Technical validation

Measured results, with their limits.

Each record identifies a capability, test method, observed result, release and limitation. These are vendor-run tests and private pilot checkpoints, not independent certification or general production qualification.

Raw packet captures, source addresses, credentials and private audit logs are not published.

Browser simulation

Explains controls and expected decisions. It does not observe live packets.

Vendor-run test

Version-pinned local or VM result. Read its method, artifact identity and limits.

Customer qualification

Requires an authorized operator, their own traffic baseline, recovery route and acceptance criteria.

ProductSearch evidence

12 evidence records

Registry artifact · 0.2.0-alpha.12 (public npm alpha tag)

Local Builder templates and redacted policy review

Node Guard Free Builder

Method: Exact annotated GitHub tag, npm staged tarball, separate clean-tag pack, Node 20/24 CI, clean registry install, and npm signature and provenance verification.
Observed: Four Builder templates were packaged. A tenant-API fixture changed one synthetic tenant decision while its control tenant stayed open; the review remained simulation-only, redacted the source IP and saved with mode 0600. The registry tarball matched the staged and clean-tag bytes.
Limit: Vendor-run and one-person review exception for this free experimental alpha. It does not verify customer source attribution, application identity, multi-process state, host XDP enforcement, or production reliability.
Debian artifact SHA-256: 86fb3fdb79e67fd59a5b3d1513d28e960c1f1672cad62b0141efdaf3ce823430
Source revision: dad7f854130b0c4f448bf763a702a0b79aa039f3

Read the report or status

VM observed · Signed Core RC2 customer candidate

Selected-source ingress enforcement and customer recovery

Firewall Beta / Infrastructure Pro

Method: Vendor-run disposable Ubuntu 24.04 AMD64 VMs using the exact signed archive, independent selected and control sources, generic XDP, customer-guide install, expiry, reboot and signed predecessor rollback.
Observed: Focused IPv4 and IPv6 block/control tests, drop counters, scoped release, console controls, natural entitlement expiry, TEST recovery and rollback/reinstall passed.
Limit: Detailed run logs are private. Earlier harness runs were inconclusive. The beta purchase path is open; full paid renewal, customer delivery, and independent production use are not established by these lab records.
Debian artifact SHA-256: cebb9f11801993927edf31139a590eec7b3292aeda3f0ec9b76f060862e11f0b

Read the report or status

VM observed · Signed Node Pro RC2 customer candidate

Authenticated two-application bridge and scoped host recovery

Node Pro

Method: Vendor-run disposable Ubuntu 24.04 AMD64 VMs using the exact signed archive, two app identities, IPv6 app grant, local console, paid entitlement expiry, reboot and signed predecessor rollback.
Observed: Two-app identity and restart, scoped IPv6 selected/control effect, console block/release, natural expiry, TEST recovery and rollback/reinstall passed.
Limit: Detailed run logs are private. An earlier update/rollback fixture error was corrected and retained. The beta purchase path is open; paid renewal and customer delivery are not established by these lab records.
Debian artifact SHA-256: 2bc2c7c7de4c95ec62a4e75f889b2296f32d935c8d8fdca4f6c73f5fa58bba38

Read the report or status

VM observed · 2.3.6-rc4 Iron-Hive

Automatic local detection and bounded XDP enforcement

HoneyMesh Core Beta

Method: Vendor-run isolated Ubuntu 24.04 AMD64 VMs with selected and independent control sources; generic XDP.
Observed: Controlled TCP trap interactions created local grants. Separate 120-second expiry, 600-second reboot recovery, and 12,000-response reference workload tests passed their scoped checks.
Limit: Earlier and later RC4 candidates contributed different observations. This does not establish native-XDP line rate, broad false-positive rates or general production reliability.
Debian artifact SHA-256: fbd192d23acbe1f02c68934c34aeadf06cb40adac3da0096c7789b1a65c6ebf5
Source revision: b47095a81d0b09d9084b4c961ddad49c50afa3d1

Read the report or status

VM observed · 2.3.6-rc2 Iron-Hive

Three-node manual ban propagation

HoneyMesh Infrastructure

Method: Operator-issued ban on host A in an isolated AMD64 lab; separate banned and control clients across five IPv4 TCP, UDP and ICMP cases.
Observed: Hosts A, B and C stopped replying to the selected source while the unbanned control kept reaching tested listeners.
Limit: This was a manual-ban rc2 lab. It does not qualify automatic detection, current RC4 Exchange retraction, IPv6 federation or customer production load.
Debian artifact SHA-256: 37aef1515a344f5a2f7cefc993c87b5976eb9da33127ebd22975e6b8f87fc15c

