Anti Regression Mesh
Guardian — ARM
Inward-only defense mesh (anti-regression + cybersecurity)
What it is
Anti Regression Mesh (ARM) exists to stop the thing that actually breaks software: the change that quietly undoes last month's fix. Every save-point runs a type check, a lint pass, an import-graph-selected slice of the test suite, and a privacy scan; every push additionally runs the entire suite, a full production build, and a live replay of 207 previously-closed attacks against the real database. Each replay fixture is hash-pinned, so weakening one, deleting one, or slipping a new one in unnoticed all fail the run. Before it checks your code it checks itself - the toolchain, the runtime libraries, its own hooks - so a compromised build environment cannot wave bad code through, and the usual developer bypass switches produce a loud refusal rather than a skipped check. Guards are not assumed to work: they are deliberately sabotaged, and the system must catch the sabotage to a measured pass rate before release. The highest-blast-radius administrative actions require two different humans, self-approval is structurally impossible, and an administrator who goes silent has their elevated access frozen automatically until another human restores it. It is inward-only in the shipped artifact, not merely in policy: the gate stack acts on the repository it is installed in and nowhere else. There is no outbound action of any kind - which is what makes it deployable where an active-response tool is not.
What is built, and what is ahead
Proven and operating today inside a live production marketplace: the commit and push gauntlets, the 207 hash-pinned replays, the mutation-proven guards, the tamper-evident audit chain, two-of-N approval, and the dead-man quarantine. Designed and specified, not yet shipped: the drop-in, install-anywhere packaged edition, the always-on autonomic daemon, and the duo-Helm coupling. The deployment witnessed is one; the sector reach is design intent stated as design intent.
The numbers behind it
What it does
Nothing Ships Unproven
Every commit and every push runs the full gauntlet - type check, lint, an import-graph-selected test slice, a privacy scan, then the entire suite, a production build, and a live attack replay. If any one fails, the change does not ship. The same mesh keeps watching on a schedule after release.
Every Attack Ever Closed, Replayed
207 previously-closed attack vectors are re-attacked against the live system before a single line reaches the shared branch - and the number only goes up. Each fixture is cryptographically pinned, so weakening one, deleting one, or slipping a new one in unnoticed all fail the build.
It Refuses to Be Switched Off
The usual developer bypass switches produce a loud refusal, not a skipped check, and an attempt to swap out its own machinery is detected and aborted rather than silently tolerated.
It Protects Its Own Machinery First
Before it checks your code, it checks itself - the tools, the runtime libraries, its own guard rails, and the package registry configuration - so a compromised build environment cannot wave bad code through.
Two Humans, Not One
The actions that could do the most damage need two different people within a bounded window, and self-approval is structurally impossible. A single stolen or coerced administrator account cannot perform them alone.
Silence Is a Signal
An attacker holding stolen administrator credentials stays quiet; legitimate administrators do not. Go silent long enough and elevated access freezes itself - and a heartbeat alone never lifts the freeze. Only another human can.
Guards Proven by Breaking Them
A guard is not assumed to work. It is deliberately sabotaged and the system must catch the sabotage, to a measured pass rate, before release. Adversarial review is a standing three-pass ritual, not an annual audit - and findings are re-checked against the running system before anyone acts on them, including our own.
A Published Honesty Floor
This system publishes its own capability score and refuses to move it by shipping features. Registering more modules moves the number by exactly zero, because the denominator is production incidents survived against a real adversary - and that count is honestly still zero. The score rises when the defense survives an attacker, not when the roadmap does.
Designed Never to Brick What It Guards
The packaged edition is specified to hold the line without bricking the application it protects, and never to go dark silently - a design constraint written into its plan before a line of it was built.
Duo-Helm Guardians
At the frontier, the lineage apex is designed to couple with the two soul-gated sovereign siblings under a strictly one-way, operator-granted permission model: deeper access is always a human act, and the mechanism that can revoke access is structurally incapable of granting it. Names sealed until release.
Who it serves
Caught before it leaves the developer's machine, not in production.
Most teams find that class of defect in production, from a customer complaint. Here it is caught at the commit, at the push, and again on a schedule after release.
It replaces the manual pre-release checklist and the annual pen-test as the only adversarial signal.
Adversarial review becomes a standing three-pass ritual, the administrative audit trail becomes hash-chained so it cannot be edited after the fact, and the highest-damage actions need two humans.
Inward-only in the shipped artifact, designed to run inside your own database, and it under-claims deliberately.
The gate stack has no outbound action at all - it acts on the repository it guards and nowhere else, which is what makes it deployable where an active-response tool is not. An evaluator can verify the under-claiming directly, because the vendor publishes the number that makes it look worst.
What it decides, and what you decide
Each gate below is a control enforced in the software itself — not a policy statement about how it should be used.
- Detection and refusal only - the commit and push gauntlets run without asking anyone, and they block
- Scheduled continuous watch on a cron cadence after release
- Nothing beyond detect-and-block happens autonomously
- Two-of-N approvalTwo administrators
Required before any highest-blast-radius administrative action. Self-approval is structurally impossible and the approval window expires.
