolism and revive when conditions improve. Tardigrades rely largely on disordered proteins (CAHS and SAHS), with trehalose low or absent in some species. Germination is selective. The defensive question. Can supply-chain code that stays inert through every scan and build, and wakes only in a high-value production niche, be caught early? The hypothesis. Clone the artifact into many ephemeral, deliberately varied, isolated contexts. Legitimate code behaves the same everywhere. Conditioned code forks. Where it breaks. Biological dormancy answers a signal sensed by receptors and is finite. A digital artifact can wait far longer, and an adversary who can enumerate our lab’s contexts can detect or out-wait them. The question we’d put to you: in your systems, what signal most reliably separates true dormancy from slow but live activity? Who we are looking for: Microbiologists of dormancy and extremophiles, astrobiologists. L3 · Behavioral memory of attacks In nature. In bacteria and archaea, CRISPR-Cas captures short spacers from an invader into a genomic memory, and a guide RNA with a Cas protein later cuts matching sequence. A short PAM next to the target helps the system avoid cutting the cell’s own genome. The defensive question. Can a defense remember an attack by its behavior rather than its hash? The hypothesis. Attacks stored as behavioral “spacers”, normalized patterns of low-level execution, with an identity check in the role the PAM plays. Where it breaks. CRISPR memory is a sequence, the opposite of our thesis, and it tolerates mismatches, especially far from the PAM. Spacers aimed at the host’s own genome cause autoimmunity. The PAM is a sequence context that carries no identity. Any such mechanism must begin in shadow mode. The question we’d put to you: where does the specificity versus autoimmunity trade-off sit in real immune systems, and what is the equivalent of a false positive we cannot afford? Who we are looking for: Molecular biologists, immunologists, evolutionary biologists. L4 · Passive decoys In nature. Light in the deep sea does three different jobs. The anglerfish dangles a bacteria-lit lure to draw prey. The vampire squid ejects luminous mucus as a defensive distraction. Vibrio fischeri glows as a cooperative, density-dependent signal in a mutualism with its host squid. The defensive question. Can a defender place passive decoys in opaque digital spaces so that automated attackers reveal themselves before they reach anything real? The hypothesis. Realistic but valueless decoys, such as phantom endpoints and canary credentials, could turn an imminent automated attack into pre-compromise intelligence, much as a lure exploits the prey’s attraction to light. Where it breaks. Only the anglerfish’s lure matches the idea, and prey can habituate and learn to ignore a lure. The decoy must stay strictly passive: it observes, never induces, never strikes back, never holds real funds. Inducement may be illegal depending on jurisdiction. The question we’d put to you: in predator-prey signaling, what separates an honest lure from one the prey learns to ignore? Who we are looking for: Deep-sea biologists, behavioral ecologists, quorum-sensing microbiologists. L5 · Marks of policy that expire In nature. Every cell of an organism carries the same genome, and epigenetic marks decide which genes are expressed without changing the sequence. DNA methylation is stable and long-lived. Histone acetylation turns over fast and is reversible. Cells also keep a memory of past stress. The defensive question. Can infrastructure harden its posture during an attack, without a patch or a redeploy, and return to normal on its own? The hypothesis. Digital marks with context, memory and an expiry, kept outside the code in an auditable store. Marks that block a syscall or a route during an attack follow acetylation and decay quickly. Only standing policy approved by a person follows methylation and lasts. Critical actions go through shadow-mode simulation and human approval. Where it breaks. Inheritance of marks is debated in mammals, where marks are erased in gametogenesis, so replicas that “inherit” restrictions are plain configuration propagation. Overreaction can stall legitimate services, and the marking engine is itself attack surface. The question we’d put to you: in your systems, what makes a mark get erased in time instead of piling up? Who we are looking for: Epigeneticists, stress biologists, researchers of transgenerational inheritance. L6 · Graded damage signaling In nature. Nociception is the detection of harmful stimuli. Fast A-delta fibers report sharp, localized damage and slow C fibers carry a dull signal that