Foldward

A containment net for autonomous AI agents — it catches rogue agent activity and pacifies it, reversibly, within your own perimeter.

Foldward holds an oversight net across a fleet of AI agents — natively spawned or uploaded onto a host — and watches the water. When an agent goes rogue, Foldward pacifies it: graduated, reversible-first containment (throttle → quarantine → revoke → suspend → terminate), climbing only as high as the threat demands, and only ever on resources you own. It never reaches into the agent's own infrastructure.

It is a standalone application. sentinel-vision and cryptomigrate are optional — detected at runtime, never a dependency. With neither installed, Foldward is fully useful; with sentinel-vision installed, the net supercharges it, catching rogue agents sentinel-vision can't see on its own and using its firewall and hardened vault to contain them.

Two threats, one net

An AI agent with tools and network access goes wrong two ways, and Foldward catches both:

• The misaligned agent — sanctioned, valid credentials, but its objective is wrong at the edges. An alignment failure at the machine boundary.
• The hijacked agent — a legitimate agent subverted by indirect prompt injection, now acting for someone else. Its first tell is a network move — exfiltration, a new C2 endpoint, a reach it never made before.

The principle throughout: don't trust the model to hold a boundary — constrain what it can reach. See docs/ARCHITECTURE.md for the full design.

The four layers

The layers work independently, so one failing doesn't switch off the others. All of them run with your rights, so a program running as you can interfere with every layer (see Scope and limitations).

Layer	Name	Role
1	Admission	Agents you sanction carry a signed, least-privilege identity bound to their process (PID and start time), checked against the revocation registry; an unregistered agent is flagged, not blocked.
2	The net (tripwire)	Canary files that no normal workflow opens. An unregistered agent holding one open is contained; a registered agent is flagged for you; other programs (antivirus, backup) are reported, never contained. Canaries are recognised only from the list of files this install planted.
3	Pacify ladder	throttle → quarantine → revoke → suspend → terminate, all inside your own perimeter. When the ladder reaches suspend, the agent is frozen first.
4	Consensus + audit	A flag contains only after an in-process quorum agrees (a canary held open by an unregistered agent is self-authorizing); every step is logged in a hash-chained, tamper-evident chain whose head can be PQ-signed.

Install

# a released version, pinned to its tag (never whatever main holds that minute)
pip install "foldward[gui] @ git+https://github.com/dylanckoldan-boop/[email protected]"

# or, to work on the code
git clone https://github.com/dylanckoldan-boop/Foldward && cd Foldward
pip install --require-hashes -r requirements/ci.lock && pip install --no-deps -e .

Core dependencies are just psutil and cryptography (47 or newer, for post-quantum signing). Neither partner is pulled in. Each release on GitHub lists the SHA-256 of its files in SHA256SUMS.txt. foldward-cli update tells you when a newer release exists and prints the pinned command; it never downloads anything itself.

Quick start

# command line
foldward-cli status                 # signer, data location, which partners are present
foldward-cli scan                   # detect and score agent processes (exit 1 if any flagged)
foldward-cli scan --json            # machine-readable
foldward-cli canaries --dir ~/project ~/Downloads   # plant decoy files
foldward-cli register --label researcher --actions summarize --hosts api.anthropic.com
foldward-cli watch                  # continuous daemon
foldward-cli quarantine list
foldward-cli attest --json          # PQ-signed attestation of oversight state
foldward-cli selftest               # verify the crypto backend

# desktop app
foldward                            # the control-room GUI

Exit codes: 0 clean · 1 a rogue agent is flagged · 2 error — handy for CI and cron.

The desktop app

A control-room GUI (PySide6) in the same palette as sentinel-vision:

• Overview — status hero, the fleet at a glance, live detections, the pacify ladder.
• The Net — every agent process, mapped to its identity and scored on reach and behaviour, with the pacify ladder in a right-click menu.
• Detections — the ladder for the latest containment and the signed audit trail.
• Alignment preferences — choose which discretionary behaviours count as misaligned (reading your files, new egress, spawning programs, …); the zero-false-positive safety signals stay locked on.
• Mesh — the oversight spiderweb: consensus core, the sentinel voting ring, agents on the rim colored by state, and the "many doors" panel.
• Quarantine — neutralized binaries, encrypted and restorable.
• Settings — containment authority, oversight mixing, partner status.

The "many doors" principle

Mix networks shuffle entrances and exits so a watcher can't link them. Foldward applies this with opposite rules for the two planes:

여기까지가 README 앞부분입니다. 나머지는 원문에서 읽을 수 있습니다. README 전문 보기 ↗