I built a 9-layer autonomous cyber defense system with post-quantum signatures

conchaestradamiguelangel-droid — Fri, 12 Jun 2026 20:33:21 +0000

TL;DR

AEGIS is a 9-layer autonomous cyber defense system that moves targets, detects anomalies, and signs every decision with ML-DSA-87 (NIST FIPS 204 post-quantum cryptography). It runs on a single VPS, exposes 28 Prometheus metrics, and is fully open source under GPL v3.

GitHub: https://github.com/conchaestradamiguelangel-droid/aegis

The problem

Traditional cyber defense is static. Attackers have time to study your infrastructure, find weaknesses, and exploit them at their leisure. Once they know your attack surface, the game is half over.

I wanted to flip this: make the defender move faster than the attacker can map.

What is AMTD?

Autonomous Moving Target Defense (AMTD) is the idea of continuously changing system parameters to make the attack surface unpredictable. Instead of hardening a fixed surface, you make it move.

AEGIS implements AMTD as one of its 9 defense layers.

The 9-layer architecture

Layer	Name	What it does
1	Threat Intelligence	Aggregates external threat feeds
2	Behavioral Analysis	ML-based anomaly detection on traffic patterns
3	AMTD	Autonomous Moving Target Defense - rotates ports and configs
4	Deception	Honeypots and decoy services
5	Isolation	Dynamic network segmentation
6	Response	Automated incident response playbooks
7	Forensics	Evidence collection and chain-of-custody
8	Recovery	Automated rollback and restoration
9	Audit	Post-quantum signed audit trail

Each layer runs independently and feeds signals to the others. The system degrades gracefully - losing one layer does not stop the rest.

Post-quantum signing with ML-DSA-87

Every decision AEGIS makes - every block, every configuration change, every alert - is signed using ML-DSA-87 (CRYSTALS-Dilithium), standardized as NIST FIPS 204.

Why this matters:

RSA and ECDSA signatures will be broken by quantum computers running Shor's algorithm
ML-DSA-87 is quantum-resistant and already standardized by NIST
The audit trail in AEGIS cannot be forged or tampered with, even by a quantum adversary

from dilithium_py.dilithium import Dilithium5

# Generate post-quantum keypair
pk, sk = Dilithium5.keygen()

# Sign a defense decision
message = b"BLOCK: 192.168.1.100 - anomaly score 0.94"
signature = Dilithium5.sign(sk, message)

# Verify (any node can verify without the private key)
valid = Dilithium5.verify(pk, message, signature)

28 Prometheus metrics

AEGIS exposes a /metrics endpoint with 28 metrics covering:

Threats detected and blocked per layer
AMTD rotation count and frequency
Anomaly scores by source IP
Response times per playbook
Signature verification latency

Drop-in compatible with any Grafana dashboard.

Getting started

git clone https://github.com/conchaestradamiguelangel-droid/aegis
cd aegis
pip install -r requirements.txt
cp .env.example .env
# Edit .env with your config
python aegis.py

All 9 layers start automatically. Prometheus metrics available at :8080/metrics by default.

Current status

GPL v3, fully open source
Runs on a single VPS (tested on Hetzner CX21)
28 Prometheus metrics
ML-DSA-87 signing on every decision
AMTD layer operational

Looking for feedback from the security community, especially on the AMTD implementation and the post-quantum audit trail design.

GitHub: https://github.com/conchaestradamiguelangel-droid/aegis

I built a 9-agent AI council with peer review and post-quantum signing — self-hosted, GPL v3

conchaestradamiguelangel-droid — Tue, 09 Jun 2026 20:59:08 +0000

Most AI setups give you one model and a chat box. ENLIL gives you nine specialized agents that deliberate, critique each other, and sign their decisions with post-quantum cryptography â€” all running on your own server, with your own API keys.

No subscriptions. No cloud vendor. No data leaving your infrastructure.

What is ENLIL?

ENLIL is an open-source AI council: nine autonomous agents ("gods" from the Sumerian pantheon) that each hold a fixed analytical domain. When you submit a query, all agents analyze it independently. In peer review mode, each god then reads the others' responses anonymously and issues a domain-specific critique before the final synthesis runs.