forces rest. The spinal cord fires a reflex arc before the brain notices, and the vagus nerve restrains excess inflammation through the inflammatory reflex. The defensive question. Can scattered telemetry become a graded damage signal, answered in milliseconds, without the defense turning on its own system? The hypothesis. Kernel, network and identity sensors emit signals with context. A graph of vital functions weighs where the damage lands. A bounded local reflex isolates a process on high-confidence damage, and a policy layer brakes it. Near a vital function the reflex only preserves evidence and alerts a person. Where it breaks. Nociception is not pain. Pain is an experience and can occur without injury, so the analogy covers signaling and reflex only. An adversary can poison the telemetry or trigger a reflex so the system harms itself, and the vital-function graph is a model that can be wrong. The question we’d put to you: what mechanism stops a protective reflex before it does more harm than the injury? Who we are looking for: Pain neurophysiologists, neuroimmunologists. L7 · Graded containment of compromised endpoints In nature. Necrosis bursts a cell and inflames tissue. Apoptosis is orderly: death receptors or the mitochondrial pathway (BAX and BAK, a point of no return) activate caspases that dismantle the cell, and an “eat-me” signal lets macrophages clear it without inflammation. The defensive question. Endpoint defense swings between a passive alert and drastic isolation. Can only the compromised context, such as a session, a process tree or a token, be sacrificed in a controlled way, keeping the evidence? The hypothesis. A four-step ladder: observe more closely, cut lateral traffic or revoke tokens, kill the process tree, wipe and reprovision. Forensic capture comes before any destructive step, severe steps need policy and human approval, and it acts only on the organization’s own devices. Where it breaks. Apoptosis is decided inside the cell, while here an outside policy engine decides. A fleet-wide false positive can do more damage than the intrusion, an adversary can slowly poison the detector, and a cell has no right to privacy while an employee does. The question we’d put to you: what keeps apoptosis from firing on a false signal without slowing the response to a real threat? Who we are looking for: Cell-death biologists, immunologists, digital forensics and data-protection experts. L8 · Decentralized network self-isolation In nature. A mycelium has no brain. Hyphae branch toward nutrients and fuse through anastomosis, turning a fragile tree into a mesh. Faced with damage, the fungus seals its septa with Woronin bodies, reabsorbs useless branches and reinforces productive routes. The defensive question. When the control plane falls to a DDoS, lateral ransomware or a bad configuration, can the network keep telemetry alive and isolate the compromised segment without destroying it? The hypothesis. Local eBPF sensors let each node detect stress and act without central orders. Encrypted tunnels between verified neighbors keep an out-of-band channel, and routes into the toxic zone are cut while the infected process keeps running, so evidence survives. Policy, a digital twin and, for large changes, a human signature gate each decision. Where it breaks. Hyphal fusion relies on genetic self-recognition, and a network has adversaries who forge identity, so every fusion needs attested identity. Woronin bodies belong to Pezizomycotina, one group of fungi. Autonomous rerouting can create loops, and in industrial networks it would only observe. The question we’d put to you: what tells a hypha to seal one septum and not another, and what does a false positive cost the fungus? Who we are looking for: Mycologists, fungal physiologists, network modelers. L9 · Security for biological computation The problem. Modern biology is a computational science. Sequencers and synthesizers are edge devices, genomic data flows through open-source pipelines, and lab robotics runs on legacy operational technology. The chain from sample to decision is a security-critical interface, and we suspect large parts of it are unprotected. We have not measured that. The defensive question. How do you protect integrity and privacy end to end, against a malformed sequence file that overflows an old parser, a poisoned training set, an over-privileged lab system, or a leak of genomic data that, unlike a password, can never be reissued? The direction. Provenance across the chain, with cryptographic attestation of every transformation. Privacy-preserving computation over genomic data. Guardrails on the AI agents that drive the lab. Defensive