NHIM audit

NHIM audit is a static Kubernetes inventory scan run via the open-source nhim-audit CLI (@blekline/nhim-audit@0.2.2). It produces JSON (schema version 2.0) describing agent workloads, egress paths, sidecar coverage, and mandatory-hop gaps — without mutating the cluster.

Output

• JSON includes assurance metadata, score.staticGateStatus (unknown until --probe), and rule IDs NHIM-001..019 under --profile generic.
• Upload JSON to /operations/posture or during platform eval onboarding.
• Feeds deployment hub gap list and committee forwarding pack.
• Optional --probe with self-serve blw_eval_* from Deployment hub; assurance.probeTokenValidatedOnline when BLEKLINE_EVAL_ONLINE=1.

Not the same as

• NHIM pentest — program gate, not yet complete (see operator runbook).
• Runtime enforcement — audit is pre-deploy static analysis; sidecar is runtime.

In Blekline

• Quickstart: /docs/get-started/nhim-audit-quickstart
• Package: @blekline/nhim-audit (OSS)