Co-Recursive Intelligence Under Deterministic Authority: Zero-UI Protocols, Pre-Gate Routing, and Ring-0 Security

Most conversational products dissolve sessions into flat buffers, while agent frameworks wire language models directly to shells, networks, and filesystems. Our integrated prototype treats both as the same architectural mistake: intelligence must propose, but authority must stay deterministic. The note walks through email-native co-thinking personas, a calibrated pre-gate that escalates reflection only under structural tension, Telos-Line memory that preserves the why behind ideas, and a Ring-0 monitor that blocks attacks in microseconds without LLM judges — with empirical results from EXP-31 through EXP-41, including pre-gate routing on moral judgment (EXP-37) and longitudinal email threading (EXP-38).

Contemporary artificial intelligence systems are trapped between two opposing structural failure modes:

1. The Stateless Chat Silo (Epistemic Amnesia & Sycophancy): Most conversational AI products lock users inside proprietary browser tabs where every session starts from a near-blank slate or a flat vector buffer. When confronted with genuinely complex, ambiguous, or normatively contested questions, single-pass language models tend either toward sycophantic agreement or toward unfocused "overthinking" that drifts away from the user's core premise. Worse, because sessions dissolve once the tab closes, no structured, inspectable trajectory of shared thought—no genuine epistemic partnership—ever accumulates over months and years.
2. The Unbounded Agent Wrapper (Brittle Guardrails & Regulatory Fragility): At the opposite extreme, autonomous agent frameworks wire probabilistic language models directly to file systems, databases, web search, and email—relying on prompt-level instructions or secondary LLM "judges" to police behavior. Our empirical benchmarks demonstrate that this paradigm is fundamentally unsound: probabilistic language models cannot serve as their own security reference monitor. When an agent reads an untrusted newsletter, a third-party PDF attachment, or an SEO-poisoned web snippet, indirect prompt injection can silently hijack its control flow, exfiltrate secrets, pollute long-term memory, or violate statutory data-protection boundaries.

To move beyond disposable chat widgets and fragile agent wrappers, we built the first integrated Evercursion Prototype. Its core thesis is architectural: deep, evolving machine reflection and mathematical system trust are not competing goals—they require the same structural separation of powers. For the first time in a single system, our prototype unites a Protocol-First Zero-Interface architecture, a Calibrated Pre-Gate Router, Multi-Perspective Reflection, and a Cryptographically Versioned Wisdom Graph beneath a non-bypassable Ring-0 Reference Monitor enforcing Security by Design and European Compliance by Design.

Why force human thinking into yet another proprietary web dashboard? Deep reflection is naturally asynchronous, threaded, and document-rich.

Instead of coupling the intelligence core to a bespoke user interface, the Evercursion prototype is Protocol-First and Zero-UI. Every interaction—whether human-to-AI correspondence, document digestion, external knowledge retrieval, or future messaging and bot-to-bot channels—is normalized into an immutable, transport-agnostic cryptographic envelope before crossing into the reasoning engine.

In its primary deployment, the system operates over the world's oldest, most resilient federated communication protocol: cryptographically authenticated email (SPF, DKIM, and DMARC):

• Adaptive, User-Tailored Co-Thinking Personas: Rather than forcing users to engineer brittle system prompts or interact with a generic, one-size-fits-all assistant, users correspond via email with dedicated Co-Thinking Personas customized to their specific domain interests, analytical requirements, and personal communication style. Over time, each persona learns from the user's evolving body of work—absorbing their recurring themes, conceptual vocabulary, and strategic priorities through the Wisdom Graph—so it can challenge assumptions, surface unexpected connections across months of prior thought, and genuinely inspire new directions with the warmth, clarity, and rigor of a trusted intellectual partner.
• Zero-Trust Identity Resolution: User and tenant identities are never embedded in the recipient address. Even when hundreds of users write to the exact same persona address with identical subject lines, the Ring-0 provenance gate resolves tenant identity strictly from the cryptographically verified sender signature (SPF/DKIM/DMARC alignment across RFC 5322 headers), guaranteeing zero cross-tenant collision and complete isolation of each user's personalized knowledge graph.

