Guardian-ARM
PQCAnti Regression Mesh
Inward-only defense mesh (anti-regression + cybersecurity)
What is built, and what is ahead
Proven and operating today inside a live production marketplace: the commit and push gauntlets, the 207 hash-pinned replays, the mutation-proven guards, the tamper-evident audit chain, two-of-N approval, and the dead-man quarantine. Red-teamed to a state-level threat model across nine campaigns - swarm concurrency (simultaneous seams at 10x), deceptive-sleeper token-smuggling and homoglyph evasion, kill-switch-chain corrigibility bypass, hybrid post-quantum downgrade, timing side-channels and error oracles - 23 fail-open holes were found and closed fail-loud, with 224 adversarial assertions and a 1,100/1,100 head-to-head shutout all green. Designed and specified, not yet shipped: the drop-in, install-anywhere packaged edition, the always-on autonomic daemon, and the duo-Helm coupling. The deployment witnessed is one; the sector reach is design intent stated as design intent.
The numbers behind it
What it does
Nothing Ships Unproven
Mechanism and limits inside.
Full capability detail - Nothing Ships Unproven
Every commit and every push runs the full gauntlet - type check, lint, an import-graph-selected test slice, a privacy scan, then the entire suite, a production build, and a live attack replay. If any one fails, the change does not ship. The same mesh keeps watching on a schedule after release.
Every Attack Ever Closed, Replayed
Mechanism and limits inside.
Full capability detail - Every Attack Ever Closed, Replayed
207 previously-closed attack vectors are re-attacked against the live system before a single line reaches the shared branch - and the number only goes up. Each fixture is cryptographically pinned, so weakening one, deleting one, or slipping a new one in unnoticed all fail the build.
It Refuses to Be Switched Off
Mechanism and limits inside.
Full capability detail - It Refuses to Be Switched Off
The usual developer bypass switches produce a loud refusal, not a skipped check, and an attempt to swap out its own machinery is detected and aborted rather than silently tolerated.
It Protects Its Own Machinery First
Mechanism and limits inside.
Full capability detail - It Protects Its Own Machinery First
Before it checks your code, it checks itself - the tools, the runtime libraries, its own guard rails, and the package registry configuration - so a compromised build environment cannot wave bad code through.
Two Humans, Not One
Mechanism and limits inside.
Full capability detail - Two Humans, Not One
The actions that could do the most damage need two different people within a bounded window, and self-approval is structurally impossible. A single stolen or coerced administrator account cannot perform them alone.
Silence Is a Signal
Mechanism and limits inside.
Full capability detail - Silence Is a Signal
An attacker holding stolen administrator credentials stays quiet; legitimate administrators do not. Go silent long enough and elevated access freezes itself - and a heartbeat alone never lifts the freeze. Only another human can.
Guards Proven by Breaking Them
Mechanism and limits inside.
Full capability detail - Guards Proven by Breaking Them
A guard is not assumed to work. It is deliberately sabotaged and the system must catch the sabotage, to a measured pass rate, before release. Adversarial review is a standing three-pass ritual, not an annual audit - and findings are re-checked against the running system before anyone acts on them, including our own.
A Published Honesty Floor
Publishes its own capability score - and the incidents-survived count is honestly still zero.
Full capability detail - A Published Honesty Floor
This system publishes its own capability score and refuses to move it by shipping features. Registering more modules moves the number by exactly zero, because the denominator is production incidents survived against a real adversary - and that count is honestly still zero. The score rises when the defense survives an attacker, not when the roadmap does.
Designed Never to Brick What It Guards
The packaged edition is specified to hold the line without bricking the app it protects.
Full capability detail - Designed Never to Brick What It Guards
The packaged edition is specified to hold the line without bricking the application it protects, and never to go dark silently - a design constraint written into its plan before a line of it was built.
Duo-Helm Guardians
The apex is designed to couple with the two soul-gated siblings. Names sealed until release.
Full capability detail - Duo-Helm Guardians
At the frontier, the lineage apex is designed to couple with the two soul-gated sovereign siblings under a strictly one-way, operator-granted permission model: deeper access is always a human act, and the mechanism that can revoke access is structurally incapable of granting it. Names sealed until release.
