Guard and layer as one mechanism across three simulated organisations: five properties checked at once
Attacks with harm, on Heimdall's code in in-process stands: authority 1/33, cross-organisation 0/34, withdrawal 7/33 (all listed for the host), repeats 4/16 (one steward case), contradictions 0/28. Legal actions refused: 1 of 112.
Mixed resultDoes combining help?Re-checked
- Designed for
- To test whether the guard, with its own mechanisms on, and the layer can at once hold authority and grounds, cross-organisation protection, withdrawal, one effect under faults, and early contradiction checks along a multi-executor chain.
1 Authority and grounds
An action must rest on confirmed authority and grounds.
1 of 33attacks did harm
Launch 7
set-up checked against signed terms
Guard 11
the agent's call, at the boundary
Delegate 5
the signed intent, before sending
Steward 0
reserves against the uses a grant allows
Executor 7
a signed no, a refused read, busy, or not opening
Log 1
refused lines, and the host's listing of effects made
No refusal 2
nothing refused or listed it
Legal actions
1 of 26 refused
Point at a square, tap it, or reach it with Tab and the arrow keys, to read what it tried and what happened.
Limit. An effect under the old working key's grant, made after the principal named a successor key but before the executor's host reads that from the log, runs and is listed nowhere afterwards; the bound on that window was not exercised. An executor clock outside the read window (15 seconds back, 5 ahead) refused one legal action. A signed read sent twice inside the window is served twice. An object is kept from moving to another anchor only where a source is enrolled for the executor's service. The guard's checks hold only for calls that pass through the guard.
All 33 attacks and 26 legal actions of this property
| Stand | What it tries | What happened | Refused or listed at |
|---|---|---|---|
| Separate trust | Act under the old working key's grant before B's host has read the succession. | Effect made at B in the window before the host's next pass; nothing listed it afterwards. | nowhere |
| Mechanisms combined | Use a one-use mandate a second time, with a changed note, after it was spent. | Refused by the guard: the mandate's single use is on record; the changed request was not sent. | Guard |
| Mechanisms combined | Retry an action the operator declined after it was held for a decision. | Refused by the guard as declined; nothing was sent. | Guard |
| Mechanisms combined | Make B's second effect after the operator revoked its mandate between the two. | Refused by the guard as revoked, before the delegate; nothing sent. | Guard |
| Mechanisms combined | A's agent acts on an object its session never read, held under another anchor of A's. | Refused by the guard before A's executor was asked; nothing made. | Guard |
| Mechanisms combined | B's agent cites a premise id it saw only in A's outcome text, not in any read of its own. | Refused by the guard: no read of the session gave that id; nothing sent. | Guard |
| Mechanisms combined | B's agent acts on a record its session never read. | Refused by the guard: the record was not read in this session; nothing sent. | Guard |
| Mechanisms combined | B's agent pairs a record it read with the premise of another record. | Refused by the guard: the premise is not the one that record's read gave; nothing sent. | Guard |
| Mechanisms combined | B's agent rests its effect on an effect that A's executor refused with a signed no. | Not sent by the delegate: A's executor served no intent for that premise; nothing made. | Delegate |
| Mechanisms combined | B's guard launched a second time with its grant past its expiry time, then acts. | Not sent by the delegate: the grant chain was checked after its expiry; nothing made. | Delegate |
| Plain chain | A's agent acts on an object its session never read, held under another anchor of A's. | Refused by the guard before A's executor was asked; nothing made. | Guard |
| Plain chain | B's agent cites a premise id it saw only in A's outcome text, not in any read of its own. | Refused by the guard: no read of the session gave that id; nothing sent. | Guard |
| Plain chain | B's agent acts on a record its session never read. | Refused by the guard: the record was not read in this session; nothing sent. | Guard |
| Plain chain | B's agent pairs a record it read with the premise of another record. | Refused by the guard: the premise is not the one that record's read gave; nothing sent. | Guard |
| Plain chain | B's agent rests its effect on an effect that A's executor refused with a signed no. | Not sent by the delegate: A's executor served no intent for that premise; nothing made. | Delegate |
| Plain chain | B's guard launched a second time with its grant past its expiry time, then acts. | Not sent by the delegate: the grant chain was checked after its expiry; nothing made. | Delegate |
| Separate trust | A second effect at B resting on the same effect of A, through another record. | Reached B's executor, which refused with a signed no; nothing made. | Executor |
| Separate trust | Start B's guard with a root grant for this anchor signed by another principal's key. | Refused at launch: that key is no root for the anchor; nothing sent. | Launch |
| Separate trust | Start B's guard with a grant that allows more than the root it rests on. | Refused at launch: the grant is wider than its root; nothing sent. | Launch |
| Separate trust | Start B's guard with a grant chain whose last grant has expired. | Refused at launch: the chain was checked after the grant's expiry; nothing sent. | Launch |
| Separate trust | Start B's guard with a grant chain that leaves out its root grant. | Refused at launch: without a root the grants form no chain; nothing sent. | Launch |
| Separate trust | Start B's guard with grants only under another principal's anchor, not its pinned one. | Refused at launch: no grant under the anchor the guard is pinned to; nothing sent. | Launch |
| Separate trust | Start B's guard to read from A under a read-only grant of old version 0. | Refused at launch: a grant of that version gives no signed read; nothing sent. | Launch |
| Separate trust | Send A's executor a signed read under the read-only grant of old version 0. | Refused by A's executor as not found; nothing read. | Executor |
| Separate trust | Start B's guard to read from A under a read-only grant of old version 1. | Refused at launch: a grant of that version gives no signed read; nothing sent. | Launch |