Read the report or status

Registry artifact · 0.2.0-alpha.10 (public npm alpha tag)

Canonical IPv6 source identity and signed package integrity

Node Guard Free

Method: Pinned GitHub tag, staged tarball, clean tag clone, offline read-only Node 20 container, and clean public-registry install.
Observed: Node 20/24 CI and 35 source tests passed. Expanded and compact IPv6 forms shared thresholds and release state. The published package matched the reviewed tarball and has a verified npm registry signature and provenance attestation.
Limit: A one-person review exception was approved for this free experimental alpha. This does not qualify customer workloads, multi-worker state, host XDP enforcement, or production reliability.
Debian artifact SHA-256: 2b62d217da41a6c2335ceb358712328027fbebe67c3f15911c1e25bb7d09e9a5
Source revision: 72b81c265566c16bc2738193aef7f8ca7b05c923

Read the report or status

Local HTTP fixture · 0.2.0-alpha.6 (public npm)

Application limits and expiry under a controlled HTTP workload

Node Guard Free

Method: Exact public npm tarball, digest checked, installed in a temporary Express app with controller-assigned source fixtures.
Observed: 12,000 normal responses had zero unexpected status. Observe stayed open; enforce returned 429 for 10 selected probes and 200 for 10 control probes. The selected source recovered after controlled-clock expiry.
Limit: One process and synthetic source assignment. No measured no-SDK baseline, real customer ingress, false-positive population, or production throughput claim.
Source revision: 2b76cf9

Read the report or status

Local proxy fixture · 0.2.0-alpha.6 (public npm)

Client-supplied forwarding header does not select the protected source

Node Guard Free

Method: Exact public npm tarball behind a local proxy fixture that appends a controller-assigned source to a spoofed X-Forwarded-For value.
Observed: Selected source returned 429 with a spoofed leftmost control IP; control source returned 200 with a spoofed leftmost selected IP. Expiry restored the selected source.
Limit: The proxy source was assigned by the fixture. Real ingress, cloud proxy configuration, direct-access isolation, and multi-worker state remain unqualified.
Source revision: 2b76cf9

Read the report or status

Unprivileged container · 0.2.0-alpha.6 (public npm)

Published package installs and simulates on Node 20

Node Guard Free

Method: Pinned public npm version in a disposable Node 20.20.2 container with an unprivileged process and read-only root filesystem.
Observed: The published CLI initialized an OBSERVE policy, reported one-process state and unchecked source trust, validated policy syntax, and simulated two synthetic observations without enforcement.
Limit: Developer-run container check, not a second human operator or customer workload. The first noexec temporary-workspace attempt was corrected and recorded in the report.
Source revision: 2b76cf9

Read the report or status

Clean Next.js app · 0.2.0-alpha.6 (public npm)

Published package runs in a Node-runtime Route Handler

Node Guard Free

Method: Fresh Next.js 16.4.3 app installed the pinned public npm package under Node 20.19.5, built, started on loopback, and called a controlled Route Handler.
Observed: Two distinct synthetic authentication-failure events produced HTTP 429 with Retry-After 60 through the package's Next.js adapter.
Limit: Fixed source fixture. No real proxy attribution, Edge runtime, multi-worker state, customer traffic, or production reliability claim.
Source revision: 2b76cf9

Read the report or status

Component tested · 0.1.2 private signed candidate

Application-level limits without a host agent

HoneyMesh Node Guard

Method: Unprivileged no-agent container with an entitlement, controlled invalid requests, independent control traffic and operator release.
Observed: The signed candidate limited the selected application source while control requests continued. Paid sandbox invoices selected distinct entitlements.
Limit: Scoped beta evidence. Hosted-platform attribution, independent customer installation, and broad recovery remain unqualified. Paid beta checkout does not change those test limits.

Read the report or status

VM observed · 2.3.6-rc4-nodepro2 private signed candidate

Application-owned IPv6 grant on generic XDP

HoneyMesh Node Pro

Method: Disposable Ubuntu VM, signed Node Pro bundle, paid sandbox entitlement fixture, isolated app identities, selected and control clients.
Observed: One scoped app-owned grant blocked the selected IPv6 source; control traffic stayed reachable and release restored connectivity.
Limit: One producer path and one address family in this run. Full four-owner, Exchange lifecycle and customer installation gates remain open.

