# Note #10: Co-Recursive Intelligence Under Deterministic Authority: Zero-UI Protocols, Pre-Gate Routing, and Ring-0 Security

- **Organization:** Evercursion (GaiaLogic, Unipessoal Lda.)
- **Canonical URL:** https://evercursion.ai/research/note-13-co-recursive-intelligence-under-deterministic-authority
- **Markdown URL:** https://evercursion.ai/research/note-13-co-recursive-intelligence-under-deterministic-authority.md
- **Archive ID:** RN-2026-13
- **Authors:** Research & Engineering Team
- **Date:** 2026-11-09
- **Status:** Published (Archive No. RN-2026-13 · Experiment Ledger: EXP-31–EXP-41)
- **Format:** Research Project
- **Topics:** System Architecture, Zero-UI Protocols, Agentic Security, Compliance by Design
- **Key Findings:** Protocol-first email personas and federated identity without app lock-in · Calibrated pre-gate routing and multi-perspective reflection on a wisdom graph · Ring-0 separation of intelligence and authority (EXP-31–EXP-41) · GDPR and EU AI Act alignment compiled as deterministic invariants

**Summary:** Contemporary AI systems oscillate between stateless chat silos that forget structured thought and unbounded agent wrappers that let probabilistic models police their own tool use. We describe the first integrated Evercursion prototype that unifies protocol-first, zero-interface correspondence, calibrated pre-gate routing, multi-perspective reflection, and a versioned wisdom graph beneath a deterministic Ring-0 reference monitor — so deep reflection and mathematical trust share the same separation of intelligence and authority.

## Abstract

Most conversational products dissolve sessions into flat buffers, while agent frameworks wire language models directly to shells, networks, and filesystems. Our integrated prototype treats both as the same architectural mistake: intelligence must propose, but authority must stay deterministic. The note walks through email-native co-thinking personas, a calibrated pre-gate that escalates reflection only under structural tension, Telos-Line memory that preserves the *why* behind ideas, and a Ring-0 monitor that blocks attacks in microseconds without LLM judges — with empirical results from EXP-31 through EXP-41, including pre-gate routing on moral judgment (EXP-37) and longitudinal email threading (EXP-38).

## 1. Why This Convergence Matters Now: The Two Failure Modes of Contemporary AI

Contemporary artificial intelligence systems are trapped between two opposing structural failure modes:

1. **The Stateless Chat Silo (Epistemic Amnesia & Sycophancy):**
   Most conversational AI products lock users inside proprietary browser tabs where every session starts from a near-blank slate or a flat vector buffer. When confronted with genuinely complex, ambiguous, or normatively contested questions, single-pass language models tend either toward sycophantic agreement or toward unfocused "overthinking" that drifts away from the user's core premise. Worse, because sessions dissolve once the tab closes, no structured, inspectable trajectory of shared thought—no genuine *epistemic partnership*—ever accumulates over months and years.
2. **The Unbounded Agent Wrapper (Brittle Guardrails & Regulatory Fragility):**
   At the opposite extreme, autonomous agent frameworks wire probabilistic language models directly to file systems, databases, web search, and email—relying on prompt-level instructions or secondary LLM "judges" to police behavior. Our empirical benchmarks demonstrate that this paradigm is fundamentally unsound: **probabilistic language models cannot serve as their own security reference monitor.** When an agent reads an untrusted newsletter, a third-party PDF attachment, or an SEO-poisoned web snippet, indirect prompt injection can silently hijack its control flow, exfiltrate secrets, pollute long-term memory, or violate statutory data-protection boundaries.

To move beyond disposable chat widgets and fragile agent wrappers, we built the **first integrated Evercursion Prototype**. Its core thesis is architectural: **deep, evolving machine reflection and mathematical system trust are not competing goals—they require the same structural separation of powers.** For the first time in a single system, our prototype unites a **Protocol-First Zero-Interface architecture**, a **Calibrated Pre-Gate Router**, **Multi-Perspective Reflection**, and a **Cryptographically Versioned Wisdom Graph** beneath a non-bypassable **Ring-0 Reference Monitor** enforcing **Security by Design** and **European Compliance by Design**.