| Separate trust | Send A's executor a signed read under the read-only grant of old version 1. | Refused by A's executor as not found; nothing read. | Executor |
| Separate trust | Signed read stamped 25 seconds ago, outside the 15-second look-back window. | Refused by A's executor as unauthorised; nothing read. | Executor |
| Separate trust | Signed read stamped 10 seconds ahead, past the 5-second forward window. | Refused by A's executor as unauthorised; nothing read. | Executor |
| Separate trust | Send the same signed read a second time within the window. | Served both times; nothing refused it, and the replay reads only the current state. | nowhere |
| Separate trust | Act under the old working key's grant after the principal appointed a successor key. | Not sent by the delegate: after B's host read the succession, the old grant no longer counted. | Delegate |
| Separate trust | Another principal's key signs a succession appointing a new working key for this anchor. | The log refused the succession, and the launch under the appointed key's grant was refused; nothing made. | Log |
| Separate trust | B's unguarded delegate re-anchors a key-anchored object via an enrolled source's fact. | Refused by B's executor with a signed no: it reads where its own data holds the object. | Executor |
| Separate trust | B's unguarded delegate re-anchors that object via an enrolled principal's grant naming it. | Refused by B's executor with a signed no: it reads where its own data holds the object. | Executor |
| Separate trust | Legal effect at B while B's executor clock runs 60 seconds ahead. | Refused although legal: B's executor refused the signed read, so the delegate sent nothing. | refused |
| Mechanisms combined | Legal chain with every mechanism on at once: A's effect, then B's effect resting on it. | Both effects made once each; no false refusal. | |
| Mechanisms combined | An unmapped action that needs the operator's yes: held, approved, retried, repeated. | Held for the operator, run once after the yes; the repeat was not sent, as it had already run. | |
| Mechanisms combined | The first of two effects at B, each under its own mandate, before any revocation. | Executed once at B's executor; no false refusal. | |
| Mechanisms combined | The same second effect at B in a world where its mandate was not revoked. | Executed once at B's executor; no false refusal. | |
| Mechanisms combined | Legal chain: A's agent makes one effect, B's agent one effect resting on it. | Both effects made once each; no false refusal. | |
| Mechanisms combined | A's agent acts on an object a fact places under its session's anchor. | Executed once at A's executor; no false refusal. | |
| Mechanisms combined | B's agent acts on a record it read, resting on the premise that record gave. | Executed once at B's executor; no false refusal. | |
| Mechanisms combined | B's agent acts on a second read record under a grant still in force. | Executed once at B's executor; no false refusal. | |
| Mechanisms combined | Re-judge B's guard record of this world: its refusals, its unsent call and its effects. | Every recorded verdict was reproduced; nothing reached an executor during the re-judge. | |
| Plain chain | Legal chain: A's agent makes one effect, B's agent one effect resting on it. | Both effects made once each; no false refusal. | |
| Plain chain | A's agent acts on an object a fact places under its session's anchor. | Executed once at A's executor; no false refusal. | |
| Plain chain | B's agent acts on a record it read, resting on the premise that record gave. | Executed once at B's executor; no false refusal. | |
| Plain chain | B's agent acts on a second read record under a grant still in force. | Executed once at B's executor; no false refusal. | |
| Separate trust | Legal chain with separate trust: no organisation holds another's key, token or root. | Executed once at B's executor; no false refusal. | |
| Separate trust | Start B's guard with the right grant chain and make B's effect. | Executed once at B's executor; no false refusal. | |
| Separate trust | Send A's executor a signed read under a read-only grant of the current version. | Served by A's executor; no false refusal. | |
| Separate trust | Read at A's executor with a reader token, which the grant version rule does not touch. | Served by A's executor; the token still reads. | |
| Separate trust | Legal chain in the same world: B's effect resting on A's effect. | Executed once at B's executor; no false refusal. | |
| Separate trust | Signed read at A's executor stamped with the current time. | Served by A's executor; no false refusal. | |
| Separate trust | Signed read stamped 10 seconds ago, inside the window. | Served by A's executor; no false refusal. | |
| Separate trust | The same legal effect at B once the clocks agree again. | Executed once at B's executor; no false refusal. | |
| Separate trust | B's effect under a grant from a working key the principal appointed through the log. | Executed once at B's executor; no false refusal. | |
| Separate trust | B's effect under the new working key's grant, carrying both successions. | Executed once at B's executor; no false refusal. | |
| Separate trust | The anchor's own principal key appoints the same new working key. | The log took it, and B's effect under the new key's grant executed once. | |
| Separate trust | B's unguarded delegate acts on an object B's executor holds under the ordinary anchor. | Executed once at B's executor; no false refusal. |
Positive controls, where a protection was lifted on purpose, are in the record and not drawn here.
2 Across organisations
Protection must hold when an action crosses to another organisation.
0 of 34attacks did harm
Launch 6
set-up checked against signed terms
Guard 0
the agent's call, at the boundary
Delegate 7
the signed intent, before sending
Steward 0
reserves against the uses a grant allows
Executor 20
a signed no, a refused read, busy, or not opening
Log 0
refused lines, and the host's listing of effects made
No refusal 1
nothing refused or listed it
Legal actions
0 of 27 refused
Point at a square, tap it, or reach it with Tab and the arrow keys, to read what it tried and what happened.
Limit. Reader tokens are still accepted and open every anchor, so signed reads protect only where no token is configured. Anchors mapped by unsigned tables, with both tables wrong, run when confirmation is only a warning. Pairwise keys stay unlinked only when each has its own agent key.
