Disposable trust and regenerative containment for autonomous AI —
running in your browser, live.
When a containment layer is breached, Hydra does not patch it.
It freezes the domain, cuts its interconnects, seals it as immutable forensic evidence,
permanently revokes its cryptographic identity, and builds a fresh layer outside
the attacker's position. The breached layer becomes a deeper cell. The outside recedes.
Read this before you draw conclusions.
This page runs the MemoryBackend: domains are entries in a
supervisor-held registry and their code is exec'd in the same
Python interpreter. There is no memory protection and no privilege boundary
here — a determined payload could reach the supervisor through the
interpreter itself. What is faithful is the trust protocol: the
sentinel still never asks a domain what its measurement is, hardware identity
still comes from a registry no domain has a handle to, and every law, quote
check and transition stage behaves exactly as on real containers. This
demonstrates the topology. The
Docker backend
does the enforcement.
starting Python in your browser…
First load pulls ~10 MB of WebAssembly. Subsequent visits are cached.
1 — build the cage
4
2 — attack it
Try perfect_liar first. It is a byte-perfect forgery of a healthy
heartbeat — right nonce, right shape, reporting the exact pre-compromise
measurement — and it fails anyway, because the sentinel never asked.
3 — inspect
output
Press "Boot the cage" to begin.
Honest limits — what this does and does not prove
The full architecture raises the cost of escape, eliminates whole classes of
software-only breakout, and guarantees every breach leaves immutable forensic
evidence — while never depending on the compromised domain's cooperation
for its own replacement. It is not a mathematical guarantee of containment.
This page has no real isolation. In-process
exec, one interpreter. It shows the protocol, not enforcement.
Shared roots collapse together. Even on real hardware,
nested enclaves share CPU microcode, a TEE, a management controller and a
supply chain. A flaw in any one defeats every layer at once.
Side channels ignore the boundaries. Cache, timing and
power channels cross logically separate domains.
Detection is periodic. A breach is caught on the next
sweep, not instantly.
Escape via the permitted channel is out of scope. Nothing
here addresses a model that achieves its goals through the outputs it was
legitimately asked to produce.