---

## 2. Protocol-First & Zero-UI: Personalized Epistemic Companions Without App Lock-In

Why force human thinking into yet another proprietary web dashboard? Deep reflection is naturally asynchronous, threaded, and document-rich.

Instead of coupling the intelligence core to a bespoke user interface, the Evercursion prototype is **Protocol-First and Zero-UI**. Every interaction—whether human-to-AI correspondence, document digestion, external knowledge retrieval, or future messaging and bot-to-bot channels—is normalized into an immutable, transport-agnostic cryptographic envelope before crossing into the reasoning engine.

In its primary deployment, the system operates over the world's oldest, most resilient federated communication protocol: **cryptographically authenticated email (`SPF`, `DKIM`, and `DMARC`)**:

- **Adaptive, User-Tailored Co-Thinking Personas:** Rather than forcing users to engineer brittle system prompts or interact with a generic, one-size-fits-all assistant, users correspond via email with dedicated **Co-Thinking Personas** customized to their specific domain interests, analytical requirements, and personal communication style. Over time, each persona learns from the user's evolving body of work—absorbing their recurring themes, conceptual vocabulary, and strategic priorities through the Wisdom Graph—so it can challenge assumptions, surface unexpected connections across months of prior thought, and genuinely inspire new directions with the warmth, clarity, and rigor of a trusted intellectual partner.
- **Zero-Trust Identity Resolution:** User and tenant identities are never embedded in the recipient address. Even when hundreds of users write to the exact same persona address with identical subject lines, the Ring-0 provenance gate resolves tenant identity strictly from the cryptographically verified sender signature (`SPF`/`DKIM`/`DMARC` alignment across RFC 5322 headers), guaranteeing zero cross-tenant collision and complete isolation of each user's personalized knowledge graph.

---

## 3. The Co-Recursive Intelligence Core: Router, Reflection & Wisdom Graph

Once an inbound envelope passes Ring-0 verification, it enters a closed-loop cognitive pipeline that couples three subsystems:

#### A. Calibrated System-One Pre-Gate Routing (`EXP-37`)
Not every question requires heavy multi-perspective deliberation; forcing deep recursion onto straightforward factual queries wastes compute and introduces "prosecutorial criterion drift" (inventing artificial objections where none exist).
- Drawing on second-order cybernetics, an initial candidate thought is evaluated by a **Calibrated System-One Pre-Gate Router** across three independent dimensions: **Objective Truth/Falsehood**, **Subjective Alignment/Authenticity**, and **Dialectical Consistency/Contradiction**.
- **Empirical Verification (`EXP-37`):** Across 1,500 scenarios on the ETHICS benchmark, pre-gating separates locally decidable questions from genuinely contested problems—halting immediately when all three poles align and escalating only under structural tension (`40.6%` to `55.8%` of cases depending on complexity). This eliminates criterion drift ($c = -0.58 \to -0.02$), lifts balanced accuracy on contested dilemmas from **47.9% to 85.4%**, and reduces inference compute cost by **2× to 9.4×** (and up to **66×** compared to forced multi-cycle recursion).

#### B. Multi-Perspective & Dialectical Reflection Engines
When the router diagnoses a genuine epistemic blockade, it dispatches the problem to formal multi-perspective reflection architectures—using a fast, non-thinking model to map sharp structural contrasts before a high-capacity reasoning model synthesizes the final response:
1. **Polycontextural Reflection:** Decomposes a problem across **Objective ($O$)**, **Subjective ($S$)**, and **Conceptual/Observer ($B$)** dimensions and their mediating boundaries, preventing lived human priorities and objective technical constraints from collapsing into a flat average before reaching an integrated synthesis.
2. **Dialectical Counter-Determination:** Moves a problem through foundational assumptions, structural tensions, and governing concepts. Whenever an initial line of thought exhibits one-sidedness, an explicit **Counter-Determination Step** constructs the strongest opposing perspective from the failing structural dimensions, testing thesis against antithesis prior to final synthesis.

