awwall
Say what a workload may reach, and watch everything else fail closed.
The Aither World is an operating system for agents — a Linux you can hand to one, the runtimes it works in, and the tools it works with. awwall is one of its 68 bricks — each installs on its own, runs offline, and needs no account.
The problem
Every other gate asks about the CALLER — who they are, what role they hold, whether they are human. Nothing asks what a workload is allowed to REACH. So a service quietly dials whatever its config says, and when that config is stale the failure is a DNS or connect error naming a host with no relationship to the problem — the symptom points at an innocent service. Measured on our own fleet 2026-08-23: 11 registry entries pointed at hosts that did not exist while the real container was running, and every one of those failures named the wrong subsystem.
that a service only talks to the hosts you think it talks to
an explicit egress allowlist, where a denial names the rule that denied it
Adopt it
pip install awwallBlock one outbound host for one workload and watch the call fail closed with the rule that denied it.
Pairs with
awiamawbacawnestawnboardawditawnetawtunnelawnodeawdk
Pairing is composition, never dependency — awwall installs and runs on its own.
The rest of the Aither World
Every brick below is live, drawn from that repository's own published manifest.