The Path › Man pages › awwall

awwall(tool, public)

Say what a workload may reach, and watch everything else fail closed.

Name

awwall — Say what a workload may reach, and watch everything else fail closed.

The problem it solves

Every other gate asks about the CALLER — who they are, what role they hold, whether they are human. Nothing asks what a workload is allowed to REACH. So a service quietly dials whatever its config says, and when that config is stale the failure is a DNS or connect error naming a host with no relationship to the problem — the symptom points at an innocent service. Measured on our own fleet 2026-08-23: 11 registry entries pointed at hosts that did not exist while the real container was running, and every one of those failures named the wrong subsystem.

Instead of trusting / you check

instead of trusting
that a service only talks to the hosts you think it talks to
you check
an explicit egress allowlist, where a denial names the rule that denied it

Adopt it alone

Block one outbound host for one workload and watch the call fail closed with the rule that denied it.

Install

install
pip install awwall

Where it sits in the path

  • Not on the path yet — reference only.

See also

awiam · awbac · awnest · awnboard · awdit · awnet · awtunnel · awnode · awdk

Links

Source on GitHub · Its own page

Generated 2026-09-14 00:48Z from the ecosystem registry. A field here that is wrong is wrong in the registry — fix it there and this page follows.

One estate, 8 doors

These projects are organs of the same system — the same identity plane, the same agent runtime, the same operational discipline. Follow any of them.

the osaitherium.comThe Living OS these four repos are cut from. Open, no login.pythonAither ADKBuild AI agent fleets — 3 lines, any backend, local or cloud.markdownawskillsPortable agent skills — self-contained procedures an agent loads on demand.markdownawknowledgeHow to run a coding agent so the result survives — the laws, with evidence.cudaaitherkvcacheNear-optimal KV cache quantization for LLM inference — sub-byte compression.powershellAitherZeroPowerShell 7+ automation framework — numbered, self-describing scripts.writingThe BlogHow all of it is actually built, measured and operated.pythonawrunA priority-aware queue and dispatcher for agentic runs and ad-hoc CI builds. It also judges whether the runner pool is big enough for the queue it is draining, and can ask a host to grow it -- reserving capacity is zero-sum, so a saturated pool needs more of it, not a different share of it.

The ecosystem this belongs to

Every Aitherium repository publishes an aither-manifest.json beside its page, and each surface reads all of them — so the network is browsable from any node in it.