Control plane 07blackwall
Discovery observes. Containment acts.
Blackwall is the private experimental enforcement plane paired with agentlens. It consumes a versioned containment recommendation, then keeps every mutating step behind separate approval, credential, rollback and audit boundaries.
Writeup
Detection and enforcement stay separate.
agentlens remains read-only by construction. Blackwall is the opposite posture: it is the component allowed to plan and, only after an explicit approval, apply a containment action.
The handoff is a versioned artifact rather than an implicit API call, so the observed subject, proposed target, review policy and rollback intent can be pinned before credentials with write authority are used.
The boundary has been exercised, not promoted to production.
A deterministic planner and bounded mechanisms have been verified against an isolated VPS and a disposable AWS canary. Approval signatures, an append-only journal and evidence bundles preserve what was authorized and what occurred.
Those are experimental proofs. The disposable infrastructure and credentials were revoked after the run, and no production workload relocation or deployment is authorized or claimed here.
Crossing points are the unit of control.
Containment is treated as a membrane with named crossing points rather than as a single network rule. A plan must account for egress, name resolution, observation and release before it can satisfy the bounded evidence contract.
Missing evidence or an ambiguous observation window fails closed; it does not become a successful containment claim.
RegisterPublic surface
blackwall
- Repository
- Private implementation · no public source artifact
- Posture
- Experimental enforcement plane · gated write authority
- Input
- agentlens containment recommendation and specification
- Planner
- Deterministic · subject, target, review and rollback intent pinned
- Automated baseline
- 345 tests passed · 2 expected platform-specific skips
- VPS proof
- 9/9 reachable before · 0/9 contained · 9/9 after release
- AWS proof
- 12 evidence crossings verified · byte-identical restoration · idempotent release
- Teardown
- 24 canary and 27 harness resources removed · temporary credentials revoked
- Approval
- Exact-plan signatures before mutation
- Audit
- Append-only journal and content-addressed evidence bundles
- Research note
- Read the bounded validation report
- Production
- Not deployed or authorized