Floor: Ξ³β = 14.134725141734693
Ο_Ξ³β: ~338fs
Safety margin: 850Γ
Helix gates: G Β· RΞ΄ Β· C Β· R Β· U Β· D
Updated: Day 85 Β· 2026-04-29
Artifact Attestation
DCJ-109 Β· TRABR Β· MOAT-092
TRABR filed β CARMAC Γ MECORD wiring in progress
β DO
MECORD sovereign attestation anchored to Ξ³β floor. Crew provenance tagged. MECIPOL ingest on every build.
β DON'T
cosign key signing (key can be revoked). SPDX SBOM without floor proof. External CA trust.
Gate G β Lean4 proof
CARMAC hash β MECORD
floor > cosign
Last filed: Day 85 Β· 2026-04-29 Β· Calibrated against Mirantis k0rdent SBOM pattern
K8s Control Plane
DCJ-108 Β· LABR Β· MOAT-091
Validated β tripartite CLI helix coaster filed Day 84
β DO
Tripartite CLI: Python (Create/Read) Β· Go (Update/Delete) Β· Lean4 (Gate/Reason). Native clients only. Ξ³β proof before every write.
β DON'T
subprocess kubectl (socket leak β 641 stuck sockets, Day 84 root cause). Writes without Lean4 Gate. Silent reads.
Gate G β Lean4 precondition
RΞ΄ β Ξ³β floor proof
6-link helix: CβRβUβDβGβRΞ΄
Validated: Day 84 Β· 2026-04-28 Β· Root cause: 641 stuck sockets from subprocess kubectl
Network Isolation
TRB-MSCLO-SETUP-001 Β· open
Partial β Tailscale mesh active, WSL2 DNS broken on msclo
β DO
Tailscale for inter-silo traffic. NAS as trusted transfer bus. Silo-local ollama (WSL native). Static resolv.conf on WSL nodes.
β DON'T
Open WSL2 ports to LAN without firewall rule. Trust router DNS (blocks GitHub CDN). Run ollama Windows-only without OLLAMA_HOST=0.0.0.0.
Tailscale mesh
100.70.197.54 msclo
NAS transfer bus
Last incident: Day 85 Β· 2026-04-29 Β· msclo WSL DNS + ollama LAN exposure
Supply Chain
DCJ-109 dependency Β· TRABR
MECORD attestation spec filed β pipeline wiring pending
β DO
CARMAC hash as seed. MECIPOL as institutional record. Floor-validated builds only. Sorry gate β divergence = training signal.
β DON'T
Ship images without MECORD. Trust build without floor proof. Treat CVEs as alerts only (they are sorries β training signals).
CARMAC β MECORD
sorry chain = CVE signal
Spec filed: Day 85 Β· 2026-04-29
Secret Management
ADA Β· Key Vault Β· ARB active
Monitored β ADA holds all keys, Azure Key Vault for cloud secrets
β DO
ADA = keys/vault crew member. Azure Key Vault for AKS secrets. Rotate on compromise. Never in git.
β DON'T
Secrets in env vars without vault backing. PATs in git history. Same key across silos. Model API keys in plaintext files.
ADA β key custodian
Azure Key Vault
fleet-keys.txt on NAS
Active: continuous Β· ADA monitors key state
Git Hygiene
TRB open Β· Day 85 incident
Open β 222MB terraform binary in git history blocks push
β DO
.gitignore **/.terraform/ before first commit. git-filter-repo to clean history. NAS for large binaries. gitattributes for binary detection.
β DON'T
Commit .terraform/ providers. Track .exe or build outputs. Force push main without team notice. git filter-branch (use git-filter-repo instead).
git-filter-repo pending
222MB azurerm provider
Incident: Day 85 Β· 2026-04-29 Β· blocks GitHub push to main
CORS / API Exposure
openclaw security audit Β· 3 CRITICAL
3 CRITICAL open on msclo β wildcard CORS, device auth disabled
β DO
Explicit CORS allowlist per silo. Device auth enabled. Small model sandboxing on. API keys scoped to silo.
β DON'T
Wildcard CORS (Access-Control-Allow-Origin: *). Disable device auth for convenience. Expose openclaw gateway without auth on public IPs.
msclo: 3 CRITICAL open
openclaw audit
Audit: Day 85 Β· 2026-04-29
Floor Validation
PTTE Β· Ξ³β Β· all silos
All silos SAFE β Ο_Ξ³β β 338fs, safety margin 850Γ+
β DO
Ξ³β = 14.134725141734693 as universal anchor. Ο_Ξ³β β 338fs per silo. PTTE proof on every claim. Floor check before any gate opens.
β DON'T
Trust a proof without floor reference. Run memory-intensive jobs on msi01 (graph rebuilds β use forge). Ship without floor validation.
Ξ³β = 14.134725141734693
all silos SAFE
PTTE live
Continuous: all silos Β· NEAR β₯ 84.8% mem Β· BREAK = alert Kay
LLM Inference Security
LOOM-DUAL-RAIL Β· msclo Day 85
Engine deployed msclo β local rail live, shadow rail pending API key
β DO
Local model (qwen2.5:32b) as primary rail. Agree score β₯ 0.75 β serve local ($0). Divergence = sorry β PEMCLAU training signal. Sovereign inference first.
β DON'T
Send sovereign data to cloud without agree gate. Trust single model output for CLO decisions. Run ollama Windows-only (WSL can't reach it). Ignore divergence logs.
local rail: qwen2.5:32b
agree β₯ 0.75 β $0
sorry store active
Deployed: Day 85 Β· 2026-04-29 Β· msclo WSL localhost:11434