EVIDENCE-PENDING PREVIEW

Still allowlisting IP and MAC addresses in the age of AI?

AI makes address spoofing cheap. Beam makes trust hardware-bound.

Stop treating an address—or a copyable certificate file—as an identity.

BetaService publishing

Open the canonical product panel Products

Beam Publish

Beta

The diagram shows the mechanism, its current result, and the limit that remains in force.

Step 1 of 3Enrollment and mTLS survive address churn
An endpoint keeps its enrolled identity and active mTLS credential while DHCP, NAT, or interface addresses change. Route and locality decisions remain configuration-specific and require their own current evidence.
Step 2 of 3Stable identity, separately gated path
An address change does not rename the enrolled endpoint. The consuming product keeps its own policy, while stronger membership and locality outcomes remain separate evidence gates.
Step 3 of 3Evidence boundary
Stronger membership and locality-authorization outcomes remain production-dark pending #19093, #19094, #19112–#19115, and accepted activation evidence in #19095.

Core transportCore mesh transport is available. The evidenced join baseline is enrollment plus mTLS key possession; TPM or Secure Enclave custody is a stronger, platform- and profile-specific tier.Hardware-rooted moatEvidence pending #19095

Cryptographic endpoint identity

endpoint kd:7F2A · enrollment + mTLS

Identity persists

Network addresses change

IP 10.24.8.14 · MAC …:31IP 172.20.5.91 · MAC …:A7

Mechanism

An endpoint keeps its enrolled identity and active mTLS credential while DHCP, NAT, or interface addresses change. Route and locality decisions remain configuration-specific and require their own current evidence.

Platform state

Publish is beta and public distribution is not implied by in-tree command and service code.

Evidence boundary

Stronger membership and locality-authorization outcomes remain production-dark pending #19093, #19094, #19112–#19115, and accepted activation evidence in #19095.

Before you start

Accepted installer and activation, abuse controls, domain and certificate ceremony, package distribution, and operator acceptance.

Evidence reviewed 2026-08-26

Beam products

Overview
Beam Publish — Beta
The beta design maps a registered slug to a local HTTP origin over outbound Beam transport, with visibility depending on the selected authentication path.
1. Mechanism
  Slug-routed outbound publish
  The agent registers a bounded publish route and carries traffic over the relay without opening an inbound listener at the origin.
2. Current outcome
  A reviewable public endpoint model
  Core routing, auth-mode, certificate-ledger, and tier tests exist while launch acceptance remains pending.
3. Evidence boundary
  Evidence boundary
  Provider-blind behavior applies only to the SNI-splice path; relay-side visitor authentication necessarily reads the HTTP request.
Platform state
Publish is beta and public distribution is not implied by in-tree command and service code.
Before you start
Accepted installer and activation, abuse controls, domain and certificate ceremony, package distribution, and operator acceptance.
Beam SDKs — Planned
TypeScript, Go, and Python are tracked as distinct distribution surfaces rather than inferred from internal service APIs.
1. Mechanism
  Versioned client boundary
  A client validates configuration, sends an allowlisted operation, and returns explicit route and failure state.
2. Current outcome
  Consistent integration intent
  Developers can find the canonical SDK owner while unavailable registries expose no install command.
3. Evidence boundary
  Evidence boundary
  No npm, Go module, or Python package availability is claimed by source-code presence alone.
Platform state
Each language package remains unavailable until its registry publication, signing, compatibility, and live acceptance evidence is complete.
Before you start
Published package identity, authentication contract, compatibility matrix, examples, signing, and revocation path.
Beam CI previews — Planned
The intended workflow associates one reviewed build output with a time-bounded Beam route and an explicit cleanup result.
1. Mechanism
  Build-scoped route lifecycle
  A CI identity requests a preview after a successful build, records the route as an output, and removes it on completion or expiry.
2. Current outcome
  Reviewable preview intent
  The workflow is visible without exposing credentials or presenting an unpublished action as installable.
3. Evidence boundary
  Evidence boundary
  This production-dark panel provides no copyable workflow, secret, or activation CTA.
Platform state
No CI provider or runner is claimed supported until its action/package and live acceptance record exist.
Before you start
Published action, least-privilege identity, secret-handling contract, expiry/cleanup behavior, and provider acceptance.
Beam Terraform integration — Planned
The intended provider separates configuration planning from live relay provisioning and reports unsupported topology explicitly.
1. Mechanism
  Plan before apply
  A typed resource schema produces a reviewable plan; only an accepted provider and authenticated backend may apply it.
2. Current outcome
  Auditable infrastructure intent
  Operators can understand the desired resource lifecycle without mistaking a schema or source tree for a published provider.
3. Evidence boundary
  Evidence boundary
  This panel exposes no provider install block or apply path while distribution is unavailable.
Platform state
No Terraform Registry or OpenTofu distribution is claimed until package, signing, upgrade, import, and acceptance evidence exists.
Before you start
Published provider, scoped credentials, state protection, import/upgrade behavior, documentation, and live acceptance.
Beam mesh transport — Available
Beam Mesh is the shared transport beneath Reach, Twin, Publish, and other product flows. Its currently evidenced endpoint identity is enrollment and mTLS based rather than IP or MAC based; each consuming product keeps its own authorization.
Core transportAvailableHardware-rooted moatEvidence pending #19095
Cryptographic endpoint identity
endpoint kd:7F2A · enrollment + mTLS
Identity persists
Network addresses change
IP 10.24.8.14 · MAC …:31IP 172.20.5.91 · MAC …:A7
1. Mechanism
  Enrollment and mTLS survive address churn
  An endpoint keeps its enrolled identity and active mTLS credential while DHCP, NAT, or interface addresses change. Route and locality decisions remain configuration-specific and require their own current evidence.
2. Current outcome
  Stable identity, separately gated path
  An address change does not rename the enrolled endpoint. The consuming product keeps its own policy, while stronger membership and locality outcomes remain separate evidence gates.
3. Evidence boundary
  Evidence boundary
  Stronger membership and locality-authorization outcomes remain production-dark pending #19093, #19094, #19112–#19115, and accepted activation evidence in #19095.
Platform state
Core mesh transport is available. The evidenced join baseline is enrollment plus mTLS key possession; TPM or Secure Enclave custody is a stronger, platform- and profile-specific tier.
Before you start
Enrolled identity, valid mTLS credentials, configured peers or relay, consuming-product authorization, network compatibility, and accepted path evidence.
Beam self-host relay — Planned
The beta profile targets a relay plus SQLite-backed slug allocation without requiring the full platform control plane.
1. Mechanism
  Small self-managed control surface
  The relay and slug store keep route allocation local to the operator while reusing the same Publish transport contract.
2. Current outcome
  A credible deployment shape
  Core slug-store and adapter tests exist, but the composed installation remains a separate packaging and acceptance decision.
3. Evidence boundary
  Evidence boundary
  The extended compose package has not landed, so this panel offers no install command or availability claim.
Platform state
Self-host implementation pieces are beta; a complete supported compose package and platform matrix are not currently published.
Before you start
Accepted images, compose bundle, TLS and domain setup, upgrade/backup runbook, security hardening, and live install evidence.