Nucleus is a formally verified permission lattice and security runtime for AI agents. The permission algebra has 67 Kani bounded model checking proofs (50 in portcullis, 17 in the constitutional kernel) and a Lean 4 HeytingAlgebra proof on the production Rust permission type via the Aeneas translation pipeline. 10 proofs run on every PR (fast tier); the full 67 run nightly. Every tool call is intercepted by a kernel-level proxy that enforces the lattice — the DecisionToken linear type makes kernel bypass structurally impossible, proven by 5 Kani harnesses (E1-E5) covering both token-issuing paths (decide() and issue_approved_token()). The exposure tracker classifies every operation into a 3-bit label set and detects uninhabitable states (combinations of read + untrusted + exfil capabilities) via ExposureSet::is_uninhabitable(). The nucleus-claude-hook is a 2-command install that intercepts Claude Code tool calls via PreToolUse hooks, routing them through Kernel::decide() with cross-invocation exposure tracking. The hook fails closed — empty stdin, parse errors, and denied operations all exit non-zero. Fleet lockdown drops all agents to read-only in under one second via gRPC bidirectional streaming, preserving read access for forensic investigation while blocking writes and exfiltration. The nucleus-audit scanner discovers uninhabitable states in Claude Code settings.json, MCP configs, and PodSpec files, exiting non-zero when critical or high findings exist for CI gating.