Who it serves
Caught before it leaves the developer's machine, not in production.
Why this matters for consumer
Most teams find that class of defect in production, from a customer complaint. Here it is caught at the commit, at the push, and again on a schedule after release.
It replaces the manual pre-release checklist and the annual pen-test as the only adversarial signal.
Why this matters for business
Adversarial review becomes a standing three-pass ritual, the administrative audit trail becomes hash-chained so it cannot be edited after the fact, and the highest-damage actions need two humans.
Inward-only in the shipped artifact, designed to run inside your own database, and it under-claims deliberately.
Why this matters for government
The gate stack has no outbound action at all - it acts on the repository it guards and nowhere else, which is what makes it deployable where an active-response tool is not. An evaluator can verify the under-claiming directly, because the vendor publishes the number that makes it look worst.
What it decides, and what you decide
Each gate below is a control enforced in the software itself — not a policy statement about how it should be used.
- Detection and refusal only - the commit and push gauntlets run without asking anyone, and they block
- Scheduled continuous watch on a cron cadence after release
- Nothing beyond detect-and-block happens autonomously
Two-of-N approvalTwo administrators
Required before any highest-blast-radius administrative action. Self-approval is structurally impossible and the approval window expires.
Hardware-key overrideOperator
The strictest gate in the system guards the override path, and it requires a hardware security key on top of two-of-N.
The un-quarantine gateA second human
A frozen administrator cannot self-restore. A heartbeat never lifts the quarantine; another human must.
Autonomy is offOperator
The autonomic capability exists and is inactive. Turning it on is an operator act, not a system decision - and this page does not claim it is running.
Mount depthOperator
Coupling depth is monotone-narrowing: a deeper grant is always a human act, never self-escalation, and the reaper can only downgrade.
The commercial build lockOperator
The packaged, install-anywhere edition does not begin until the operator engages it. It is named, and it is held.
How it is built
- Codebase cybersecurity
- Hash-pinned exploit replay
- Mutation-proven guards
- Two-of-N approval
- Dead-man privilege quarantine
- Operator-gated approvals + tamper-evident ledger
- Self-protecting toolchain integrity
- Runs inside your own database
- Inward-only: acts on the repository it guards, nowhere else
- Un-bypassable commit and push gates
- 207 hash-pinned exploit replays
- Mutation-proven guards
- Two-of-N approval, self-approval impossible
- Dead-man quarantine on silent administrators
Where it came from
Guardian-ARM (Anti Regression Mesh) is the post-next-gen successor to the OAR defensive lineage. Every stage of that lineage is preserved and carried forward, and the apex is designed to couple with the two soul-gated sovereign siblings as the duo-Helm Guardians - two restricted guardian intelligences designed to helm the ecosystem's inward-only defense at the frontier, under a one-way permission model where deeper access is always a human act. Their names remain sealed until release.
The full lineage context - merged ladders and Flagship APEX boundary
The ladder is shown merged with the wider defensive family's: its own rungs run V1 to V4, and the apex below is that family's flagship rather than a rung of this system.
Full lineage detail - V1 Foundation
The mechanical floor: static security gates that run on every commit and block rather than warn. The free tier is the intended commercial line, not yet a fact of the licence registry.
Full lineage detail - V2 Defense Mesh
The eight-phase detection-and-alarm mesh: layered detection with alarm fan-out, and nothing beyond detection and alarm.
Full lineage detail - V2.5 Operational Mid
The pure-logic helper layer — insider-threat approval, supply-chain gating, model-quality drift, formally verified money arithmetic, and push-based watch. Written as side-effect-free logic, and it named its own debt: half of it had no caller yet.
Full lineage detail - V3 ELISH A-D — Auto Defender
The Quirk Factor substrate and the full orchestrator together - the Auto Defender the earlier layers were missing - resolving and dispatching defense compositions through a tamper-evident decision log. The orchestrator arrives here, and it ships dormant: planning and enacting nothing until armed.
Full lineage detail - V4 Detachable Engine — LifeForce
The detachable commercial engine — a portable, licensed engine that installs into your own database, with a conservation-law monitor watching for silent state divergence. Designed and specified; not yet built.
