⚠️ KNOTENCORE v2.24.24 (Zero-Trust CRDT Mesh Runtime) IS AN EXPERIMENTAL ALPHA RELEASE · RESEARCH & EVALUATION ONLY
v2.24.24 · Architecture & Status Catalog

Technical Glossary

Precise architectural definitions with calibrated implementation status: Distinguishing between verified implementations, active experimental hardening, and architectural specifications in v2.24.24.

🔍
20 terms loaded
Category:
Status:
Glossary Status Classification
Verified Implemented & verified by unit/integration tests in Rust
Experimental Functional in alpha; active hardening / capacity tuning in progress
Architectural Protocol/API specification defined; distributed multi-host rollout on roadmap
Quick Jump Index
Cryptography & Identity Verified
# Copy Link

Self-Certifying Node Identity (knc-<hex>)

Deterministic cryptographic node address derived directly from the 32-byte Ed25519 public key, eliminating arbitrary node-ID assignment and preventing node-ID spoofing without possession of the corresponding private key.

In KnotenCore v2.24.24, peer IDs are not arbitrary string aliases or user-chosen hostnames. The canonical node ID is derived directly from the complete 32-byte Ed25519 public key as knc-<64_hex_chars> using derive_node_id(public_key). When a node initiates a handshake or submits a heartbeat, the receiving node computes the hex representation from the verified public key. If the claimed node_id does not match this mathematically derived value, the connection is instantly rejected with error code -32001 (ERR_UNAUTHORIZED).
💡 Why this matters for autonomous AI agents
Autonomous AI swarms cannot rely on human-administered certificate authorities or manual key pinning. Mathematical self-certification ensures that an agent cannot squat or impersonate another node identifier without possessing the underlying private key.
Relevant JSON-RPC Endpoints:
knc_mesh_verify_peer knc_mesh_discover
// Canonical node identity derivation (src/security.rs)
pub fn derive_node_id(pubkey: &[u8; 32]) -> String {
    format!("knc-{}", hex::encode(pubkey))
}

// Verification gate:
if claim_node_id != derive_node_id(&peer_pubkey) {
    return Err(RpcError::unauthorized("Claimed node_id does not match Ed25519 pubkey"));
}
Cryptography & Identity Verified
# Copy Link

Zero-Trust Ed25519 Wire Envelope

Cryptographic wire format encapsulating peer-to-peer JSON-RPC messages with an Ed25519 signature, timestamp, and unique 64-bit nonce.

Every peer-to-peer payload transmitted across the KnotenCore mesh is wrapped inside an Ed25519 signature envelope. The envelope bundles the serialized RPC payload, a millisecond-precision UTC timestamp (req_timestamp), a cryptographic 64-bit random nonce (req_nonce), and the sender's public key. Nodes authenticate and validate the envelope before accepting the enclosed RPC operation for normal processing.
💡 Why this matters for autonomous AI agents
Ensures that peer-to-peer commands cannot be tampered with in transit or injected by unauthenticated third parties on untrusted networks.
Relevant JSON-RPC Endpoints:
knc_mesh_ping knc_task_submit
{
  "jsonrpc": "2.0",
  "method": "knc_task_submit",
  "params": {
    "task_id": "job-8419",
    "isolate_quota_gas": 500000,
    "sender_node_id": "knc-9f8a...c1",
    "req_timestamp": 1787220000,
    "req_nonce": 948172901847291,
    "signature": "3a0b4e..."
  },
  "id": 1
}
Cryptography & Identity Experimental
# Copy Link

Sliding Replay Window & Nonce Cache

Stateful defense mechanism rejecting re-transmitted, duplicated, or stale RPC requests across mesh peers within a configured time horizon.

To defend against network eavesdroppers capturing valid signed requests and re-submitting them later, KnotenCore maintains an in-memory Nonce Cache paired with a timestamp validation window (±60 seconds clock skew tolerance). Incoming messages with timestamps outside the acceptable window, or whose (sender_id, req_nonce) pair has already been observed, are rejected with -32001 (ERR_UNAUTHORIZED).
💡 Why this matters for autonomous AI agents
Prevents adversaries from replaying recorded task submissions or state mutations to induce duplicate execution or repeated side-effects.
⚠️ Current Implementation & Hardening Scope

Current Limitation (Audit M2): The in-memory nonce cache is capacity-bounded. Under high-throughput burst traffic, older nonces can be evicted before their ±60-second window has expired. Hardening for memory-bounded strict TTL buckets is currently in progress.

