Skip to content
GHOSTHREAD AI
Enterprise Security Whitepaper // Core Specifications

Trust, Isolation & Defense-in-Depth Architecture

Ghosthread AI is engineered from the silicon up for zero-trust environments. This document provides a rigorous breakdown of the cryptographic boundaries, message-queue isolation models, and kernel-level safety interdictions that protect local infrastructure.

01. WAL SQLite Vault 02. Win32 Ghost Lane 03. NTFS Kernel Fences 04. Access Control API
Subsystem 01 // Data Sovereignty

Local-First Memory Vault & WAL-Mode Concurrency

Conventional AI and automation platforms stream conversational logs, contextual screen scrapings, and workspace file metadata to remote cloud aggregators. Ghosthread AI enforces absolute data sovereignty through a local-first storage architecture (`axon/storage/database.py`).

# SQLite Execution Pragma Settings:

• PRAGMA journal_mode = WAL; (Write-Ahead Logging for concurrent non-blocking reads/writes)

• PRAGMA synchronous = NORMAL; (Optimized disk durability without unnecessary fsync bottlenecks)

• PRAGMA mmap_size = 268435456; (256MB memory-mapped I/O for sub-millisecond retrieval)

• PRAGMA cache_size = -64000; (64MB dedicated page cache)

Furthermore, all outgoing natural-language prompts pass through an active **Data Loss Prevention (DLP)** regex inspection barrier. This barrier automatically scrubs absolute Windows filesystem paths (`C:\Users\...`), private keys (`-----BEGIN PRIVATE KEY-----`), and API tokens (`AIzaSy...`) prior to any external model transmission.

FTS5 Trigram Semantic Search: Local historical notes and learned preferences are indexed via SQLite's virtual FTS5 table using porter unicode tokenization, allowing sub-millisecond keyword recall weighted by a 14-day temporal half-life decay function.

Subsystem 02 // Input Isolation

Win32 Ghost Lane Message-Queue Interdiction

Standard desktop automation tools rely on OS-level cursor injection (e.g., PyAutoGUI or AutoHotkey coordinates), physically seizing the mouse pointer and blinding the user during execution. Ghosthread eliminates focus theft entirely through asynchronous Win32 message routing (`axon/platform/ghost.py`).

[Natural Language Goal] ──> [BrainPlanner Compiler] ──> [DAG Execution Kernel]
                                                               │
┌──────────────────────────────────────────────────────────────┴───────────────────────────────────────────┐
│                                                                                                          │
│  [DWM Buffer Unfreeze] ──> [Child Input Sink Resolution] ──> [PostMessageW / SendMessageTimeoutW]        │
│       (SW_SHOWNOACTIVATE)        (RenderWidgetHostHWND)         (Zero Cursor Seizure / No Focus Theft)   │
│                                                                                                          │
└──────────────────────────────────────────────────────────────────────────────────────────────────────────┘

Child Input Sink Resolution: Ghosthread recursively inspects target application window hierarchies to locate the exact active input surface (such as Chromium's `RenderWidgetHostHWND` or WinUI 3 `RichEdit` child windows). Actions are dispatched directly to the window message queue using `PostMessageW`. The target application can be completely occluded or running behind other windows; DWM DirectComposition buffers (`PW_RENDERFULLCONTENT`) are captured headlessly without raising the window or stealing focus.

Pre-Flight Focus Guard: For operations requiring hardware-level input pulses, our RAII context manager (`transient_target_pulse`) verifies foreground ownership and restores the original cursor and focus state within milliseconds.

Subsystem 03 // Filesystem Security

Zero-Trust NTFS Kernel Fences & Recycle Bin Safety

Filesystem modifications and workspace cleanups are governed by an immutable security enforcement layer (`axon/platform/ntfs_kernel.py` & `axon/tools/workspace.py`). The software assumes a zero-trust posture toward destructive operations:

  • • System Directory Jails: Real-time path validation (`is_path_safe_to_modify`) hard-blocks any write, patch, or delete operation targeting `C:\Windows`, `System32`, `Program Files`, or partition volume boot records. Matching is strictly case-insensitive and immune to relative path traversal escapes (`..\..\Windows`).
  • • Recycle Bin Routing: All file deletion and cleanup actions route exclusively through native Windows Shell APIs (`SHFileOperationW` using `FO_DELETE` and `FOF_ALLOWUNDO`), backed by 64-bit aligned PCZZWSTR double-null terminated buffers. Files are never permanently purged without explicit manual intervention.
  • • Cloud Placeholder Safeguards: Sniffs cloud storage file attributes (`FILE_ATTRIBUTE_REPARSE_POINT`, `FILE_ATTRIBUTE_OFFLINE`) to prevent accidental synchronous hydration of offline OneDrive stubs during background indexing.
Subsystem 04 // Governance

Natural Language Access Control Gateway

Operators maintain absolute administrative control over runtime capabilities via our local Access Control Gateway (`axon/security/access_control.py`). The system enforces strict user-governed permission policies over sensitive OS primitives:

  • • PowerShell Execution Guard: Toggling off shell execution completely disables background PowerShell and system command dispatchers.
  • • Filesystem Write Interdiction: Prevents automated scripts from creating, overwriting, or organizing files on disk.
  • • Dynamic Application Blacklisting: Users can restrict interaction with specific applications (e.g., restricting IDEs or sensitive financial clients) simply by stating it in natural language (processed by `vault.py` and `access_control.py`).