Furth FortuneM9 reference

Assurance fabric / System overview

Security and Tenancy

Deny-by-default checks at each boundary

Identity, application, data, service, tenant, and device checks each require a declared grant. Passing one check does not bypass the next check.

Inside the system

Architecture plates

Each plate preserves the internal layout, paths, boundaries, and highlighted decisions. Use the short label first, then follow the lines through the system.

Plate 01

Six checkpoints, and the default at each is deny

checkpoint · refusal · the task budget under all of it

CHECKPOINT · THE DEFAULT AT EACH IS DENY REFUSAL · TYPED, RECORDED, NEVER A GUESS 0 · call endpoint admit toolgate.admit(record, token) in toolgate.tri token present, scope subset, provenance member unauthorized · not_callable denied_scope · denied_provenance an omitted scope set is not public, so it denies every caller 1 · namespace root classification expr_ns_id in trident_rt.c returns NS_HOSTVERB or none a root that classifies as none resolves to no C at all UnknownFunction an unregistered root never reaches the host verb hook a forged namespace is a Tier-1 corpus case (ax502) 2 · package namespace closure trident_namespace_require(rt, ns, arena) one exact namespace per grant, never a prefix or a wildcard NamespaceNotGranted NamespaceSourceHashMismatch on a source byte change HostCallbackAuthorityMissing on an undeclared host callback 3 · runtime capability bit rt_has_capability(rt, TRIDENT_RT_CAP_FILE_IO) 11 bits: 4 in _DEFAULT, 7 off until a host grants them CapabilityDenied the bit is read again at each verb call, not cached in a handle code loaded through t.sys.loadScript inherits the same set 4 · scoped path grant io_core_verb_denied(rt, verb, path) read: exact string match. write: contained under a root CapabilityDenied "./README.md" is not the allowlisted "README.md" the terminal branch of the decision returns DENY 5 · host dispatch switch strcmp(name, "ns.verb") in 3 host TUs, 79 verbs each handler validates the WHOLE doc before it applies any UnknownFunction, or a refusal doc an unmatched name falls out of the switch, never dispatches wild a bad doc returns { ok: 0, code } with no partial mutation UNDER EVERY CHECKPOINT · THE DECLARED TASK BUDGET trident_rt_set_task_budget(rt, budget) mem_bytes · op_hard · wall_ns · max_threads OutOfMemory · OpBudgetExceeded · TimeLimit · TRIDENT_BUDGET_EXCEEDED The runaway is torn to a fault state. The host process stays live and a sibling tenant continues.
Plate 02

The sandbox boundary, and what the gate actually proves

reachable set · three gate leaves · the outcome classifier

WHAT AN UNTRUSTED .tri REACHES the t.* surface its sdkVersion pins the host verbs its host registered the namespaces its closure grants the paths its scoped grants name its own runtime state, arena, and budget WHAT IT DOES NOT REACH an unregistered namespace or verb another runtime's state or modules the bytes behind a typed value a path with no grant, by any spelling a neighbour's arena, ops, or wall time ASSURANCE · WHAT BACKS THE CLAIM TESTED the standing gate, per vector MODEL-CHECKED none PROVEN none HARDWARE-ENFORCED none isolation is logical and in-process THE STANDING ADVERSARIAL GATE · gates.d LEAVES trident.conformance.adversarial.adversarial Tier 1, in-language · 27 axNNN_*.tri cases ax0xx type confusion ax1xx integer overflow into an index ax2xx arena use-after-free, task region ax3xx out of bounds, negative length ax4xx unbounded depth, cyclic module graph ax5xx dispatch reachability trident.tests.adversarial-cap Tier 2, C-driven · 8 Surface-2 vectors namespace hijack · non-escalation · traversal revocation · reentrancy · cross-runtime trident.tests.adversarial-dos Tier 2, C-driven · 5 Surface-3 vectors alloc bomb · op bomb · wall-clock spin schema flood · thread flood OUTCOME CLASSIFIER · TIER 1 PASS stdout equals the frozen .expected FAIL/diff the NO_TRAP sentinel: a program that did not trap is a silent-success breach FAIL/crash a signal exit is a real memory breach FAIL/hang a missing termination guard THE POSITIVE TWIN ax207 asserts that a clean task region gives its arena back. ax208 reinstates the escape and asserts the arena DOES grow, so a green ax207 cannot mean the measure went blind.
Plate 03

A capability is (mechanism, tenant, tier, policy)

