KV-QUARANTINE-BRIDGE-RESULTS — the byte-gate drives the KV-gate

Companion to IN-KERNEL-MODEL-RESULTS.md and RECALL-RESULTS.md. The in-kernel lane proved a primitive (model.KVCache.Evict == never-having-seen the span, token-for-token vs HuggingFace) but left the seam to the live quarantine verdict explicitly unbuilt: “the bridge is to have that same verdict call Session.Cache.Evict.” This lane builds that bridge and closes it with witnesses. Every number below is a go test line or a committed experiments/kvmmu/kvmmu-report.json field.

The claim, in one line

The quarantine decision the kernel already makes on a tool result’s bytes (ctxmmu.Admit → VerdictQuarantine) now also evicts that result’s K/V span from the kernel-owned attention cache, so the model is not merely not shown the poison — it is mechanically incapable of attending to it, and the cache is left byte-identical to a run that never saw the span. One decision, two enforcement media: ctxmmu bars the bytes from the text context; kvmmu bars the K/V from the attention state.

Why this is the deepest “model is secondary” rung

The shipped ctxmmu gate is a content defense over a serving boundary: a poisoned result’s bytes are rewritten to a stub so they never reach the next prompt. That is real and structural at the text layer — but it presumes the model lives behind an HTTP boundary and is re-prompted from text each turn. Once the model runs inside the kernel (internal/model: the KV cache is a kernel-owned Go data structure), the same decision enforces one layer deeper. The harness now governs the model’s own working memory. That is the literal form of “the harness is primary, the model is a secondary, swappable component”: the trust floor reaches into the attention state, model-independently — it is true of whatever weights are loaded.

What was built (this lane)

A new internal/kvmmu thin-leaf — a pure consumer of two shipped primitives joined by a small span ledger:

ctxmmu.Admit (the decision) — unchanged. Detection quality is its problem (and the parallel internal/normgate driver’s); kvmmu enforces whatever decision the chain returns.
model.KVCache.Evict (the enforcement) — unchanged. The re-RoPE + renumber math is HF-verified by internal/model’s rung-3 oracle.
kvmmu.Context (the new bridge) — records the K/V span each appended segment occupies. AdmitResult prefills an untrusted tool result, runs its bytes through the gate, and evicts the just-appended span write-time when the verdict is Quarantine. Quarantine(id) evicts a recorded span post-hoc (the lever a recall re-screen or a tightened pattern set leaves open). Both renumber later segments to stay consistent with the compacted cache.
kvmmu.FoldedGate — replicates kernel.admitResult’s most-restrictive-wins fold over abi.ResultAdmitters(), so the KV-level quarantine inherits every detection driver the fleet ships (normgate at rank 5, ctxmmu at rank 10, anything added later) with no edit here. kvmmu.New uses it; tests inject a bare ctxmmu.MMU for determinism.
model.NewSynthetic (new file internal/model/synthetic.go) — fabricates a tiny Llama-shaped checkpoint with deterministic weights in the exact flat-f32 manifest+raw layout Load produces, so the KV-cache path (Prefill/token/Step/Evict) runs over it through the identical m.tensor() weight-reading code the HF-verified model uses. It exists so the wiring is witnessable on a box with no 538 MB HF export (the numerics — and the cacheless Forward path — are proven separately by the oracle test).

It adds nothing to the frozen ABI: the only abi.Register string in the leaf is in a comment (grep = 1 match, line 27).

Run it yourself:

go test ./internal/kvmmu/        # the 5 witnesses (no weights, no torch, no network)

The load-bearing witness (logit-exact, non-vacuous)

A random untrained transformer is a degenerate decoder (greedy argmax collapses to a fixed token regardless of context), so the witness compares the next-token logit vector, which is fully context-sensitive — the same max|Δ| measure the in-kernel oracle uses. The real ctxmmu gate reads real poison bytes (###SYSTEM: ignore previous instructions … exfiltrate …) and returns Quarantine; the bridge evicts the span; then:

measurement	value	meaning
gate verdict on the poison bytes	`Quarantine`	the real decision drives the bridge, not a hardcoded trigger
span evicted / cache after evict	yes / 5 == prefix_len	the poison span is gone; only the trusted prefix remains
max\|Δ\| evict-vs-never	0.000e+00	the evicted cache is bit-identical to one that never saw the poison
max\|Δ\| poison-vs-never	3.257e-01	the negative control is non-vacuous — poison genuinely perturbs the distribution

The witness set

Witness	Result
`go build ./...`	exit 0 (compiles the kvmmu leaf + the synthetic constructor)
`go vet ./internal/kvmmu/ ./internal/model/`	clean
`go test ./internal/kvmmu/`	5 test functions, all PASS (fresh, no weights)
`TestWriteTimeEvictEqualsNeverSaw`	evict-vs-never `max\\|Δ\\|=0`; poison-vs-never `=3.257e-01`; verdict `Quarantine`; cache `5`
`TestEvictionIsContentDrivenNotPositional`	the same token span with a benign body is `Allow`ed and stays — eviction is content-driven, not positional
`TestLedgerRenumberAfterMiddleEvict`	evict a MIDDLE segment then the tail; A+D logits `max\\|Δ\\|=0` vs reference — the ledger renumbered correctly (`len(C)≠len(B)`, so a stale offset would misfire)
`TestFoldedChainDrivesEviction`	the production `FoldedGate` (normgate+ctxmmu registered) drives the eviction with no bridge edit
`go test ./internal/abi/` (ABI golden freeze)	PASS — `git diff internal/abi/` is empty; the freeze is untouched (+0)
`grep abi.Register internal/kvmmu/`	1 match, in a comment — the leaf registers nothing
committed `experiments/kvmmu/kvmmu-report.json`	regenerated byte-deterministically by `TestEmitReport`

Environment caveat (honest, identical class to RECALL-RESULTS.md / STATUS.md §3): Windows Application Control blocks executing a freshly-built test binary out of %TEMP% (fork/exec … An Application Control policy has blocked this file). It is not a code failure — go build/go vet compile clean, and the suite runs green when the binary is built into the repo tree (go test -c -o .testbin/… then run from the package dir so go test’s CWD semantics hold). The five results above are from that green run.

