Discovery evidence, enforcement control.

Agent infrastructure is often deployed without a complete registry, which makes both inventory and monitoring status matters of inference. Agentlens was evaluated as a read-only discovery and correlation layer; Blackwall was evaluated as a separate, approval-gated enforcement layer consuming a versioned containment artifact.

The recorded baseline combined automated testing, live-provider collection where access was available, synthetic interoperability checks and bounded infrastructure proofs. The results support the architectural separation and the tested containment mechanisms within their stated scope. They do not establish production readiness or universal provider coverage.

Four evidence classes were kept distinct. Automated suites exercised schema, correlation, deterministic planning, signatures, journals, rollback and failure handling. Live collection checked reachable provider surfaces. A pinned synthetic fixture tested artifact reproducibility across the Agentlens-to-Blackwall handoff. Dedicated VPS and disposable AWS environments tested real network behavior and lifecycle evidence.

Claims were accepted only when tied to the pinned subject, target, observation window and evidence contract. Missing crossing points, ambiguous timing and scope drift failed closed. Provider calls in the Blackwall unit suite were simulated; the VPS and AWS exercises supplied the separate live mechanism evidence.

The pinned Agentlens baseline passed 995 automated tests. Thirteen collectors across seven providers were implemented, and live validation was completed for every provider surface reachable during the study. CrowdStrike and Entra live validation were deferred and are not included in that claim.

Independent outputs from real collectors merged end to end through the correlation engine. A least-privilege AWS collection produced a schema-valid containment candidate bound to the exact disposable instance, while the synthetic interoperability fixture was reproduced byte for byte.

The pinned Blackwall baseline passed 345 automated tests with two expected platform-specific skips. On the dedicated VPS, nine tested network paths were reachable before containment, none were reachable during containment, and all nine returned after release. Management and runtime paths designated as denied remained denied.

The disposable AWS lifecycle satisfied all twelve evidence crossings or their reviewed absence controls. Initial and final target captures were byte-identical, release was idempotent, and separate code and evidence reviews returned GO without unresolved blocking or high-risk findings.

The AWS evidence bundle used content addressing and immutable S3 Object Lock custody. Reviewed destroy plans removed 24 canary and 27 harness resources without creates or changes. Subsequent inventories found no active run infrastructure.

Temporary controller and read-only roles, virtual MFA material, sessions and signing credentials were revoked after the exercise. This reduced the chance that a successful test environment silently became a standing control path.

The evidence does not certify production workload relocation, stateful transfer, Kubernetes enforcement, multi-host orchestration, Azure or GCP enforcement, or any target beyond the sealed disposable runs. Live validation also depended on provider access; deferred surfaces remain explicitly unclaimed.

The synthetic interop fixture demonstrates deterministic compatibility, not live discovery. The VPS replay used real exported observations but was not a live discovery pipeline. Evidence integrity and custody controls preserve the tested record, but they do not convert a bounded mechanism proof into reusable authorization.

The findings support a narrow architectural conclusion: discovery can remain read-only while mutation is isolated behind a versioned contract, exact-plan approval, short-lived credentials, rollback and evidence capture. The tested designs preserved that separation across collector correlation, artifact handoff, containment and release.

A production action would require a new target capture, plan, authorization, credential set, validity window, review and evidence cycle. The validated baseline is therefore best read as mechanism evidence and an operating model for further study.