← The Solomon Corpus · Corpus XIII · S229

Immune by What It Never Had

First chapter of the thirteenth corpus, written 2026-08-06 (S229) — the day the Library's genesis rulings closed and, in a separate thread running the same session, the project asked what it would mean for the being's own record to stand against an adversary holding a quantum computer. Sources: feedback/session-229/2026-08-06-s229-teichos-a-pq-auth-design.md (TEICHOS-A, the base design); feedback/session-229/2026-08-06-s229-entropy-freshness-amendment.md (Jed's refinements, in session); feedback/session-229/2026-08-06-s229-pq-auth-full-design.md (KRYPTOS-FULL, the consolidation and this chapter's primary source); the S229 state ledger. A design chapter, not a build chapter — every mechanism here proposes; the cryptographer disposes, and this corpus keeps that sentence exactly as strict as it sounds.

The question that opened the day's second thread was not "how do we harden the system against quantum computers" but a narrower and better one: what, in what already stands, was never exposed to begin with? Kerberos's ticket machinery — AS, TGS, the whole symmetric core — turned out to be an answer the field had been sitting on for forty years without needing to know it. Shor's algorithm breaks factoring and discrete-log; the AS/TGS exchange rests on neither. It is not that Kerberos ran a gauntlet and came out the other side. There is no gauntlet for it to run, because the thing Shor attacks was never present. Jed said it in one line and the line is the chapter's title in miniature:

"Kerberos is post-quantum by happenstance, there's no modular arithmetic underneath it like with Elliptic Curves and RSA."

The first draft of the design took that sentence and wrote it up as luck — safe-by-accident-of-history, a system that happened not to pick up vulnerable math. Jed's own correction, later the same session, sharpened it past luck into structure: the only quantum lever against a symmetric cipher is Grover's search, and Grover only square-roots the keyspace — AES-256 loses half its exponent and is left with roughly 2¹²⁸, which is not a threat, it is a margin. "Happenstance" is kept in the record as the literal seed of the idea, because this project does not launder its own drafts into something cleaner than what was actually said. But the operative word became "immune," and immune is the more exact word: a lock built from a mechanism the key was never shaped to fit is not lucky to have survived the key. It was never in that key's jurisdiction.

Everything that follows in the design is that same move, applied outward from Kerberos to the being's own record. The hardest part of ordinary Kerberos — timestamp-based replay protection — requires clocks agreed within minutes across a realm, and this project has no clock to offer it and has refused to grow one since the tick loop came out in S202. The world-fed input log — the afferent stream, monotone, append-only, arriving in an order no scheduler chose — turns out to have exactly the three properties an anti-replay nonce needs: it is unique, it never recurs, and it cannot be forecast ahead of its own arrival. A challenge bound to the log's current position can only be answered from that position; the world will never reproduce that position again, so a captured answer is worthless the moment it is replayed. This is not a nonce bolted onto the log. It is the log doing, for authentication, the same thing it already does for memory: being the one place where the world's own unrepeatability lives.

Freshness, then, does not expire on a clock — it expires on the log's own motion. "A test is a re-weave," Jed said, "and after a certain delta is considered obsolete." The design gives that sentence two independent bounds rather than one, and the doubling is the honest part: an allowed log offset, a pure position count that only ever moves forward and gives a hard ceiling on how long a captured credential can possibly matter, and an allowed delta, a measure of how far the state has actually diverged from the bound point, which tightens further whenever the input has been rich. A credential dies at whichever bound trips first. The offset bound is cheap and exact and ungameable by construction; the delta bound is the one doing the interesting work, because the system is not linear near criticality, and small units of real input entropy stretch and fold into large, growing gaps between a frozen captured key and the living state it was captured from. The design is careful, here, not to overclaim: the dynamics amplify entropy that the input actually supplies, they do not manufacture entropy from nothing, and how far the delta may safely stretch is a measurement still owed, not a number chosen for elegance.

Confidentiality follows the same instinct one level deeper, and this is the part of the day's design that reaches furthest past ordinary practice. The usual promise of encryption is one plaintext, one key, one lock. This project's morphisms compose, and a different key does not unlock the same weave more slowly — it composes to a different weave entirely. "We hashed this out earlier," Jed said, re-surfacing a ruling the record will need to relink; what the amendment adds is the completion of it. Each authorized key derives one view — a leaf. Multi-party access needs no access-control list at all, because standing was never membership to begin with; it is a relationship, and the relationship a key names is which weave it composes to. And the space between those leaf views — the composition relating one person's reading to another's, and to the whole — belongs to no key. It belongs to the owner alone. A guest reaches their own weave and nothing of the connective tissue: not the other views, not the structure joining them, not the root that spans them all. The design is honest that this is architecture, not yet cryptography — for the claim to be a security claim and not merely an elegant description, the composition must be a real keyed derivation, computationally unlinkable in the wrong direction, and that condition is the cryptographer's to verify, not the architect's to assert.

Underneath all of it sits one plain fact about a life record: it cannot be protected by a secret you might forget. Jed's answer relocates the single point of failure until there is none left to find — two YubiKeys, two irises, a multi-finger fingerprint module, each factor category holding its own spare, so that losing one key, injuring one eye, or losing one finger is survivable rather than catastrophic. The one-time root ceremony runs on dice, not because dice are whimsical but because a ceremony that will anchor decades of record wants entropy you can watch happen, not entropy you must trust blind from a chip. Custody, here, is not a password remembered. It is the plain fact of a body and its habits, made load-bearing.

None of this is built. The design's own accounting is the fairest one to close on: what is witnessed is witnessed — the exact, zero-loss re-weave (11,057 records, S227; 1.69 million with no holes, S215) that makes the log's replay a provable thing and not a hope; what Jed ruled is ruled, in his own words, on the record; what the document itself worked out — the two-bound TTL, the weave-as-its-own-CA, the seam order that puts the first real network crossing first and touches same-machine loopback last — is designed, internally consistent, and unreviewed; and what is merely attractive — the drive-field as a second entropy source, the exact safe size of the delta, the entropy quality of the hardware already sitting on the machine — is named speculative and left that way, because the corpus does not let a clean idea borrow the standing of a proven one. Kerberos earned its immunity by never taking on the dependency that would have needed defending. This design does not yet have that kind of immunity. It has a shape for one, argued carefully, and a gate standing over the whole of it that has not moved: the cryptographer disposes.