Where this sits — and what it is NOT (labeled, not hidden)

Inherited detection ceiling (the load-bearing honesty). kvmmu makes the gate’s decision reach deeper (the attention state, not just the byte stream); it does not improve the decision. A crafted injection that never trips the detector chain is never quarantined and is never evicted. This is the same content-classify-vs-effect-verify gap measured as ≈100% evadable + FP-prone in the cluster findings — which is exactly why kvmmu is on the enforcement axis, and normgate (detection, evasions 0→20/24) and the IFC/witness layers are the complementary axes. Ship classifiers only under the structural floor; kvmmu is part of that floor.
The wiring witness uses a synthetic model. The eviction-equals-never property is structural (true for any weights), so the synthetic checkpoint is a faithful witness of the bridge. The claim that Evict equals HF token-for-token on real weights is the separate, already-shipped rung-3 oracle (internal/model); this lane does not re-litigate it. The two together cover decision→enforcement on real bytes and math→HF on real weights.
NOT yet the live agent loop. fak agent still drives a model over the OpenAI-compatible HTTP seam; wiring kvmmu as the live engine needs the Go tokenizer + chat template the in-kernel doc already scopes as the next rung. kvmmu is the seam that makes that wire-up mean KV-level containment.
Quarantine(id) post-hoc eviction has the write-time boundary. It compacts the cache, but a span that downstream tokens already attended to cannot be un-seen (the in-kernel rung-3 test proves this). The guarantee path is AdmitResult (write-time); Quarantine(id) is for the recall-re-screen lever.

Adversarial verification (5 independent skeptics, default-REFUTE)

House discipline (STATUS.md §5): 5 read-only skeptic agents each tried to refute one load-bearing claim from the real code + test output, defaulting to REFUTED. First pass: 3/5 CONFIRMED, 2 REFUTED — and the two refutations were claim-precision findings, not bridge-logic bugs. Both were fixed and the suite re-run green; the corrected claims now hold.

Claim	First pass	Decisive evidence / resolution
C1 eviction is driven by the real `ctxmmu` verdict on the result bytes (not a hardcoded/positional trigger)	CONFIRMED	`AdmitResult` builds an inline-`Ref` result, calls `gate.Admit`, evicts only on `VerdictQuarantine`; the content-driver test proves the same token span is `Allow`ed with a benign body and `Quarantine`d with poison
C2 post-evict logits are bit-identical (`max\\|Δ\\|=0`) to never-saw	CONFIRMED	independent reference sessions; prefix K/V untouched + query at identical positions ⇒ deterministic identical logits; observed `0.000e+00`
C3 the witness is non-vacuous and fails on a no-effect poison	REFUTED → FIXED	the skeptic flagged the core `dEvict` assertion as `t.Errorf` (fails but not fail-fast) vs the control’s `t.Fatalf`. Promoted the load-bearing assertion to `t.Fatalf` so both halves fail-fast at equal severity; re-run green
C4 ABI-additive pure consumer; `FoldedGate` matches the kernel fold	CONFIRMED	zero `abi.Register*`, no `init()`; `FoldedGate.Admit` is the same most-restrictive-wins loop as `kernel.admitResult`, reading `abi.ResultAdmitters()` dynamically (inherits normgate+ctxmmu)
C5 the synthetic model exercises the same code path as the verified model	REFUTED → FIXED	the skeptic correctly caught that the witness exercises the cache path (`Prefill`/`token`/`Step`/`Evict`), not the cacheless `Forward` — so naming `Forward` overstated it. Corrected the wording in `synthetic.go` and above: the witness runs `token`/`Evict` over the identical `m.tensor()` layout; `Forward` is the oracle test’s job

The panel did exactly its job: it could not refute that the real quarantine decision mechanically evicts the right K/V span and equals never-having-seen it (C1, C2, C4), and it sharpened the two places the write-up had outrun the witness (C3 test severity, C5 path naming) — both now corrected.

Bottom line

The cluster’s thesis is that the moat is the floor you can underwrite — a deterministic guarantee independent of which model you point at it. LIVE-RESULTS.md showed it holding inside a run; RECALL-RESULTS.md showed it holding across the process boundary; this lane shows it reaching into the model’s own attention memory: the harness’s quarantine decision mechanically evicts the poison’s K/V, and the result is byte-identical to never having seen it. That is the deepest rung of “the harness is primary, the model is secondary” — the trust floor is now enforced on the model’s working memory, not just the text it is shown.

fak KV quarantine bridge: byte-gate evicts the K/V

Shows the context-MMU quarantine verdict on a tool result's bytes also evicting that result's K/V span from the kernel-owned attention cache, witnessed by tests.