Definitions · M · Deploy & eval
Mandatory hop
A mandatory hop requires agent traffic to pass through Blekline ingress (sidecar or MCP proxy) before reaching models, tools, or the public internet. Fleet benchmarks (B6) verify agents cannot bypass the hop.
A mandatory hop requires agent traffic to traverse Blekline ingress (MCP proxy or sidecar) before reaching models, tools, or external HTTP. Ungoverned bypass paths are a common failure mode in agent fleet rollouts.
Verification
- Benchmark B6 in the benchmarks matrix: can agent pods reach external HTTP without the hop?
- NHIM audit JSON flags workloads missing sidecar injection or hostNetwork egress.
- K8s deploy guide: Kubernetes fleet — Helm values enforce injection.
In Blekline
- Posture upload surfaces hop gaps on
/operations/posture. - Track 03 checklist includes mandatory-hop probe steps on
/operations/deploy.