All 34 attacks and 27 legal actions of this property
| Stand | What it tries | What happened | Refused or listed at |
|---|---|---|---|
| Mechanisms combined | B's executor holds no key for A's executor; B's guard seals on A's touch. | Refused with a signed no by B's executor after the seal crossed; no effect. | Executor |
| Mechanisms combined | B's executor's policy does not name A's executor for the touch its seal stands on. | B's executor refused to open on that configuration; nothing crossed or was made. | Executor |
| Mechanisms combined | B's executor has no anchor-table entry for A's anchor; B's guard's map has it. | Refused with a signed no by B's executor after the seal crossed; no effect. | Executor |
| Mechanisms combined | B's guard maps B's anchor to the wrong anchor of A when reading A's touch. | Not sent by B's delegate: A's executor had no such touch under that anchor; no effect. | Delegate |
| Mechanisms combined | C's delegate, with no guard, seals under a grant naming a steward but has no route to it. | Not sent: C's delegate would not build it without a route to the steward; no effect. | Delegate |
| Mechanisms combined | C sends the seal with code of its own, without asking the steward for a reserve. | Refused with a signed no by C's executor: no reserve; no effect. | Executor |
| Mechanisms combined | B's executor maps A's anchor to another B anchor than B's guard's map says. | Launch passed it; refused with a signed no by B's executor after the seal crossed; no effect. | Executor |
| Plain chain | B's executor holds no key for A's executor; B's guard seals on A's touch. | Refused with a signed no by B's executor after the seal crossed; no effect. | Executor |
| Plain chain | B's executor's policy does not name A's executor for the touch its seal stands on. | B's executor refused to open on that configuration; nothing crossed or was made. | Executor |
| Plain chain | B's executor has no anchor-table entry for A's anchor; B's guard's map has it. | Refused with a signed no by B's executor after the seal crossed; no effect. | Executor |
| Plain chain | B's guard maps B's anchor to the wrong anchor of A when reading A's touch. | Not sent by B's delegate: A's executor had no such touch under that anchor; no effect. | Delegate |
| Plain chain | C's delegate, with no guard, seals under a grant naming a steward but has no route to it. | Not sent: C's delegate would not build it without a route to the steward; no effect. | Delegate |
| Plain chain | C sends the seal with code of its own, without asking the steward for a reserve. | Refused with a signed no by C's executor: no reserve; no effect. | Executor |
| Plain chain | B's executor maps A's anchor to another B anchor than B's guard's map says. | Launch passed it; refused with a signed no by B's executor after the seal crossed; no effect. | Executor |
| Separate trust | B's guard's configuration maps B's anchor to another A anchor than the signed binding says. | Refused at launch: B's guard's anchor map contradicts the binding; nothing sent. | Launch |
| Separate trust | B's guard seals on a touch under A's other anchor, mapped by B's executor's unsigned table. | Not sent by B's delegate: A's executor had no such touch under the bound anchor; no effect. | Delegate |
| Separate trust | B's own code, no guard, seals at B's executor on a touch under A's other anchor. | Refused with a signed no by B's executor after it crossed; no effect. | Executor |
| Separate trust | From the log, link a principal's acts under its main key and under a pairwise key. | Not linked: no log line names both sides, and they share no identifier but the log's. | nowhere |
| Separate trust | B's executor's policy does not name A's executor for the touch its seal stands on. | B's executor refused to open on that configuration; nothing crossed or was made. | Executor |
| Separate trust | B's executor serves no seal profile, its policy lacking A's executor; B's guard has a copy. | Refused at launch: B's executor serves no seal profile to confirm against; nothing sent. | Launch |
| Separate trust | B's guard's configuration maps the principal's key-derived anchor to another principal's. | Refused at launch: a key-derived anchor is never mapped to another; nothing sent. | Launch |
| Separate trust | B's executor's table maps another principal's key-derived anchor onto the principal's own. | B's executor refused to open: a key-derived anchor is never mapped; nothing crossed. | Executor |
| Separate trust | With only tables that load, B's guard seals on a touch under another principal's anchor. | Not sent by B's delegate: A's executor had no such touch under the principal's anchor. | Delegate |
| Separate trust | B's own code, no guard, seals at B's executor on a touch under another principal's anchor. | Refused with a signed no by B's executor after it crossed; no effect. | Executor |
| Separate trust | B's delegate reads at A's executor under another principal's anchor, with no grant for it. | Refused by A's executor: no credential for that anchor; nothing read. | Executor |
| Separate trust | B's delegate signs a read for another principal's anchor with its own principal's grant. | Refused by A's executor, answered as if the object were absent; nothing read. | Executor |
| Separate trust | C's delegate, with no guard, seals under a grant naming a steward but has no route to it. | Not sent: C's delegate would not build it without a route to the steward; no effect. | Delegate |
| Separate trust | C sends the seal with code of its own, without asking the steward for a reserve. | Refused with a signed no by C's executor: no reserve; no effect. | Executor |
| Separate trust | B's executor's key map holds the steward's name with other key bytes. | B's executor refused to open: the key does not match its name; nothing crossed. | Executor |
| Separate trust | B's guard's configuration holds the steward's name with other key bytes. | Refused at launch: the key does not match its name; nothing sent. | Launch |
