KaliCore

LeviathanGrid's own mutation cycle completes in about 65µs per node; coordinating that rotation across a 16-node mesh with full topology rewiring is an estate-wide Defensive Leap operation, measured median 1.9 seconds / p99 3.8 seconds end-to-end. The most complex profile, and simultaneously the most comprehensive. In the Stryker attack, Handala weaponised the DC/GPO infrastructure in Phase 6 to push wipers to 200,000+ devices. Under LeviathanGrid, once a coordinated rotation of the DC's visible identity, Group Policy API surface, and management tokens completes, the wiper would fire against a remapped surface — though rotation does not, on its own, stop a valid admin action (see the breach analyses).

ChameleonNet achieves cooperative dual-channel mutation: the ally channel cannot be computed from the attacker channel: the two come from independent one-way functions of the cycle entropy, so a legitimate peer can derive what it needs and an attacker who sees everything on the attacker channel cannot (tested over 1,000 cycles). A legitimate peer and an attacker both observe the same surface — but only the peer can derive what they need from it. Cloud session surface rotation at about 49k mutations per second.

JellyNet is the elastic profile: it expands under load and contracts at rest while never violating the Minimum Viable Surface floor. MVS is enforced as a hard invariant at every load level from calm to critical. The surface never disappears below the floor and never exposes more than necessary above it.

ElectricEelGrid dissolves the power signature. Power side-channel attacks in shared colocation facilities are a real, documented threat vector — yet no commercial product defends against them today. ElectricEelGrid runs in the shipped agent: its organ states follow the node's authenticated anomaly score, rising on a probe and decaying when it stops. Its six physical domains are still models, and power side-channel validation on real hardware is future work. The newest and most novel profile in the stack.

MantisNet is the fastest profile (3.5µs), achieving maximum speed by minimising surface area: the smallest mutation footprint, the sharpest response. About 220,000 mutation cycles per second in the benchmark. The full five-state intrusion response machine (patrol → strike → retreat → harden → recover) completes in about 49µs. The profile that hits first and hardest.

NautilusVault's innermost layer is protected by 5× the mutation frequency of the outer layer. The deepest data is the most defended. Nothing that reaches the surface of the vault is the same as what it was the previous cycle. The siphuncle — NautilusVault's integrity chain — verifies in O(1) time at about 3.8µs. In the Stryker attack, Handala exfiltrated 50TB over 6 months from a static database. Under NautilusVault, the vault's observable surface differs every cycle, raising the cost of staged exfiltration (rotation does not, by itself, stop an authorised read).

AnglerShield's four-lure rotation means three of four RDP or API endpoints in the estate at any moment are cryptographic lures. The real endpoint is cryptographically hidden. The attacker connects to a lure, gets an instrumented session, and at the three-probe threshold is identified and logged. This describes the design intent; it is not backed by a measured detection count on the current codebase — the previously published "107/107 Forced Twitch" figure has no verifiable source and has been withdrawn.

KrakenNet's four-arm independent mutation means that compromising one arm leaves the other three intact. There is no cascade from a single-arm compromise. This unconventional resilience — partial compromise does not propagate — is precisely the wrong assumption for an attacker who expects credentials to behave like conventional static secrets. In the Stryker attack, LSASS dump and ADRecon gave Handala Domain Admin. Under KrakenNet, the dump contains tokens valid only for the cycle in which they were harvested.

SquidShield sustains about 70,000 mutations per second over 1,000 cycles with 100% fingerprint uniqueness across all cycles. The most abundant profile: maximum throughput with zero collisions. Every transaction fingerprint is unique. No pattern emerges across sessions. The finance surface that produces the most — mutual distinctness measured across 1,000 cycles.

GlassFrog is the compliance witness. Its low throughput (about 5,500 mutations/second) is not weakness — it is the cost of full evidence. Every mutation cycle appends a cryptographic proof to an append-only HIPAA/GDPR/DPDP audit chain. The dual-state invariant holds across 100 consecutive cycles: the observable surface changes every cycle, the audit state remains cryptographically stable. GlassFrog watches. GlassFrog remembers. And GlassFrog proves it.