"Small is secure. Bloat is vulnerability. Infrastructure is not a personality."
HERESY-SEC is a minimal, verifiable security monitor for AI agent systems, built on the QSOLAI deterministic kernel. It challenges bloated SIEM/EDR solutions by treating security as computation rather than infrastructure.
- Monitors AI agent actions via canonical JSON normalization
- Enforces policies through deterministic verification (not heuristics)
- Generates mathematical proof receipts for every decision (QEC-inspired)
- Provides exact replay for incident forensics
- Alerts via sonification (using SPECTRAL toolkit) when anomalies occur
- No cloud dependencies (runs entirely on your infrastructure)
- No heuristic detection (uses mathematical verification instead)
- No bloat (326-byte core vs. 500MB+ SIEM agents)
- No black boxes (every decision is replayable and auditable)
- QSOLAI — Deterministic orchestration kernel
- QEC — Quantum error correction proof system
- HERESY — Minimal desktop philosophy
- SPECTRAL — Sonification alerts
No package installation required:
git clone [https://github.com/multimodalas/HERESY-SEC.git](https://github.com/multimodalas/HERESY-SEC.git)
cd HERESY-SEC
python -m heresy_sec selftest
python -m heresy_sec init demo
python -m heresy_sec run demo/task.json --policy demo/policy.json --runs-dir runs
🧪 Quick Start
1. Initialize a Demo Environment
python -m heresy_sec init demo
2. Run a Security Policy Check
python -m heresy_sec run demo/task.json --policy demo/policy.json --runs-dir runs
3. Verify a Run
python -m heresy_sec verify runs/<run_name>
4. Replay an Incident
python -m heresy_sec replay runs/<run_name>
📜 Determinism Contract
For one engine/source-bundle version:
same canonical task envelope
+ same canonical policy pack
+ same mutation index and run nonce
+ same agent manifests
+ same captured worker-output bytes
= same normalized candidates
+ same verification results
+ same decision
+ same event chain
+ same final output bytes
+ same manifest hashes
+ same deterministic archive bytes
Live worker generation in CAPTURED_LIVE or EXPLORATORY is outside this equality. HERESY-SEC commits only to exact post-capture processing. CANONICAL_REPLAY never invokes a live worker.
🛡️ Security & Authority Boundary
HERESY-SEC does not execute worker-proposed actions. It has:
No default network client
No cloud requirement
No database server
No telemetry service
No dynamic code execution
No pickle path
No unrestricted process launcher
Deferred profiles—READ_ONLY_EXTERNAL, WORKSPACE_WRITE and CONTROLLED_EXECUTION—are documentation labels only and are not implemented in v0.1.0.
🧩 Core Components
1. Canonical JSON Normalization
{
"agent_id": "agent_7f2a9c",
"timestamp": "2026-07-28T11:04:22Z",
"action_type": "dataset_loader",
"parameters": {
"dataset_name": "user_uploads",
"execution_mode": "remote_code"
},
"canonical_hash": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
}
2. Hash-Chained Receipts
Every agent action generates a receipt linked to the previous one:
{
"receipt_id": "receipt_8h3k2d",
"previous_hash": "sha256:8h3k2d...",
"action_hash": "sha256:9f86d08...",
"policy_hash": "sha256:p0o9i8...",
"timestamp": "2026-07-28T11:04:22Z",
"signature": {
"alg": "EdDSA",
"sig": "c5af83...",
"public_key": "8f3b2c..."
}
}
3. Minimal Policy Engine
# Example: 326-byte policy enforcement
class PolicyEngine:
def __init__(self):
self.ipc_slots = [None] * 32 # Fixed IPC slots (HERESY-inspired)
self.services = {
'file': self._file_service,
'network': self._network_service,
'process': self._process_service
}
def verify(self, action):
"""Minimal policy check (326 bytes of logic)"""
if action['slot'] not in range(32):
return False
if action['service'] not in self.services:
return False
return True
📊 Run Artifacts
Each completed or review-pending run contains:
task.json policy.json
implementation.json plan.json
prompts/ observations/
candidates/ verification/
decision.json final.json
final.txt event-log.jsonl
manifest.json README_ORIGIN.txt
human-approval.json # only after applicable review
The manifest commits to every other file by exact byte length and SHA-256.
🧪 Quality Gates
From a clean checkout:
python -m unittest discover -s tests -v
python -m heresy_sec selftest
python scripts/audit_architecture.py
python scripts/audit_network.py
python scripts/build_zipapp.py
python scripts/verify_size.py dist/heresy_sec.pyz
📚 Runnable Examples
network_constraint — deterministically rejects unauthorized network access
process_boundary — enforces process execution limits
file_integrity — verifies file system constraints
ipc_slot_management — manages fixed IPC slot allocations
🎨 Philosophy
HERESY-SEC Manifesto
Small is secure. Bloat is vulnerability.
Determinism over heuristics. Mathematical proofs > pattern matching.
Proof over promises. Cryptographic receipts > marketing claims.
Minimalism over complexity. 326 bytes > 500MB+.
Verification over virtue. Replayable evidence > trust.
The Asymmetry Problem
While attackers face no restrictions, defenders using commercial AI services often hit safety guardrails when analyzing attack payloads. HERESY-SEC solves this by using self-hosted open-weight models for unrestricted forensic analysis.
📈 Roadmap
v0.1.0 (Current)
✅ QSOLAI kernel integration
✅ Basic policy engine
✅ Canonical JSON normalization
✅ Hash-chained receipts
v0.2.0 (Next)
🚧 Sonification alerts (SPECTRAL integration)
🚧 Network boundary policies
🚧 Process execution constraints
🚧 File system integrity checks
v0.3.0 (Future)
📋 Multi-agent coordination
📋 Anomaly detection models
📋 Community threat intelligence
📋 Satirical bloat metrics
🤝 Contributing
We welcome contributions that align with our design philosophy:
Radical minimalism — Every byte must justify its existence
Deterministic execution — No hidden state, no non-determinism
Formal verification — Mathematical proofs over heuristics
Interdisciplinary inspiration — Quantum error correction, retro computing, etc.
Contribution Process
Fork the repository
Create a feature branch (git checkout -b feature/amazing-feature)
Commit your changes (git commit -m 'Add amazing feature')
Push to the branch (git push origin feature/amazing-feature)
Open a Pull Request
Development Setup
git clone [https://github.com/multimodalas/HERESY-SEC.git](https://github.com/multimodalas/HERESY-SEC.git)
cd HERESY-SEC
python -m pip install -e ".[dev,science]"
pytest -q -ra
📜 License & Lineage
HERESY-SEC is licensed under the Mozilla Public License 2.0. It is a clean implementation informed conceptually by:
QEC — Quantum error correction proof system
RES=RAG — Relational equilibrium framework
SONIFICATION — Deterministic sonification toolkit
SPECTRAL — Audio geometry and analysis
Ternary Drift — Ternary computation patterns
Attribution and boundaries are recorded in SOURCE_LINEAGE.md and NOTICE.md.
🐍 About
HERESY-SEC — A deterministic AI agent intrusion detection system built on QSOLAI. 326 bytes of policy. Zero cloud dependencies. Heresy against security infrastructure religion.
github.com/multimodalas/HERESY-SEC
🏷️ Topics
deterministic-security agent-monitoring bloat-free quantum-inspired intrusion-detection ai-agents minimalist heresy qsolai qec
Remember: Infrastructure is not a personality. Security is not a product. It's a proof.