Material Quarantine Trust Model

Defines the trust model used to quarantine and normalize externally acquired untrusted data (RAG payloads, user files, web search results) before admitting it into the safe Material layer.

1. Purpose

When external data is injected directly into LLM attention, prompt injection, source misrecognition, and attention pollution become likely. AIKernel enforces a quarantine-first pipeline to provide:

• Reasoning-path contamination prevention: raw untrusted inputs never enter reasoning directly; they pass through an isolated quarantine stage.
• Strict provenance tracking: each material item carries source and trust metadata so output evidence remains explainable.
• Structured materialization: unstructured raw data is normalized into typed material that the reasoning engine can safely consume.

2. Theoretical Background: Quarantine and Trust

AIKernel treats external data as a potential contamination source and defines trust-state transitions:

• Unreliable: raw external strings/bytes before quarantine.
• Quarantined: syntax-checked, harmful-content filtered, and structurally normalized.
• Material: provenance-bound, trust-scored content approved for context admission.

3. Core Contracts

3.1 IMaterialQuarantine

• Responsibility: scan raw input and perform normalization plus structural conversion.
• Functions: injection detection, sensitive-data masking, and format normalization.

3.2 IStructuredMaterial

• Responsibility: container for quarantined material.
• Typical fields: Body, Schema, TrustLevel, SourceInfo.

3.3 SourceInfo

• Responsibility: define data lineage and provenance.
• Typical properties: Uri, Timestamp, Hash, Author.

3.4 IRagProvider and IEmbeddingProvider

• Responsibility: fetch from external knowledge stores and hand off into quarantine workflow.

4. Trust Rules

• Mandatory quarantine: external inputs (API responses, file content, user text) must not enter MaterialContext without IMaterialQuarantine.
• Provenance immutability: once IStructuredMaterial is created, SourceInfo is immutable and must propagate to downstream outputs.
• Recursive quarantine rule: prior Expression output reused as input must be quarantined again (prevents hallucination feedback loops).
• Metadata separation: provenance metadata is stored in MetadataContext-like channels, not mixed into main prompt text.

5. Fail-Closed Rule

Any broken trust chain causes exclusion from reasoning path.

• Unknown source rejection: missing or tamper-detected SourceInfo is blocked immediately.
• Quarantine timeout/error: failed quarantine marks material as potentially contaminated; reject and optionally halt pipeline.
• Trust-threshold enforcement: materials below configured TrustLevel minimum are excluded from critical reasoning.

6. Process Flow (Conceptual)

1. Fetcher: acquire raw data from web/search/store (Status: Unreliable).
2. Quarantine: remove directive payloads, normalize, structure (Status: Quarantined).
3. Analyzer: calculate provenance and trust score (Status: Material).
4. Kernel: store in MaterialContext; OrchestrationContext references it only when needed.

Changelog

• v0.0.0 / v0.0.0.0: Initial draft
• v0.0.1 (2026-05-06): Version upgrade aligned with documentation guidelines