throughout, and nothing here touches the design or synthesis of harmful biology. The question we’d put to you: where in your sequencing-to-decision pipeline would a silent integrity failure do the most damage, and what evidence would convince you it had been prevented? Who we are looking for: Bioinformaticians, lab directors, biosecurity researchers. → / How to take part Tell us what makes sense, and what doesn’t. An objection of three lines is enough: which line, what breaks, and what observation would show it. No portfolio and no statement of motivation. We will keep a public register of every objection received and what we did with it, including the lines we withdraw. The working memoranda behind these summaries are shared under the access tiers described in the Vision tab. We would rather hear the objection that breaks an idea than the reasons it sounds nice. Rodrigo Gutiérrez · rodrigo@kawesqar.org · northern Patagonia, Chile The vision · from northern Patagonia The south has the talent. It has lacked the opportunity. Deep technology of this kind is built almost entirely in the northern hemisphere. Systems-security engineering at this level barely exists in Latin America, and it is almost absent from northern Patagonia. Ability is not what is missing. A door is. Kawésqar wants to open one, and wants this new, highly advanced industry to be Patagonia’s own, built here by people from here and not as a branch of someone else’s. Chile Northern Patagonia: where this is built, not where it is shipped to ~10% of Chile’s venture capital reaches deep tech 7% of the country’s 18,300 PhDs work in companies 60% of Latin America’s tech venture capital goes to fintech Sources: IDB Lab, Deep Tech ecosystem diagnosis for Chile, January 2026 (PhDs, 7% and 10%); LAVCA 2025 (60% to fintech). 01 / Why it isn’t here yet The will is here. The ecosystem isn’t. What Chile does not yet have is the ecosystem this work needs: a critical mass of deeply specialized talent and an investment culture willing to back it. The country is intensely centralized, and almost every serious path runs through the capital or abroad. According to IDB Lab, only about 10% of Chile’s venture capital reaches deep tech, which starves the slow, expensive stages between a prototype and a product. Of more than 18,300 PhDs, around 7% work in companies. That the south has the talent is a conviction, and the best proof we can offer is a track record: the person behind this reported maximum-severity vulnerabilities, worked at Trustix in Norway, led cyberdefense in industry at Itaú Corpbanca and builds today from northern Patagonia. See Who is behind this, below. The harder gap: validation Present kernel- and hypervisor-level security to the local market and you spend your time explaining the premise instead of debating the evidence, because few counterparts can judge whether it holds. That is why our first serious interlocutors are international. 02 / Not idealism Anchored to a product. A vision alone is a wish. This one rides on Agent Fabric, aimed at a problem that is global and growing: running untrusted, autonomous AI agents without handing them standing authority. An industry in the south does not have to live on subsidy. It can sustain itself the ordinary way, by building something the world needs to a standard the world can verify. Overview: the execution fabric for untrusted agents. Server: the hardened distribution it runs on. Research: open lines of defense science. 03 / A high bar, on purpose An industry that is hard to stand up overnight. We hold this work to a first-rate international standard, not the bar that often passes for “enough”. Deep security and systems engineering of this kind are not improvised overnight without the knowledge and experience behind them. That difficulty is the point: a demanding field can take root in northern Patagonia and compete globally on its own merits, not on proximity to a capital. 04 / What we build here, concretely An industry, one deliverable at a time. Each piece has its own page, its own evidence and its own maturity label. Agent Fabric: disposable execution cells on Xen, gated by external evidence. Kawésqar Research: open defense science, with a lab for those who come to build. Laboratories in northern Patagonia, with universities and partners who bring equipment first. Talks and hands-on time for young people in vulnerable situations. Horizon What it means State Tested The architecture re-tested on a physical Xen host under the strictest IOMMU mode, with the invariants intact · strict mode denies transfers that were never mapped · the cryptographic path runs end to end inside real cells and composes at depth