Read the report or status

Review package release status See the earlier proof of concept Plan a scoped host test

Loading HoneyMesh...

Technical validation

Measured results, with their limits.

Raw packet captures, source addresses, credentials and private audit logs are not published.

Browser simulation

Explains controls and expected decisions. It does not observe live packets.

Vendor-run test

Version-pinned local or VM result. Read its method, artifact identity and limits.

Customer qualification

Requires an authorized operator, their own traffic baseline, recovery route and acceptance criteria.

ProductSearch evidence

12 evidence records

Registry artifact · 0.2.0-alpha.12 (public npm alpha tag)

Local Builder templates and redacted policy review

Node Guard Free Builder

Method: Exact annotated GitHub tag, npm staged tarball, separate clean-tag pack, Node 20/24 CI, clean registry install, and npm signature and provenance verification.
Observed: Four Builder templates were packaged. A tenant-API fixture changed one synthetic tenant decision while its control tenant stayed open; the review remained simulation-only, redacted the source IP and saved with mode 0600. The registry tarball matched the staged and clean-tag bytes.
Limit: Vendor-run and one-person review exception for this free experimental alpha. It does not verify customer source attribution, application identity, multi-process state, host XDP enforcement, or production reliability.
Debian artifact SHA-256: 86fb3fdb79e67fd59a5b3d1513d28e960c1f1672cad62b0141efdaf3ce823430
Source revision: dad7f854130b0c4f448bf763a702a0b79aa039f3

Read the report or status

VM observed · Signed Core RC2 customer candidate

Selected-source ingress enforcement and customer recovery

Firewall Beta / Infrastructure Pro

Method: Vendor-run disposable Ubuntu 24.04 AMD64 VMs using the exact signed archive, independent selected and control sources, generic XDP, customer-guide install, expiry, reboot and signed predecessor rollback.
Observed: Focused IPv4 and IPv6 block/control tests, drop counters, scoped release, console controls, natural entitlement expiry, TEST recovery and rollback/reinstall passed.
Limit: Detailed run logs are private. Earlier harness runs were inconclusive. The beta purchase path is open; full paid renewal, customer delivery, and independent production use are not established by these lab records.
Debian artifact SHA-256: cebb9f11801993927edf31139a590eec7b3292aeda3f0ec9b76f060862e11f0b

Read the report or status

VM observed · Signed Node Pro RC2 customer candidate

Authenticated two-application bridge and scoped host recovery

Node Pro

Method: Vendor-run disposable Ubuntu 24.04 AMD64 VMs using the exact signed archive, two app identities, IPv6 app grant, local console, paid entitlement expiry, reboot and signed predecessor rollback.
Observed: Two-app identity and restart, scoped IPv6 selected/control effect, console block/release, natural expiry, TEST recovery and rollback/reinstall passed.
Limit: Detailed run logs are private. An earlier update/rollback fixture error was corrected and retained. The beta purchase path is open; paid renewal and customer delivery are not established by these lab records.
Debian artifact SHA-256: 2bc2c7c7de4c95ec62a4e75f889b2296f32d935c8d8fdca4f6c73f5fa58bba38

Read the report or status

VM observed · 2.3.6-rc4 Iron-Hive

Automatic local detection and bounded XDP enforcement

HoneyMesh Core Beta

Method: Vendor-run isolated Ubuntu 24.04 AMD64 VMs with selected and independent control sources; generic XDP.
Observed: Controlled TCP trap interactions created local grants. Separate 120-second expiry, 600-second reboot recovery, and 12,000-response reference workload tests passed their scoped checks.
Limit: Earlier and later RC4 candidates contributed different observations. This does not establish native-XDP line rate, broad false-positive rates or general production reliability.
Debian artifact SHA-256: fbd192d23acbe1f02c68934c34aeadf06cb40adac3da0096c7789b1a65c6ebf5
Source revision: b47095a81d0b09d9084b4c961ddad49c50afa3d1

Read the report or status

VM observed · 2.3.6-rc2 Iron-Hive

Three-node manual ban propagation

HoneyMesh Infrastructure

Method: Operator-issued ban on host A in an isolated AMD64 lab; separate banned and control clients across five IPv4 TCP, UDP and ICMP cases.
Observed: Hosts A, B and C stopped replying to the selected source while the unbanned control kept reaching tested listeners.
Limit: This was a manual-ban rc2 lab. It does not qualify automatic detection, current RC4 Exchange retraction, IPv6 federation or customer production load.
Debian artifact SHA-256: 37aef1515a344f5a2f7cefc993c87b5976eb9da33127ebd22975e6b8f87fc15c