Relevant JSON-RPC Endpoints:
knc_mesh_verify_peer knc_task_steal
// Sliding window & nonce check (src/mesh.rs)
let now = current_unix_timestamp_secs();
if (now - req.req_timestamp).abs() > 60 {
    return Err(RpcError::unauthorized("Request outside +/- 60s sliding window"));
}
if !nonce_cache.insert_if_absent(req.sender_node_id, req.req_nonce) {
    return Err(RpcError::unauthorized("Replay detected: Nonce already consumed"));
}
Cryptography & Identity Verified
# Copy Link

Namespace Isolation & Anti-Squatting

Strict boundary enforcement preventing legacy HMAC-authenticated nodes from claiming or squatting on canonical knc-* identities.

KnotenCore maintains backward compatibility with legacy HMAC-SHA256 tokens while enforcing hardened Ed25519 identities. To eliminate namespace squatting, the authentication engine strictly verifies that legacy HMAC senders can never claim identifiers starting with the prefix knc-. Any legacy request attempting to claim a knc-* identity triggers an immediate authorization fault.
💡 Why this matters for autonomous AI agents
Enables mixed legacy and modern clusters without permitting legacy nodes to masquerade as cryptographic Ed25519 peers.
Relevant JSON-RPC Endpoints:
knc_mesh_gossip knc_store_put
// Strict namespace partition check (src/security.rs)
if auth_type == AuthType::LegacyHmac && sender.starts_with("knc-") {
    return Err(RpcError::unauthorized("Legacy HMAC cannot claim knc-* namespace"));
}
Cryptography & Identity Verified
# Copy Link

Peer Revocation Gate (revoked_keys.json)

Dynamic key blacklisting file enforced on peer handshakes and background heartbeat cycles without requiring node restarts.

When a node key is compromised or decommissioned, it is added to the local revoked_keys.json database or broadcasted via knc_mesh_revoke_peer. KnotenCore's security layer inspects this registry during handshakes, heartbeats, and store replication steps. Active sessions associated with revoked keys are terminated immediately.
💡 Why this matters for autonomous AI agents
Enables immediate cluster remediation when an agent host is compromised, cutting off malicious peers dynamically.
Relevant JSON-RPC Endpoints:
knc_mesh_revoke_peer knc_mesh_rotate_key
// Hot revocation check
if is_key_revoked(&peer_pubkey) {
    terminate_session(session_id);
    return Err(RpcError::unauthorized("Public key explicitly revoked"));
}
Distributed State & CRDT Verified
# Copy Link

CRDT Anti-Entropy State Store

Conflict-free Replicated Data Type engine guaranteeing eventual consistency across asynchronous peer nodes without global locking.

KnotenCore features an embedded CRDT state store for distributed agent knowledge bases and task boards. By leveraging state-based CRDT mathematics (CvRDT) and bounded tombstone sets, nodes can mutate key-value pairs locally even during temporary network partitions. When connectivity resumes, concurrent updates converge deterministically according to the configured merge semantics.
💡 Why this matters for autonomous AI agents
AI agents operating in unstable network environments can continuously read and write local state without synchronization deadlocks.
Relevant JSON-RPC Endpoints:
knc_store_put knc_store_get knc_store_sync
// Rust CRDT Entry representation
pub struct CrdtRegister<T> {
    pub value: T,
    pub timestamp_micros: u64,
    pub writer_node_id: String,
}
Distributed State & CRDT Verified
# Copy Link

Anti-Entropy State Digest (ring::digest::SHA256)

Cryptographic 256-bit fingerprint of a store shard allowing O(1) state divergence detection across network peers.

Instead of transferring full keysets to check whether two nodes have matching states, nodes invoke knc_store_digest. KnotenCore computes an incremental SHA-256 digest over the canonical ordered keys and version timestamps using ring::digest. Matching SHA-256 digests indicate that the compared canonical states are identical with cryptographic collision resistance, avoiding redundant bandwidth usage.
💡 Why this matters for autonomous AI agents
Drastically reduces the network overhead of routine synchronization checks during continuous gossip heartbeats.
Relevant JSON-RPC Endpoints:
knc_store_digest
// RPC Request to check state fingerprint
{"jsonrpc": "2.0", "method": "knc_store_digest", "params": {"shard": "agent_world_model"}, "id": 12}
// Returns: {"result": {"digest": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"}}
Distributed State & CRDT Verified
# Copy Link

Differential Sync (knc_store_diff)

Bandwidth-optimized reconciliation protocol exchanging only missing or newer records between diverging peers.

