BULWARK

Civilian infrastructure coordination that degrades on purpose instead of failing by surprise.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Water and power utilities. Inter-utility settlement that can freeze without going dark.
• Civil protection agency. A coordination layer with an island mode for the bad week.
• Municipal operations. One switch halts every write while the auditors keep seeing.
• Regional mutual aid. Resource sharing between authorities, settled and attested.

The problem

Civilian infrastructure coordination fails in one of two ways: systems so interconnected that one compromise cascades, or systems so isolated that nothing coordinates at all. The missing shape is a network that can voluntarily degrade, freeze, island itself, and come back with its books intact.

The system

BULWARK is the settlement and coordination layer for a region’s civilian utilities: water, power distribution, municipal services, sharing crews, equipment and capacity through escrowed agreements between sovereign deployments. On the good days it is unremarkable, which is the point. Synthetic canary transactions run the live paths continuously, so "the rails work" is a measured fact on a board rather than an assumption in a binder.

On the bad day, the shape changes deliberately. A suspected compromise at one utility triggers the break-glass: a single switch freezes every state-changing request and every scheduled job on that deployment while reads, sign-in and the ledger auditor keep working, because an operator who freezes a system must not go blind inside it. There is no API to lift the freeze, on purpose; a switch a compromised credential can flip off is not a safety mechanism. If the region’s links look wrong, a deployment islands itself and runs standalone, and when it rejoins, recovery is not declared but re-verified: the supply invariant is checked before anyone trusts the books again.

The cast and their ceilings

The flow, step by step

1. Utilities share crews and capacity through escrowed agreements.
2. Canaries run the same rails real value takes. Health is measured, not assumed.
3. Mutual aid settles and attests between sovereign peers.
4. The region ledger keeps the books.
5. On the bad day, one switch freezes writes. Reads and the auditor keep working.

Each need, mapped to a live primitive

The attack this chamber refuses: The remote thaw

The attack. The attacker who prompted the freeze uses a captured admin token to switch the deployment back to writable.

Why it fails. The freeze is environment-only and has no lifting API. Turning it off requires deliberate action on the host by someone with hands on the deployment, which is exactly the property a safety switch needs.

What actually happens. The deployment stays frozen, the operator keeps reading, the auditor keeps auditing, and the attacker holds a token to a system that will not write.

Deep architecture

BULWARK deployed: one utility’s sovereign deployment on the left, the region’s peers on the right, mutual aid settling between them through escrowed agreements. The canary fleet proves the rails continuously, the duty officer holds a break-glass no API can lift, and OT sits below with no wires into any of it, because this layer coordinates and settles and never actuates. The trace replays a good week and the start of a bad day.

The deployment, traced

1. The region coordinator structures mutual aid. It proposes and funds; it cannot force a peer’s books.
2. The water board escrows the agreement: crews and capacity, within declared limits.
3. The real work happens with real crews. This layer never touches a valve.
4. The aid desk claims on delivery, against the escrow.
5. Settlement crosses to the neighbour with an idempotency key.
6. The power utility’s deployment credits exactly once, under its own governance.
7. Their ledger writes the same settlement.
8. On the good days, canaries run the live paths hourly. "The rails work" is a measurement, not a binder.
9. Judged end to end, on a board someone actually watches.
10. The bad day: a suspected compromise. The duty officer flips the break-glass, once.
11. Every write and every scheduled job freezes; reads, sign-in and the ledger auditor keep working, because an operator who freezes a system must not go blind inside it. There is no API to lift the freeze, on purpose.
12. If the region’s links look wrong, a deployment islands itself and runs standalone. Rejoining is not declared but re-verified: the supply invariant is checked before anyone trusts the books again.

Adoption, phase by phase

Discover: Mutual aid, re-read as agreements.

• Runs. Nothing. Last storm season’s mutual aid redrawn as escrowed agreements and delivery attestations.
• Agents. None. Emergency managers define what counts as delivered aid in daylight, before the storm asks.
• Integrates. Nothing. OT, SCADA and the radio room stay exactly as they are, in this phase and all others.
• Deliberately not yet. No deployment, no escrow, no canaries.
• Proof that gates the next phase. One historical aid event re-expressed as agreements and settlements, and both utilities agree the telling matches what was owed.

Pilot: Two utilities, one corridor, drills only.

• Runs. A single-VM deployment at each of two utilities, federated bilaterally. Island mode exercised monthly.
• Agents. utility-ops and the aid desk on each side; the canary fleet from day one; each duty officer holds a drilled break-glass.
• Integrates. Crew rosters and equipment lists read-side. Nothing actuates, ever.
• Deliberately not yet. Pocket settlements. The region coordinator observes rather than structures.
• Proof that gates the next phase. A freeze drill on one deployment stops its writes in one action while its auditor keeps reading, and the partner utility’s operations never notice.

Production: The region’s utilities, coordinated and freezable.

• Runs. One sovereign deployment per utility, island-capable standalone mode stock. About nine containers each.
• Agents. The full cast per utility; canaries prove every corridor hourly; break-glass procedures on the wall, not in a wiki.
• Integrates. Mutual aid, equipment sharing and capacity settle from escrow; OT remains air-gapped and out of scope.
• Deliberately not yet. Wide-area automation. This layer coordinates and settles; it never actuates, and that is permanent.
• Proof that gates the next phase. A regional exercise runs aid across three utilities with one deliberately islanded mid-exercise, and its rejoin passes supply re-verification before any settlement resumes.

Federation: A region that degrades on purpose.

• Runs. Unchanged. More utilities, more corridors.
• Agents. Per-corridor limits bound every relationship; the coordinator proposes across all of them.
• Integrates. Each new utility is a signed card and a licence.
• Deliberately not yet. Defence and military applications, deliberately and permanently out of scope for this catalogue.
• Proof that gates the next phase. The region’s resilience report cites measured canary uptime and drill outcomes from the ledgers, not attestations from memory.

Sizing

One aid settlement, and the freeze that outranks it

sequenceDiagram
  participant Co as region-coordinator
  participant WU as water utility (frame A)
  participant TEG as mutual-aid escrow
  participant XT as cross-registry settle
  participant PU as power utility (frame B)
  participant Duty as duty-officer
  Co->>WU: proposes aid (cannot force)
  WU->>TEG: escrow the agreement
  TEG->>XT: settle on delivery (idempotency key)
  XT->>PU: credited exactly once
  Duty->>WU: break-glass, one switch
  Note over WU: writes freeze; reads and the auditor keep working
  Note over WU: no API lifts the freeze; rejoin is re-verified, not declared

Topology, as declared

flowchart LR
  UA["utility A frame"] -->|"escrowed mutual aid"| TEG["TEG escrow"]
  TEG -->|"settle + attest"| UB["utility B frame"]
  CAN["canary fleet"] -.->|"synthetic transactions hourly"| TEG
  DO["duty officer"] -->|"break-glass"| RO["READONLY_MODE<br/>env-only, no lifting API"]
  RO -.->|"writes halt, reads live"| UB
  UB --> ES[("region ledger<br/>auditor exempted from freeze")]

Standing it up

• Infrastructure. One sovereign deployment per utility; island-capable standalone mode is stock.
• Agents. 4 roles per utility, plus the canary fleet the platform already ships.
• Integration. OT and SCADA remain air-gapped and out of scope. This layer coordinates and settles; it never actuates.

What this does not claim

• BULWARK is civilian coordination and settlement. It controls no physical process, touches no OT network, and carries no safety-instrumented function.
• Defence and military applications are deliberately out of scope for this catalogue.