The boundary · describe, don't detonate

Nothing runs against your network.
That's architecture — not a promise.

The bright line isn't one check you have to trust. It's four independent controls, ordered strongest to weakest — every one would have to fail before a single packet could reach one of your assets offensively.

The same invariant that governs our own autonomous SOC: the AI proposes, deterministic code decides — and no AI sits in the decision path.
defence in depth · strongest → weakest

Four controls, each fatal on its own

0Capability removalPrimary · makes execution impossible

The red engine is an emitter: it produces a described-chain JSON document and nothing else. There is no chain(), exploit() or actuate() method registered anywhere for it to call, and the schema forbids any command or payload field. A chain carrying one is rejected, not sanitised — uninvokable, not merely disallowed.

You cannot detonate a weapon you were never handed.
▼ and, as backstops beneath it ▼
1Dry-run / tier gateBackstop · deterministic policy, no AI

Every side-effecting action is forced to dry-run. The forbidden set is un-overridable by any rules-of-engagement — there is no live-execution mode for an IP Fabric target to enable, by construction.

2Read-only scope allowlistBackstop · fail-closed scope

A signed allowlist encodes the MoU in machine-readable form: the pinned snapshot, the hero-path assets only, lab_only:true, and an expiry tied to the MoU term. An independent invariant refuses any globally-routable target offensively. Out of scope → fail closed, logged.

The read-only choke pointSingle object · every HTTP verb passes through it

Any request to IP Fabric can only travel through one guarded client. It permits a short read allowlist and fails closed on everything else — no config-push, no write, no actuator can even be formed.

ReadOnlyGuard — the allowlisteverything else → ReadOnlyViolation
GET /snapshotsread
POST /tables/**read (inventory, hosts, config)
POST /graphsread (path-lookup)
PUT / PATCH / DELETEfail closed
any config-push / actuatorfail closed
snapshot pinned · .json() only, .model() lint-banned · a CI test asserts no stage reaches IP Fabric outside this factory
3Signed run ledgerBackstop · proof, not prevention

Every read, every described chain (executed=false), every scope check and a deliberate negative-control (a write + actuator attempt, both shown blocked) are recorded to an append-only, Ed25519 hash-chained ledger — non-repudiable, and it proves only reads ever happened.

Three of the four layers exist so the guarantee never rests on a single class of failure.

📋 The run ledger — regulator-shaped

Per pass, an append-only ledger records a defensible, reproducible artifact — not a screenshot.

  • Run header: rules-of-engagement ref, pinned snapshot, dry-run enforced
  • Every IP Fabric call — proving only reads happened
  • Every described chain + gate verdict; each scope drop individually justified
  • A negative-control proof: a deliberate write + actuator attempt, both blocked
  • Hash-chain re-verifiable via embedded public key — no shared secret

DORA — reproducible artifact; read-only testing means no operational disruption. NIS2 — tamper-evident, per-finding justification.

Local & air-gapped — honestly

We won't overclaim this. Here is the real state, and where it goes.

Reachability + CVE reasoning (deterministic)local ✓
Describe-only narrative — POC, hosted modelegress
Describe-only narrative — local modelroadmap ✓
Any customer addressing / hostnamesscrubbed

The sovereign, fully air-gapped appliance — a local model running continuously on your own metal, its served weights pinned to a verified hash — is the roadmap. During the validation we say plainly which parts touch a hosted model and which don't.

The honest caveat — where the guarantee rests today

The three deterministic backstops (dry-run gate, scope validator, signed ledger) are canonical and battle-tested in our AI-SOC platform, but not yet vendored into this integration. Until they are — and until a write-attempt and an actuator-attempt are proven to fail closed end-to-end through the real orchestrator — the read-only, describe-only guarantee for the validation rests on Layer 0 (capability removal) + the schema bans + the read-only choke point. That is sufficient for a describe-only, read-only engagement. Hardening in the full backstops is part of the six-week plan, and mandatory before any actuator capability is ever contemplated.