# Integrity Kernel MOC
The **Integrity Kernel** is a deterministic, cross-domain anomaly-detection layer for industrial control systems (ICS / [[The OT Intelligence Layer|OT]]). Instead of scoring how "weird" a reading looks, it answers a harder question — *are we still allowed to act on this system?* — and answers it reproducibly enough to stand as evidence. Built by Nabiel H at Admissibility Systems (Doha, Qatar).
> [!abstract] The one-sentence version
> A fixed, unmodified trust core runs eight rules and six proven invariants to drive a four-state trust machine, producing bit-identical results across four physically distinct water/process domains — turning anomaly detection into a [[Fail-Closed Trust Gate|fail-closed gate]] backed by [[Frozen Evidence Baseline|admissible, frozen evidence]].
## How it works
- [[Four-State Trust Machine]] — `TRUSTED → DEGRADED → UNTRUSTED → SAFE_STATE`; trust is the output, and it degrades monotonically.
- [[Detection Rules]] — the eight rules (R1–R8) that catch deviation.
- [[Pressure Baseline Drift]] — R5/R5b, the most discriminative check (1,262× SWaT, 1,188× HAI).
- [[Proven Invariants]] — 6 of 15 proven (I1–I6); what must always hold.
- [[Fail-Closed Trust Gate]] — execution validity vs. prediction quality; deny-by-default.
## Why it's defensible
- [[Deterministic Detection]] — the core architectural property; reproducible over 899,838+ rows via SHA-256.
- [[Common Trust Core]] — one unmodified `kernel.py` everywhere.
- [[Profile-Based Portability]] — new sites are a profile, not a code fork.
- [[Cross-Domain Validation]] — same core across SWRO, WADI, HAI 21.03, SWaT.
## Evidence & scope
- [[Frozen Evidence Baseline]] — `IK_MASTER_PROGRAM_FREEZE_V1`, 27 proven claims.
- [[Unvalidated Components]] — ACE, MCC, Command Validation (honestly excluded).
- [[Maturity Levels]] — currently Level 3; pilot drives Level 3 → Level 4.
## Path to deployment
- [[Deployment Path]] — Replay → Advisory → Enforcement (pilot phases 1A/1B/1C).
## Related notes in this vault
> [!info] Connections to existing thinking
> The Integrity Kernel sits at the intersection of industrial AI, evidence-based diligence, and infrastructure defensibility already mapped elsewhere in the vault.
- [[The OT Intelligence Layer]] — the broader OT data/trust opportunity this lives inside.
- [[Industrial AI MOC]] — consultancy-vs-platform and [[Deployment Velocity]] framing apply directly.
- [[Evidence Hierarchy]] — the proven/claimed discipline behind the frozen baseline.
- [[Technical DD Framework]] — how an investor would pressure-test these claims.
- [[Data Moat]] · [[Switching Cost Design]] — why a fixed, embedded trust core compounds.
- [[Sovereign AI Positioning]] — GCC critical-infrastructure go-to-market (Qatar / Kahramaa).
- [[Renacore/Security and Zero Trust]] · [[Renacore/Pilot Structure and KPIs]] — adjacent OT-security and pilot patterns.
- [[IP Strategy for Deep Tech Startups]] — protecting a deterministic core + evidence package.
- [[The Age of Vertical Models]] · [[Selling AI MOC]] — vertical, trust-led enterprise motion.
## Map
```mermaid
graph TD
MOC[Integrity Kernel] --> Core[Common Trust Core]
Core --> Rules[Detection Rules R1-R8]
Core --> Inv[Proven Invariants I1-I6]
Rules --> R5[Pressure Baseline Drift]
Rules --> FSM[Four-State Trust Machine]
Inv --> FSM
FSM --> Gate[Fail-Closed Trust Gate]
Core --> Port[Profile-Based Portability]
Port --> Val[Cross-Domain Validation]
Core --> Det[Deterministic Detection]
Det --> Freeze[Frozen Evidence Baseline]
Freeze --> Unval[Unvalidated Components]
Gate --> Deploy[Deployment Path]
Deploy --> Mat[Maturity Levels]
class Core,Rules,Inv,R5,FSM,Gate,Port,Val,Det,Freeze,Unval,Deploy,Mat internal-link;
```
---
Source: `Nabiel - Integrity Kernal` submission package (Read Me, Overview, Technical Summary, Pilot Proposal, Founder Brief).
Tags: #integrity-kernel #deeptech #systems #kp