Fail static

Losing the control plane changes nothing

The last acknowledged policy stays enforced from local disk, across agent restarts and host reboots (ADR-0011). Control-plane downtime degrades management, never enforcement.

Persisted before it is applied

Every policy is written durably to the agent’s state directory before the kernel transaction runs, and it is acknowledged as applied only when both succeeded (ADR-0020). The persisted file is checksummed: a corrupt one applies nothing and is reported.

On start, the agent re-applies the persisted policy before it dials the control plane. When the daemon exits, its rules stay in the kernel.

The agent cannot cut its own stream

The owned chain accepts established and related traffic before any rule. The agent’s stream to the control plane is an outbound connection the agent opened, so its return traffic is established. With inbound-only policy, nothing after that line can touch it (ADR-0020).

Telemetry while disconnected

While the control plane is unreachable, closed flow windows are held in a bounded in-memory buffer. What does not fit is dropped and recorded as an evidence gap (ADR-0011).

The local kill switch

Root on the host can always remove enforcement, without the control plane:

innerwall-agent down --state-dir ./agent-state

It deletes the owned table and nothing else. The persisted policy stays on disk, so a running daemon re-applies it on its next update and a restarted one on start: stopping enforcement for good means stopping the daemon too.

Checking a host

nft list ruleset shows what a host enforces. Set names and rule comments carry the authored rule ids, and the terminal rule’s comment names the mode (ADR-0020).