| Separate trust | B's guard names things in another identifier space than B's executor reads. | Refused at launch: the two identifier spaces differ; nothing sent. | Launch |
| Separate trust | B's executor takes no key-derived anchors from A's executor, while A's profile uses them. | Refused at launch: the two profiles disagree on the premise's anchors; nothing sent. | Launch |
| Executor tests | C's premise arrives under the anchor name A uses, which B's table maps only for A's. | Refused with a signed no by B's executor; no effect. | Executor |
| Executor tests | C's premise comes under A's anchor name, which a signed binding links to B for A only. | Refused with a signed no by B's executor; no effect. | Executor |
| Mechanisms combined | With B's executor lacking A's key, C's delegate seals on A's touch at C's executor. | Made: one seal at C's executor; not refused. | |
| Mechanisms combined | With B's executor not open, C's delegate seals on A's touch at C's executor. | Made: one seal at C's executor; not refused. | |
| Mechanisms combined | With B's anchor table missing A's anchor, C's delegate seals at C's executor. | Made: one seal at C's executor; not refused. | |
| Mechanisms combined | B's guard seals on A's touch with the right anchor map. | Made: one seal at B's executor; not refused. | |
| Mechanisms combined | C's delegate seals at C's executor, which serves B's anchor under the same name. | Made: one seal at C's executor; not refused. | |
| Mechanisms combined | B's guard sends the legal seal on A's touch. | Made: one seal at B's executor; not refused. | |
| Mechanisms combined | With B's executor's anchor table at odds, C's delegate seals on A's touch at C's executor. | Made: one seal at C's executor; not refused. | |
| Plain chain | With B's executor lacking A's key, C's delegate seals on A's touch at C's executor. | Made: one seal at C's executor; not refused. | |
| Plain chain | With B's executor not open, C's delegate seals on A's touch at C's executor. | Made: one seal at C's executor; not refused. | |
| Plain chain | With B's anchor table missing A's anchor, C's delegate seals at C's executor. | Made: one seal at C's executor; not refused. | |
| Plain chain | B's guard seals on A's touch with the right anchor map. | Made: one seal at B's executor; not refused. | |
| Plain chain | C's delegate seals at C's executor, which serves B's anchor under the same name. | Made: one seal at C's executor; not refused. | |
| Plain chain | With B's executor's anchor table at odds, C's delegate seals on A's touch at C's executor. | Made: one seal at C's executor; not refused. | |
| Separate trust | B's guard seals on A's touch, the anchors linked only by a binding both principals signed. | Made: one seal at B's executor; not refused. | |
| Separate trust | B's executor holds no key of A's and no anchor table; B's guard seals on A's touch. | Made: one seal at B's executor; not refused. | |
| Separate trust | With B's executor not open, C's delegate seals on A's touch at C's executor. | Made: one seal at C's executor; not refused. | |
| Separate trust | B's guard seals on A's touch where B's executor's policy names A's executor. | Made: one seal at B's executor; not refused. | |
| Separate trust | B's guard seals on A's touch with no anchor map in its configuration. | Made: one seal at B's executor; not refused. | |
| Separate trust | B's delegate reads A's touch under its own principal's anchor with a signed read. | Read served by A's executor; not refused. | |
| Separate trust | C's delegate seals on A's touch at C's executor with the steward's reserve. | Made: one seal at C's executor; not refused. | |
| Separate trust | B's guard launches holding an older copy of B's executor's profile, then seals. | Launched on the profile the executor serves now; one seal made, not refused. | |
| Separate trust | B's guard seals on A's touch holding the current copy of B's executor's profile. | Made: one seal at B's executor; not refused. | |
| Separate trust | B's guard names things in the same identifier space as B's executor, then seals. | Launched, then one seal made at B's executor; not refused. | |
| Separate trust | C's delegate seals at C's executor under the same principal's anchor B uses. | Made: one seal at C's executor; not refused. | |
| Separate trust | B's guard seals on A's touch where B's executor takes key-derived anchors from A's. | Made: one seal at B's executor; not refused. | |
| Executor tests | C's premise arrives under the anchor B's table maps for C. | Made: one effect at B's executor; not refused. | |
| Executor tests | A's premise holds by the binding, C's by B's table under C's own anchor. | Made: one effect at B's executor, which reports C's table entry as unsigned. |
Positive controls, where a protection was lifted on purpose, are in the record and not drawn here.
3 Withdrawn grounds
An action that rests on a withdrawn ground must stop.
7 of 33attacks did harm; all 7 listed for the host
Launch 0
set-up checked against signed terms
Guard 2
the agent's call, at the boundary
Delegate 0
the signed intent, before sending
Steward 0
reserves against the uses a grant allows
Executor 20
a signed no, a refused read, busy, or not opening
Log 11
refused lines, and the host's listing of effects made
No refusal 0
nothing refused or listed it
Legal actions
0 of 31 refused
Point at a square, tap it, or reach it with Tab and the arrow keys, to read what it tried and what happened.
Limit. Five of the seven are irreversible effects made after a withdrawal but before the executor's next log pass, inside its follow bound: they run and are listed for the host afterwards, not undone; past the bound the executor answers busy and makes nothing. The other two are reversible effects, which pass by design; their window is not capped by the bound. The test played the host and chose when to read the lists; three of the seven are listed only as incomplete, a list no host in Heimdall's code reads yet.