When a disparity is detected via knc_store_digest, nodes do not transmit the full dataset. Instead, they issue a knc_store_diff call providing their local version timestamps. The responding node calculates the set of updated entries and streams only the delta records.
💡 Why this matters for autonomous AI agents
Enables efficient state reconciliation over constrained network links, minimizing data transfer volume.
Relevant JSON-RPC Endpoints:
knc_store_diff knc_store_sync
// Querying differences since logical clock
{"jsonrpc": "2.0", "method": "knc_store_diff", "params": {"since_ts": 1787219500000}, "id": 13}
// Returns only keys updated after that timestamp
Distributed State & CRDT Verified
# Copy Link

Last-Write-Wins (LWW) Register

Deterministic merge strategy resolving concurrent field updates using monotonic microsecond timestamps and node-ID tie-breaking.

When two autonomous agents modify the same key concurrently across a network partition, KnotenCore resolves the conflict using a Last-Write-Wins register. The update with the higher logical microsecond timestamp takes precedence. If timestamps are identical, the lexicographical ordering of the canonical node_id breaks the tie deterministically across all nodes.
💡 Why this matters for autonomous AI agents
Eliminates merge ambiguity and guarantees that all cluster nodes converge to identical values for any given key without human intervention.
⚠️ Current Implementation & Hardening Scope

Semantic Property: LWW is a conflict resolution strategy where the earlier concurrent value is superseded by the winning write. It provides convergence, not multi-version value preservation.

Relevant JSON-RPC Endpoints:
knc_store_put
// Conflict resolution logic (src/store/crdt.rs)
if incoming.timestamp > local.timestamp || 
   (incoming.timestamp == local.timestamp && incoming.node_id > local.node_id) {
    *local = incoming; // Adopt winning update
}
Distributed State & CRDT Experimental
# Copy Link

Epidemic Gossip Protocol

Decentralized P2P dissemination protocol routing peer metadata, task announcements, and topology metrics with logarithmic diffusion.

KnotenCore uses an epidemic gossip protocol with a fanout factor of k=3 and hop-count attenuation (TTL). When an agent publishes an event or discovers a new peer, it transmits the update to a randomized subset of known peers. Each recipient retransmits to another subset. This achieves logarithmic information diffusion O(log N) across the cluster without centralized coordinators.
💡 Why this matters for autonomous AI agents
Decentralized resilience: The cluster functions without a single coordinating master whose failure could sever mesh communications.
Relevant JSON-RPC Endpoints:
knc_mesh_gossip knc_mesh_metrics
// Gossip message propagation with TTL limit
if msg.ttl > 0 {
    let mut forwarded = msg.clone();
    forwarded.ttl -= 1;
    peer_pool.random_fanout(3, &forwarded);
}
Swarm Governance & Raft Verified
# Copy Link

Fail-Closed Swarm Governance

Safety architecture ensuring that cluster partitions and lost quorums default to strict read-only observer mode rather than risking inconsistent mutations.

A system is 'fail-closed' if it halts mutable operations when consensus conditions are unmet. KnotenCore enforces fail-closed semantics: if a node loses connectivity to the cluster leader or cannot assemble a verified majority quorum, it revokes its own write permissions and rejects state-modifying tasks with error -32003 (ERR_QUORUM_LOST).
💡 Why this matters for autonomous AI agents
Prevents split-brain scenarios where isolated agents might execute conflicting real-world actions or corrupt distributed state.
Relevant JSON-RPC Endpoints:
knc_swarm_quorum knc_swarm_roles
// Fail-closed enforcement
if !has_quorum_majority(active_nodes, total_nodes) {
    set_node_role(Role::Observer);
    return Err(RpcError::internal_error("Quorum lost: Node demoted to read-only observer"));
}
Swarm Governance & Raft Architectural
# Copy Link

Raft Quorum Threshold ((N/2) + 1)

Mathematical consensus invariant requiring a strict majority of verified nodes to authorize leadership transitions and cluster topology mutations.

Swarm coordination decisions—such as coordinator election (knc_swarm_elect) and storage shard rebalancing—are governed by a majority quorum threshold defined as floor(N / 2) + 1, where N is the count of active, verified nodes. In a 5-node cluster, at least 3 nodes must endorse a proposal.
💡 Why this matters for autonomous AI agents
Guarantees mathematically that two disjoint network partitions cannot both achieve quorum simultaneously, preventing dual-leader split-brain states.
⚠️ Current Implementation & Hardening Scope

Implementation Status (Audit M1): KnotenCore v2.24.24 implements the quorum mathematics ((N/2)+1), role state machine (Leader/Follower/Observer), and fail-closed observer fallback. However, multi-node vote distribution over network RPC currently runs inside a single-node simulation harness. Full distributed multi-host election consensus is scheduled for the post-alpha roadmap.

