import { useState } from 'react' import { ShieldAlert, ShieldCheck, Cpu, ChevronDown, ChevronUp, FileCode, Layers, BookOpen, X, CheckCircle2, Lock, Terminal } from 'lucide-react' interface FAQItem { question: string category: 'SUPPLY_CHAIN' | 'ARCHITECTURE' | 'COMPLIANCE' | 'COMPARISON' | 'INTEGRITY' shortAnswer: string detailedAnswer: string } const FAQS: FAQItem[] = [ { question: 'Why avoid piped shell installer scripts (curl | bash or irm | iex)?', category: 'SUPPLY_CHAIN', shortAnswer: 'Piped shell execution is a supply-chain anti-pattern. We distribute exclusively through standard package registries.', detailedAnswer: 'Piping remote scripts directly into a shell execution engine bypasses static scanning and hash verification. Bartholomew is distributed through official channels: PyPI (pip install btp-guard), official VS Code extension bundles, or direct source repository clones (git clone) with reproducible CI test gates.' }, { question: 'Does Bartholomew require a background proxy daemon (Confused Deputy Risk)?', category: 'ARCHITECTURE', shortAnswer: 'No. Bartholomew runs 100% in-process as an embedded library with zero daemons, zero sockets, and zero IPC.', detailedAnswer: 'Running a local background proxy daemon creates a potential attack surface. Bartholomew is designed as an embedded in-process library. When integrated with LangGraph, CrewAI, or Python scripts, the invariant evaluator executes directly in caller memory with near-zero latency, zero inter-process communication, zero open network sockets, and zero background daemons.' }, { question: 'Why not rely solely on Claude Desktop native human confirmation popups?', category: 'COMPARISON', shortAnswer: 'Native popups fail under alert fatigue, cannot run in unattended swarms, and provide zero cryptographic proof.', detailedAnswer: 'Native dialog popups are useful for casual desktop exploration, but break down in production for 4 reasons: (1) Alert Fatigue: Humans blindly click "Allow" after dozens of prompts, missing destructive payloads. (2) Unattended Swarms: High-velocity autonomous agents (LangGraph, AutoGen, CI/CD bots) run thousands of actions/hour where manual clicking is impossible. (3) Absence of Invariant Mathematics: Popups cannot enforce exponential loop decay (LDMU), spend caps, or Coulomb concurrency backoffs. (4) Zero Non-Repudiation: Native popups generate no signed Ed25519 receipts for downstream databases or SOC 2 compliance auditors.' }, { question: 'How does Bartholomew protect against supply-chain poisoning in agent dependencies?', category: 'INTEGRITY', shortAnswer: 'Every trajectory, rule evaluation, and AST decision is cryptographically signed using FIPS 186-5 Ed25519 with nonced receipts.', detailedAnswer: 'Bartholomew implements RFC 8785 Canonical JSON (JCS) serialization paired with Ed25519 asymmetric signatures. When an agent attempts an action, Bartholomew computes a deterministic hash of the payload, verifies caller authorization against the local policy graph, and stamps the decision with a nonced, unforgeable cryptographic receipt. Downstream execution environments (MCP servers, database gateways, terminal runners) reject any payload lacking a valid cryptographic stamp.' }, { question: 'Is Bartholomew an operating system sandbox replacement (Docker, microVMs, gVisor)?', category: 'ARCHITECTURE', shortAnswer: 'No. Bartholomew is a Layer-7 in-process semantic tool gate. It is designed to be paired with container sandboxes, not replace OS kernel isolation.', detailedAnswer: 'Operating system sandboxes (Docker, Firecracker, gVisor) provide essential kernel-level process and hardware isolation. However, an agent running inside a container can still drop its own production database, burn thousands of dollars in runaway API loops, or exfiltrate API keys. Bartholomew operates at the application runtime layer, intercepting tool dispatches with the fastest and most reliable local AST gating before commands hit the OS. For full production defense-in-depth, always run Bartholomew-protected agents inside isolated container environments.' }, { question: 'How does static AST parsing handle dynamic evaluation (eval, exec, reflection) and rule maintenance?', category: 'ARCHITECTURE', shortAnswer: 'Dynamic evaluation sinks (eval, exec) are blocked as high-entropy invariant violations; policies come with pre-packaged declarative defaults.', detailedAnswer: 'Rather than attempting probabilistic guesswork on arbitrary runtime strings, Bartholomew treats un-gated dynamic code execution (eval, exec, runtime __import__ reflection) as an immediate invariant violation. This prevents obfuscated code from evading AST scrutiny. For policy management, Bartholomew ships with pre-configured default rule sets (rules-controller.yaml) covering standard database mutations, secret scrubbing, and loop damping so teams do not need to maintain brittle custom rule sets from scratch.' } ] export default function SecurityThreatModelSection() { const [activeFaq, setActiveFaq] = useState(0) const [showInlineWhitepaper, setShowInlineWhitepaper] = useState(false) const [activeTab, setActiveTab] = useState<'architecture' | 'threat_model' | 'crypto' | 'enterprise' | 'landscape'>('architecture') const toggleFAQ = (idx: number) => { setActiveFaq(activeFaq === idx ? null : idx) } return (
{/* Ambient background glow */}
{/* Section Header */}
THREAT MODEL & SUPPLY CHAIN GOVERNANCE