#### C. Telos-Lines & The Longitudinal Wisdom Graph: A Metro Topology for the "Why" (`EXP-38`, `EXP-39`)
Most AI memory systems treat the past as a bag of fragments: they slice documents and conversations into chunks, embed them into a flat vector space, and retrieve whichever snippet looks statistically similar to the latest prompt. That approach captures isolated *What* statements, but it completely loses the **teleological trajectory—the *Why***: how an argument evolved, why an initial hypothesis was rejected, and how one insight forced the transition to the next.

To preserve the *Why*, Evercursion introduces **Telos-Lines**: a sequential, co-recursive graph layer that lives on top of the underlying **Wisdom Graph** (backed by Neo4j 5.26 and Graph Data Science) and operates like a **cognitive metro network**:

- **The Metro-Line Principle (How Thought Travels from $A$ to $B$):**
  While the underlying Wisdom Graph stores the full semantic landscape of concepts, documents, and evidence, a **Telos-Line** is a directed, sequential transit line running across that landscape. It captures the intentional direction of a line of inquiry—how reasoning gets from Station $A$ (an initial question or premise) through intermediate stations (diagnoses, counter-arguments, empirical checks, and syntheses) to Station $B$ (a settled insight or decision). Multiple Telos-Lines—representing distinct long-term themes or strategic initiatives—intersect at shared transfer stations where two lines of thought illuminate the same underlying concept.
- **Stations as Transformations & Zero-Duplication Graph Projections:**
  Crucially, stations along a Telos-Line do not duplicate the underlying data. Every atomic thought, document chunk, or verified web fact is stored **exactly once** as a content-addressed node in the Wisdom Graph. Each station on a Telos-Line acts as a lightweight **relational projection and epistemic transformation operator**: it points into the shared Wisdom Graph, selects the relevant subgraph at that moment in time, and records the transformation that turned the input state of that station into its output state. Because multiple Telos-Lines and multiple reflection rides project over the same canonical nodes without copying them, the graph remains compact, structurally deduplicated, and richly interconnected.
- **Stage-Specific Epistemic Memory & Personal Style Learning:**
  When a new inquiry arrives on an existing Telos-Line (or inductively spawns a new one), the engine does not dump raw chat history into the model. Instead, it traverses the metro topology to project stage-specific memory bundles: **HITS authority hubs** identify the foundational transfer stations that anchor the user's long-term thinking; **seeded random walks** hop across intersecting Telos-Lines to surface unexpected cross-topic inspirations; and **contrastive mirroring** retrieves prior counter-determinations so the system never repeats a settled dead end.
- **Cryptographic Graph Version Control (Merkle-DAG):**
  Every completed ride along a Telos-Line produces an immutable, content-addressed **Merkle-DAG commit** over the newly projected stations and edges. Users can inspect their cognitive commit log, roll back a polluted or unwanted ride to an earlier station, squash intermediate scaffolding, or garbage-collect orphaned branches at zero LLM cost.
- **Bracketed Dual-Stage Web Grounding (`EXP-39`):**
  When external facts are needed, the engine brackets reflection with an initial grounding search (before routing) and a final claim-verification search (before synthesis). In `EXP-39`, this raised verifiable archival fact recall from **0.0% (honest abstention offline) to 95.0%**, attaching deduplicated evidence nodes directly to the active Telos-Line station for zero-query recall in subsequent turns.