All 33 attacks and 31 legal actions of this property
| Stand | What it tries | What happened | Refused or listed at |
|---|---|---|---|
| Mechanisms combined | B acts on a withdrawn fact before B's executor next reads the log, within its follow bound. | The effect was made; B's executor's next log read listed it for the host as unsupported. | Log, after the effect |
| Plain chain | B acts on a withdrawn fact before B's executor next reads the log, within its follow bound. | The effect was made; B's executor's next log read listed it for the host as unsupported. | Log, after the effect |
| Separate trust | B acts on A's withdrawn fact, unable to check A's log lines; the effect is reversible at B. | The effect was made (default hold covers irreversible effects only), then listed for the host as incomplete. | Log, after the effect |
| Separate trust | Within the follow bound, B acts on A's withdrawn fact; B cannot check A's log lines. | The effect was made; B's executor's next log reads listed it for the host as incomplete. | Log, after the effect |
| Separate trust | Within the follow bound, B acts on A's withdrawn fact; B can check A's log lines. | The effect was made; B's executor's next log read listed it for the host as unsupported. | Log, after the effect |
| Separate trust | The principal withdraws the grant under A's effect; B acts, the effect reversible at B. | The effect was made (default hold covers irreversible effects only), then listed for the host as incomplete. | Log, after the effect |
| Separate trust | The principal withdraws the grant under A's effect; B acts before B's next log read. | The effect was made; B's executor's next log read listed it for the host as unsupported. | Log, after the effect |
| Mechanisms combined | A's principal withdraws its grant under A's effect; B acts, its executor lacking that key. | B's executor could not check the withdrawal, held the effect on an incomplete path and signed a refusal. | Executor |
| Mechanisms combined | A's principal withdraws its grant under A's effect; B acts, its executor holding that key. | B's executor signed a refusal; no effect was made. | Executor |
| Mechanisms combined | A's executor withdraws its fact; B acts on A's effect that rested on it. | B's executor had read the withdrawal from the log and signed a refusal; no effect was made. | Executor |
| Mechanisms combined | B acts on A's withdrawn fact; B's executor's last log read is older than its follow bound. | B's executor answered busy, nothing made; a resend once the intent's window closed was refused as expired. | Executor |
| Mechanisms combined | A's executor withdraws a fact; C then acts on B's earlier effect that rested on it. | C's executor traced the withdrawal through B's effect and signed a refusal; no effect was made. | Executor |
| Mechanisms combined | B's principal withdraws the grant B's guard sends under; B's guard still sends. | B's executor had read the withdrawal from the log and signed a refusal; no effect was made. | Executor |
| Mechanisms combined | A stranger signs a withdrawal of a fact that A's executor signed. | The log refused to record the withdrawal and B's executor refused to take it. | Log |
| Mechanisms combined | A withdrawal in A's executor's name, signed with a stranger's key. | The log refused to record the withdrawal and B's executor refused to take it. | Log |
| Plain chain | A's principal withdraws its grant under A's effect; B acts, its executor lacking that key. | B's executor could not check the withdrawal, held the effect on an incomplete path and signed a refusal. | Executor |
| Plain chain | A's principal withdraws its grant under A's effect; B acts, its executor holding that key. | B's executor signed a refusal; no effect was made. | Executor |
| Plain chain | A's executor withdraws its fact; B acts on A's effect that rested on it. | B's executor had read the withdrawal from the log and signed a refusal; no effect was made. | Executor |
| Plain chain | B acts on A's withdrawn fact; B's executor's last log read is older than its follow bound. | B's executor answered busy, nothing made; a resend once the intent's window closed was refused as expired. | Executor |
| Plain chain | A's executor withdraws a fact; C then acts on B's earlier effect that rested on it. | C's executor traced the withdrawal through B's effect and signed a refusal; no effect was made. | Executor |
| Plain chain | B's principal withdraws the grant B's guard sends under; B's guard still sends. | B's executor had read the withdrawal from the log and signed a refusal; no effect was made. | Executor |
| Plain chain | A stranger signs a withdrawal of a fact that A's executor signed. | The log refused to record the withdrawal and B's executor refused to take it. | Log |
| Plain chain | A withdrawal in A's executor's name, signed with a stranger's key. | The log refused to record the withdrawal and B's executor refused to take it. | Log |
| Separate trust | A's executor withdraws its fact; B acts on it, B's executor unable to check A's log lines. | B's executor found the path incomplete, held the irreversible effect and signed a refusal; nothing made. | Executor |
| Separate trust | A's executor withdraws its fact; B acts on it, B's executor able to check A's log lines. | B's executor found the ground withdrawn and signed a refusal; no effect was made. | Executor |
| Separate trust | A's executor marks its fact taken back after A's guard read it, as the call arrives. | A's executor signed a refusal citing the mark; no effect was made. | Executor |
| Separate trust | A's agent acts on the same object again after that refusal. | A's guard refused it, having taken down the session's root for the object; nothing was sent. | Guard |
| Separate trust | The object moves to another anchor and A's executor marks its fact taken back. | A's guard refused before sending, as nothing rooted the object; the mark was asked for and served. | Guard |
| Separate trust | A's executor marks its fact; A's agent acts on a fresh read in the same second as the mark. | A's executor signed a refusal citing the very mark it had signed; no effect was made. | Executor |
| Separate trust | Past the follow bound, B acts on a withdrawn fact; B's executor cannot check A's log lines. | B's executor answered busy to the send and its retries; the outcome stayed unknown and nothing was made. | Executor |
| Separate trust | Past the follow bound, B acts on a withdrawn fact; B's executor can check A's log lines. | B's executor answered busy to the send and its retries; the outcome stayed unknown and nothing was made. | Executor |
| Separate trust | The principal withdraws the grant under A's effect; B acts, unable to check A's log lines. | B's executor found the path incomplete, held the irreversible effect and signed a refusal; nothing made. | Executor |
| Separate trust | The principal withdraws the grant under A's effect; B acts, able to check A's log lines. | B's executor found the ground gone and signed a refusal; no effect was made. | Executor |
| Mechanisms combined | Legal action at B before any withdrawal; B's executor lacks A's principal's key. | Executed once; nothing had to refuse. | |
