NHIM lineage, runtime intent validation, and human-in-the-loop kill switches for AIUC-1 aligned programs.
Deploy
Docker sidecar
Track 02 platform eval — Trust Vault, Lineage Firewall, and ingress proxy on ghcr.io/blekline/sidecar. Validate VPC enforcement in ~1 hour without a full cluster rollout.
Eval tracks
Engineered for regulated verticals
Defense against LLM01 prompt injection, LLM02 insecure output handling, and LLM06 sensitive information disclosure.
Stateful PII tokenization at the pod boundary and immutable execution logs for transparency workflows.
Track 02 validates Blekline runtime enforcement in Docker before a Kubernetes pilot. Same NHIM image as production Track 01 — Trust Vault tokenization, Lineage Firewall session blocking, and ingress proxy on :8787.
Ideal for platform teams proving VPC-side enforcement while cluster change windows are scheduled.
Image
ghcr.io/blekline/sidecar:0.2.1-nhim
NHIM capabilities require the image above — not a DIY build from the open-source reference sidecar (contracts-level enforcement only).
Quick start
docker pull ghcr.io/blekline/sidecar:0.2.1-nhim
export BLEKLINE_WORKSPACE_TOKEN="blw_..."
export BLEKLINE_SIDECAR_AUTH="$(openssl rand -hex 32)"
export BLEKLINE_VAULT_MASTER_KEY="$(openssl rand -hex 32)"
docker compose up -d
Enterprise sandbox packs include a ready docker-compose.yaml, hardening guide, and digest-pin checklist.
Required secrets
| Variable | Purpose |
|---|---|
BLEKLINE_SIDECAR_AUTH | Bearer token for sidecar ingress (required) |
BLEKLINE_VAULT_MASTER_KEY | Trust Vault encryption key |
BLEKLINE_WORKSPACE_TOKEN | Control plane policy + events |
→ Trust Vault sidecar · Lineage enforcement
Verify health
# Without auth — expect 401
curl -s -o /dev/null -w "%{http_code}" http://localhost:8787/health
# With auth — expect 200
curl -H "Authorization: Bearer $BLEKLINE_SIDECAR_AUTH" http://localhost:8787/health
Point SDKs and agents at http://localhost:8787/v1. See Ingress proxy for route compatibility.
Mandatory hop pattern
Agent process → POST /v1/enforce-tool-call → (allow) → downstream tool/MCP
↑
blekline-sidecar (:8787)
Trigger a governed tool call from your agent; confirm the decision in Operations → Activity.
Step 0 (recommended)
Run [NHIM audit](/docs/get-started/nhim-audit-quickstart) against staging if you also operate Kubernetes — attach posture JSON to your platform eval request.
Enterprise sandbox
Request Track 02 pack via platform eval signup or attach nhim-audit.json to enterprise@blekline.com.
Upgrade path: Kubernetes fleet · MCP self-serve