NanoMind Specification v2.0

1. Overview

NanoMind is an open protocol for embedding intelligence into CLI security tools and runtime protection systems. Any tool can implement the NanoMind adapter interfaces to gain:

• CLI Mode: Natural language intent routing, 16 intent types, cross-product command mapping
• Runtime Mode: Behavioral anomaly detection, sub-2ms inference, federated learning

2. CLI Adapter Contract

The CLI adapter interface defines how security tools expose their command surface to NanoMind. Implementing this interface enables natural language routing and cross-tool command mapping.

interface NanoMindCLIAdapter {
  cliName: string;
  cliVersion: string;
  getCommandManifest(): CommandManifest;
  executeCommand(cmd: string): Promise<ExecutionResult>;
  getScanHistory(): ScanHistoryEntry[];
  getCheckRegistry?(): CheckEntry[];
  getATCData?(): ATCData;
}

2.1 Intent Taxonomy

All natural language inputs are classified into one of 16 intent types. Each intent has an assigned compute tier that determines inference routing.

3. Runtime Adapter Contract

The runtime adapter interface defines how agents and services expose behavioral telemetry to NanoMind for anomaly detection and federated learning.

interface NanoMindRuntimeAdapter {
  agentId: string;
  agentCategory: string;
  subscribeToBehavioralEvents(
    handler: (event: BehavioralEvent) => void
  ): Unsubscribe;
  getATCContentHash(): string;
  onAnomalyDetected(
    handler: (score: number, action: ARPAction) => void
  ): Unsubscribe;
  isOfflineMode(): boolean;
}

3.1 Behavioral Event Schema

Every observable action emits a behavioral event. The event schema captures the action type, timing, and the L0 guard decision.

interface BehavioralEvent {
  agentId: string;
  sessionId: string;
  sequenceNum: number;
  eventType: 'TOOL_CALL' | 'CAPABILITY_CHECK' | 'MCP_CALL' |
             'MEMORY_READ' | 'MEMORY_WRITE' | 'EXTERNAL_CALL';
  capability: string;
  toolName: string | null;
  argHash: string;
  timestampDelta: number;
  wallClock: number;
  responseSize: number;
  responseCode: number;
  l0Decision: 'allow' | 'block' | 'alert';
}

3.2 Anomaly Response Tiers

Anomaly scores map to graduated response actions. The response escalates proportionally to the deviation from established behavioral baselines.

4. Federated Learning Protocol

4.1 Gradient Submission

Endpoints submit anonymized gradients to POST /api/v1/telemetry/behavioral-gradient:

{
  "agentCategory": "financial",
  "gradientVector": [0.01, -0.02, ...],
  "localLoss": 0.023,
  "eventCount": 10000,
  "privacyEpsilon": 1.0
}

4.2 Privacy Requirements

• Gradient clipping: L2 norm ≤ 1.0
• Gaussian noise: sigma = sensitivity * sqrt(2ln(1.25/delta)) / epsilon
• Default: epsilon = 1.0, delta = 1e-5
• Server rejects submissions with epsilon > 2.0

4.3 Raw Data Guarantee

5. Guard Protocol

All non-direct input (piped, file, agent output) is screened for injection before routing. The guard checks for:

• Instruction override patterns
• Role switching patterns
• Permission escalation patterns
• Encoded payload patterns
• Zero-width character injection

6. Conformance

A tool is NANOMIND_COMPATIBLE if it satisfies all of the following:

1. Implements either CLIAdapter or RuntimeAdapter (or both)
2. Passes the conformance test suite (@nanomind/conform)
3. Guard is active on all non-direct input (CLI mode)
4. Differential privacy is applied to all gradient submissions (Runtime mode)
5. Raw behavioral data never leaves the endpoint (Runtime mode)