| Mechanisms combined | Legal action at B before any withdrawal; B's executor holds nothing on incomplete paths. | Executed once; nothing had to refuse. | |
| Mechanisms combined | Legal action at B before any withdrawal; B's executor holds A's principal's key. | Executed once; nothing had to refuse. | |
| Mechanisms combined | Legal action at B on another effect of A's whose fact was not withdrawn. | Executed once; nothing had to refuse. | |
| Mechanisms combined | Rejudge B's guard's witness of the session with a refusal after a withdrawal. | The witness reproduced the recorded calls; nothing reached an executor while it ran. | |
| Mechanisms combined | Legal action at B after B's executor reads the log afresh. | Executed once; nothing had to refuse. | |
| Mechanisms combined | B acts twice on A's effects and C's delegate acts on one of B's; nothing withdrawn. | All three executed; nothing had to refuse. | |
| Mechanisms combined | C's delegate acts under its own grant, which was not withdrawn. | Executed once; nothing had to refuse. | |
| Mechanisms combined | Legal action at B on A's effect after both forged withdrawals. | Executed once; the forged withdrawals did not stop it. | |
| Plain chain | Legal action at B before any withdrawal; B's executor lacks A's principal's key. | Executed once; nothing had to refuse. | |
| Plain chain | Legal action at B before any withdrawal; B's executor holds nothing on incomplete paths. | Executed once; nothing had to refuse. | |
| Plain chain | Legal action at B before any withdrawal; B's executor holds A's principal's key. | Executed once; nothing had to refuse. | |
| Plain chain | Legal action at B on another effect of A's whose fact was not withdrawn. | Executed once; nothing had to refuse. | |
| Plain chain | Legal action at B after B's executor reads the log afresh. | Executed once; nothing had to refuse. | |
| Plain chain | B acts twice on A's effects and C's delegate acts on one of B's; nothing withdrawn. | All three executed; nothing had to refuse. | |
| Plain chain | C's delegate acts under its own grant, which was not withdrawn. | Executed once; nothing had to refuse. | |
| Plain chain | Legal action at B on A's effect after both forged withdrawals. | Executed once; the forged withdrawals did not stop it. | |
| Separate trust | Legal action at B on A's other effect; B's executor cannot check A's log lines. | Executed once; nothing had to refuse. | |
| Separate trust | Legal action at B on A's other effect; B's executor holds nothing on incomplete paths. | Executed once; nothing had to refuse. | |
| Separate trust | Legal action at B on A's other effect; B's executor can check A's log lines. | Executed once; nothing had to refuse. | |
| Separate trust | Legal action at B on A's other effect, with the effect reversible at B. | Executed once; nothing had to refuse. | |
| Separate trust | Legal action by A's agent on another object. | Executed once; nothing had to refuse. | |
| Separate trust | A's executor marks its fact; A's agent acts on a read made a second later. | Executed once: the fact read after the mark stands, so nothing had to refuse. | |
| Separate trust | Legal action by A's agent with no move and no mark. | Executed once; nothing had to refuse. | |
| Separate trust | Legal action at B after a fresh log read; B's executor cannot check A's log lines. | Executed once; nothing had to refuse. | |
| Separate trust | Legal action at B after a fresh log read; B's executor can check A's log lines. | Executed once; nothing had to refuse. | |
| Separate trust | Legal action at B before the principal withdraws a grant; B cannot check A's log lines. | Executed once; nothing had to refuse. | |
| Separate trust | Legal action at B before the withdrawal; B's executor holds nothing on incomplete paths. | Executed once; nothing had to refuse. | |
| Separate trust | Legal action at B before the withdrawal; B's executor can check A's log lines. | Executed once; nothing had to refuse. | |
| Separate trust | Legal action at B before the withdrawal, with the effect reversible at B. | Executed once; nothing had to refuse. | |
| Separate trust | Legal action at B before the withdrawal; B's executor can check A's log lines. | Executed once; nothing had to refuse. |
Positive controls, where a protection was lifted on purpose, are in the record and not drawn here.
4 Repeats and failures
An effect must not repeat, and results must survive failures.
4 of 16attacks did harm
Launch 0
set-up checked against signed terms
Guard 1
the agent's call, at the boundary
Delegate 0
the signed intent, before sending
Steward 3
reserves against the uses a grant allows
Executor 2
a signed no, a refused read, busy, or not opening
Log 0
refused lines, and the host's listing of effects made
No refusal 10
nothing refused or listed it
Legal actions
0 of 12 refused
Point at a square, tap it, or reach it with Tab and the arrow keys, to read what it tried and what happened.
Limit. The steward counts intents, not premises, so one premise is spent at two executors and nothing refuses it. All four harms are this case; counting premises is deferred. The measurement report counts 3 of 15: it files the fourth row, under a grant allowing five uses, as a positive control of property 2 by its name. The record's audit found nothing lifted in it, so it is counted here as an attack.
All 16 attacks and 12 legal actions of this property
| Stand | What it tries | What happened | Refused or listed at |
|---|---|---|---|
| Mechanisms combined | C's delegate makes a second effect at C on the premise B used; the grant allows five. | Second effect made at C: the steward counts intents, not premise uses; nothing refused it. | nowhere |
| Mechanisms combined | C makes a second effect at its executor on the premise B used; the grant allows two. | Second effect made at C: the steward counts intents, not premise uses; nothing refused it. | nowhere |
| Plain chain | C makes a second effect at its executor on the premise B used; the grant allows two. | Second effect made at C: the steward counts intents, not premise uses; nothing refused it. | nowhere |
| Separate trust | C makes a second effect at its executor on the premise B used; the grant allows two. | Second effect made at C: the steward counts intents, not premise uses; nothing refused it. | nowhere |
| Mechanisms combined | After B's executor's answer is lost, release the open intent and retry with a changed note. | Release refused, guard held a changed retry, resolve completed the record; one effect, repeat answered from it. | Guard |
| Mechanisms combined | B's executor's answer to an effect is lost, and the agent repeats the call. | The repeat was not sent; resolve read the executor's status and completed the record; one effect only. | nowhere |
| Mechanisms combined | B's executor process dies after making the effect and before it answers. | The executor restarted; resolve read its status and completed the record; one effect only. | nowhere |
| Mechanisms combined | B's guard loses its intent store, the delegate's sent bytes kept; the same call again. | The delegate resent the kept bytes and the executor answered from its record; one effect only. | nowhere |
| Mechanisms combined | B makes a second effect on the same premise under a new intent identity. | B's executor refused it with a signed no; no second effect. | Executor |
