The Pure-Rust Application Chassis for
Sovereign AI & Proactive Self-Defense.
Build high-performance, air-gapped commercial desktop, server, Android mobile, and industrial SCADA applications with zero Python dependencies, zero Electron bloat, and zero cloud data leaks. Powered by 24 `sovereign-*` SDK crates, 18 `anvaya-*` shared crates, and 19 `alaska*` cyber defense crates.
The 8 Proactive Cyber Pillars Baked Into Every Binary
Traditional frameworks sit completely passive during an intrusion. Every app built on the Anvaya Armored SDK actively hardens its host, deploys Alphabetical Sandwich honeyfiles, scrubs storage with BLAKE3, and self-tests via idle chaos drills—while staying 100% clean in user-space (0% Microsoft Defender or CrowdStrike false positives).
Autonomous Pre-Flight Hardening
Enforces Win32 DACL (`0600`) process-only file ACLs on databases/models and configures local WFP loopback firewall rules on boot.
Shannon Entropy Circuit-Breaker
Inspects incoming byte streams in RAM; automatically quarantines pre-encrypted ransomware payloads ($H \ge 7.85$) before write.
Alphabetical Sandwich Canaries
Arms passive honeyfiles at the top (`!00_...`) and bottom (`zz_...`) of folders to catch traversal ransomware at step zero.
Continuous BLAKE3 Scrubber
Rayon work-stealing background task continuously verifies block digests and autonomously heals bit-rot from local parity snapshots.
WORM Ransomware Airlocks
Seals historical sessions, clinical reports, and audit logs with OS-level immutable attributes (`FILE_ATTRIBUTE_READONLY` / `chattr +i`).
Automated Idle Chaos Fire Drills
Executes non-destructive threat simulations while idle to verify tripwires, circuit breakers, and `.anvayadiag` flight recorders.
In-RAM Key Zeroization
Enforces `zeroize::ZeroizeOnDrop` across all keys, passwords, and tokens, wiping heap buffers to defeat cold-boot attacks.
Adaptive Ingress Shield
Tracks connection velocity and applies exponential latency backoff to protect local management and mobile companion ports.
1. Proprietary AI Model Vault
Fine-tuned GGUF & Safetensors weights are encrypted at rest with hardware AES-256-GCM and streamed directly into Candle RAM/VRAM. Zero decrypted model bytes are ever written to disk.
2. SCADA & Industrial OT Airlock
Bump-in-the-wire pure-Rust Modbus TCP/RTU, DNP3, and OPC-UA sanitizer with `<500µs` `ractor` fault recovery and in-RAM Candle physical vibration anomaly detection.
3. Sovereign Android Mobile SDK
Hermetic zero-internet Android apps (`0` network permissions), ARM NEON quantized Whisper speech AI, StrongBox HSM key anchoring, and `CLOCK_MONOTONIC_RAW` zero-GC timing.
10 Turnkey Regulated Industry Enclaves + SIT30 Clinical Suite
Pre-configured compliance, encryption, and local Candle AI pipelines ready out of the box.
| Enclave Profile | Regulatory Standard | Core In-RAM Rust Capabilities | Target Deployments |
|---|---|---|---|
| 🏥 Clinical Healthcare (`clinical` / `SIT30`) | HIPAA § 164.312, SMART on FHIR | Multilingual Candle Whisper scribe, `<1ms` hesitation tracker, 11 psychometric indices, Ed25519 PDF seal | Hospitals, psychology clinics, diagnostic labs |
| ⚖️ Legal Practice (`legal`) | ABA Model Rule 1.6, E-Discovery | Air-gapped deposition transcription & local BGE-M3 semantic vector search | Law firms, litigators, general counsel |
| 🛡️ Defense & Aerospace (`defense`) | CMMC 2.0 Level 2, ITAR, NIST 800-171 | SCIF-isolated CUI vault, silicon node-locking, DACL process isolation | Defense contractors, military enclaves |
| 🏦 Wealth & Advisory (`finance`) | SEC Reg S-P, FINRA Rule 4511 | In-RAM PII/SSN redaction, WORM estate safes, tamper-proof audit logs | RIAs, family offices, private wealth |
| 🏭 Critical Infrastructure (`industrial`) | NERC-CIP-005/010, CISA ICS | Memory-safe Modbus/DNP3 airlock, `<500µs` crash isolation, vibration AI | Power utilities, water plants, pipelines |
| 🔐 Digital Asset Cold Vault (`cryptoledger`) | Multi-Sig, Shamir 2-of-3, Merkle DAG | Master seed splitting onto physical FIPS USB shards, zero-gas Merkle proofs | Crypto treasuries, Web3 foundations |
| 🚓 Law Enforcement (`cjis`) | FBI CJIS Security Policy v5.9 | In-RAM interrogation scribe, BLAKE3 chain-of-custody, court-ready PDF proof | Police departments, forensic units |
| 🎓 Special Education (`education`) | FERPA 34 CFR Part 99, IDEA | IEP meeting transcription, automated SMART goals, airlocked student safes | K-12 districts, school psychologists |
| ⚓ Maritime & Offshore (`maritime`) | IMO, MARPOL, NMEA 0183/2000 | Voice bridge logbook, NMEA telemetry blackbox, offline voyage reporting | Commercial shipping, offshore rigs |
| 🏠 Consumer Smart Home (`home`) | Matter, Local MQTT, RTSP ONVIF | Zero-cloud smart home hub, private RTSP camera NVR, family inheritance vault | Privacy-first families & executives |
Interactive Pure-Rust Crate Explorer
Search and filter all 24 `sovereign-*` SDK crates, 18 `anvaya-*` shared infrastructure crates, and 19 `alaska*` cyber/DFIR crates engineered in our workspace.
