Execution Boundary Reference

HELM AI Kernel is the proof-bearing execution boundary for governed AI tool use. The authoritative runtime record is the HELM boundary record plus its receipt binding; telemetry, coexistence manifests, external evidence envelopes, and scanner outputs are compatibility surfaces around that native authority.

Audience

Use this page if you build integrations that cross the HELM execution boundary, audit receipts, run MCP/sandbox surfaces, or maintain conformance tests.

Outcome

After this page you should know the public boundary surfaces, their CLI and HTTP entry points, what durable state they produce, how fail-closed cases are recorded, and which validation commands prove the behavior.

Boundary Flow

flowchart TD
    subgraph Evaluation["2. Evaluation & Policy Plane"]
        Normalize["normalize and validate"]
        PDP["fail-closed PEP/PDP"]
        Checkpoint["boundary checkpoint"]
    end

    subgraph Execution["3. Execution & Verdict Plane"]
        Request["tool, proxy, MCP, or sandbox request"]
        Record["seal boundary record"]
        Deny["seal deny record"]
        Dispatch["dispatch governed action"]
    end

    subgraph Ledger["4. Tamper-Evident Ledger Plane"]
        Receipt["emit receipt"]
        Evidence["EvidencePack / offline verification"]
    end

    %% Operational Flow Edges
    Request --> Normalize
    Normalize --> PDP
    PDP -->|allow| Record
    PDP -->|deny| Deny
    Record --> Dispatch
    Deny --> Receipt
    Dispatch --> Receipt
    Receipt --> Checkpoint
    Checkpoint --> Evidence

    %% Premium Styling Rules
    style Request fill:#3182ce,stroke:#2b6cb0,stroke-width:2px,color:#fff
    style Normalize fill:#2d3748,stroke:#4a5568,stroke-width:2px,color:#fff
    style PDP fill:#2d3748,stroke:#4a5568,stroke-width:2px,color:#fff
    style Record fill:#3182ce,stroke:#2b6cb0,stroke-width:2px,color:#fff
    style Deny fill:#e53e3e,stroke:#9b2c2c,stroke-width:2px,color:#fff
    style Dispatch fill:#3182ce,stroke:#2b6cb0,stroke-width:2px,color:#fff
    style Receipt fill:#2f855a,stroke:#276749,stroke-width:2px,color:#fff
    style Checkpoint fill:#2d3748,stroke:#4a5568,stroke-width:2px,color:#fff
    style Evidence fill:#2f855a,stroke:#276749,stroke-width:2px,color:#fff

flowchart TD
    subgraph Evaluation["2. Evaluation & Policy Plane"]
        Normalize["normalize and validate"]
        PDP["fail-closed PEP/PDP"]
        Checkpoint["boundary checkpoint"]
    end

    subgraph Execution["3. Execution & Verdict Plane"]
        Request["tool, proxy, MCP, or sandbox request"]
        Record["seal boundary record"]
        Deny["seal deny record"]
        Dispatch["dispatch governed action"]
    end

    subgraph Ledger["4. Tamper-Evident Ledger Plane"]
        Receipt["emit receipt"]
        Evidence["EvidencePack / offline verification"]
    end

    %% Operational Flow Edges
    Request --> Normalize
    Normalize --> PDP
    PDP -->|allow| Record
    PDP -->|deny| Deny
    Record --> Dispatch
    Deny --> Receipt
    Dispatch --> Receipt
    Receipt --> Checkpoint
    Checkpoint --> Evidence

    %% Premium Styling Rules
    style Request fill:#3182ce,stroke:#2b6cb0,stroke-width:2px,color:#fff
    style Normalize fill:#2d3748,stroke:#4a5568,stroke-width:2px,color:#fff
    style PDP fill:#2d3748,stroke:#4a5568,stroke-width:2px,color:#fff
    style Record fill:#3182ce,stroke:#2b6cb0,stroke-width:2px,color:#fff
    style Deny fill:#e53e3e,stroke:#9b2c2c,stroke-width:2px,color:#fff
    style Dispatch fill:#3182ce,stroke:#2b6cb0,stroke-width:2px,color:#fff
    style Receipt fill:#2f855a,stroke:#276749,stroke-width:2px,color:#fff
    style Checkpoint fill:#2d3748,stroke:#4a5568,stroke-width:2px,color:#fff
    style Evidence fill:#2f855a,stroke:#276749,stroke-width:2px,color:#fff

Source Truth

Public Boundary Surfaces

Durable State

helm-ai-kernel serve persists boundary surface state in the runtime database through boundary_surface_snapshots. SQLite Lite Mode and Postgres use the same table contract. Standalone CLI commands use HELM_BOUNDARY_REGISTRY_PATH or HELM_DATA_DIR/boundary/surfaces.json, so records, approvals, checkpoints, envelopes, and budget changes survive separate CLI invocations.

Fail-Closed Cases

The boundary must deny before dispatch when policy or authorization state is not trustworthy. Public conformance vectors cover at least these cases:

• missing or stale policy;
• PDP outage;
• stale relationship snapshots;
• missing credentials;
• malformed tool arguments;
• schema drift;
• direct upstream bypass;
• sandbox overgrant;
• blocked egress;
• denial receipt emission.

Deny paths are still proof paths: they produce a boundary record and receipt rather than silently dropping the action.

Native Evidence Authority

External envelopes can help auditors and procurement teams move evidence between systems, but they do not become the source of truth. Verification starts with HELM receipts, grant or snapshot hashes, boundary record hashes, checkpoints, and the EvidencePack manifest.

HELM can consume and correlate external host evidence produced by independent recorders. Imported host chains can prove that a host observed outbound network behavior; HELM correlation then checks whether that behavior aligns with HELM authority receipts, policy verdicts, sandbox leases, and egress ceilings. A host event with no matching HELM intent, a host event after a HELM deny, a destination mismatch, or a byte-volume excess is reported as Boundary Drift.

This OSS kernel does not claim eBPF, seccomp, TPM, or packet-blocking network enforcement unless a specific code path and verifier prove it. Hardware-rooted claims in imported host evidence are retained and structurally checked; unknown or unsupported roots are reported as not verified.

Validation

cd core
go test ./pkg/contracts ./pkg/boundary ./cmd/helm-ai-kernel -run 'Test.*Boundary|Test.*Route|Test.*Evidence|Test.*MCP|Test.*Sandbox' -count=1
cd ../tests/conformance
go test ./...

Troubleshooting