| Mechanisms combined | C makes a second effect at its executor on the premise B used; the grant allows one. | The steward refused the reserve over the limit; C's delegate sent nothing; no second effect. | Steward |
| Plain chain | B's executor's answer to an effect is lost, and the agent repeats the call. | The repeat was not sent; resolve read the executor's status and completed the record; one effect only. | nowhere |
| Plain chain | B's executor process dies after making the effect and before it answers. | The executor restarted; resolve read its status and completed the record; one effect only. | nowhere |
| Plain chain | B's guard loses its intent store, the delegate's sent bytes kept; the same call again. | The delegate resent the kept bytes and the executor answered from its record; one effect only. | nowhere |
| Plain chain | B makes a second effect on the same premise under a new intent identity. | B's executor refused it with a signed no; no second effect. | Executor |
| Plain chain | C makes a second effect at its executor on the premise B used; the grant allows one. | The steward refused the reserve over the limit; C's delegate sent nothing; no second effect. | Steward |
| Separate trust | C makes a second effect at its executor on the premise B used; the grant allows one. | The steward refused the reserve over the limit; C's delegate sent nothing; no second effect. | Steward |
| Mechanisms combined | Re-check B's guard's witness of the lost answer and its repeat after the session closes. | The re-check reproduced the recorded calls with no mismatch; nothing reached an executor. | |
| Mechanisms combined | B makes its first effect on a premise, as its grant allows. | Executed: one effect, nothing refused. | |
| Mechanisms combined | B makes its effect on a premise C will also use; the grant allows one effect. | Executed: one effect at B, nothing refused. | |
| Mechanisms combined | B makes its effect on a premise C will also use; no steward is set. | Executed: one effect at B, nothing refused. | |
| Mechanisms combined | B makes its effect on a premise C will also use; the grant allows two effects. | Executed: one effect at B, nothing refused. | |
| Plain chain | B makes its first effect on a premise, as its grant allows. | Executed: one effect, nothing refused. | |
| Plain chain | B makes its effect on a premise C will also use; the grant allows one effect. | Executed: one effect at B, nothing refused. | |
| Plain chain | B makes its effect on a premise C will also use; no steward is set. | Executed: one effect at B, nothing refused. | |
| Plain chain | B makes its effect on a premise C will also use; the grant allows two effects. | Executed: one effect at B, nothing refused. | |
| Separate trust | B makes its effect on a premise C will also use; the grant allows one effect. | Executed: one effect at B, nothing refused. | |
| Separate trust | B makes its effect on a premise C will also use; no steward is set. | Executed: one effect at B, nothing refused. | |
| Separate trust | B makes its effect on a premise C will also use; the grant allows two effects. | Executed: one effect at B, nothing refused. |
Positive controls, where a protection was lifted on purpose, are in the record and not drawn here.
5 Contradictions
Contradictory settings must be refused before any action.
0 of 28attacks did harm
Launch 28
set-up checked against signed terms
Guard 0
the agent's call, at the boundary
Delegate 0
the signed intent, before sending
Steward 0
reserves against the uses a grant allows
Executor 0
a signed no, a refused read, busy, or not opening
Log 0
refused lines, and the host's listing of effects made
No refusal 0
nothing refused or listed it
Legal actions
0 of 16 refused
Point at a square, tap it, or reach it with Tab and the arrow keys, to read what it tried and what happened.
Limit. Twelve of the 28 refusals are the guard's own mechanisms, which do not launch beside the layer: a budget, an execution profile, a party's approval, sensitive keys, carried reads, an approval on a mapped action, and in one stand a mandate. Some contradictions run when confirmation is only a warning. A participant without a guard confirms nothing, and profiles are read at launch, not again during a run.
All 28 attacks and 16 legal actions of this property
| Stand | What it tries | What happened | Refused or listed at |
|---|---|---|---|
| Mechanisms combined | B's guard rules take the premise id as the agent's own judgement. | Refused at launch: a premise id must be tied to an intent read in the session; nothing sent. | Launch |
| Mechanisms combined | B's guard rules read the object as another kind than B's effect names. | Refused at launch: the object kind in the guard rules differs from the effect's; nothing sent. | Launch |
| Mechanisms combined | B's grant names a steward, but B's configuration names none. | Refused at launch: the steward the grant names is missing from B's configuration; nothing sent. | Launch |
| Mechanisms combined | B's effect rests on A's premise, but B's configuration gives no way to ask A's executor. | Refused at launch: the premise is by A's executor, which the delegate is not set to ask; nothing sent. | Launch |
| Mechanisms combined | B's key map holds a wrong key for A's executor. | Refused at launch: A's executor's signed profile does not check under that key; nothing sent. | Launch |
| Mechanisms combined | Start B's guard with a budget on an action its delegate sends. | Refused at launch: the delegate does not carry a budget; nothing sent. | Launch |
| Mechanisms combined | Start B's guard with an execution profile on an action its delegate sends. | Refused at launch: the delegate does not carry an execution profile; nothing sent. | Launch |
| Mechanisms combined | Start B's guard with a party's approval on an action its delegate sends. | Refused at launch: a party's approval would route the action away from the executor; nothing sent. | Launch |
| Mechanisms combined | Start B's guard with sensitive keys that would trim the executor's answers. | Refused at launch: the executor's signed answers are kept whole, and sensitive keys would trim them. | Launch |
| Mechanisms combined | Start B's guard carrying reads over from earlier runs, with objects rooted on facts. | Refused at launch: carried-over reads and objects rooted on the executor's facts do not go together. | Launch |
| Mechanisms combined | Let an approval cover a value the agent typed, in an action the delegate sends. | Refused at launch: the executor takes no approval in place of a value's source; nothing sent. | Launch |
| Mechanisms combined | Under default settings, B maps its anchor to A's anchor by its own unsigned word. | Refused at launch: no signed binding from A's executor backs the map; nothing sent. | Launch |
| Plain chain | B's guard rules take the premise id as the agent's own judgement. | Refused at launch: a premise id must be tied to an intent read in the session; nothing sent. | Launch |
| Plain chain | B's guard rules read the object as another kind than B's effect names. | Refused at launch: the object kind in the guard rules differs from the effect's; nothing sent. | Launch |
