The home bridge's single security surface — live-layer attestation
operator console plus dashboard for úknocked-platform (honeypot +
dashboard + alerts), rootrabbit (observations + Burrow /
Warren / Thump), and bean (registry + fleet + cognitive
firewall). Every signal comes from the bridge's actix routes.
PlaneKey turns the cylinder · Úknocked is the lock · Bean signs · RootRabbit watches
connecting to bridge…
Live operator console
Live-layer attestation
The verify / scan / apply tools server-core (the live-layer
attester) runs inside the customer's program. Same buttons render
here for bridge operators and inside server-core's local fallback
UI; the responses come from
/api/admin/planekey/*.
Ready. Pick an action above or type a command below.
~/planekey $
Bridge security dashboard
Platform status
—
Service—
Uptime—
Version—
GET /v1/uknocked/status
Dashboard stats
—entities
Active alerts—
Signals (24h)—
Threat intel indicators—
GET /v1/uknocked/dashboard/stats
Risk distribution
None—
Low—
Medium—
High—
Critical—
GET /v1/uknocked/dashboard/stats · risk_distribution
Top risk entities
no data yet — endpoint not wired
GET /v1/uknocked/dashboard/top-risks
Recent alerts
no data yet — endpoint not wired
GET /v1/uknocked/dashboard/recent-alerts
RootRabbit observations
Preferred—
Usable—
Degraded—
Avoid—
GET /v1/rootrabbit/observations/summary?window=5m
Burrow tier counts
Hop—
Run—
Vault—
GET /v1/rootrabbit/burrow/counts
Warren mirrors
Fresh—
Stale—
Recommended region—
GET /v1/rootrabbit/warren/mirrors
Bean registry
Total—
Biological—
Silicon—
In fleet—
GET /v1/bean/registry/summary
Bean Vault · Cognitive firewall
🔒 admin
Screened (24h)—
Passed—
Flagged—
Blocked (injection)—
Max edge score—
GET /v1/bean/firewall/summary · admin-gated (bean vault)
AI confidence · Sophia (corpus-bridge)
Bridge AI-consensus confidence (live)
Sophia is the bridge's confidence tracker — accumulated signals with
TTL + 1314-harmonic decay (PHI-balanced). Each AI-consensus outcome,
attestation, or ChallengeGate classifier hit records a signal; the
rolled-up score picks the reliance mode (Agora · Stoa · Logos) the
AI contribution rail runs in.
Confidence score
—
range [0.0, 1.0] · PHI-balanced
Class
—
≥0.85 high · ≥0.60 medium · else low
Reliance mode
—
Agora · Stoa · Logos
Live signals
—
non-expired Sophia entries
GET /v1/corpus-bridge/confidence · POST /v1/corpus-bridge/signal ·
GET /v1/corpus-bridge/drift · POST /v1/corpus-bridge/gc ·
GET /v1/corpus-bridge/probe-decay
Trust graph · AI contribution modes
Choose who contributes. Choose who learns.
PlaneKey can run enterprise AI, the Rgano helper, or both in a hybrid
contribution rail. The AI receives scoped project records and live-report
context from pk-client, proposes changes locally, then the user approves
before bridge validation, GitHub sync, deploy, and live fingerprint
confirmation.
Enterprise AI only
Use the customer-approved model for code contribution. PlaneKey still handles lineage, preflight, bridge approval, deployment safety, and live verification.
Generation sourceTheir AI
Rgano helper only
Use the PlaneKey Rgano helper for structural suggestions, overlap detection, downgrade warnings, and audit-ready patch proposals.
Generation sourcePlaneKey AI
Hybrid consensus
Run both models on the same scoped contribution packet. Compare answers, score consensus, flag conflicts, and show the merged proposal for approval.
Generation sourceBoth
Private trainingFeedback trains only the organization-specific helper model.
Shared anonymousOperational lineage patterns improve ecosystem intelligence without raw code/content.
Consortium poolSelected groups share model feedback inside a trusted enterprise/research pool.
Core rule: AI proposes. User approves. pk-client verifies. Bridge authorizes. Live service confirms.
Trust graph · Credentialed contributors
Vetted security contributors get a signed calling card.
PlaneKey can map verified certifications into PK Trust IDs. The first
pass supports practical IT, security, audit, cloud, and pentest
credentials; new credentials are tracked separately so support can be
added without overclaiming what's enforced in the trust model today.
Ready now
CompTIA A+, Network+, Security+, CySA+, PenTest+, Linux+, Cloud+, plus ISACA CISM/CISA/CRISC/CGEIT, ISC2 CISSP/CCSP/CSSLP, CEH, and OSCP.
Trust sourceVerified credential
PK Trust ID
Credentials contribute to role-scoped trust levels for authorized disclosures, cloud pool access, remediation reports, and verified safeguarding workflows.
Identity layerSigned calling card
Not wired yet
Additional credentials are tracked separately so new cert support can be added without overclaiming what is already enforced in the trust model.
RoadmapTo-do docs
Core rule: credential claims must be verified before they grant trust
privileges. Documentation support does not imply automatic entitlement.
Search the trust graph
Find ChallengeGate events, build-update decisions, live-config receipts,
bridge reports, and directly linked README/docs — without exposing raw
private payloads.
Run a search to populate results.
Trust portal — disclosure & runbooks
Searchable trust map for ChallengeGate events, RootRabbit routes,
and disclosure lineage. Browse by category or full-text search.