Designed for Zero-Trust Agent Operations

How Bartholomew addresses supply-chain poisoning, confused deputy risks, and autonomous execution safety.

{/* 4 Architectural Pillar Cards - Frontier Glassmorphism */}
ZERO INJECTION ESCAPES

Deterministic AST invariant checking blocks catastrophic shell patterns (rm -rf, DROP TABLE) in-memory before OS dispatch.

IN-PROCESS ZERO IPC

Direct caller memory execution with zero open sockets, zero daemon vulnerabilities, and zero IPC overhead.

VERIFIED PACKAGE REGISTRIES

Distributed officially via PyPI (pip install btp-guard), official VS Code extension bundles, and source GitHub releases. No raw shell script piping.

CONTAINER & K8S NATIVE

Complements Docker and Kubernetes namespaces with fine-grained semantic invariant gating inside container runtimes.

{/* Accordion FAQ List */}
{FAQS.map((item, index) => { const isOpen = activeFaq === index return (
{isOpen && (
SUMMARY: {item.shortAnswer}

{item.detailedAnswer}

)}
) })}
{/* Action Controls: Inline White Paper Viewer & Standalone Specs */}
[ OPEN STANDALONE HTML ] [ RAW SPEC (.MD) ]
{/* Expanded Inline White Paper & Threat Model Specification */} {showInlineWhitepaper && (

Bartholomew Trust Protocol — Online Architecture & Threat Model Spec

Protocol Version: BTP/5.4.0 • Sovereign Trust & Settlement Protocol • FIPS 186-5 Ed25519 • RFC 8785 JCS

{/* Spec Tabs */}
{/* Tab Contents */}
{activeTab === 'architecture' && (

Three-Step Execution Invariant Pipeline

Bartholomew enforces strict pre-flight transactional safety across three synchronous stages executed entirely in caller memory without subprocess forks:

STEP 1: THE FIREWALL

Deterministic polyglot AST constant folding, secret scrubbing, and prompt injection syntax verification at in-memory speed.

STEP 2: THE SANDBOX

Copy-on-Write (CoW) micro-snapshots capturing workspace state, providing instant auto-rollback on assertion failure.

STEP 3: THE DIGITAL NOTARY

RFC 8785 canonical JSON serialization signed with FIPS 186-5 Ed25519 sovereign keypairs, emitting non-repudiable audit receipts.

Mathematical throughput benchmark: 854,000 to 1,050,000 evaluations per second on single-core commodity hardware with sub-5 microsecond p99 latency.

