Ackermann set theory