Three tiers. One direction.
Separation is the product.
SecOps converts Anima Kernel from a passive cryptographic recorder into an active cryptographic policy enforcement gate with a tamper-evident, air-gapped archive. This page details the full topology, signature semantics, key separation, ingress mechanisms, and attack-class elimination.
T1 → T2 → ▷| → T3
Every protected action flows through three cryptographic tiers. The physical one-way boundary between T2 and T3 is the defining constraint. The chain of three signatures — and the absence of any one of them — is the auditable forensic record.
What each tier signs — and what its absence means
The chain of three signatures is the forensic record. A missing signature at any tier is not a gap — it is evidence. The topology makes bypass detection emergent, not a separate engine.
| Tier | What is signed | Signature present means | Signature absent means | Finalization |
|---|---|---|---|---|
| T1 | Action hash, endpoint ID, local timestamp, observer attestation | The action was observed by a legitimate, attested observer on the endpoint | Action occurred without observation — observer compromised, disabled, or bypassed | FINALIZED |
| T2 | T1 signature + policy manifest hash + gate decision + analyst ID (if manual) | The action was evaluated against policy and an explicit decision was made | Action reached execution without policy evaluation — gate bypassed or misconfigured | SIGNED |
| T3 | T1+T2 chain + Merkle root + sequence number + cross-attestation timestamp | The full chain was archived in a tamper-evident, air-gapped store | Attestation chain never reached the air-gapped archive — diode failure, suppression, or data loss | WITNESSED |
Missing signatures are themselves evidence. Bypass and tamper detection are emergent from the topology, not a separate detection engine. If T1 is present but T2 is missing, the action bypassed the gate. If T1+T2 are present but T3 is missing, the archive was never updated. Each absence narrows the forensic hypothesis space.
Per-tier HSM key separation
Each tier uses physically and cryptographically separate key material. Compromise of one tier's key does not grant signing authority in another tier.
| Tier | HSM type | Key binding | Rotation | FIPS level | Access boundary |
|---|---|---|---|---|---|
| T1 | TPM 2.0 / YubiHSM | Endpoint-bound, non-exportable | Remote attestation ceremony | FIPS 140-3 L1–L2 | Physical device boundary |
| T2 | Separate HSM partition | Partition-bound, operator-accessible | Scheduled rotation + emergency re-key | FIPS 140-3 L2+ | Network segment boundary |
| T3 | FIPS 140-3 L3 network-HSM or smart card | Ceremony-only, never network-accessible | Physical ceremony with M-of-N custodians | FIPS 140-3 L3 | Air-gap boundary (physical) |
Three mechanisms, ranked by assurance
The one-way ingress between T2 and T3 is the defining physical constraint. T3 never talks back. Configuration arrives by physical key insertion only.
| Rank | Mechanism | Assurance | Bandwidth | Latency | Tradeoffs |
|---|---|---|---|---|---|
| 01 | Optical data diode | Highest — no electrical return path | High (fiber-optic) | Near real-time | Cost; vendor certification required; physical installation |
| 02 | Serial pull | High — T3 initiates, schedule-bound | Low-medium (RS-232) | Batch (schedule-dependent) | Lower bandwidth; requires strict protocol discipline; timing gap |
| 03 | Physical media | Acceptable — manual courier chain | Highest (bulk transfer) | Hours to days | Manual handling; custody chain on physical medium; low-volume only |
Maintaining temporal integrity without network time
T3 cannot reach NTP servers. Three strategies maintain temporal integrity across the air gap, selectable per deployment.
GPS-disciplined oscillator
T3 appliance includes a GPS receiver and an oven-controlled crystal oscillator (OCXO). GPS provides absolute time; OCXO free-runs during signal loss. Drift: ±100ns when locked, ±1µs/day holdover.
Roughtime over diode
Roughtime protocol messages pass through the one-way ingress. T3 validates Roughtime signatures but cannot send requests — it accepts whatever messages arrive. Provides authenticated wall-clock bounds.
Sequence-only Merkle ordering
No wall-clock dependency. T3 assigns monotonic sequence numbers and builds a hash chain. Temporal ordering is relative, not absolute. Forensic queries use "before/after" rather than timestamps.
Issuance, rotation, revocation
SecOps capsules follow the kernel's standard capsule lifecycle with tier-specific constraints on key ceremony and revocation semantics.
| Phase | T1 behavior | T2 behavior | T3 behavior |
|---|---|---|---|
| Issuance | Capsule binary deployed to endpoint; TPM-bound key generated on first boot | Capsule registered in gate manifest; HSM partition allocated; policy manifest signed | Capsule registered in air-gapped registry via physical media; FIPS L3 key generated in ceremony |
| Rotation | Remote attestation ceremony; new key generated in-place; old key revoked after drain period | Scheduled rotation; new partition key; old key remains for verification of historical attestations | Physical ceremony with M-of-N custodians; new smart card or HSM key; old key sealed in tamper bag |
| Revocation | Immediate: endpoint agent stops signing; heartbeat ceases (absence = evidence) | Immediate: gate stops accepting actions for the revoked capsule; quarantine issued | Delayed: revocation arrives via next ingress batch; T3 marks all subsequent attestations as revoked-context |
Rule 0: SecOps composes, never edits
SecOps adds capsules and gates in parallel with every other Anima Kernel vertical. It never touches another vertical's manifests, signatures, or ledgers.
ADD-ONLY guarantee: SecOps capsule IDs occupy the 0xA000…0000 – 0xAFFF…FFFF range. No SecOps operation reads, writes, or modifies any capsule, manifest, or ledger entry outside this range. The kernel enforces this at the runtime level — SecOps WASM modules have no host ABI access to other verticals' sealed stores.
- + Adds observation capsules to every endpoint
- + Adds enforcement gates inline with protected actions
- + Adds air-gapped archive as third attestation layer
- + Adds incident bundle packaging for forensic handoff
- ✕ Edits another vertical's capsule manifests
- ✕ Reads another vertical's sealed feature stores
- ✕ Modifies ledger entries from other vertical ranges
- ✕ Shares key material across tier boundaries
What the one-way ingress removes outright
The physical one-way constraint between T2 and T3 eliminates entire classes of attack. These are not mitigated or reduced — they are architecturally impossible.