SovereignAppConfig, PlatformEnvironment, SovereignError & SovereignAppExtension traits.
Autonomous host pre-flight hardening: Win32 DACL (0600) & loopback WFP firewall rules.
Hardware AES-256-GCM model weight encryption at rest & direct-to-RAM tensor streaming.
Offline silicon hardware fingerprinting (CPU/UUID/TPM) & Ed25519 token validation.
1-Click CISO compliance generator (HIPAA § 164.312, SOC2, CMMC 2.0, NERC-CIP).
30-item projective sequence wizard & sub-millisecond hesitation latency tracking.
Pure-Rust Hugging Face Candle Whisper Multilingual speech-to-text pipeline.
Indic script Unicode normalizer (Devanagari, Dravidian, viramas) & Hinglish tokenizer.
Offline clinical & forensic PDF compiler with practitioner Ed25519 cryptographic seals.
Authenticated AES-256-GCM vaulting & in-RAM key zeroization (ZeroizeOnDrop).
Passive Alphabetical Sandwich decoys (!00_... & zz_...) & OS directory watchers.
Pre-ingest Shannon entropy circuit breaker (H >= 7.85) & automated idle chaos fire drills.
Zero-App-Store PWA server, ephemeral HMAC QR code pairing & local LAN upload receiver.
Air-gapped flight recorder, 10,000-event circular ring buffer & Windows WER suppression.
Embedded memory-mapped redb wrappers with zero schema resets.
In-process Candle AI tensor execution engine & cross-lingual BGE-M3 cosine similarity.
Continuous background BLAKE3 scrubber, self-healing bit-rot recovery & WORM airlocks.
Axum REST engine, Adaptive Ingress Shield & compile-time single-binary embedded UI.
Anvaya Hub distribution client, Ed25519 token claiming & delta .patch hot-patching.
In-process Erlang/OTP Actor Reactor (AISwarm), bounded mailboxes & mTLS P2P mesh.
SCADA & Industrial OT Gateway: Modbus/DNP3 type-safe sanitizer & bump-in-the-wire airlock.
Sovereign Android & Mobile SDK: C-ABI/JNI bridge, ARM NEON Candle AI & StrongBox HSM.
Sovereign Home Hub: Matter/MQTT, RTSP camera NVR, Shamir inheritance vault & NAS shield.
Universal Sovereign CLI (cargo sovereign new, package, backport, sync, verify-fleet).
Embedded super-admin governance, RBAC & break-glass tamper lock controls.
Multi-provider local/hybrid AI tensor & Sentinel incident diagnosis router (ai_sentinel.rs).
WebSocket & SSE streaming UI adapters for real-time local AI copilot responses.
7-crate audit suite (forensics, system, recon, report, web, static) with SARIF & STIX 2.1.
Alphabetical Sandwich, Registry Tripwires, RDP/SMB/SSH decoys, RAM key extract & freeze.
Unified security posture cockpit and cross-module defense orchestrator.
Commercial licensing UI shell, tier badge renderer & offline activation wizard.
Cross-platform diagnostic bundle compiler (DiagnosticBundle) & privacy-tiered crash logs.
Signed binary release packager, manifest generator & OTA delta patch distributor.
Sovereign zero-knowledge identity (anvaya-id-core), passkeys & session token manager.
Peer-to-peer encrypted LAN discovery, mTLS transport & fleet heartbeat gossip.
Ephemeral QR pairing (PairingSession), HandoverTokenManager & BLAKE3 mobile dedup.
Community giving, donor transparency ledger & social impact reporting module.
Shared React/Tailwind sovereign design system and tactical HUD component library.
Content-addressed FastCDC chunking, deduplication & encrypted blob store.
Automated disaster recovery runbooks, RTO/RPO telemetry & clean-room rehydration.
Low-level ChaCha20-Poly1305 / AES-256-GCM envelope encryption & Shamir secret sharing.
Interactive vault explorer, WORM lock toggle & storage health visualization components.
Sub-millisecond Windows Filtering Platform (WFP) & Linux host network isolation engine.
Out-of-band cryptographic heartbeat and dead-man-switch fleet status emitter.
Forensic CaseManager, chain-of-custody binder & Ed25519 case sealer (/api/cases/:id/seal).
Alaska Command 27-crate / 80-route C2 tactical command router & MITRE/NIST posture hub.
Offline DFIR analyst AI copilot for automated MITRE TTP explanation & evaluation.
High-speed PayloadDecoder for XOR, Base64, URL-encoding & Shannon entropy scoring.
PurpleTeamEngine executing safe MITRE ATT&CK adversary simulations (T1087, T1082).
Alaska Forensics live RAM minidump workstation, PE analyzer, YARA scanner & CISA KEV.
Zero-trust API gateway, mutual TLS termination & adaptive velocity rate-limiter.
CIS benchmark host hardening auditor (BenchmarkRule) and PostureReport evaluator.
High-concurrency endpoint ProcessHunter with executable Shannon entropy scanning.
Event Tracing for Windows (ETW) and Linux eBPF telemetry consumer for kernel visibility.
Immutable forensic evidence notary with BLAKE3 Merkle root proofs.
Deep socket inspection, C2 beacon inter-arrival time (IAT) jitter detector & mapper.
Active Volume Shadow Copy (VSS) protector and Copy-on-Write (CoW) micro-rollback engine.
CycloneDX / SPDX Software Bill of Materials generator & supply-chain vulnerability auditor.
Alaska Sentinel endpoint EDR fusion engine, EVTX Sigma matcher, FIM & Prefetch/PCAP.
Pure-Rust SigmaEngine translating rules to KQL, Splunk, PowerShell, and Grep.
Local DNS sinkhole (ResolverCore), Shannon entropy DGA radar & canary domain tripwire.