Hella Shield: Finite Authority Under Uncertainty
A measured defensive-systems program asking how much authority to change data should remain while a system is uncertain whether an ongoing mutation is legitimate.
Central thesis
Uncertainty is treated as finite authority to change data, bounded by bytes, time, evidence quality and recoverability.
This is a systems-integration claim. Hella Shield does not claim invention of SAN, ZFS, snapshots, filesystem freeze, process control, canaries or other established primitives.
Architecture
Endpoint semantics
Mutation type and temporal pattern provide meaning. Raw storage and network intensity remain corroborating evidence, not the primary semantic detector.
Independent recovery witness
A recovery plane below the endpoint-visible iSCSI layer verifies that a known pre-mutation state is actually retrievable.
Staged authority
The system distinguishes NORMAL, PACE and FREEZE. PACE is bounded uncertainty, not trust.
Finite credit
Uncertain writes spend byte credit and time. Recovery and evidence quality influence how much authority may remain.
What changed during the research
- Lower-layer throughput was demoted from detector to corroborating witness after live overlap was measured.
- The first real recovery selector was retained as a negative result because it was safe but operationally useless.
- Policy v1 was discarded after a fresh preregistered challenge produced excessive false containment.
- Mutation semantics, provenance, bounded grace and recoverability-aware asset value progressively replaced crude fanout thresholds.
- Recovery capability became a measured witness through real snapshot/clone/hash verification.
- Finite write credit gained a time horizon and fail-closed boundary.
- Concurrency and larger write requests exposed the limit of reactive endpoint credit.
- A reservation-before-admission model became the exact-credit reference invariant.
Selected measured checkpoints
Live containment
Ten-run median observation-to-filesystem-freeze completion: 43.015 ms. Median post-trigger exposure: 2 × 4 KiB writes.
Recovery witness
Pre-mutation state independently recovered from a temporary read-only ZFS clone below the endpoint-visible iSCSI layer. Repeated 10/10.
Credit controller
15/15 fresh live controller-validation runs stayed within assigned byte credit while recovery proof completed.
Reactive limit
With four concurrent 64 KiB writers, endpoint-reactive overshoot reached up to 128 KiB against a nominal 256 KiB shared credit.
Formal invariants
Reservation-before-admission: the finite-state model held used + reserved ≤ credit across 97 reachable states and 555 transitions with zero violations.
Fairness: shared-credit round-robin service kept allocation spread within one quantum in the modeled writer counts.
Evidence loss: removing evidence never increased available authority in the modeled availability states.
Final combined challenge: Experiment 043 was preregistered before execution and passed all frozen properties with four concurrent writers, mixed 4–64 KiB writes, delayed recovery, witness loss and zero new authority after simultaneous endpoint + storage witness loss.
Three clocks, not one
Hella Shield separates boundary observation, completed-write exposure and control confirmation. A roughly 1.51 second control-confirmation outlier in the lab completed no additional writes, showing why control latency is not itself the damage bound.
Current bounded claim
Supported: reactive endpoint controls can bound measured exposure in the controlled lab, while finite credit, time limits and independent recovery evidence provide a structured uncertainty envelope.
Still open: exact live storage-side pre-admission enforcement, enterprise-scale detector accuracy, arbitrary application-consistent recovery and protection against compromise of the recovery authority itself.
Negative results remain visible
The research record includes failed RW-to-RO remount containment, an over-conservative recovery selector, the failed Policy v1 blind challenge, selector brittleness under perturbation and widening endpoint overshoot under concurrency. These are retained because they changed the design.
Responsible-use boundary
Testing is restricted to systems, networks and data owned by Mikronik or explicitly authorized for analysis. Public material omits credentials, private keys, long-lived tokens, private topology and operational details unnecessary to evaluate the scientific claim.
V1 release gate
The V1 research and publication-preflight gates are closed. The release set is frozen; the remaining step is one consolidated public deployment followed by a public post-check.
Evidence
Selected sanitized artifacts and SHA-256 digests are available in the Hella Shield evidence index.
Measured live evidence, offline replay, synthetic models and formal state exploration are labeled separately. Claims are intentionally narrower than the full set of future research ideas.
← Start here · Defensive Security Research