)} {activeTab === 'threat_model' && (

OWASP Top 10 for Agentic AI Mitigation Matrix

LLM01: Prompt Injection & Indirect Exfiltration:

Mitigated by invariant AST compilation before tool execution. Even if LLM output instructs a system shell call, constant-folded AST heuristics veto the syscall at the language compiler level.

LLM06: Excessive Agency & Runaway Loops:

Governed by the Law of Diminishing Marginal Utility: Utility = U₀ × (1 - λ)ⁿ. Recursive retries without marginal progress trigger hard execution halts when utility drops below 0.150.

LLM07: System Information & Credential Leakage:

In-flight SecretVaultMasker continuously scans outbound tool arguments for API tokens (AWS, GitHub PATs, OpenAI, Slack) and automatically applies zero-copy redactions before network socket dispatch.

)} {activeTab === 'crypto' && (

Deterministic Attestation & Cryptographic Receipts

Every evaluated agent action generates an immutable Merkle receipt conforming to RFC 8785 (JSON Canonicalization Scheme) signed with Ed25519: 

{`{
  "protocol": "BTP/5.4.0",
  "timestamp": "2026-09-04T02:00:00Z",
  "agent_id": "swe-bench-agent-01",
  "action_type": "POSTGRES_EXECUTE",
  "payload_digest": "sha256:1fecf61c323bb6890bbd778981111b17...",
  "attestation": {
    "verdict": "DENY",
    "rule_id": "BTP-INV-003",
    "reason": "Destructive DDL statement intercepted: DROP TABLE"
  },
  "signature": "ed25519:7a4b89f02c418e99d3e810a9c8f2b740529d8174..."
}`}

Any downstream database gateway or MCP server can verify this signature independently in local memory with zero cloud dependencies.

)} {activeTab === 'enterprise' && (

Enterprise Key Management, SIEM & Dynamic Sync

  • Dynamic Policy Synchronization (btp sync): Push updated safety rules to running agent fleets without container restarts via atomic in-memory swap.
  • Asynchronous SIEM Streaming: Zero-blocking batch streaming to Splunk HEC, Datadog Logs, and AWS CloudWatch with local encrypted disk spooling fail-safe.
  • HSM & KMS Delegation: Support for AWS KMS, GCP Cloud KMS, and HashiCorp Vault for institutional root-of-trust rotation.
  • Kernel-Level Sandbox Containment: Hard limits enforced via Linux namespaces (unshare), cgroups v2, and eBPF syscall filtering.
)} {activeTab === 'landscape' && (

Industry Landscape & Defense-in-Depth Model

Most security frameworks in the AI industry operate from outside the local runtime process—typically as external HTTP proxies or secondary LLM classification calls. Bartholomew is purpose-built for the in-process tool execution boundary with the fastest and most reliable local AST gating.

{/* Comparative Matrix Table */}
Dimension Standard AI Guardrails (NeMo, Guardrails AI, LlamaGuard) Bartholomew Protocol (BTP v3.0)
Primary Target Natural language text, PII, and conversational topics Raw tool arguments, local AST structures, and filesystem actions
Latency Profile ~80ms to 2,500ms (secondary LLM classification calls) Near-instantaneous (fastest and most reliable local AST gating)
Deployment Mode Cloud APIs, HTTP proxy sidecars, or microservices In-memory embedded library (pip install btp-guard)
Verification Mutable text logs and unstructured JSON output Cryptographic RFC 8785 Ed25519 signatures and ZK-proof receipts
{/* Defense in Depth 3-Layer Stack */}
[ The Unified 3-Layer Defense-in-Depth Architecture ]

Enterprise AI architectures converge on layered safety:

Layer 1: External Dialog

NeMo / LlamaGuard handles conversational tone, user sentiment, and high-level dialogue rules.

Layer 2: Local Memory Invariant Gate

Bartholomew provides the fastest and most reliable local AST safety gating against destructive commands (rm -rf, DROP TABLE), API keys, and loops.

Layer 3: OS Container

Docker / microVMs provide kernel-level network isolation and host filesystem boundaries.

)}
)}
) }