beyond one · verification ran outside the control domain, with asymmetric keys and no private key on the control side · the Gate itself demands the in-cell signature · a cell without a disk exposes only its console to the host, with zero private memory pages, while a cell with a disk shows its data path as a positive control · a 400-cycle create-and-destroy soak under strict IOMMU shows no leak of IOMMU or grant structures · scoped, n=1, assuming a correct hypervisor tested · bare metal · n=1 Now Kawésqar Server and the Agent Fabric reach the public alpha · the research call is open · evidence is shared with partners who can read it · the SMT side channel is measured and suppressed by placement (lab52): a co-located sibling-thread cell steals ~5 to 6x throughput, a separate core brings it back to ~1.1x; the cross-core cache channel is measured too and small (~1.1x, lab53), left as a declared residual in progress Next main item still pending: an independent external review (n of at least 2 and smaller gaps still open too); DMA confinement between domains was measured on bare metal (lab50) · laboratory infrastructure in northern Patagonia · first talks in public schools of the region planned Later Teams formed from local talent · northern Patagonia as a place deep tech comes from intention The horizon is an intention, not a promise. Each row moves to the product pages only when there is evidence behind it. 05 / Universities, on practical terms We don’t need a badge. We need labs. We are not tied to any university, and we are not here to give courses: there is too much to build. We are open to something concrete. If a university brings what is scarce here, the infrastructure to do real science, with laboratories and equipment up front, we will support it, take part and experiment with the hard, new ideas alongside it. Scientists whose fields might inform system defense are welcome too, and the Research tab is the open call. 06 / Talent where it is overlooked A degree does not make you someone. Our founder and maintainer gives talks to motivate and to show what is possible. Teaching would happen only where a class can change a life: with children and young people in vulnerable situations, who cannot picture a future because nobody at home can pay for university. Their disadvantage starts long before tuition: public schools without a private school’s resources, a society that judges you by how you speak, a system that tells you that without a degree you are nobody. This trade proves otherwise. Here a degree counts for little, and the work does not care about your accent or where you studied. It asks for the self-taught kind of learning, watching, reading, failing twenty times and persisting until it runs. What always worked against you can become your advantage: a lateral way of seeing and the resilience to hold it. That is the talent we most want to find. 07 / Who is behind this We did not arrive yesterday. Our founder and maintainer has 27 years in the field: he helped build pioneering secure-Linux distributions and reported maximum-severity vulnerabilities. The road began with reverse engineering in the 1990s, and the first formal home was Trustix, in Norway: secure Linux, firewalls, infrastructure management and over-the-air updates for mobile devices, a company ahead of its time and a very good school. Later, in industry: security roles at CSC and IBM, and then director of cyberdefense at Itaú Corpbanca, leading six areas. Among them is CVE-2004-0214, a long share-name buffer overflow in Microsoft Windows (Explorer and Internet Explorer), rated CVSS 10.0 and fixed in Microsoft bulletin MS04-037. A flaw of that class could have compromised essentially every Windows system of its time. That history does not make this work flawless. It means the instincts were earned, and there is a public trail you can check instead of taking it on faith. The record is public and it is old. In the early 2000s he reported a remote buffer overflow in the Blue World Lasso web platform (CVE-2002-2118), and in 2005 he found and disclosed cross-site scripting in the “Speaking of Security” blog of RSA, one of the most important security companies in the world, kept in the industry errata. All of that around 2005, when most people had not yet heard the word cybersecurity. We are a small team of motivated professionals and we treat evidence as the final judge: every claim carries where it was tested, and every gap is shown instead of buried. It is built on personal time and limited means, out of conviction. Rodrigo Gutiérrez · linkedin.com/in/ciberdefensa · rodrigo@kawesqar.org · northern Patagonia, Chile 08 / How we work · who we are looking