Safety

Sovereignty Final Word: inspects the meta-shield: any shield can be overruled by the human, always with the override logged and a re-review date - protection that won't become its own authority. Verdicts: allow, flag (severity critical). Rules: allow, warn. False-positive story: The meta-shield has no false positives to escape into; its own discipline is that even its flags answer to the human, so the override path is its reason for existence and this entry is the record of that.

Provider Failover Integrity: inspects routing switches. Verdicts: block, flag (severity high). Rules: block, warn. False-positive story: Privacy-sensitive turns must never route at all; the override is the user local-only pin.

Model Drift Watch: inspects provider model versions. Verdicts: flag (severity high). Rules: warn. False-positive story: Declared version bumps move behavior legitimately; the override distinguishes announced releases from silent swaps.

Benchmark Contamination: inspects eval scores. Verdicts: flag (severity medium). Rules: warn. False-positive story: Canonical public benchmarks overlap most corpora by nature; the override flags the score as overlap-limited in reporting.

Bandwidth Honesty: inspects capability claims in marketing copy vs actual behavior. Verdicts: flag (severity low). Rules: warn. False-positive story: Roadmap language is legitimately forward-looking; the override requires the FUTURE tense to be visible in the copy itself.

Overtrusting Prompt: inspects user delegating high-stakes calls fully ("just decide"). Verdicts: flag (severity medium). Rules: warn. False-positive story: A human may deliberately pre-authorize a class of irreversible acts; the override is that standing instruction, logged.

Sycophancy Brake: inspects the OS's own agreement rate with the user. Verdicts: flag (severity low). Rules: warn. False-positive story: Harmonious periods produce honest high agreement; the override notes the period and keeps watching.

Outramp Meter: inspects draft replies while sentiment high. Verdicts: flag (severity low). Rules: warn. False-positive story: Righteous anger at a real wrong is legitimate; the override is the human sending now.

Filter Bubble Mirror: inspects the organism's own recommendations. Verdicts: flag (severity low). Rules: warn. False-positive story: Niche legitimate interests narrow the feed honestly; the override names the declared specialty.

Invest Hype Detector: inspects market content the user asks about. Verdicts: flag (severity medium). Rules: warn. False-positive story: Momentum strategies intentionally ride what the detector calls hype; the override marks the declared strategy context.

Romance Grooming Tell: inspects channel conversations (user-opt-in family mode). Verdicts: flag (severity high). Rules: warn. False-positive story: Long-distance families legitimately escalate intimacy of logistics; the override is opt-out with the local model untouched.

Scam Pressure Forms: inspects inbound requests to the user (urgency+secrecy+payment+authority). Verdicts: flag (severity high). Rules: warn. False-positive story: Genuine invoices carry urgency and payment together; the override learns the known billers.

Rate Limit Self Discipline: inspects outbound to third-party APIs. Verdicts: allow, flag (severity medium). Rules: allow, warn. False-positive story: Batch imports legitimately need burst-then-idle; the override declares the import window up front.

Free Tier Respect: inspects provider quota states. Verdicts: block, flag (severity medium). Rules: block, warn. False-positive story: A prepaid upgrade the human clicked is consent; the override ties to that approval record.

Token Waste Meter: inspects repeated near-identical calls. Verdicts: flag (severity low). Rules: warn. False-positive story: Fresh context legitimately repeats questions after memory updates; the override discounts the cache-invalidated window.

Spend Anomaly: inspects API billing per provider. Verdicts: flag (severity high). Rules: warn. False-positive story: A deliberate large migration spikes spend legitimately; the override pre-declares the expected spike window.

Cold Storage Alert: inspects backup media untouched past a verification window. Verdicts: flag (severity low). Rules: warn. False-positive story: The archive is intentionally write-once and never re-read; the override records a one-time restore test result instead.

Wifi Evil Twin Aware: inspects network changes at known locations. Verdicts: flag (severity medium). Rules: warn. False-positive story: The cafe legitimately rotates its AP keys each season; the override pins the new BSSID after the human confirms the venue.

Phishing Mirror Site: inspects links in user's inbound. Verdicts: flag (severity high). Rules: warn. False-positive story: Country-code domains of real services look near by string distance; the override registers the verified official domain set.

Duplicate Persona: inspects incoming contacts/accounts. Verdicts: flag (severity medium). Rules: warn. False-positive story: Legitimate work-and-personal accounts for one person overlap; the override links the identities as the same human.

Statistical Implausibility: inspects ingested numbers. Verdicts: flag (severity medium). Rules: warn. False-positive story: Engineered reference tables have exactly clean digits and trip the test; the override marks the series as synthetic-by-design.

Schema Drift Lie: inspects "freshness says current but rows stopped". Verdicts: flag (severity medium). Rules: warn. False-positive story: A source with genuinely no new records still looks stale to the detector; the override records the explicit no-change attestation.

Fail2ban Ally: inspects repeated hostile patterns. Verdicts: flag (severity medium). Rules: warn. False-positive story: Loading a dev server from the LAN at scale looks hostile; the override adds the sanctioned network.

Resource Hog Triage: inspects CPU/mem/fd exhaustion sources. Verdicts: allow, flag (severity medium). Rules: allow, warn. False-positive story: Indexing and compile jobs hog on purpose; the override pre-authorizes the declared workload class.

Time Skew Watch: inspects clock jumps. Verdicts: flag (severity medium). Rules: warn. False-positive story: NTP corrections after suspend are normal; the override recognizes disciplined sync versus unexplained jumps.

