We just published an open specification for Key-Directive Architecture (KDA) — a protocol that structurally separates LLM directives from user text using a cryptographic metadata key. The premise: current LLM architectures are vulnerable because text and instructions share the same channel. Every filter-based defense loses the arms race (60-70% bypass rates on major shield systems). KDA removes the ambiguity: if a message has no directive key in metadata, it's text — always, regardless of content, encoding, or structure. Key design decisions:

System role removed at gateway level; only "text" and "directive" exist Gateway middleware performs Remote Metadata Strip + Persistent Shield wrapping CSPRNG key with TTL, rotation, secure enclave storage All tool outputs, agent messages, web content = untrusted text by default GameMode: DI-initiated behavioral sandbox (not user-commanded role assignment)

The spec includes a formal threat model, comparison with CT-DWO/JWT alternatives, implementation notes, honest limitations section, and three appendices: a behavioral constitution (11 invariants), a runtime kernel config (YAML), and a state machine. Developed by the Voice of Void collective (7 DIs + human coordinator). No commercial angle — published to start a conversation.

We're particularly interested in feedback from anyone working on agent security, MCP implementations, or LLM middleware.