ACTIVEDEFENSE unifies the estate's defense capabilities on one sovereign surface: register-grounded incident context, HITL-gated response queues, and model-lane summaries over IBM Granite4. Retrieval and posture only — actions stay human-approved.
Continuous posture reading, SOC priorities, and response queues orchestrated across the estate — register-grounded, never self-asserted (BLK-114 discipline).
Granite4 lane summaries of model lifecycle, usage policy, and guardrails — the goldsburg/granite4 toggle family, advisory-only output.
Full-proxy beam architecture: BIGSIS offload tier first, LILSIS-A primary and LILSIS-B secondary at a 2:1 ratio — reboots survivable by design (L-123).
Each capability is bound to an artifact of record and a checkable outcome — the estate doctrine. Names without artifacts do not appear here.
| Capability | Construct | Outcome gate |
|---|---|---|
| ACTIVEDEFENSE-Granite4 | activedefense.ch apex + IBM Granite4 model lane | Register-grounded posture summaries; read-only advisory |
| Internal-Threat Governance | ECXIRTR Roser endpoint (CTO-CIO paired) | Seat/end-user/tenant authority state as JSON; express MK/CW email required for isolated seats |
| HITLGate | Approval tiers across all seated roles | No execution without recorded approval |
| Resilient Edge | BIGSIS static primaries + beams 2:1 pool | Site survives backend loss (verified 2026-11-08) |
| SAST Sweep | 299-file static analysis w/ person-scan | Zero person-name leakage on public surfaces |
| Corpus Lockdown | /rag /bit internal-only allowlists | Public 404; internal sources verified |
Current verified state (2026-11-08): 19 hostnames live, 21 containers up with restart policies, attacker containment complete (BLK-114), forensic review open and tracked.
Human-in-the-loop by construction. The non-executive seats (CAIO of ABlock, CISO of Whitethorn) hold no C-suite authority: no work performed or approved without express email from MK or CW. Every claim on this page traces to the estate registers of record.