Arcane.firewall

This focused page is derived from the mechanically checked full member inventory.

Syntax

Arcane.firewall

Member kind

Namespace

Description

Firewall-only review, bounded audit, and explicitly confirmed development lifecycle simulation for the global deny policy.

Overview

Arcane.firewall exposes Firewall-app-only policy status, bounded audit, and explicitly confirmed lifecycle operations for Arcane-owned development simulation state. Mutation requests must carry the current positive policy and machine-state generations; stale expectations fail instead of silently applying to a different state.

Availability and security

Reads require firewall.read; mutations require firewall.manage, the firewall app id, Core, privilege, and an exclusive mutation boundary. Audit limit defaults to 100 and must be an integer from 1 through 200. Current live machine-wide mutation is unsupported; simulation must remain labeled.

Example

const access = await globalThis.Arcane.capabilities.list();
const canReadFirewallStatus = access.methods.includes('firewall.status');

console.log('Firewall review admitted:', canReadFirewallStatus);

Members

• Arcane.firewall.status() — Firewall-app-only status for the canonical policy, Arcane-owned platform plan/state, projection, audit count, limitations, supported lifecycle operations, and fail-closed installReady/enableReady evidence. Current non-simulation status is unsupported; simulation is labeled and never claims machine-wide coverage. Requires firewall.read.
• Arcane.firewall.audit() — Returns bounded lifecycle and owned-state metadata, not packet payloads or complete per-packet attribution. Requires firewall.read.
• Arcane.firewall.install() — After separate user confirmation, stages the reviewed global-deny projection in deterministic development simulation. Domain projection may use bounded system DNS and admits at most 4,096 domain rules; status disables Install before confirmation when the canonical policy exceeds that native ceiling. Live mutation is unavailable. Requires firewall.manage.
• Arcane.firewall.enable() — After confirmation, enables only the exact installed, unexpired projection in simulation; it does not resolve or silently replace policy. Requires firewall.manage.
• Arcane.firewall.disable() — After confirmation, disables only Arcane-owned simulation state. Requires firewall.manage.
• Arcane.firewall.rollback() — After confirmation, restores only an unexpired retained projection for the current canonical policy when it preserves every current deny. Requires firewall.manage.
• Arcane.firewall.recover() — After confirmation, reconciles only Arcane-owned simulation state; divergence blocks other lifecycle actions. Requires firewall.manage.

Reference group

Namespace, constructor, and values