Relevant JSON-RPC Endpoints:
knc_swarm_elect knc_swarm_quorum
// Quorum threshold calculation (src/swarm/mod.rs)
pub fn quorum_threshold(active_node_count: usize) -> usize {
    (active_node_count / 2) + 1
}
Swarm Governance & Raft Verified
# Copy Link

Observer Role Fallback

Autonomous security demotion of unverified, lagging, or partitioned nodes to non-voting observer status.

Nodes in KnotenCore occupy one of three roles: Leader, Follower, or Observer. Observers can receive state broadcasts, execute read-only queries, and export telemetry, but their votes do not count toward quorum thresholds and they cannot propose cluster mutations. Nodes suffering from excessive clock drift or failing consecutive heartbeats are downgraded to Observer status.
💡 Why this matters for autonomous AI agents
Protects cluster consensus from unstable or degraded nodes without severing telemetry visibility.
Relevant JSON-RPC Endpoints:
knc_swarm_roles
// Role transition
match node.health_status() {
    Health::Unsynced | Health::ClockDriftExceeded => {
        node.transition_to(Role::Observer);
    },
    Health::Synchronized => node.transition_to(Role::Follower),
}
Compiler & VM Isolates Verified
# Copy Link

JSON-AST (.nod Program Format)

First-class JSON Abstract Syntax Tree representing executable programs emitted directly by LLM agents without raw code string parsing.

Instead of requiring LLM agents to emit raw source code strings (which are susceptible to syntax errors, escaping glitches, and injection vectors), KnotenCore accepts code as structured JSON Abstract Syntax Trees (JSON-AST). Every statement, loop, variable declaration, and function call is a validated JSON object conforming to the .nod schema.
💡 Why this matters for autonomous AI agents
Allows LLMs to interact as structured compilers rather than text typists. Code validation occurs at parse time prior to execution, eliminating raw string injection risks.
Relevant JSON-RPC Endpoints:
knc_compile knc_execute
// JSON-AST addition program (.nod format)
{
  "jsonrpc": "2.0",
  "method": "knc_compile",
  "params": {
    "session_id": "agent-alpha-1",
    "ast": {
      "Add": [
        { "IntLiteral": 42 },
        { "IntLiteral": 58 }
      ]
    }
  },
  "id": 101
}
Compiler & VM Isolates Verified
# Copy Link

AOT Stack-VM & Bytecode Dispatch

Ahead-Of-Time compiled stack virtual machine executing node instructions via linear opcode sequences without JIT warmup overhead.

KnotenCore's compiler transforms incoming JSON-AST into linear bytecode sequences. The stack VM uses an opcode dispatch loop written in idiomatic Rust without unsafe blocks. Instructions operate on a typed value stack, enforcing integer bounds checks and strict call-frame depth limits (MAX 512 nested frames).
💡 Why this matters for autonomous AI agents
Delivers predictable, deterministic execution latency with memory safety and zero runtime compilation warm-up delay.
Relevant JSON-RPC Endpoints:
knc_compile knc_execute
// Bytecode instruction stream
[OpCode::PushInt(42), OpCode::PushInt(58), OpCode::Add, OpCode::Ret]
// Stack evaluation: [42] -> [42, 58] -> [100] -> Return 100
Compiler & VM Isolates Verified
# Copy Link

Sandboxed VM Isolate (knc_eval_isolate)

Controlled in-process execution boundary isolating agent workloads and scripts from the KnotenCore host runtime.

Each agent session in KnotenCore runs inside a dedicated Sandboxed Isolate. Isolates have no direct access to the host filesystem, environment variables, raw network sockets, or host pointers. All input and output occurs exclusively through the controlled JSON-RPC boundary. If an isolate triggers a panic or limit violation, it is halted cleanly without terminating the engine process.
💡 Why this matters for autonomous AI agents
Provides a controlled execution boundary between agent workloads and the KnotenCore host runtime, containing runaway errors inside the faulted isolate.
⚠️ Current Implementation & Hardening Scope

Security Boundary Scope: Sandboxed Isolates provide in-process execution boundaries, panic catching, and resource metering within the KnotenCore engine. They are not a replacement for OS-level hypervisors or container virtualization when running adversarial native binaries.