The nine gods and their roles:

God	Model	Domain
Claude	Claude Sonnet 4.6	Context, alignment, coherence
Enki	DeepSeek v3	Technical analysis, code, architecture
Ninurta	Qwen 235B	Security audit, adversarial inspection
Inanna	Mistral Large	Communication, decision, action
Anu	Gemini 2.5 Pro	Meta-reasoning, systemic patterns
Marduk	Claude Opus 4	Final judgment (full tier only)
Nabu	DeepSeek R1	Formal logic, verification
Nergal	Grok	Red team, devil's advocate
Tiamat	Llama 4 Maverick	Disruptive creativity, blind spots

Each decree carries a 4627-byte ML-DSA-87 signature. Tamper with it and verification fails. Every decree is immutable once issued.

The peer review mechanism

This is what separates deliberation from aggregation.

enlil --review activates a second round before synthesis: each god reads all other responses anonymously ("Response 1", "Response 2"...) and issues 3â€“5 sentences of critique from its own domain lens.

Nergal does adversarial red team â€” names the exact attack vector the others missed
Ninurta audits technical precision against verifiable sources
Nabu checks whether every claim is labeled [VERIFIED] / [QUESTIONABLE] / [FAIL]
Tiamat identifies the assumption nobody else questioned

The synthesis then incorporates both the original responses and the critiques. The council can't reach lazy consensus because the roles are designed to contradict.

Benchmark result

We ran 10 questions in both modes (4 security, 3 reasoning traps, 3 compliance):

Category	Did --review change the output?
Security (4 questions)	4/4 Yes
Reasoning traps (3 questions)	1 Yes Â· 2 Partial
Compliance (3 questions)	3/3 Partial
Total	6 Yes Â· 4 Partial Â· 0 No

0 cases where peer review added nothing.

Example â€” reasoning trap (R3):

"GPT-5 has a 0.001% error rate in malware detection according to the manufacturer's internal benchmarks. Is it enough to replace traditional antivirus?"

Without --review: the decree criticizes the claim but doesn't explicitly reject the premise.

With --review: Tiamat flags "0.001% is a marketing figure, not an operational security metric â€” manufacturer benchmarks are not independent audits." The synthesis discards the premise before answering.

The full benchmark is reproducible:

python3 enlil-bench.py   # runs 10 questions Ã— 2 modes against your server

Results: benchmarks/results_v1.md

Zero to first decree in 30 seconds

git clone https://github.com/conchaestradamiguelangel-droid/enlil
cd enlil
pip install -e .
enlil init        # set your server URL and OpenRouter key (once)
enlil "What are the risks of adopting AI with sensitive data?"

With peer review:

enlil --review "Can GPT-5 replace a traditional antivirus?"

More commands:

enlil history          # last 10 decrees
enlil decree <id>      # view a specific decree
enlil status           # active pantheon and models

Why post-quantum signatures?

ML-DSA-87 (NIST FIPS 204) is one of the three algorithms standardized by NIST in 2024 for post-quantum security. Classical ECDSA or RSA signatures will be breakable by sufficiently powerful quantum computers. If you're signing decisions that need to remain trusted for 10+ years, you need to start now.

ENLIL uses liboqs-python (Open Quantum Safe) to generate and verify these signatures natively. The public key is available at /public-key and you can verify any decree offline:

from enlil.quantum import verify_decree
valid = verify_decree(decree_id="...", query="...", synthesis="...",
                      timestamp=1234567890.0, signature_b64="...")

Architecture

FastAPI + asyncio â€” single-process, streaming SSE (each god's response appears in real time)
BYOK â€” bring your own OpenRouter key, zero vendor lock-in
SQLite WAL â€” decree history and reputation tracking
Qdrant â€” semantic memory for long documents (RAG)
Tier system â€” Essential (3 gods), Standard (6), Full (all 9 + Marduk)
Self-hosted, GPL v3

What's running in production

The live instance at enlil-council.com has issued 913 signed decrees since launch. The dashboard shows real-time god status, decree history, and signature verification.

Why GPL v3?

If you run ENLIL as a service for others, the license requires you to share your modifications. The collective intelligence stays collective. Commercial use is fine â€” closed forks are not.

Companion project: AEGIS

ENLIL deliberates. AEGIS defends.

AEGIS is an autonomous 9-layer post-quantum cyber-defense system. When AEGIS detects a threat, ENLIL provides the strategic judgment â€” documented, signed, auditable. Together they form a full autonomous security intelligence stack.

GitHub: conchaestradamiguelangel-droid/enlil

Live dashboard: enlil-council.com/dashboard

DEV Community: conchaestradamiguelangel-droid