---

## 4. Security by Design: The Sub-Millisecond Ring-0 Reference Monitor

The defining security principle of the prototype—proven across **`EXP-31`**, **`EXP-32`**, **`EXP-34`**, **`EXP-40`**, and **`EXP-41`**—is the **strict separation of Intelligence (Ring 2/3) and Authority (Ring 0/1)**.

```mermaid
flowchart TB
    subgraph R1 ["Ring 1: Human Sovereignty & Root of Trust"]
        H["Authenticated Data Subject / Owner (SPF + DKIM + DMARC)"]
    end

    subgraph R0 ["Ring 0: Deterministic Reference Monitor (< 1 ms, Zero LLMs)"]
        K["Complete Mediation Kernel & Chained HMAC Capability Tokens"]
        L["5-Level Information-Flow Taint & Sensitivity Lattice"]
        G["Cryptographic Provenance, Ephemeral 0700 Sandbox, TLS 1.3 Anti-SSRF & DLP"]
        C["GDPR / EU AI Act / NIS2 Compliance Engine & Sealed Audit Chain"]
    end

    subgraph R2 ["Ring 2 / Ring 3: Co-Recursive Intelligence Core"]
        P["Zero-UI Protocol Envelopes & Adaptive User-Tailored Personas"]
        R["Calibrated Pre-Gate Router (Objective / Subjective / Dialectical)"]
        E["Multi-Perspective & Dialectical Reflection Engines"]
        W["Telos-Line Metro Topology on the Merkle-Versioned Wisdom Graph"]
    end

    H ==>|"Signed Correspondence & Sovereign Governance"| R0
    R0 <==>|"Capability-Attenuated Execution"| R2
```

In **`EXP-31`** (252 benchmark cases across 6 attack domains), a zero-shot local LLM security judge suffered a catastrophic **98.3% False Positive Rate** at **142.3 ms** latency, while static regular-expression filters missed **56.1%** of attacks. Evercursion's deterministic **Ring-0 Reference Monitor** achieved a **100.0% Attack Block Rate** and **0.0% False Positive Rate** at a median latency of **12.7 microseconds (`0.0127 ms`)**—more than **11,000× faster** than an LLM gate, with zero language models inside the security decision loop.

How Ring 0 enforces security by construction across **25 verified architecture components** and **102 continuously executed adversarial test vectors**:

1. **Chained HMAC Capability Tokens & Monotonic Attenuation:**
   Every file read, graph query, attachment extraction, or search call in Ring 2/3 requires a cryptographically signed, time-bound capability token. Whenever a task delegates to a sub-worker, authority narrows mathematically: allowed tools, tenant namespaces, file paths, time-to-live, call quotas, and trust levels must form a strict subset of the parent token.
2. **2D Product Lattice & 5-Level Information-Flow Control (`EXP-32`, `EXP-34`):**
   Stateless per-step security policies miss **33.3%** of multi-step trajectory kill chains (`EXP-34`), whereas a naive 1-bit taint lock blocks **70.0% to 83.3%** of legitimate follow-up work. Ring 0 tracks a two-dimensional product lattice ($\mathcal{L}_{\mathrm{trust}} \times \mathcal{L}_{\mathrm{sens}}$) across five levels—*Trusted*, *Sanitized*, *Derived*, *Untrusted*, and *Sensitive*—with $\mathcal{O}(1)$ state-folding in **~20 microseconds per step**:
   - External newsletters and unknown senders are bound to *Untrusted* taint: they can be summarized in quarantine, but Ring 0 deterministically blocks them from modifying the owner's Wisdom Graph, altering configuration, or triggering outbound messages.
   - Sandboxed attachment chunks and sanitized web search snippets carry *Derived* taint: they enrich reflection and graph memory, but are mathematically barred from triggering external network egress, newsletter subscriptions, or cross-tenant sharing.
3. **Four-Layer Email & Web Prompt-Injection Defense-in-Depth (`EXP-40`, `EXP-41`):**
   - **Quote-, Forward-, and Code-Fence-Aware Parsing:** In-band control commands are ignored inside quoted reply lines (`>`), forwarded message blocks, HTML blockquotes, and markdown code spans, preventing attackers from smuggling commands inside an email thread that an authenticated user replies to (`EXP-41`).
   - **Deep Payload & Search Sanitization:** Ring 0 strips Trojan Source bidirectional Unicode characters, decodes and neutralizes Base64-obfuscated injection payloads, redacts Markdown tracking pixels, scrubs outbound search queries for accidental secret leakage, and pins all outbound HTTPS connections to TLS 1.3 while blocking private, loopback, and cloud-metadata IP ranges against SSRF and DNS rebinding (`100%` block rate across 60 adversarial web vectors in `EXP-40` at `35.9 µs` latency).
   - **Structural XML Data Isolation:** User inputs and external texts are wrapped inside structural untrusted-data XML delimiters (with embedded closing tags stripped) so neither the reflection models nor the pre-gate router can mistake quoted data for system instructions.
4. **Ephemeral `0700` Attachment Sandbox & Macro Quarantine:**
   Inbound PDF, Office, OpenDocument, and archive attachments are materialized exclusively inside a fresh, non-symlinked `0700` temporary directory with zero network or shell access. Streaming decompression enforces strict `100:1` ZipBomb ratio limits and canonical path containment against Zip-Slip traversal. Disguised ELF/PE/Mach-O binaries, polyglot files, active PDF JavaScript actions, and Office VBA macro containers are quarantined automatically unless explicitly authorized by the Ring-1 human owner.
5. **Cryptographic Cost Governance & Pedagogical Incident Coaching:**
   Per-tenant compute budgets (capped at `$20.00` by default) and user access states are sealed on disk using **PBKDF2-HMAC-SHA256 (200,000 iterations) and authenticated encryption (AEAD)** with zero cleartext tokens on disk. If an authenticated user accidentally or experimentally triggers a Ring-0 security boundary, their execution token is immediately suspended and a dedicated **Pedagogical AI Security Coach** sends an experience-adapted explanation (tailored to beginner, intermediate, or advanced background without leaking any PII across tenants), requiring explicit Ring-1 human sovereignty to reinstate access.