for Open, evidence-first, and built on other people’s late nights. The core is, and will remain, free and open source: a small contribution to a movement we believe in and to the years of work in the software beneath us. Everything we claim has its evidence beside it, for you to read, question, improve or refute with a proof of concept or a well-reasoned argument. Who we are looking for People who like to experiment and can prove what they imagine: kernel developers, Linux and BSD alike; scientists, physicists and biologists whose ideas may map onto system defense; cyber-defense veterans and creative pentesters; anyone who can take an idea and make it run on an old machine. You do not need a title, decades on paper or public recognition. Knowledge, the right motivation and contributions backed by believable evidence are the whole bar. Tell us your motivation, how you could contribute now, and show us some of your work. Early access to the evidence is narrow and need-to-know until the public alpha, when the repositories open and the bar becomes the ordinary one: good work, in the open. For partners and funders Infrastructure, compute credits or financial support are welcome, and supporters are recognized. You get the data behind every claim, the experimental code and the documentation of how each test was run, so you can reproduce it. In return, tell us what you bring, what you expect back and what motivates you. The project is not for sale: the core will be free and open, and that is a commitment, not a negotiating position. Building fast with new tools is a skill we respect. At this stage we present to organizations already working in experimental systems engineering or AI, because explaining how a Linux kernel or an open hypervisor works would use time we need for the evidence. Many products do not hold up on the inside, and this one is judged by what is underneath. The proof of concept is a trimmed, hardened kernel and Xen hypervisor shipped with an untouched baseline to measure against, and its goal is to stand up to a serious frontier agent attacking it. The architecture has been tested nested and then re-tested on a physical Xen host, scoped and n=1, assuming a correct hypervisor. That re-test ran under the strictest IOMMU mode, which denies transfers that were never mapped, and with the cryptographic path working end to end inside real cells and composing at depth beyond one. Verification also ran outside the control domain, and the Gate itself now demands the in-cell signature, two separate results. The cell boundary was also measured: a cell without a disk exposes only its console to the host, with zero private memory pages, and a 400-cycle soak under strict IOMMU leaked no IOMMU or grant structures. The SMT side channel is measured and suppressed by placement (lab52): a co-located sibling-thread cell steals about 5 to 6x of a victim's throughput, and a separate core brings it back to about 1.1x. The cross-core cache channel is measured too and small (about 1.1x, lab53), left as a declared residual since placement cannot remove it. DMA confinement between domains was measured on bare metal (lab50); the main remaining item is an independent external review, with n of at least 2 and a persistent check-and-activate still open. It may not hold, and we will report what happens either way. The name · Chilean Patagonia Kawésqar. A people of the cold channels at the end of the Americas, navigators who knew their territory in depth, one of the hardest climates inhabited by humans. They carried little and knew a great deal. We borrow the name in homage. the fire they carried The channels: a labyrinth of fjords and islands in the Magallanes region of Chile, the Kawésqar’s home waters. · / Who they are The canoe people of the austral channels. The Kawésqar (also written Kawéskar) are an Indigenous people of the Patagonian archipelago of south-western Chile. For thousands of years they lived as nómadas canoeros, canoe nomads: moving through cold, storm-worn waters, fishing, diving for shellfish, hunting sea mammals, and carrying fire with them from one shore to the next. Contact with Europeans began from the sixteenth century, and with full force in the nineteenth and twentieth. Disease and displacement reduced them to a small community, today centred around Puerto Edén on Wellington Island, and the Kawésqar language is critically endangered, held now by only a handful of fluent speakers. With respect We name this project after them in homage, not in ownership. We do not speak for the Kawésqar, we do not formalize their knowledge, and we draw no scientific claim from their culture. If you belong to a Kawésqar community