™Roadblock owns the start.
A scheduled or manual job enters the control plane. Roadblock checks that both connection paths are closed before creating any worker.
CONTROLLED INGESTION. DELIBERATE SEPARATION.
Roadblock™
The API & MCP
Traffic Cop™
Bring outside information into your private foundation—one controlled connection at a time.
Roadblock sits between outside sources and Hawkeye. Its control plane schedules collection, isolates the handoff in staging, and permits inside delivery only after the outside connection is closed and security controls clear the data.
THE ROADBLOCK CONNECTION RULE
ROADBLOCK™CONTROL PLANE
OutsideCOLLECT
ORInsideDELIVER
Never connected simultaneously.
Fresh containers. Fresh connections.
No persistent inside or outside sessions.
Control-plane initiatedEphemeral workersInspect before releaseClose after every job
01THREE ZONES. ONE CONTROL AUTHORITY.
Outside. Control plane. Inside.
A staged handoff between them.
Explore a complete transfer.
The connection indicators follow the job state.
Illustrative simulation
No live connections or jobs
No live connections or jobs
01 / OUTSIDE
External API sourceApproved source endpointRecords · files · event feeds
NO ACTIVE CONNECTION
External pull containerNot createdCreated per collection job
Compare source → pull the diff
Write changed data to staging
Write changed data to staging
Outside connection: CLOSED
02 / CONTROL PLANE
Roadblock™Schedule · initiate · enforce · audit
Connection interlockWorker lifecycleRelease authority
Commands both workers
No direct source-to-lake session
No direct source-to-lake session
Isolated staging
Waiting for a new batch
Customer security scansData & content inspectionPolicy clearance
Release gate: LOCKED
03 / INSIDE
Internal delivery containerNot createdCreated only after clearance
NO ACTIVE CONNECTION
Hawkeye private data lakeApproved tenant destinationData · databases · local AI
Pick up the cleared batch
Write, acknowledge, disconnect
Write, acknowledge, disconnect
Inside connection: CLOSED
OUTSIDE WORKERSTAGINGCollection phase only
CLEARED STAGINGINSIDE WORKER → LAKEDelivery phase only
Blue = active data connectionClosed = no active sessionOutside and inside cannot overlap
RB-001 · PHASE 01 / 08Every hour
Roadblock owns the start.
A scheduled or manual job enters the control plane. Roadblock checks that both connection paths are closed before creating any worker.
Acquire the transfer lock; select the source, diff checkpoint, destination, and inspection policy.
Demonstration only. Schedule and inspection choices do not configure Hawkeye.
Test the connection interlockAdvance to Collect or Deliver to test a conflicting connection request.
01Schedule
02Collect
03Disconnect
04Inspect
05Release
06Deliver
07Teardown
08Complete
02ONE JOB, FROM COLLECTION TO TEARDOWN
A connection for the task.
Then a clean disconnect.
The workers are temporary.
The control plane retains the job's history.
BOTH CLOSED
A fresh outside worker collects the difference.
Roadblock creates a new external pull container and initiates a new API or MCP connection. The worker compares the source with the last committed checkpoint and writes the changed data to staging. The inside path stays blocked.
Close the outside connection. Destroy the worker.
The external session is closed and the pull container is destroyed. Roadblock verifies teardown before the job can proceed. If teardown cannot be confirmed, the job remains blocked.
Inspect the batch while both paths are closed.
Apply the customer's configured security scanning and inspection to staged data. The release decision belongs to the control plane's policy workflow. Failed, incomplete, or unavailable checks keep the batch in staging.
Clear the inspected batch for inside delivery.
The configured security controls have cleared this specific batch. Roadblock records the release decision and rechecks that the outside connection is closed before authorizing a new inside worker.
A fresh inside worker delivers to Hawkeye.
Roadblock creates a new internal delivery container and initiates a new inside connection. The worker picks up only the cleared staging batch and places it in the designated tenant's Hawkeye private data lake. The outside path stays blocked.