Full lineage detail - Apex Singularity
The flagship of the wider defensive family, shown here because the two ladders are presented merged. It is deliberately versionless - built to its own floor, under its own control, and the flagship regardless of what ships after it. It is not a rung of this system's ladder and it does not ship inside Guardian-ARM.
What is running inside it
Every row below is attributed to this system alone and carries the state it is actually in — installed, present in source, or an honest seam.
The 18 technologies inside this system, each with the state it is actually in
- Installed
- present and in use in this system's own tree.
- In source
- present in source; not installed, or behind a try/except. Not a shipped capability.
- Seam
- an honest, fail-closed seam. No implementation is wired behind it.
Hash-pinned exploit replay, content-locked
InstalledEvery previously-closed attack is re-attacked against the live database before a line reaches the shared branch, and each fixture is pinned by content - so weakening one, deleting one, or slipping a new one in unnoticed all fail the run.
Import-graph test selection
In sourceThe gauntlet selects its own test slice by walking the import graph outward from the changed files. A graph search, not a model.
Two-of-N approval, self-approval structurally impossible
In sourceThe highest-blast-radius actions require two different humans inside a bounded window, and one account cannot satisfy both roles.
Dead-man quarantine of elevated privilege
In sourceElevated access freezes itself after a silence window, and a heartbeat alone never lifts the freeze. Only a second human can.
Tamper-evident audit chain
In sourceAdministrative actions are sealed into a chain where a later edit, deletion or reordering is detectable rather than merely discouraged.
Mutation-proven guards
In sourceA guard is not assumed to work: it is deliberately sabotaged and the system must catch the sabotage to a measured bar before release.
Self-protecting toolchain integrity
In sourceBefore it checks your code it checks itself - the tools, the runtime libraries, its own hooks and the package registry configuration - so a compromised build environment cannot wave bad code through.
Published capability floor that refuses to move
In sourceThe system publishes its own capability score and registering more modules moves it by exactly zero, because the denominator is production incidents survived against a real adversary - and that count is honestly still zero. Its own documentation states plainly that the substrate is live while the operational layer is dormant by design.
Cumulatively counted rejection discipline
In sourceIts own review discipline records every rejection it issued against itself and carries the running total forward rather than resetting it per release, so the count can only ever embarrass its author.
ML-KEM (FIPS 203) — Kyber
InstalledEncaps/decaps shared-secret matches; a tampered ciphertext fails. Verified green.
ML-DSA (FIPS 204) — Dilithium
InstalledHybrid Ed25519 + ML-DSA: tampering either half fails, and post-quantum downgrade is rejected fail-closed.
SLH-DSA / SPHINCS+ (FIPS 205)
InstalledWinternitz one-time signatures: valid verifies, tamper / wrong-key / forgery all fail, and the one-time limit is documented.
FN-DSA / Falcon (FIPS 206)
InstalledSign/verify passes; a tampered message fails. Verified green.
Ed25519 · RFC-6962 Merkle · SLSA provenance
InstalledEd25519 sign/verify; a Merkle transparency log where forged roots and in-place rewrites fail; and a provenance gate that denies bad builder/source/signature/transparency, each fail-closed.
Hash-based signatures · SHA-256 chains · Shamir (quantum-immune)
InstalledWinternitz one-time signatures, collision-free canonical encoding, and information-theoretic secret sharing — no number-theoretic assumption to break.
Split-conformal · ACI · Martingale · CUSUM · GCRA · CRC
InstalledPer-class quantiles, adaptive conformal inference, martingale change detection, and rate-limit/risk-control proofs — drift defense that fails closed.
Runtime-verification · metamorphic · N-version · corrigibility
InstalledNon-low risk is gated behind an irrevocable latch; a metamorphic oracle catches bugs label-free; N-version consensus fires on divergence; and re-arm replay ratchets hold.
Ed25519 BFT quorum · scrypt sessions · per-IP limit · site shield
InstalledN-of-M quorum intersection, timing-safe expiring sessions, an 11th-attempt 429, and a default-deny, subdomain-aware shield.
How to reach it
Guardian-ARM
Releasing 8.31.2026 - join the waiting list for defense-system access.