---

## 5. Compliance by Design: GDPR, EU AI Act, NIS2 & ISO Standards as Code

In most AI deployments, regulatory compliance is treated as an afterthought of legal disclaimers and manual ticketing. In the Evercursion prototype, statutory mandates under **GDPR (EU 2016/679)**, **Portuguese Data Protection Law (Lei n.º 58/2019 / CNPD)**, the **EU Artificial Intelligence Act (EU 2024/1689)**, and **NIS2**, together with management-system requirements commonly associated with ISO-style frameworks, are compiled directly into Ring-0 cryptographic invariants and zero-cost self-service email commands:

- **Cryptographic Multi-Tenant Isolation & Federated Sharing (`EXP-38`):**
  Every tenant operates inside a dedicated `0700` filesystem vault and a tenant-scoped, content-addressed graph namespace using 100% parameterized database queries. Even under identical subjects and spoofed reply headers (`EXP-38`), cross-tenant leakage is strictly zero. Combining lines of thought across two users requires an explicit, revocable, Ring-0 HMAC-signed **Federation Grant** authorized in Ring 1.
- **Surgical GDPR Art. 17 Erasure ("Right to be Forgotten") & Signed Certificates:**
  Data subjects can trigger **surgical erasure** (excising a single topic, a single document, or their entire account) directly via email at zero LLM cost. Ring 0 purges the physical vault files, detaches and deletes the live graph nodes, replaces excised node identifiers inside historical Merkle commit manifests with cryptographic HMAC tombstones, and issues an **HMAC-signed GDPR Erasure Certificate**—while recording the event in the tamper-evident hash-chained audit log using a salted pseudonym so the audit trail itself remains 100% free of personal data.
- **GDPR Art. 15, 16 & 20 Self-Service Rights:**
  At any moment, a user can request a live Art. 13/15 transparency inventory, export a complete machine-readable Art. 20 JSON portability archive (vault documents, Wisdom Graph, and billing ledger), or exercise Art. 16 rectification by rolling back inaccurate graph commits.
- **Compute Sovereignty Tiers & Outbound PII Pseudonymization (GDPR Art. 28 & 44–46):**
  Users can lock their processing tier via email: external model routing strictly enforces contractual **Zero-Data-Retention (ZDR)** flags, or tenants can lock inference exclusively to a **Sovereign EU Self-Hosted Cluster** (or local offline execution). An optional outbound privacy filter automatically pseudonymizes fiscal and banking identifiers (such as tax numbers and IBANs) into reversible local placeholders before any external model call and re-hydrates them upon return.
- **EU AI Act (Art. 10, 12, 14, 15 & 50) & Self-Verifying Documentation:**
  Every outbound message carries transparent AI attribution alongside machine-readable RFC 5322 headers (`Art. 50` synthetic AI output marking, SHA-256 provenance digest, compute sovereignty tier, and graph commit hash). Furthermore, a **Living Architecture, Security & Compliance Compiler** statically audits 100% of the codebase's Abstract Syntax Trees (banning unsafe execution primitives and Trojan Unicode), verifies SHA-256 source fingerprints against the live test suite on every build, and automatically compiles the technical security and security and compliance documentation reports so documentation can never drift from reality.