Confirm the write. Remove the inside worker.
After delivery is acknowledged, Roadblock closes the internal session and destroys the delivery container. The delivery receipt and ingestion checkpoint can be retained for the next job; the worker and connection are not reused.
The job ends with both paths closed.
Roadblock records completion and returns to its schedule. The next run starts with a new external container and a new connection, followed by a separately created internal container only after clearance.
03YOUR INSPECTION. YOUR RELEASE POLICY.
Staging is a decision point.
Arrival does not mean approval.
The outside worker can deposit a batch into staging. It cannot authorize that batch to enter Hawkeye. Customers apply their security scanning and inspection in the staging zone; Roadblock permits internal delivery only after the configured controls have cleared the batch.
Scan the staged content
Apply customer-selected malware scanning, file inspection, and content analysis before a batch is eligible for release.
Validate the data
Check file types, schemas, allowed content, and the batch manifest. Preserve the link between source records, the diff, and the staged objects.
Enforce release policy
Define the checks that must pass and when human review is required. A pending or failed result keeps the batch held and the inside path closed.
Keep the transfer history
Retain job IDs, source identifiers, acquisition timestamps, batch hashes, worker lifecycle events, inspection results, release decisions, and delivery receipts under your policy.
Uncertain state means no release.
A failed scan, pending review, unknown connection state, or unconfirmed worker teardown keeps the transfer blocked. Additional scheduled jobs wait for the same protected transfer boundary to become available.
Carry provenance from intake to evidence review.
Preserve the original downloaded batch and record its source, collection time, and hash baseline in staging. Verify transfer integrity when the cleared batch reaches the private data lake, and retain those records for the evidence workflow. Supported forensic images can later be exported as EWF (.E01) with verification and custody documentation; native files retain their original format. Security clearance permits a transfer—it does not by itself authenticate evidence or establish a forensic acquisition.
Explore EWF evidence export04NON-PERSISTENT CONNECTIONS. ACCOUNTABLE TRANSFERS.
New workers every time.
A traceable job across the handoff.
Every external and internal connection is initiated by Roadblock's control plane. Each is a new, task-scoped session. Neither worker keeps a persistent connection open, and neither worker is reused for the next job.
How the next diff knows where to start
Retain the job's checkpoint and delivery receipt separately from its workers. The next fresh external container compares the source against the last committed state. An interrupted or rejected batch does not silently become a completed ingestion.
WHAT ENDS WITH THE TASKWHAT CAN BE RETAINED BY POLICY
External pull containerSource and diff checkpoint
External API / MCP sessionStaged batch and manifest
Internal delivery containerInspection and release records
Internal delivery sessionDelivery receipt and audit trail
Job records persist by policy. Connections do not.
05THE BOUNDARY, EXPLAINED
Clear rules.
At every handoff.
Can outside and inside connect at the same time?
No. The control plane checks actual connection and worker state before opening either path. The connection interlock applies across jobs sharing that transfer boundary, so a second job cannot create an overlapping outside or inside session.
Does the control plane act as a live data bridge?
The reference design uses a staged handoff. Roadblock orchestrates and authorizes the workers; an external session does not stream directly through to the private data lake. Outside collection ends before inside delivery begins.
What happens when a job is interrupted?
Keep the affected batch held, close the active session, and verify worker teardown. A retry requires a fresh worker and a new connection after state is reconciled. It does not resume a persistent inside or outside tunnel.
How does this fit Hawkeye's offline foundation?
Roadblock provides a controlled ingestion boundary when outside information must be imported. After cleared data reaches the private data lake, Hawkeye applications, search, analytics, and on-box AI use that local data without an ongoing source connection. This diagram describes staged connection separation; physical air-gap arrangements depend on the deployment.
Let the data through.
Keep the connection under control.
Roadblock™. The API & MCP Traffic Cop™.