every send is decided again on lsm/socket_sendmsg; neither guard consumes the token, and neither looks at the destination
last verdict—no token
EPERM
No live causal token — connect() and every send are refused.
a click, tap or key press this page did not script
📋 Kernel audit log0 events
Replay a kernel path
CAUSALITY_WINDOW = 500 ms
no token — every write, connect or send is EPERM
one token, two hooks: write() on lsm/file_permission and sendmsg() on lsm/socket_sendmsg, until the window closes
DCC Ring 0 is a set of eBPF programs attached to Linux Security Module hooks. A process may write a file, connect, send or execute only while it holds a causal token younger than 500 ms. A token is issued by an authority on request; a process cannot issue one to itself. Whether the request must come from a person depends on what the authority demands — today a shared secret, not a hardware key.
This page runs a model of that kernel code in your browser. The model follows dcc_core.bpf.c as built on 2026-08-07, branch by branch, and 36 conformance tests pin each branch to the source. A mutation test plants 23 known-wrong behaviours into the model or the source; the tests catch all 23.
What it is not
It is not the kernel, and nothing here talks to a server. The verdicts are the model's. How close the model is to the kernel is exactly what the conformance tests measure — see Evidence.
The application writes to capture.jpg. Each write() reaches the dcc_axiom_validator program on lsm/file_permission, and each is decided on its own:
The first write consumes the token and binds the transaction to that file's inode.
Further writes to the same inode are allowed while the window is open.
A write to a different file with the same token is refused as a TOCTOU pivot — always, even in log-only mode.
Once the token is older than 500 ms, the next write is refused (VERDICT_EXPIRED). The file stays open; writing to it does not.
Every refusal returns EPERM.
What the panel shows
The panel renders the model's own state for this path and nothing else: the target inode, the entry the file's name has in file_axiom_map, the transaction state and the inode it is bound to, and one mark per write() the model decided, in the order it decided them. The mark that ends a run is the refusal itself. Nothing is drawn that the model did not produce, and no file is written — the write is the model's, not the file system's.
Evidence
D-01 (a process without a token cannot write) and D-02 (an expired token is worth nothing) — PROVEN on a live 6.1 kernel in blocking mode, 2026-08-07, one disposable VM. Earlier: T01 blocked on the Tokyo host, 2026-05-25 (report v1.4, §6).
connect() reaches dcc_network_guard on lsm/socket_connect. Every send — connected or not, TCP or UDP — reaches dcc_sendmsg_guard on lsm/socket_sendmsg. Both ask one question: is there a token no older than 500 ms?
They do not consume the token, so the network stays usable after the first file write.
They do not look at the token's op_class. A token scoped to writing still opens a connection — try op_class vs axiom in the replay bar.
After the window, the socket is still open, but sending is refused.
What the panel shows
No page is loaded and no packet leaves your browser: there is nothing to fetch, because the connection is the model's, not the network's. The panel renders the socket's state, the verdict connect() received, and one mark per sendmsg() the model decided. The destination is printed because the application named it — 203.0.113.9:443 is a documentation address (RFC 5737) — and it is printed only to make that point: neither guard reads it, so the same verdict would follow for any peer.
Configuration
The network guard is off by default in the loader and must be switched on (--net-guard-block). This page emulates it switched on, as in the proof runs.
Evidence
D-04 — connectionless (UDP) egress is mediated. PROVEN, 2026-08-07. Before the socket_sendmsg hook was added, sendto() walked past the connect guard; that gap was measured and closed the same day.
The kernel has two token sources:
dcc_causality_monitor on the input_event tracepoint — a physical key press. This tracepoint does not exist on the 6.1 generic kernel, so in the measured build this program never attaches (ledger O-D1), and a headless server has no keyboard anyway.
dcc_mint_token, a program only a privileged authority can run. An application asks the authority; the request is signed, replay-protected and bound to the caller's identity. The application cannot write a token itself — the token map is frozen.
In this page, a trusted browser event (isTrusted=true) stands in for the human-originated request. A script on this page cannot produce one — try Scripted click. A program that drives the browser or the operating system's input can: this site's own tests click the button that way. isTrusted means the input came from outside the page, not that a person made it.
What makes a button truly physical
Only a signal no program can generate: today that means a hardware key whose touch sensor signs the specific request. The authority in the measured build authenticates requests with a shared secret instead (O-D4), so whoever can read that secret can obtain a token without anyone pressing anything. See Evidence for the full list of conditions.
Lifetime
500 ms from the moment it is issued. The authority cannot back-date a token or give it a longer life. A forked child inherits a live, unconsumed token with the parent's timestamp, at most three generations deep; a consumed token is not passed on.
Evidence
D-05 (a token source that works on a headless machine), D-06 (an application cannot issue itself a token), D-07 (signed, anti-replay, caller identity, rate limit) — PROVEN, 2026-08-07. T10 (the frozen token map refuses even root) — Tokyo, 2026-05-25.
Slow motion
The ×10 switch stretches wall time only. The model still sees 500 ms; the verdicts do not change.
Lines with a VERDICT_* name are what the kernel model emitted, in the order it emitted them — the same verdict codes the kernel writes to its ring buffer. Each line names the hook the decision was taken on, the program that took it, and the operation that was asked for, because the verdict alone does not distinguish a write from a send:
One process, pid 4242, drives both panels with one token. That is the point of the page: the same token is presented at two different hooks, and each hook decides for itself. The hook name is the only thing that tells the two effect paths apart — so it is printed.
Lines starting with › are this page narrating what it asked for.
The repeated line from pid 666 is an autonomous process that tries to connect every 3 seconds. It never holds a token, so it is always refused.
The replay bar
Each button drives one kernel path on its own process: an expired token, a second file with the same token (TOCTOU), a file protected with OP_BLOCK, a token scoped to writing against a network axiom, fork inheritance before and after the parent writes, and a scripted click.
Which of these are measured
Measured on a live kernel with a real token: the refusal without a token (D-01), the expired token (D-02), the TOCTOU pivot, the multi-write, op_class against an axiom, OP_BLOCK with a live token, and fork inheritance (D-16 – D-20, 2026-09-11 — effect measured, verdict names still owed). See Evidence.
Whitelisted programs are exempt within an op-class scope. A whitelisted binary runs token-free only for the effect classes in its scope (write / net / exec / read); anything else is refused (measured, D-21). The scope is by class, not yet by file or destination, and an any-scoped entry is the old blanket exemption — the model's widest door. See Headless workloads.
Root can switch the layer off (ledger D-13). It is a software layer.
Log-only mode forbids nothing (D-10). This page emulates blocking mode.
Nothing is deployed (O-D3). All 2026-08-07 results come from one disposable VM with a locally built binary. The Tokyo host still runs an older build in log-only mode.
Read mediation is not re-confirmed. It was measured on the Tokyo host in May; the 2026-08-07 build did not reproduce it (O-D5). The read guard is off here, as by loader default.
A token is not bound to what is written. Binding a token to the content hash is planned (D-11), not built.
Planned, not implemented: answering a refused process with ENODEV or ECONNREFUSED, so that a denied resource looks absent rather than forbidden. Today every refusal is EPERM.
Both documents describe the state of 2026-05-25. Later measurements (2026-08-07) and the points where they supersede the report are listed on the Evidence page. The paper's emulator used a 200 ms window; this page uses the kernel's 500 ms.
✉ REQUEST THE TECHNICAL DOSSIER
The dossier covers the eBPF/LSM implementation, the measurement protocols and their results, and licensing. It is shared under NDA. Tell us what you want to protect and we will reply with the NDA and a proposed call.