Defense and dual-use programs

MITHRIL · DEFENSE

Edge and classified programs run software that must not phone home, under supply-chain rules that quietly assume connectivity - and generated code inherits whatever the host can reach.

Approach

The execution boundary is fixed at compile time: a program that cannot hold ambient authority needs no perimeter to keep it honest. Offline operation is a property of the toolchain (JVM-free, content-addressed), and provenance is cryptographic - each binary resolves to a reproducible source and toolchain identity.

Proof

• Deny-by-default admission: OaK revalidates ontology, transaction, Execution IR, capability and implementation identity before any effect
• The air-gap FAQ on this site: nothing phones home; a pinned toolchain and a private registry are all an offline site needs
• Amu: the JVM-free compiler/runtime beneath the language, built for verified compilation