Read the report or status

Registry artifact · 0.2.0-alpha.10 (public npm alpha tag)

Canonical IPv6 source identity and signed package integrity

Node Guard Free

Method: Pinned GitHub tag, staged tarball, clean tag clone, offline read-only Node 20 container, and clean public-registry install.
Observed: Node 20/24 CI and 35 source tests passed. Expanded and compact IPv6 forms shared thresholds and release state. The published package matched the reviewed tarball and has a verified npm registry signature and provenance attestation.
Limit: A one-person review exception was approved for this free experimental alpha. This does not qualify customer workloads, multi-worker state, host XDP enforcement, or production reliability.
Debian artifact SHA-256: 2b62d217da41a6c2335ceb358712328027fbebe67c3f15911c1e25bb7d09e9a5
Source revision: 72b81c265566c16bc2738193aef7f8ca7b05c923

Read the report or status

Local HTTP fixture · 0.2.0-alpha.6 (public npm)

Application limits and expiry under a controlled HTTP workload

Node Guard Free

Method: Exact public npm tarball, digest checked, installed in a temporary Express app with controller-assigned source fixtures.
Observed: 12,000 normal responses had zero unexpected status. Observe stayed open; enforce returned 429 for 10 selected probes and 200 for 10 control probes. The selected source recovered after controlled-clock expiry.
Limit: One process and synthetic source assignment. No measured no-SDK baseline, real customer ingress, false-positive population, or production throughput claim.
Source revision: 2b76cf9

Read the report or status

Local proxy fixture · 0.2.0-alpha.6 (public npm)

Client-supplied forwarding header does not select the protected source

Node Guard Free

Method: Exact public npm tarball behind a local proxy fixture that appends a controller-assigned source to a spoofed X-Forwarded-For value.
Observed: Selected source returned 429 with a spoofed leftmost control IP; control source returned 200 with a spoofed leftmost selected IP. Expiry restored the selected source.
Limit: The proxy source was assigned by the fixture. Real ingress, cloud proxy configuration, direct-access isolation, and multi-worker state remain unqualified.
Source revision: 2b76cf9

Read the report or status

Unprivileged container · 0.2.0-alpha.6 (public npm)

Published package installs and simulates on Node 20

Node Guard Free

Method: Pinned public npm version in a disposable Node 20.20.2 container with an unprivileged process and read-only root filesystem.
Observed: The published CLI initialized an OBSERVE policy, reported one-process state and unchecked source trust, validated policy syntax, and simulated two synthetic observations without enforcement.
Limit: Developer-run container check, not a second human operator or customer workload. The first noexec temporary-workspace attempt was corrected and recorded in the report.
Source revision: 2b76cf9

Read the report or status

Clean Next.js app · 0.2.0-alpha.6 (public npm)

Published package runs in a Node-runtime Route Handler

Node Guard Free

Method: Fresh Next.js 16.4.3 app installed the pinned public npm package under Node 20.19.5, built, started on loopback, and called a controlled Route Handler.
Observed: Two distinct synthetic authentication-failure events produced HTTP 429 with Retry-After 60 through the package's Next.js adapter.
Limit: Fixed source fixture. No real proxy attribution, Edge runtime, multi-worker state, customer traffic, or production reliability claim.
Source revision: 2b76cf9

Read the report or status

Component tested · 0.1.2 private signed candidate

Application-level limits without a host agent

HoneyMesh Node Guard

Method: Unprivileged no-agent container with an entitlement, controlled invalid requests, independent control traffic and operator release.
Observed: The signed candidate limited the selected application source while control requests continued. Paid sandbox invoices selected distinct entitlements.
Limit: Scoped beta evidence. Hosted-platform attribution, independent customer installation, and broad recovery remain unqualified. Paid beta checkout does not change those test limits.

Read the report or status

VM observed · 2.3.6-rc4-nodepro2 private signed candidate

Application-owned IPv6 grant on generic XDP

HoneyMesh Node Pro

Method: Disposable Ubuntu VM, signed Node Pro bundle, paid sandbox entitlement fixture, isolated app identities, selected and control clients.
Observed: One scoped app-owned grant blocked the selected IPv6 source; control traffic stayed reachable and release restored connectivity.
Limit: One producer path and one address family in this run. Full four-owner, Exchange lifecycle and customer installation gates remain open.

Read the report or status

Review package release status See the earlier proof of concept Plan a scoped host test