Reference
Arcane.firewall.status()
Firewall-app-only status for the canonical policy, Arcane-owned platform plan/state, projection, audit count, limitations, supported lifecycle operations, and fail-closed installReady/enableReady evidence. Current non-simulation status is unsupported; simulation is labeled and never claims machine-wide coverage. Requires firewall.read.
This focused page is derived from the mechanically checked full member inventory.
Syntax
Arcane.firewall.status()
Parameters
None
Return value
Promise<FirewallStatus>
Description
Firewall-app-only status for the canonical policy, Arcane-owned platform plan/state, projection, audit count, limitations, supported lifecycle operations, and fail-closed installReady/enableReady evidence. Current non-simulation status is unsupported; simulation is labeled and never claims machine-wide coverage. Requires firewall.read.
Overview
Arcane.firewall.status() returns the canonical global-deny policy identity,
Arcane-owned native projection state, bounded audit count, coverage limits, and
action readiness. It requires firewall.read, app id firewall, and a Core
host. It is a repeatable read with no side effect or event.
The current lifecycle implementation is development-only. Deterministic
simulation can report supported: true but always reports
coverage.machineWide: false. A non-simulated host reports lifecycle mutation
unsupported until Core can authenticate its native-host caller. Never present
simulation as live traffic enforcement.
Result
The exact top-level result is {schemaVersion, platform, backend, simulation, supported, coverage, policy, state, projection, auditCount, supportedOperations, warnings} with schemaVersion: 1 and
supportedOperations exactly ['install','enable','disable','rollback', 'recover'].
coverage is exactly {machineWide, ingress, egress, limitations}. policy
is exactly {schemaVersion, generation, sha256, domainRuleCount, networkRuleCount}. state is exactly {generation, installed, enabled, installReady, enableReady, recoveryRequired, activePolicyGeneration, activePolicySha256, lastOperation, lastChangedAt}. projection is exactly
{sha256, createdAt, expiresAt, addressCount, directRuleCount, domainRuleCount}.
Use state.installReady and state.enableReady as fail-closed UI gates, then
bind any confirmed mutation to policy.generation and state.generation.
Warnings include coverage, expiry, projection, and live-host limitations and
must remain visible.
Errors and recovery
METHOD_NOT_ALLOWED means the current app is not Arcane Firewall or lacks
firewall.read. Invalid policy/state or native inspection evidence is reflected
as warnings and recoveryRequired where safe; a closed-contract failure uses
METHOD_CONTRACT_OUTPUT_INVALID. Do not enable controls by recomputing
readiness in the renderer.
Example
const status = await Arcane.firewall.status();
console.log(status.platform, status.backend, status.simulation);
console.log('Install ready', status.state.installReady);
console.log('Enable ready', status.state.enableReady);
for (const warning of status.warnings) {
console.warn(warning);
}