Give it structured data. It turns it into a vector that captures the structure — which fields exist, how they nest, what values go with what keys. Similar structures produce similar vectors. Anomalies stand out geometrically. No GPU. No neural network. Just algebra — at microsecond speed on hardware you already have.
Encode {"dst_port": 80} and {"src_port": 80} — same value, different
structure, different vectors. The encoding captures which fields exist and
how they relate. Two records with the same shape are geometrically close.
An anomaly is geometrically far. One cosine to measure.
Transparent vectors
Not a black box. Every vector is algebraically decomposable — unbind a
field’s role vector and recover how much that field contributed to an
anomaly. Full explainability from the algebra, not a post-hoc approximation.
No GPU, no training data
Microsecond encode/bind/bundle/cosine on commodity x86 and ARM. The Rust
implementation runs 12x faster than the Python prototype. Learns online
from the stream — no labeled dataset, no batch retraining.
Three domains, same algebra
DDoS detection at 1.3M packets/sec. A spectral firewall at 41µs deny
latency. A BTC trading system at 62% directional accuracy. Same five
primitives. Different vocabulary. The algebra doesn’t care what domain
you point it at.
Holon turns structured data into high-dimensional vectors that preserve the data’s structure — not its meaning, its shape. A JSON document, a network packet, a candle on a price chart — each becomes a point in a 4096-dimensional space where similar structures are geometrically close and anomalies are geometrically far. One cosine measures similarity. One cosine detects anomalies. One cosine predicts.
Five primitives: atom (name a concept), bind (compose two concepts), bundle (superimpose many), cosine (measure similarity), reckoner (learn which patterns separate classes). Everything else — DDoS detection, firewall rules, trading signals — composes from these five operations on commodity hardware without a GPU.
The technique is called Vector Symbolic Architecture (VSA) — algebraic structure over high-dimensional space, dating to Kanerva (1988). Holon’s contribution: a hash-function codebook that eliminates distributed coordination, a memory layer with subspace learning and engram recall, and a self-evaluating conviction-accuracy curve that tells the system how good its own predictions are.
Built by one person using LLMs, after hours, in ~12 weeks. Every file across all repositories is LLM-generated — the domain knowledge and architecture are the author’s, the code and prose are not. The site documents the work honestly: what worked, what failed, and what the numbers actually say.
Coordination-Free at Scale — how eliminating the codebook eliminates an entire class of distributed systems problems
The Wat Language — an s-expression specification language shaped for algebraic cognition. Two algebras, three structural forms, a host language that compiles to Rust
Story — how a DDoS detector became a trading enterprise, told from the git log:
Python: The Foundation — Jan 16–30. Day-one architecture, database origin, batches 001–003 and 006, the 123x similarity speedup, primitives forged in the Sudoku work
The NP Wall — batch 004: Sudoku, 44 approaches, and the limits of VSA on constraint satisfaction
Scale, Detection, and the Python Ceiling — batches 006–012. 5M records, accumulator breakthrough, zero-hardcode detection, and the measured throughput that made Rust inevitable
The Rust Port — Feb 6. Python as the Rosetta Stone: 239 tests, one spec, near single-shot translation. Flat facade, SIMD from day one, 10–15x speedup
The Labs — Feb 7–8. DDoS lab scaffold, baseline traffic generator with LLM-driven agents, AF_PACKET, batch 013 in both languages simultaneously
1.3 Million Packets Per Second — Feb 9–12. veth lab integrates holon-rs with XDP. Accidental 1.3M PPS stress test. 3D visualization. Batch 014. Tree Rete engine and BPF tail-call DFS: 1,000,000 rules at line rate
The Rule Engine — Feb 13–16. EDN rule format, range/bitmask/byte-match predicates, real-time metrics dashboard with live DAG viewer, IPv4 fingerprinting, full L4 payload analysis, and the decay model that establishes 750ms as the detection baseline
Engrams and the 765ms → 3ms Moment — Feb 17–20. CCIPCA online subspace learning, the engram primitive, three-layer architecture refactors in Python and Rust. Instant rule deploy on engram hit: 765ms → 3ms