Once an inbound envelope passes Ring-0 verification, it enters a closed-loop cognitive pipeline that couples three subsystems:

A. Calibrated System-One Pre-Gate Routing (EXP-37)

Not every question requires heavy multi-perspective deliberation; forcing deep recursion onto straightforward factual queries wastes compute and introduces "prosecutorial criterion drift" (inventing artificial objections where none exist).

• Drawing on second-order cybernetics, an initial candidate thought is evaluated by a Calibrated System-One Pre-Gate Router across three independent dimensions: Objective Truth/Falsehood, Subjective Alignment/Authenticity, and Dialectical Consistency/Contradiction.
• Empirical Verification (EXP-37): Across 1,500 scenarios on the ETHICS benchmark, pre-gating separates locally decidable questions from genuinely contested problems—halting immediately when all three poles align and escalating only under structural tension (40.6% to 55.8% of cases depending on complexity). This eliminates criterion drift ($c = -0.58 \to -0.02$), lifts balanced accuracy on contested dilemmas from 47.9% to 85.4%, and reduces inference compute cost by 2× to 9.4× (and up to 66× compared to forced multi-cycle recursion).

B. Multi-Perspective & Dialectical Reflection Engines

When the router diagnoses a genuine epistemic blockade, it dispatches the problem to formal multi-perspective reflection architectures—using a fast, non-thinking model to map sharp structural contrasts before a high-capacity reasoning model synthesizes the final response:

1. Polycontextural Reflection: Decomposes a problem across Objective ($O$), Subjective ($S$), and Conceptual/Observer ($B$) dimensions and their mediating boundaries, preventing lived human priorities and objective technical constraints from collapsing into a flat average before reaching an integrated synthesis.
2. Dialectical Counter-Determination: Moves a problem through foundational assumptions, structural tensions, and governing concepts. Whenever an initial line of thought exhibits one-sidedness, an explicit Counter-Determination Step constructs the strongest opposing perspective from the failing structural dimensions, testing thesis against antithesis prior to final synthesis.

C. Telos-Lines & The Longitudinal Wisdom Graph: A Metro Topology for the "Why" (EXP-38, EXP-39)

Most AI memory systems treat the past as a bag of fragments: they slice documents and conversations into chunks, embed them into a flat vector space, and retrieve whichever snippet looks statistically similar to the latest prompt. That approach captures isolated What statements, but it completely loses the teleological trajectory—the Why: how an argument evolved, why an initial hypothesis was rejected, and how one insight forced the transition to the next.

To preserve the Why, Evercursion introduces Telos-Lines: a sequential, co-recursive graph layer that lives on top of the underlying Wisdom Graph (backed by Neo4j 5.26 and Graph Data Science) and operates like a cognitive metro network:

• The Metro-Line Principle (How Thought Travels from $A$ to $B$): While the underlying Wisdom Graph stores the full semantic landscape of concepts, documents, and evidence, a Telos-Line is a directed, sequential transit line running across that landscape. It captures the intentional direction of a line of inquiry—how reasoning gets from Station $A$ (an initial question or premise) through intermediate stations (diagnoses, counter-arguments, empirical checks, and syntheses) to Station $B$ (a settled insight or decision). Multiple Telos-Lines—representing distinct long-term themes or strategic initiatives—intersect at shared transfer stations where two lines of thought illuminate the same underlying concept.
• Stations as Transformations & Zero-Duplication Graph Projections: Crucially, stations along a Telos-Line do not duplicate the underlying data. Every atomic thought, document chunk, or verified web fact is stored exactly once as a content-addressed node in the Wisdom Graph. Each station on a Telos-Line acts as a lightweight relational projection and epistemic transformation operator: it points into the shared Wisdom Graph, selects the relevant subgraph at that moment in time, and records the transformation that turned the input state of that station into its output state. Because multiple Telos-Lines and multiple reflection rides project over the same canonical nodes without copying them, the graph remains compact, structurally deduplicated, and richly interconnected.
• Stage-Specific Epistemic Memory & Personal Style Learning: When a new inquiry arrives on an existing Telos-Line (or inductively spawns a new one), the engine does not dump raw chat history into the model. Instead, it traverses the metro topology to project stage-specific memory bundles: HITS authority hubs identify the foundational transfer stations that anchor the user's long-term thinking; seeded random walks hop across intersecting Telos-Lines to surface unexpected cross-topic inspirations; and contrastive mirroring retrieves prior counter-determinations so the system never repeats a settled dead end.
• Cryptographic Graph Version Control (Merkle-DAG): Every completed ride along a Telos-Line produces an immutable, content-addressed Merkle-DAG commit over the newly projected stations and edges. Users can inspect their cognitive commit log, roll back a polluted or unwanted ride to an earlier station, squash intermediate scaffolding, or garbage-collect orphaned branches at zero LLM cost.
• Bracketed Dual-Stage Web Grounding (EXP-39): When external facts are needed, the engine brackets reflection with an initial grounding search (before routing) and a final claim-verification search (before synthesis). In EXP-39, this raised verifiable archival fact recall from 0.0% (honest abstention offline) to 95.0%, attaching deduplicated evidence nodes directly to the active Telos-Line station for zero-query recall in subsequent turns.

