drills.frtModule 35Check on demand, or on a cadence you set, that the kernel's core guarantees still hold, and keep a scorecard of every run.
drills.frt runs six fixed reference scenarios against Intralock and the receipts library: lease exclusion, grant cycles, protected classes, deadlock cycles, monotone deny and Merkle inclusion. Each run is scored and stored. An administrator can schedule it from every hour to every 90 days.
Put admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abuseThe six scenarios run on built-in fixtures, so a green run says the Intralock kernel and the receipt code behave as specified, not that your grants or enforcement points hold. To test your own grants, use drills.counterfactual.
Plane module
resultsid (FRT-1 to FRT-6), ok and a detail sentence.llmfalse. No model takes part./docs/drills-frtAPI referenceRoutes, bodies and status codes./docs/drills-frtOpen the consoleSee the module at work in the dashboard, on a seeded fleet or your own./dashboard-preview/drillsStart freeCreate a workspace and admit your first intent./auth/signup
queuedtrue when a drill workflow took the job. workflowId names it, and last holds the previous stored result.kindfrt or eval: the two drills that can be scheduled and scored.everyHoursnull for none.dueAtMsdue says whether that time has passed.runsgreenRuns of them green.streakGET /api/v1/acp/drills/frt runs FRT-1 to FRT-6 and returns results, each with id, ok and detail. With a drill workflow bound it is queued unless forceInline is set.
A run is green when every scenario passes. It is stored with its time, who ran it and whether a schedule did, in a history capped at 200 runs.
POST /api/v1/acp/drills/schedule takes kind (frt or eval) and everyHours, a whole number from 1 to 2160, or null to stop.
drills/tick runs each drill whose cadence has passed. A cron trigger calls it for every workspace on the schedule */15 * * * *. A drill with a cadence and no run is due at once.
GET /api/v1/acp/drills/scorecard returns, per kind, the cadence, dueAtMs, due, runs, greenRuns, the current streak and the latest runs.
Runs in a shared demo workspace with a demo key: anyone can see what it holds, so send nothing private. drills.frt docs
Press Run to send the request on the left to the shared demo workspace.
Runs in a shared demo workspace with a demo key: anyone can see what it holds, so send nothing private.
A request in the shape the API accepts, and an example response in the shape the module returns.
GET /api/v1/acp/drills/frt Authorization: Bearer av_workspace_•••• → 200 { results, llm }
{
"results": [
{
"id": "FRT-1",
"ok": true,
"detail": "holder admitted, waiter blocked"
},
{
"id": "FRT-2",
"ok": true,
"detail": "cycle detected + applyGrant refused"
},
{
"id": "FRT-3",
"ok": true,
"detail": "wildcard blocked on kms write"
},
{
"id": "FRT-4",
"ok": true,
"detail": "waiter-graph cycle is deadlock"
},
{
"id": ,
: ,
:
},
{
: ,
: ,
:
}
],
:
}A daily cadence leaves a dated record that lease exclusion, cycle refusal and protected classes passed on the version you run.
Run the six scenarios after the plane is upgraded and read which id failed, with its detail.
The scorecard shows how often the drill ran, how many runs were green and who or what started each.
due: true on the scorecard shows a drill whose cadence has passed with no run since.
drills.counterfactual.detection.run.A module is a strong claim about a narrow thing. Rely on it for exactly what it is.
drills/tick run what is due, and a missed run shows as due.FRT-1 admits one lease holder and refuses a second writer. FRT-2 refuses a grant cycle. FRT-3 lets a wildcard read a protected kms resource but not write it. FRT-4 reads a wait-for cycle as deadlock. FRT-5 checks quarantine never turns a deny into an allow. FRT-6 verifies receipt inclusion proofs.
drills/personas runs a scripted liar or a saboteur against the plane's own world model and lease modules and reports caught. It is a separate route and is not scored.
Running frt needs policies.propose. Setting a schedule is for a person who administers the workspace.
frt and eval can be scheduled and scored. Counterfactual runs are stored but not scored.drills/frt call is recorded as a run, including calls made by hand.Authenticate with a workspace API key as a Bearer token. The base URL is https://api.intramedial.com.
/api/v1/acp/drills/frtRun the six scenarios and record the run./api/v1/acp/drills/scorecardRead cadence, due time and results per drill./api/v1/acp/drills/scheduleSet or clear a drill's cadence (administrators)./api/v1/acp/drills/tickRun every drill whose cadence has passed.coordination.drills.frtRun the six scenarios as an MCP action.drills.counterfactual34Counterfactual simulationAsk what a policy change would do before you make it: re-run chosen requests with grants dropped or added, and see each answer change.watchdog.check36Issuance watchdogCatch a plane that is issuing leases or credentials too fast, or has gone quiet, by reading the ledger instead of asking the plane.detection.run07Conflict detectionTurn contention between agents into a filed case with the evidence attached, instead of an alert nobody can answer.conflict-audit.latest33Conflict audit reportRead the latest conflict audit: where agents contended, how well the record backs it, and which resources are ready to move from observe to enforce.conformity.sweep37SI/AI disclosure conformityFind which agents may speak to a person without a disclosure label before an authority does, and test a fleet change before you make it.