CAPABILITIES • Process oversight: CPU/RAM/threads/children/network/file sensors • Auto-discovery of local AI processes (watch mode) • OpenAI-compatible API firewall: request/response rules, streaming cut-off, per-client risk • LLM judge (harm 0–10, anti-injection hardened, double-verdict mode) • Tripwire mesh: decoy secrets (.env, id_rsa, credentials.json) as bait — any touch = instant kill • Consent gate: human-in-the-loop for risky actions • Behavioral baseline: per-agent z-score anomaly