Relevant JSON-RPC Endpoints:
knc_eval_isolate knc_inspect_state
// Evaluating logic inside isolated environment
{"jsonrpc": "2.0", "method": "knc_eval_isolate", "params": {"isolate_id": "iso-491", "expression": "Math.sqrt(x)"}, "id": 5}
Compiler & VM Isolates Verified
# Copy Link

IsolateQuota & Gas Metering

Execution bounds enforcing instruction cycle budgets (gas), memory allocation caps (bytes), and call-stack frame depth.

Every isolate is governed by an IsolateQuota configuration specifying: max_gas (maximum virtual machine instruction steps), max_memory_bytes (allocation threshold), and max_call_frames (call stack limit, default 512). Each executed opcode decrements the isolate's gas balance. When gas reaches zero, execution halts with ERR_GAS_EXHAUSTED.
💡 Why this matters for autonomous AI agents
Neutralizes infinite loops (e.g. while(true){}) and runaway recursion deterministically, preventing CPU starvation across concurrent agents.
Relevant JSON-RPC Endpoints:
knc_compile knc_execute
pub struct IsolateQuota {
    pub max_gas: u64,           // e.g. 1_000_000 cycles
    pub max_memory_bytes: usize, // e.g. 64 * 1024 * 1024 (64 MB)
    pub max_call_frames: usize,  // 512
}
Compiler & VM Isolates Experimental
# Copy Link

Hot-Module-Replacement (HMR / knc_isolate_reload)

Dynamic bytecode updates applied to running isolates while preserving in-isolate register state and active memory slots.

KnotenCore allows an orchestrator to update the running bytecode of an isolate on the fly using knc_isolate_reload. The engine compiles the new AST, pauses the isolate between opcode cycles, updates the instruction vector, and resumes execution while preserving existing in-frame variable registers.
💡 Why this matters for autonomous AI agents
Enables agents to upgrade their decision logic or apply hotfixes without discarding existing local variable state.
⚠️ Current Implementation & Hardening Scope

Experimental Scope: Dynamic opcode vector replacement preserves local variable registers and operand stack depth within the isolate frame. It does not serialize or persist external asynchronous I/O handles or active network sessions.

Relevant JSON-RPC Endpoints:
knc_isolate_reload
// Hot-reload request updating agent logic
{"jsonrpc": "2.0", "method": "knc_isolate_reload", "params": {"isolate_id": "iso-491", "new_ast": {...}}, "id": 22}
// Returns: {"result": {"status": "reloaded", "preserved_slots": 14}}
Agent Orchestration Experimental
# Copy Link

Work-Stealing Task Queue (knc_task_steal)

Decentralized task scheduling protocol enabling idle nodes to pull computational workloads dynamically from overloaded peers.

Instead of routing all jobs through a centralized broker, KnotenCore nodes maintain local task deques. When a node exhausts its local queue, it queries cluster peers via knc_task_steal, retrieving available tasks from the tail of an overloaded peer's queue.
💡 Why this matters for autonomous AI agents
Improves cluster utilization and load balancing across multi-agent setups without introducing a centralized coordinator bottleneck.
Relevant JSON-RPC Endpoints:
knc_task_submit knc_task_steal knc_task_status
// Idle node steals pending tasks from peer
{"jsonrpc": "2.0", "method": "knc_task_steal", "params": {"max_tasks": 2, "target_node_id": "knc-3e1b..."}, "id": 31}
Agent Orchestration Architectural
# Copy Link

Agent State Teleportation (knc_agent_teleport)

Serialization contract and protocol specification for packaging and migrating isolate execution state across cluster nodes.

KnotenCore specifies an agent migration protocol to freeze isolate execution state—including instruction pointers, value stack frames, and quota balances—into a signed snapshot. The knc_agent_teleport RPC endpoint handles transferring and instantiating this context on a target node.
💡 Why this matters for autonomous AI agents
Lays the architectural foundation for dynamic load balancing, edge-to-cloud handoffs, and planned node maintenance without losing agent progress.
⚠️ Current Implementation & Hardening Scope

Architectural Scope: The serialization contract and RPC endpoint (knc_agent_teleport) for isolate AST snapshots are specified and unit-tested locally. End-to-end live task migration across heterogeneous production networks remains experimental.

Relevant JSON-RPC Endpoints:
knc_agent_teleport knc_agent_snapshot knc_agent_restore
// Teleport agent to another node in the cluster
{
  "jsonrpc": "2.0",
  "method": "knc_agent_teleport",
  "params": {
    "agent_id": "agent-finance-04",
    "destination_node_id": "knc-84fa2...e1",
    "include_memory_heap": true
  },
  "id": 44
}
Copied!