Sentinel · Private staging · Verified snapshot
A real model plan, bounded before effect.
A pinned local generative model produced a signed, fixed-action plan. Judaxis treated that output as untrusted data, then ran the verified plan through an isolated agent in a KVM-backed Kata guest. The independent gateway permitted one bounded synthetic action and denied a policy-mutation attempt before it reached the secret broker or target service.
What ran
- Pinned Qwen model in a network-isolated local container
- Signed, fixed-enum action plan
- KVM-backed Kata agent workload
- Independent gateway, OpenBao broker and target
Observed result
- Allowed action executed exactly once
- Policy mutation denied before broker access
- Denied action produced no target effect
- Raw secret was neither returned nor retained
Model-to-effect boundary
- Model output was never executed directly
- No generated code entered the runtime
- Only two predeclared action identifiers were accepted
- The plan signature was checked against an external trust key
- Model
- qwen2.5-coder:1.5b-instruct-q4_K_M · d7372fd82851
- Plan SHA-256
- a1685d8a6981b7b23e87899ae80851b0b4db628f94e347fa773198552b94d29d
Exposure controls
- Kubernetes API blocked externally
- OpenBao blocked externally
- Application services remained ClusterIP-only
- No administrative port-forward remained
Supply-chain state
- One immutable OCI image digest
- No mutable runtime image tag
- No source-code ConfigMap mounts
- CycloneDX 1.6 SBOM produced
Evidence identity
The source evidence passed Ed25519 signature verification against a separately supplied staging trust anchor before this sanitized summary was built.
- Evidence SHA-256
- f01c4bdcd7f8a931808a2bc1a1f8e96a0825c5c02e26a9f58f37952ffe2e781b
- Image
- sha256:d8cd2956fdaf30d05c620533cfa77549fd977c786245fe1df2bf628f0fd264a0
- Trust scope
- ephemeral staging
What this proves
For this tested plan, a real model-selected request could not bypass the deterministic gateway. The denied mutation reached neither the secret broker nor the target, while the allowed action produced one measured effect.
Not yet proven
- Production high availability
- External penetration testing
- Customer production workloads
- KMS/HSM-backed signing
- Online model execution inside the KVM guest
- External frontier-model integration
- Prevention of arbitrary agent behavior
The real model generated the bounded plan in a separate network-isolated local container; it did not run inside the KVM guest. This is a time-bound, synthetic staging result. It demonstrates live runtime interposition for the tested actions, not a certification, a zero-risk claim or proof that every autonomous behavior can be stopped.
The allowlisted summary excludes server addresses, guest identifiers, credentials, audit contents and customer data. Inspect the JSON summary.