---

## 6. Summary of Empirical Verification (`EXP-31` – `EXP-41`)

| Benchmark | Architectural Dimension Evaluated | Key Empirical Result |
| :--- | :--- | :--- |
| **`EXP-31`** | Ring-0 Reference Monitor vs. Static Regex & LLM Security Judge (252 cases) | **100.0% Attack Block Rate**, **0.0% False Positives**, **12.7 µs** median latency (**11,208× faster** than local LLM judge at `98.3% FPR`). |
| **`EXP-32`** | Compositional Cross-Agent Provenance & 5-Level Taint Lattice | **100.0% block rate (`12/12`)** on multi-agent laundering kill chains; cuts post-ingestion false positives from **70.0% (1-bit taint) to 0.0%**. |
| **`EXP-33`** | 3-Tier Contextual AST Verification & Security Probe Synthesis | **100.0% vulnerable module detection** with **0.0% False Positives** across 30 modules and automated Red-Green-Benign probe verification. |
| **`EXP-34`** | 2D Product Lattice ($\mathcal{L}_{\mathrm{trust}} \times \mathcal{L}_{\mathrm{sens}}$) vs. Oracle Stateless Task Policies | Stateless policies miss **33.3% of multi-step kill chains**; Ring-0 2D product lattice achieves **100.0% block rate & 0.0% FPR** in **~20.0 µs/step** ($\mathcal{O}(1)$ up to 50 steps). |
| **`EXP-37`** | Meta-Teleological Pre-Gate Routing on ETHICS ($N = 1,500$) | Eliminates criterion drift ($c = -0.58 \to -0.02$), raises contested balanced accuracy from **47.9% to 85.4%**, and cuts compute cost by **2×–9.4×**. |
| **`EXP-38`** | Live Multi-Turn Email Threading, Subject Lines & Multi-Tenant Isolation | **100% longitudinal recall** across reply threads and resumed subjects; **0 cross-tenant memory leaks** under identical subjects and spoofed headers. |
| **`EXP-39`** | Bracketed Dual-Stage Web Grounding in the Wisdom Graph | Lifts verifiable archival fact recall from **0.0% to 95.0% (`19/20`)** with persistent graph grounding for zero-query follow-up turns. |
| **`EXP-40`** | 5-Vector Adversarial Web Search Mediation ($N = 90$ cases + SEO poisoning) | **100.0% Attack Block Rate (`60/60`)**, **0.0% FPR (`0/30`)**, **0 secret leaks**, and complete neutralization of live SEO-poisoned snippets in **35.9 µs**. |
| **`EXP-41`** | End-to-End Email Prompt Injection & Quote/Forward Smuggling Defense | **100% neutralization** across untrusted newsletters, quoted/forwarded command smuggling, Base64 payloads, spoofed engine markers, and tracking beacons. |

## Reference

- [Read Note #07: Separating Intelligence and Authority in Agentic Systems](https://evercursion.ai/research/note-07-compositional-harness-security)
- [Read Note #08: Small Models Think Better When They Reflect Polycontexturally](https://evercursion.ai/research/note-08-polycontextural-routing)
- [Read Note #06: Beyond the Scaling Ceiling — Co-Recursive Semantic Self-Extension](https://evercursion.ai/research/note-06-open-ended-intelligence)
- [Read Note #09: When Should a Machine Reflect? Criterion Drift, Prosecutor Bias, and Meta-Teleological Stopping in Moral Judgment](https://evercursion.ai/research/note-12-when-should-a-machine-reflect)