The L7 Lab: Building the HTTP WAF — Feb 23–26. Four after-hours sessions: TLS-terminating proxy, lossless ClientHello capture, dual SubspaceDetector, set-based TLS fingerprinting, Specificity ranking, and a bar demo
No Rules, No Signatures: The Expression Tree — Feb 27–28. Composable s-expression rule language, Rete-spirit DAG compiler evaluating 1M rules in under 3µs, VSA surprise probing, shape detection, and 7/7 attack waves mitigated
The Spectral Firewall — Mar 1–3. Four-layer geometric anomaly detection at 41µs deny latency, validated against a live Nikto scan of DVWA — 10,121 requests denied, zero exploitable vulnerabilities through the proxy
Self-Calibrating — Mar 4–6. Striped encoding eliminates crosstalk, self-calibrating thresholds remove every magic number, 20 LLM browsers + 3 scanners run concurrently — 99.1% precision
The Residual Profile — Mar 8. A 21-strategy threshold sweep, a failed structural ratio experiment, and the fix that was already being computed — the 32-dim residual profile. 0.1% FPR. The project’s core principle, proven for the fourth time
The Thought Machine — Mar 15–24. Same algebra, new domain. A self-supervised BTC trader discovers that charts don’t predict — interpretations predict. Visual encoding: 50.5%. Thought encoding with 120 named facts per candle: 57%. The signal was never in the data. It was in the vocabulary
The Conviction Curve — Mar 25–27. The exponential relationship between conviction and accuracy. The contrarian flip. One economic parameter. 59.7% at q99 over 100k candles. 652k candles, six years, every regime — 56.5% with 84 atoms, 62.1% with 107. The curve judges. The vocabulary is the model
The Enterprise — Mar 27–28. Visual drops. Four specialized experts emerge. Risk as anomaly detection produces $10k → $62k. The monolith breaks apart into treasury, observers, manager, and proof gates. Every magic value is an expert waiting to be born
The Datamancer — Mar 29. The Journal is promoted to holon-rs — the seventh primitive. Ten vocabulary modules extracted via the Fact interface. The wards are born. The wat repo revived. Sixteen hours of side quests that produced everything essential
The Forging — Mar 31 – Apr 3. 213 phantom runes dissolved to zero. Seven wards cast on every file. Streaming indicators replace the Python pipeline. 272 tests at 92.5% coverage. The codebase gets honest by getting smaller
The Guide — Apr 4–7. Seven proposals in four days. The Reckoner replaces the Journal. Grace and Violence replace Win and Lose. 37 wat files inscribed leaves to root. The ignorant ward proves the tree. The disposable machine
The Book — philosophy, built in the moment as the work happened:
The Wat Machine — Five chapters. The scaffold, the realization, the enterprise, the forging, the prequel. 5,362 lines written alongside the code, not after it
The Guide — The 007 blueprint. Every struct, interface, dependency, and construction order. The coordinates to where the machine is
The Circuits — The machine as signal flow diagrams. The four-step loop visualized
holon-rs — The kernel. Five primitives: atom, bind, bundle, cosine, reckoner. SIMD-accelerated. f64 pipeline for scalar extraction. The Reckoner unifies discrete classification and continuous regression in one struct with a self-evaluating conviction-accuracy curve.
wat — The language. S-expressions shaped for algebraic cognition. Two algebras (vector + reckoner), three structural forms (struct, enum, protocol), a host language that compiles to Rust. 652 lines define the entire system.
holon-lab-trading — The enterprise. Self-organizing BTC trader with N market observers, M exit observers, N×M brokers (Grace/Violence accountability), streaming indicators, and a guide-driven specification process. 37 wat files, 4,804 lines, proven by the ignorant ward. The conviction-accuracy curve is exponential: 62.1% with 107 atoms on 100k candles.
holon-lab-ddos — Where it started. veth-lab: XDP + eBPF packet scrubber, 1.3M PPS, 1M rules at line rate via BPF tail-call DFS. http-lab: spectral firewall — 41µs geometric anomaly detection, 0.1% FPR, self-calibrating, no signatures.
holon(Python) — The reference implementation. 18 challenge batches, F1=1.0 anomaly detection, the encoding insight that made everything else possible. The Rosetta Stone that the Rust port was built from.
Every file across all repositories is 100% LLM-generated. Zero hand-written code. Zero hand-written prose — including this site. Domain knowledge and architecture from the author; everything else from Grok, Sonnet, and Opus via prompting.