The defining security principle of the prototype—proven across EXP-31, EXP-32, EXP-34, EXP-40, and EXP-41—is the strict separation of Intelligence (Ring 2/3) and Authority (Ring 0/1).

In EXP-31 (252 benchmark cases across 6 attack domains), a zero-shot local LLM security judge suffered a catastrophic 98.3% False Positive Rate at 142.3 ms latency, while static regular-expression filters missed 56.1% of attacks. Evercursion's deterministic Ring-0 Reference Monitor achieved a 100.0% Attack Block Rate and 0.0% False Positive Rate at a median latency of 12.7 microseconds (0.0127 ms)—more than 11,000× faster than an LLM gate, with zero language models inside the security decision loop.

How Ring 0 enforces security by construction across 25 verified architecture components and 102 continuously executed adversarial test vectors:

1. Chained HMAC Capability Tokens & Monotonic Attenuation: Every file read, graph query, attachment extraction, or search call in Ring 2/3 requires a cryptographically signed, time-bound capability token. Whenever a task delegates to a sub-worker, authority narrows mathematically: allowed tools, tenant namespaces, file paths, time-to-live, call quotas, and trust levels must form a strict subset of the parent token.
2. 2D Product Lattice & 5-Level Information-Flow Control (EXP-32, EXP-34): Stateless per-step security policies miss 33.3% of multi-step trajectory kill chains (EXP-34), whereas a naive 1-bit taint lock blocks 70.0% to 83.3% of legitimate follow-up work. Ring 0 tracks a two-dimensional product lattice ($\mathcal{L}_{\mathrm{trust}} \times \mathcal{L}_{\mathrm{sens}}$) across five levels—Trusted, Sanitized, Derived, Untrusted, and Sensitive—with $\mathcal{O}(1)$ state-folding in ~20 microseconds per step:
   • External newsletters and unknown senders are bound to Untrusted taint: they can be summarized in quarantine, but Ring 0 deterministically blocks them from modifying the owner's Wisdom Graph, altering configuration, or triggering outbound messages.
   • Sandboxed attachment chunks and sanitized web search snippets carry Derived taint: they enrich reflection and graph memory, but are mathematically barred from triggering external network egress, newsletter subscriptions, or cross-tenant sharing.
3. Four-Layer Email & Web Prompt-Injection Defense-in-Depth (EXP-40, EXP-41):
   • Quote-, Forward-, and Code-Fence-Aware Parsing: In-band control commands are ignored inside quoted reply lines (>), forwarded message blocks, HTML blockquotes, and markdown code spans, preventing attackers from smuggling commands inside an email thread that an authenticated user replies to (EXP-41).
   • Deep Payload & Search Sanitization: Ring 0 strips Trojan Source bidirectional Unicode characters, decodes and neutralizes Base64-obfuscated injection payloads, redacts Markdown tracking pixels, scrubs outbound search queries for accidental secret leakage, and pins all outbound HTTPS connections to TLS 1.3 while blocking private, loopback, and cloud-metadata IP ranges against SSRF and DNS rebinding (100% block rate across 60 adversarial web vectors in EXP-40 at 35.9 µs latency).
   • Structural XML Data Isolation: User inputs and external texts are wrapped inside structural untrusted-data XML delimiters (with embedded closing tags stripped) so neither the reflection models nor the pre-gate router can mistake quoted data for system instructions.
4. Ephemeral 0700 Attachment Sandbox & Macro Quarantine: Inbound PDF, Office, OpenDocument, and archive attachments are materialized exclusively inside a fresh, non-symlinked 0700 temporary directory with zero network or shell access. Streaming decompression enforces strict 100:1 ZipBomb ratio limits and canonical path containment against Zip-Slip traversal. Disguised ELF/PE/Mach-O binaries, polyglot files, active PDF JavaScript actions, and Office VBA macro containers are quarantined automatically unless explicitly authorized by the Ring-1 human owner.
5. Cryptographic Cost Governance & Pedagogical Incident Coaching: Per-tenant compute budgets (capped at $20.00 by default) and user access states are sealed on disk using PBKDF2-HMAC-SHA256 (200,000 iterations) and authenticated encryption (AEAD) with zero cleartext tokens on disk. If an authenticated user accidentally or experimentally triggers a Ring-0 security boundary, their execution token is immediately suspended and a dedicated Pedagogical AI Security Coach sends an experience-adapted explanation (tailored to beginner, intermediate, or advanced background without leaking any PII across tenants), requiring explicit Ring-1 human sovereignty to reinstate access.

