The problem

‍

Pilot success does not equal fleet safety. A single Cursor workspace with MCP proxy is not the same as fifty LangGraph workers on Kubernetes. Without a mandatory hop, one misconfigured pod bypasses every gateway rule you thought you had.

‍

‍

How Blekline handles it

‍

• Track 01 Kubernetes — NHIM sidecar on :8787, NetworkPolicy mandatory hop.
• NHIM audit CLI (Track 0) — static scan for agent-hop bypass before you widen the pilot (NHIM-001..019).
• Fleet policy SSE — push policy updates without redeploying every agent.
• Admission webhook — fail closed on unannotated agent pods (enterprise sandbox).
• Helm + production image — NHIM sidecar image, not DIY reference sidecar alone.

‍

‍

What ships today

‍

SurfacePathStatusNHIM audit@blekline/nhim-auditShipped (OSS)K8s fleet docsapp.blekline.com/docs/deploy/k8s-fleetShippedDocker sidecarghcr.io/blekline/sidecarShippedEnterprise sandboxPost-NDA packQualified partners

‍

‍

Qualify before rollout

‍

# Track 0 — staging cluster (no account) npx @blekline/nhim-audit audit --profile generic --namespace nhim-eval --plain --json -o nhim-audit.json # Track 01 — Helm (after audit brief) helm upgrade --install sidecar blekline-ingress -n blekline --create-namespace

‍

‍

Checklist

‍

• NHIM audit on staging cluster first (Track 0)
• Sidecar not exposed on public Ingress
• replicaCount: 1 + Recreate when Trust Vault enabled
• Upload audit JSON in app for deployment checklist

‍

‍

Honest scope

‍

Fleet deployment is fixed-scope eval and pilot — not open-ended design partner work. Production contracts cover SLA, DPA, and dedicated support.