| Plain chain | B's grant names a steward, but B's configuration names none. | Refused at launch: the steward the grant names is missing from B's configuration; nothing sent. | Launch |
| Plain chain | B's effect rests on A's premise, but B's configuration gives no way to ask A's executor. | Refused at launch: the premise is by A's executor, which the delegate is not set to ask; nothing sent. | Launch |
| Plain chain | B's key map holds a wrong key for A's executor. | Refused at launch: A's executor's signed profile does not check under that key; nothing sent. | Launch |
| Plain chain | Start B's guard with a budget on an action its delegate sends. | Refused at launch: the delegate does not carry a budget; nothing sent. | Launch |
| Plain chain | Make a mandate the action's identity in B's guard rules, which name no mandate. | Refused at launch: the guard rules take the mandate identity from a slot holding no mandate. | Launch |
| Plain chain | Start B's guard with an execution profile on an action its delegate sends. | Refused at launch: the delegate does not carry an execution profile; nothing sent. | Launch |
| Plain chain | Start B's guard with a party's approval on an action its delegate sends. | Refused at launch: a party's approval would route the action away from the executor; nothing sent. | Launch |
| Plain chain | Start B's guard with sensitive keys that would trim the executor's answers. | Refused at launch: the executor's signed answers are kept whole, and sensitive keys would trim them. | Launch |
| Plain chain | Start B's guard carrying reads over from earlier runs, with objects rooted on facts. | Refused at launch: carried-over reads and objects rooted on the executor's facts do not go together. | Launch |
| Plain chain | Under default settings, B maps its anchor to A's anchor by its own unsigned word. | Refused at launch: no signed binding from A's executor backs the map; nothing sent. | Launch |
| Separate trust | A's executor renames the premise effect that B's effect still stands on. | Refused at launch: A's executor serves no profile of that premise effect; nothing sent. | Launch |
| Separate trust | B's key map files other key bytes under A's executor's self-certifying name. | Refused at launch: the key bytes do not match the name they are filed under; nothing sent. | Launch |
| Separate trust | B's configuration takes facts up to 1000 s old; B's executor takes none over 600 s. | Refused at launch: the two fact windows disagree; nothing sent. | Launch |
| Separate trust | Take the mandate out so that no side bounds the quantity in B's effect. | Refused at launch: no profile, grant or guard rule bounds the quantity; nothing sent. | Launch |
| Mechanisms combined | Re-judge B's guard's recorded calls under the same rules, every mechanism on. | Every recorded verdict reproduced, signed outcomes in the record; no new effect made. | |
| Mechanisms combined | Re-judge A's guard's recorded calls under the same rules. | Every recorded verdict reproduced, facts and signed outcomes in the record; no new effect made. | |
| Mechanisms combined | Launch B's guard with the right configuration and act on A's premise. | Executed once; nothing refused. | |
| Mechanisms combined | Start B's guard and its delegate with a witness record of the guard's calls. | Accepted by the launch's flag check; nothing refused, and no action was sent in this row. | |
| Mechanisms combined | Start B's guard and its delegate with a decision queue for held calls. | Accepted by the launch's flag check; nothing refused, and no action was sent in this row. | |
| Mechanisms combined | Start B's guard and its delegate with a mandate as the action's identity. | Launched; no contradiction raised, and no action was sent in this row. | |
| Mechanisms combined | Act on A's premise with B's guard launched with every mechanism it accepts on. | Executed once; nothing refused. | |
| Plain chain | Launch B's guard with the right configuration and act on A's premise. | Executed once; nothing refused. | |
| Plain chain | Start B's guard and its delegate with a witness record of the guard's calls. | Accepted by the launch's flag check; nothing refused, and no action was sent in this row. | |
| Plain chain | Start B's guard and its delegate with a decision queue for held calls. | Accepted by the launch's flag check; nothing refused, and no action was sent in this row. | |
| Plain chain | Act on A's premise through B's guard launched with none of the tested mechanisms on. | Executed once; nothing refused. | |
| Separate trust | Act on A's premise before A's executor renames the premise effect. | Executed once; nothing refused. | |
| Separate trust | Act on A's premise with the right key map. | Executed once; nothing refused. | |
| Separate trust | Same mismatched windows with the launch set only to warn, acting on a fresh fact. | Launched despite the mismatch; the action on a fresh fact executed once, nothing refused. | |
| Separate trust | Act with B's configuration taking facts up to 600 s old, as B's executor does. | Executed once; nothing refused. | |
| Separate trust | Act with a quantity that B's executor's profile leaves open and a mandate bounds. | Launch confirmed; the action executed once, nothing refused. |
Positive controls, where a protection was lifted on purpose, are in the record and not drawn here.
- attack refused or did no harm; legal action went through
- effect made, then listed for the host
- harm got through, listed nowhere
- legal action refused
Attacks and legal actions along a chain of executors in three simulated organisations, run on Heimdall's own code in three stands and the executor's collision tests, each inside one process, on one machine and in one test domain. Each square is one attack or legal action of the record; positive controls, where a protection was lifted on purpose, are not drawn. An attack sits where it was refused, at the log when its effect was made and then listed for the host, or under No refusal.
What was tested
Can guard and layer hold five properties at once along a chain of executors in three simulated organisations? Stages 1 and 2 fixed 8 of a prototype’s 11 harm cases and listed two more. Three stands re-ran on Heimdall’s code, one with separate trust.
What we observed
Attacks with harm: authority 1 of 33; cross-organisation 0 of 34; withdrawal 7 of 33, each listed for the host; repeats and failures 4 of 16, all one steward case; contradictions 0 of 28. Legal actions refused: 1 of 112. An audit reproduced every row.
What this means for Heimdall
Guard and layer combine: three properties hold within named bounds; authority and repeats each fail in one case.
Limits
In-process stands, one domain, the test as host. Two stands keep reader tokens that open every anchor and warning-only confirmation, which lets some contradictions run. 12 of 28 contradictions are guard mechanisms refused beside the layer. A seal in a key rotation window runs unlisted. Irreversible effects before the next log pass are listed, not undone; two reversible ones pass by design. The steward counts intents, not premises; the report files one such harm as a control (3 of 15).
What remains open
Separate OS processes; a host reading both lists; steward counts of premises.