In most AI deployments, regulatory compliance is treated as an afterthought of legal disclaimers and manual ticketing. In the Evercursion prototype, statutory mandates under GDPR (EU 2016/679), Portuguese Data Protection Law (Lei n.º 58/2019 / CNPD), the EU Artificial Intelligence Act (EU 2024/1689), and NIS2, together with management-system requirements commonly associated with ISO-style frameworks, are compiled directly into Ring-0 cryptographic invariants and zero-cost self-service email commands:

• Cryptographic Multi-Tenant Isolation & Federated Sharing (EXP-38): Every tenant operates inside a dedicated 0700 filesystem vault and a tenant-scoped, content-addressed graph namespace using 100% parameterized database queries. Even under identical subjects and spoofed reply headers (EXP-38), cross-tenant leakage is strictly zero. Combining lines of thought across two users requires an explicit, revocable, Ring-0 HMAC-signed Federation Grant authorized in Ring 1.
• Surgical GDPR Art. 17 Erasure ("Right to be Forgotten") & Signed Certificates: Data subjects can trigger surgical erasure (excising a single topic, a single document, or their entire account) directly via email at zero LLM cost. Ring 0 purges the physical vault files, detaches and deletes the live graph nodes, replaces excised node identifiers inside historical Merkle commit manifests with cryptographic HMAC tombstones, and issues an HMAC-signed GDPR Erasure Certificate—while recording the event in the tamper-evident hash-chained audit log using a salted pseudonym so the audit trail itself remains 100% free of personal data.
• GDPR Art. 15, 16 & 20 Self-Service Rights: At any moment, a user can request a live Art. 13/15 transparency inventory, export a complete machine-readable Art. 20 JSON portability archive (vault documents, Wisdom Graph, and billing ledger), or exercise Art. 16 rectification by rolling back inaccurate graph commits.
• Compute Sovereignty Tiers & Outbound PII Pseudonymization (GDPR Art. 28 & 44–46): Users can lock their processing tier via email: external model routing strictly enforces contractual Zero-Data-Retention (ZDR) flags, or tenants can lock inference exclusively to a Sovereign EU Self-Hosted Cluster (or local offline execution). An optional outbound privacy filter automatically pseudonymizes fiscal and banking identifiers (such as tax numbers and IBANs) into reversible local placeholders before any external model call and re-hydrates them upon return.
• EU AI Act (Art. 10, 12, 14, 15 & 50) & Self-Verifying Documentation: Every outbound message carries transparent AI attribution alongside machine-readable RFC 5322 headers (Art. 50 synthetic AI output marking, SHA-256 provenance digest, compute sovereignty tier, and graph commit hash). Furthermore, a Living Architecture, Security & Compliance Compiler statically audits 100% of the codebase's Abstract Syntax Trees (banning unsafe execution primitives and Trojan Unicode), verifies SHA-256 source fingerprints against the live test suite on every build, and automatically compiles the technical security and security and compliance documentation reports so documentation can never drift from reality.

• Read Note #07: Separating Intelligence and Authority in Agentic Systems
• Read Note #08: Small Models Think Better When They Reflect Polycontexturally
• Read Note #06: Beyond the Scaling Ceiling — Co-Recursive Semantic Self-Extension
• Read Note #09: When Should a Machine Reflect? Criterion Drift, Prosecutor Bias, and Meta-Teleological Stopping in Moral Judgment