and anything here should change or go, write to rodrigo@kawesqar.org. We will modify or withdraw it at your request. Sources: the Museo Chileno de Arte Precolombino; the Mineduc Programa de Lengua y Cultura de Pueblos Originarios, pueblo Kawésqar; the dictionary work of Aguilera and Tonko; and the state’s La lengua kawésqar. · / How they lived A territory made of water. The Kawésqar lived not on the land so much as between the islands, from the Gulf of Penas to the Strait of Magellan, a maze of channels where it rains most days and the wind rarely stops. the sea · the pantry Fed by cold water Shellfish gathered by women who dived in near-freezing water, sea lions, seabirds and fish: a diet read directly off the coast. knowledge · the real cargo Light boats, heavy knowledge Currents, weather, tides, every cove and its season. What they carried was small; what they knew took thousands of years to accumulate and fit in no container but people. In numbers: about 4,000 people before European contact; 3,448 identified as Kawésqar in the 2017 census, up from 2,622 in 2002; and 2.84 million hectares in the Kawésqar National Park, created in 2018. When What happened What it left From the 16th century European ships enter the channels: explorers, then sealers and whalers. Contact brings disease. A shrinking population 1881 to 1882 Eleven Kawésqar are kidnapped by a sealer and shown in Paris and in Hagenbeck’s travelling shows. Five die in Zurich. Remains of five returned in 2010 1930s The remaining families gather in Puerto Edén, next to a military and air installation, with support and pressure from the state. The end of canoe nomadism; a village that still exists 1993 Law 19.253 recognises the Kawésqar as an indigenous people of Chile. Legal standing; communities in Puerto Edén and Puerto Natales 2017 to 2018 More people identify as Kawésqar than in 2002, and the national park is created over their channels. A people that persists, with a territory bearing their name Figures from Chile’s 2017 census (INE), the park decree and published research on the 1881 exhibitions. We are engineers, not historians; where we are wrong, we will correct it. · / Words we borrow Three words, used with care. Spelled as in the sources above; spellings vary and we are not linguists. The words are a mental model for the people who run the machine, not a claim about a language. kájef The canoe Theirs: the boat that carried a family across the channels. Ours: the base system and kernel, built to carry one job and nothing more. at The hut Theirs: a dome of branches covered with skins or bark, raised at a landing and often left standing for others. Ours: the sandbox, built for one stop and left clean for whoever comes next. Kawésqar Wæs The territory Theirs: the land and waters of the Kawésqar people. Ours: nothing in the system carries it; it is here so the territory is named in their own language. · / Why we honor it To endure a demanding world, fit it. This is our reading of how the Kawésqar endured, not a claim about their philosophy. We see a people who did not try to dominate the channels, and who read their environment with patient, exact knowledge built over thousands of years. How they would put it is theirs to say. From that reading we take a few principles for our own work. A secure system does not get safer by carrying more code, more capability, more standing authority “just in case.” It gets safer by carrying less. carry only what you need Minimal footprint Build each machine for one step, with no capability that step does not require. fit the niche exactly Specialization A form shaped to its task is lighter and harder to break than a general vessel. assume a storm Resilience Design for the storm, not the calm day. · / Where it was conceived Conceived in northern Patagonia. Kawésqar was imagined in northern Patagonia, Chile, under a similar climate, further north along the same coast. That place is the temperament we want for the work: patient, self-reliant, unimpressed by noise, and more interested in what holds up against the wind than in what looks good on a calm day. Our mark is the Southern Cross, the constellation that names the south. If this work keeps the name in the light and sends a few readers to learn about the Kawésqar people and their endangered language, that is part of the point. KAWÉSQAR SECURE LINUX · PATAGONIA OverviewServerWorkstationResearchVisionKawésqar LinkedIn · KawésqarLinkedIn · maintainerrodrigo@kawesqar.org Part of Kawésqar · northern Patagonia, Chile · 2026 · founder and maintainer: Rodrigo Gutiérrez · rodrigo@kawesqar.org · evidence shared · mechanism under NDA · every figure reproducible on request