the tuple · the capability bits · the declared registries · the metering wire

A CAPABILITY IS A FOUR-PART TUPLE mechanism the kernel, verb, or codec in C tenant which Application owns the call tier system, app-admin, normal-user policy the declared row that selects it The mechanism is core and is written once. The other three legs are declared data, so no tenant is compiled in. RUNTIME CAPABILITY BITS · TridentLimits.capabilities IN _DEFAULT · 4 SCRIPT_LOAD · FILE_IO THREAD_CONTROL SCENE_EMBED_INPUT an entered app scene keeps only the last OFF UNTIL A HOST GRANTS · 7 GPU_COMPUTE · APP_REGISTRY · LAST_ERROR APP_DELIVERY · MODULE_WRITE · TEST_CLOCK DEVICE_STORE MODULE_WRITE edits the live source of truth THE HOST GRANTS; A .tri CANNOT trident_rt_set_capability(rt, cap, on) No verb raises a runtime's own capability set from inside Trident, so a denied bit stays denied. THE GRANT IS A DECLARED ROW, NOT A C LITERAL host_capability_registry.tsv 7 profiles keyed by owner, target, runtime role, entry roles, trust class, host variants, readiness facts, and the host capability families it may reach runtime_capability_registry.tsv 6 rules over that profile plus one capability token. The action column is map or deny, and 2 rows deny outright. A readiness fact must be armed to map. the generated header trident_package_runtime_ capability_registry.h The checked TSV files are authority. Do not edit the header directly. CORE C NAMES NO TENANT · THE METERING WIRE IS DATA declared configuration FATHOM_METER_VERB FATHOM_METER_ACK FATHOM_METER_FIELDS one logical=wire pair per dimension meter_wire_resolve, at startup MeterWireCfg owns a whole heap copy of every declared name 10 logical dimension names map here undeclared verb keys leave it inert C computes the dimensions net in, net out, cpu, gpu, storage no tenant verb key in core C no tenant payload field name either an allocation failure refuses the resolve
Plate 04

The tier is per Application, so the grant recurses

one principal, two tiers · the authorship tiers · the scoped grant, N deep

ONE PRINCIPAL · TWO APPLICATIONS · TWO TIERS one principal one MerTek.io identity normal-user @ the app the Application it joined as a user app-admin @ the child app the Application it provisioned THE TIER IS PER APPLICATION The app is the auth boundary, so a user is anon or authed per app. MerTek.io holds the consent and the app holds the profile. A cross-app attachment needs an explicit, scoped consent grant. THE ENDPOINT AUTHORSHIP TIERS system the platform authors it it stays immutable to app users the reserved user.* and shell.* roots app-admin the principals that define the app it carries the edit.* surface edit.validate · edit.validateGeneration normal-user an app endpoint the app's users call an agent reaches this slice over MCP the manifest is registry INTERSECT admit THE SCOPED GRANT RECURSES, N DEEP MerTek.io mints it the developer token carries app.register.self and app.provision.mint the grant token mertek.provision:childAppUid claimHex.mac, an HMAC-SHA256 over the canonical claim bytes MerTekStak validates mertekValidateGrantToken against the seeded key, locally never the flat admin secret the child app parentAppUid grantTokenScope bills to its parent REFUSED, and written to denial_event missing_token · malformed · unknown_kid · bad_mac expired · wrong_scope · deny_no_parent THE BASE CASE IS GENESIS FATHOM_GENESIS_BOOTSTRAP arms MODULE_WRITE beside FILE_IO, runs importBootstrap, then mints the first admin principal.
Plate 05

Declared, or refused: and the declaration is itself gated

three worked refusals · the capability registry · the escape-surface diff

AN UNDECLARED CASE IS REFUSED, NOT DEFAULTED placement policy mertekWritePlacement An empty sceneClass, locality, or embeddability returns deny_missing_field mertekResolvePlacement reports found = 0, and the caller denies. extension install admitInstall, trt_extension_jail.tri EnvelopeMissing · SeedUndeclared GrantsUndeclared · BudgetUndeclared InstallerScopesUndeclared Then the declared grants intersect the installer scopes: narrow, never wide. pixel-stream egress stream_verb_parse_open A missing or empty ladder returns undeclared_ladder A keyInterval below one returns undeclared_keyInterval No stream opens on a guessed ladder. t.capability.* REGISTRY · DECLARE, THEN RESOLVE three resolve modes required an absent fact denies degradeAllowed a named-set fallback optional reports absent, invents nothing three freshness policies staticUntilBuildChange ttl, with an expiry: stale-ttl past it generation, with a generation token 9 fail-closed refusal probes unknown mode · missing capabilityId undeclared provider · missing freshness domain conflict · missing required fact THE DECLARATION IS GATED · trident.tests.escape-surface-review the dispatch set a raw grep of 3 host TUs for strcmp(name, "ns.verb") reached only after an NS_HOSTVERB root a sorted set diff, BOTH ways in dispatch, not reviewed: FAIL reviewed, not dispatched: FAIL a scan that reached too few files FAILS the reviewed set docs/trident/threat-model.md each row names a capability gate, an input contract, a trust assumption

Key parts

What the system does

These are the main boundaries, inputs, outputs, and failure rules. The examples show a specific use of each part.

Layered checkpoints

A request must pass each relevant boundary. Success at one layer does not bypass the next.

Specific example

A signed-in user may open an application but still be denied a data set or device action outside the mission grant.

Scoped capability

Permission combines an allowed action with organization, service level, and policy. This limits broad access.

Specific example

A partner unit can receive read access to a shared track feed without gaining write access to the source mission store.

Declared operating posture

Network, sandbox, and tenant choices are stated and checked. Missing policy is treated as refusal.

Specific example

A workload cannot begin using an undeclared outbound connection simply because the network is reachable.

Uses

Example uses

Pilot questions

What the team must decide

Which boundaries need separate grants

How tenant and mission scope are represented

What refusal evidence may be retained and shared

Request a technical briefing

Connected references

Platform product MerTek.io Open reference Mission foundation Fathom Open reference Mission foundation BenthOS Open reference
Return to the M9 reference library