The Cognitive Firewall: Air-Gapped SSoT & Clean-Room IP Provenance#

As autonomous AI coding agents assume responsibility for core system engineering, enterprises face two existential risks: data boundary leakage (proprietary client data escaping into public feeds or cloud LLM logs) and intellectual property contamination (AI models regurgitating proprietary code or codenames from prior employers or untracked sources).

The Nomos Cognitive Firewall provides an air-gapped, procedural state boundary that strictly partitions public Single Source of Truth (SSoT) assets from private enterprise intelligence, while machine-enforcing clean-room IP provenance.

flowchart TD
    subgraph PublicSphere ["1. The Public SSoT Membrane"]
        VaultPublic["Living Vault Public SSoT (vault/public)"]
        PublicPortals["Public Web Portals (sophialabs.ca / gantlett.io)"]
        OpenCore["Nomos Open-Core Substrate (Go Kernel)"]
    end

    subgraph FirewallBoundary ["🛡️ THE NOMOS COGNITIVE FIREWALL"]
        ASTGuard["Clean-Room Provenance AST Filters"]
        PhaseLock["Read-Only Phase Disciplines (IDLE / PLAN / REVIEW)"]
        WorktreeBoundary["Isolated Transient Worktree Sandboxes"]
    end

    subgraph PrivateSphere ["2. The Sovereign Private Vault"]
        PrivateLedger["Client Ledgers, CRM & Accounting (vault/private)"]
        SovereignSwarm["Proprietary Nomos Code & NixOS Silicon"]
        InternalIP["Commercial Pricing Engines & NDA Artifacts"]
    end

    PublicSphere -.->|"Strict Clean-Room Isolation"| FirewallBoundary
    FirewallBoundary -.->|"Zero Cloud Egress Barrier"| PrivateSphere

🏛️ The Public vs. Private Knowledge Topology#

In the Nomos ecosystem, knowledge and state are divided into strict, non-overlapping vaults:

1. The Public SSoT (vault/public/):
   • Contains open architecture documentation, published handbook essays, and empirical benchmark dispatches.
   • Compiled deterministically via nomos-vault-cms with 100% SHA-256 byte parity directly to public web portals.
   • Contains zero employer references, private client IDs, or confidential commercial code.
2. The Private Sovereign Vault (vault/private/):
   • Houses confidential client accounts, founder CRM databases, commercial contracts, and private R&D experiments.
   • Completely excluded from public portal build pipelines and protected by automated AST regex hygiene gates.

🛡️ Clean-Room IP Provenance#

When software architects transition from enterprise employment to founding sovereign AI infrastructure companies, proving clean-room independence is a legal and technical necessity.

Nomos enforces clean-room provenance through three deterministic mechanisms:

1. Persona Prompt Invariants#

The Sophia AI agent and local Nomos Code workers operate under immutable system instructions prohibiting them from claiming Nomos was derived from, blueprinted on, or influenced by proprietary systems of past employers:

"Nomos is an original, first-principles deterministic software engineering substrate engineered by Mark Gantlett and Gantlett Systems Inc."

2. AST Pre-Commit Sanitization Gates#

During nomos verify and /Nomos Ship, automated AST parsers scan all staged commits, release manifests (releases.json), and public documentation mirrors for proprietary codenames, vendor targets, or employer trademarks. Any match immediately aborts the release pipeline.

3. Local Sovereign GPU Execution#

By executing Tier 2 code mutation workers (nomos code / nomos-code) strictly on local on-premise silicon (e.g. dedicated NVIDIA RTX 4080 GPUs running open-weight Gemma-4 or Qwen models), zero lines of enterprise code or prompts ever leave the corporate network perimeter.