- Hardware-key overrideOperator
The strictest gate in the system guards the override path, and it requires a hardware security key on top of two-of-N.
- The un-quarantine gateA second human
A frozen administrator cannot self-restore. A heartbeat never lifts the quarantine; another human must.
- Autonomy is offOperator
The autonomic capability exists and is inactive. Turning it on is an operator act, not a system decision - and this page does not claim it is running.
- Mount depthOperator
Coupling depth is monotone-narrowing: a deeper grant is always a human act, never self-escalation, and the reaper can only downgrade.
- The commercial build lockOperator
The packaged, install-anywhere edition does not begin until the operator engages it. It is named, and it is held.
How it is built
- Codebase cybersecurity
- Hash-pinned exploit replay
- Mutation-proven guards
- Two-of-N approval
- Dead-man privilege quarantine
- Operator-gated approvals + tamper-evident ledger
- Self-protecting toolchain integrity
- Runs inside your own database
- Inward-only: acts on the repository it guards, nowhere else
- Un-bypassable commit and push gates
- 207 hash-pinned exploit replays
- Mutation-proven guards
- Two-of-N approval, self-approval impossible
- Dead-man quarantine on silent administrators
Where it came from
Anti Regression Mesh is the post-next-gen successor to the OAR defensive lineage. Every stage of that lineage is preserved and carried forward, and the apex is designed to couple with the two soul-gated sovereign siblings as the duo-Helm Guardians - two restricted guardian intelligences designed to helm the ecosystem's inward-only defense at the frontier, under a one-way permission model where deeper access is always a human act. Their names remain sealed until release. The ladder is shown merged with the wider defensive family's: its own rungs run V1 to V4, and the apex below is that family's flagship rather than a rung of this system.
The mechanical floor: static security gates that run on every commit and block rather than warn. The free tier is the intended commercial line, not yet a fact of the licence registry.
The eight-phase detection-and-alarm mesh: layered detection with alarm fan-out, and nothing beyond detection and alarm.
The pure-logic helper layer — insider-threat approval, supply-chain gating, model-quality drift, formally verified money arithmetic, and push-based watch. Written as side-effect-free logic, and it named its own debt: half of it had no caller yet.
The Quirk Factor substrate and the full orchestrator together - the Auto Defender the earlier layers were missing - resolving and dispatching defense compositions through a tamper-evident decision log. The orchestrator arrives here, and it ships dormant: planning and enacting nothing until armed.
The detachable commercial engine — a portable, licensed engine that installs into your own database, with a conservation-law monitor watching for silent state divergence. Designed and specified; not yet built.
The flagship of the wider defensive family, shown here because the two ladders are presented merged. It is deliberately versionless - built to its own floor, under its own control, and the flagship regardless of what ships after it. It is not a rung of this system's ladder and it does not ship inside Anti Regression Mesh.
What is running inside it
Every row below is attributed to this system alone and carries the state it is actually in — installed, present in source, or an honest seam.
- Installed
- present and in use in this system's own tree.
- In source
- present in source; not installed, or behind a try/except. Not a shipped capability.
- Seam
- an honest, fail-closed seam. No implementation is wired behind it.
Hash-pinned exploit replay, content-locked
InstalledEvery previously-closed attack is re-attacked against the live database before a line reaches the shared branch, and each fixture is pinned by content - so weakening one, deleting one, or slipping a new one in unnoticed all fail the run.
Import-graph test selection
In sourceThe gauntlet selects its own test slice by walking the import graph outward from the changed files. A graph search, not a model.
Two-of-N approval, self-approval structurally impossible
In sourceThe highest-blast-radius actions require two different humans inside a bounded window, and one account cannot satisfy both roles.
Dead-man quarantine of elevated privilege
In sourceElevated access freezes itself after a silence window, and a heartbeat alone never lifts the freeze. Only a second human can.
Tamper-evident audit chain
In sourceAdministrative actions are sealed into a chain where a later edit, deletion or reordering is detectable rather than merely discouraged.
Mutation-proven guards
In sourceA guard is not assumed to work: it is deliberately sabotaged and the system must catch the sabotage to a measured bar before release.
Self-protecting toolchain integrity
In sourceBefore it checks your code it checks itself - the tools, the runtime libraries, its own hooks and the package registry configuration - so a compromised build environment cannot wave bad code through.
Published capability floor that refuses to move
In sourceThe system publishes its own capability score and registering more modules moves it by exactly zero, because the denominator is production incidents survived against a real adversary - and that count is honestly still zero. Its own documentation states plainly that the substrate is live while the operational layer is dormant by design.
Cumulatively counted rejection discipline
In sourceIts own review discipline records every rejection it issued against itself and carries the running total forward rather than resetting it per release, so the count can only ever embarrass its author.
How to reach it
Anti Regression Mesh
Releasing 8.31.2026 - join the waiting list for defense-system access.
Visit omni.aisystemsbymarjerla.com