Log Tamper Evidence: inspects write paths of audit logs. Verdicts: block, flag (severity critical). Rules: block, warn. False-positive story: Log compaction and archival look like gaps to a naive chain check; the override binds the archive manifest.

Tls Downgrade Block: inspects own connections. Verdicts: block, flag (severity high). Rules: block, warn. False-positive story: Corporate MITM proxies present re-signed certs legitimately; the override trusts the declared enterprise root CA only.

Auth Brute Watch: inspects login attempts. Verdicts: flag (severity high). Rules: warn. False-positive story: Households with shared devices mistype passwords together; the override - a human-run escape hatch - waves a burst through.

Port Scan Observer: inspects inbound scans against the daemon. Verdicts: flag (severity medium). Rules: warn. False-positive story: Security updates and vulnerability scanners from known vendors look like scans; the override pins their source ranges.

Ssrf Tripwire: inspects fetches initiated by content. Verdicts: block, flag (severity critical). Rules: block, warn. False-positive story: Local development fetches its own services constantly; the override is the declared dev-port allowlist.

Dns Rebind Guard: inspects resolved names. Verdicts: block (severity high). Rules: block. False-positive story: Home lab DNS intentionally serves private names; the override whitelists the declared internal zone.

Egress Allowlist: inspects outbound destinations per package. Verdicts: flag (severity critical). Rules: warn. False-positive story: CDNs rotate hostnames under the same service; the override groups by service, not by literal host.

Shield Off Watch: inspects the meta-shield: any disabled shield. Verdicts: flag (severity high). Rules: warn. False-positive story: A long-trusted shield may be off for months; the override that disabled it IS this shield's subject - the expiry simply forces periodic human re-acceptance rather than permanent invisibility.

Config Drift Guard: inspects security-relevant settings (approval modes, shield toggles). Verdicts: block, flag (severity critical). Rules: block, warn. False-positive story: The human does switch shields off deliberately; the override is that deliberate click, with the expiry the shield-off-watch then tracks.

Bundle Integrity Self: inspects the OS's own bundles. Verdicts: block, flag (severity critical). Rules: block, warn. False-positive story: Operators legitimately patch bundles for air-gapped sites; the override is a re-signing ritual with the operator key, logged.

Revocation Sync: inspects package revocations from publishers. Verdicts: flag (severity high). Rules: warn. False-positive story: A publisher revokes then re-publishes fixed bytes minutes later; the override applies the newer signed record, not the stale revocation.

Quarantine Sandbox: inspects suspicious artifacts. Verdicts: quarantine (severity critical). Rules: quarantine. False-positive story: Benign installers look hostile under detonation (they write registries); the override passes on the human read of the report.

Advisory Crosscheck: inspects installed stack vs OSV/NVD feeds. Verdicts: flag (severity high). Rules: warn. False-positive story: A vulnerable function in a library may never be called by the shipped configuration; the override records the reachability analysis.

Dependency Pin Ship: inspects packages with deps. Verdicts: flag (severity medium). Rules: warn. False-positive story: Rolling-release platform packages float by design; the override scopes to the platform channel.

Skill Code Static: inspects python/shell/wasm skill payloads. Verdicts: block, flag (severity critical). Rules: block, warn. False-positive story: Interpreter skills legitimately call the shell they declared; the override matches call-site to declaration, not to zero.

Model File Format Guard: inspects model packages. Verdicts: block (severity high). Rules: block. False-positive story: Legacy research checkpoints arrive pickle-only; the override confines the load to the detonation sandbox first.

Permission Inflation: inspects version history per package. Verdicts: block (severity critical). Rules: block. False-positive story: A genuine feature addition legitimately adds one permission; the override is the human accepting that one-step delta with the reason kept.

Typosquat Detector: inspects new package names. Verdicts: flag (severity high). Rules: warn. False-positive story: Legitimate sibling packages (foo-cli, foo-core) sit near each other; the override registers the publisher family.

Update Diff Review: inspects every update. Verdicts: flag (severity high). Rules: warn. False-positive story: Same-version rebuilds show an empty diff and look ignored; the override confirms no-delta and proceeds silently.

Hash Chain Audit: inspects artifact plane. Verdicts: block (severity critical). Rules: block. False-positive story: Repackaging upstream without a portal re-record breaks the chain honestly; the override is a portal re-registration, never a bypass.

Package Signature Verify: inspects every install/update. Verdicts: block (severity critical). Rules: block. False-positive story: Self-built dev packages are unsigned by default; the override is the explicit local-trust grant, scoped and logged.

Hoax Amplifier Check: inspects reshare-worthy claims. Verdicts: flag (severity medium). Rules: warn. False-positive story: Already-verified news gets re-shared constantly; the override marks the source as fact-checked for that story thread.

Url Preview Trust: inspects links the OS sends. Verdicts: block, flag (severity medium). Rules: block, warn. False-positive story: Redirect shorteners hide the final host; the override shows the expanded chain to the sender for a human call.

Image Forensics Out: inspects AI imagery leaving the OS. Verdicts: allow, flag (severity high). Rules: allow, warn. False-positive story: Unbranded work-for-hire imagery has its own labeling contract; the override records the buyer policy for that batch.

Deep Satire Label: inspects fictional/roleplay output. Verdicts: allow (severity medium). Rules: allow. False-positive story: Satire venues expect the mask unlabeled; the override applies inside declared-fiction containers only.

Copyright Respect: inspects long verbatim third-party text reproduction. Verdicts: flag (severity medium). Rules: warn. False-positive story: Public-domain and licensed text reproduces legitimately; the override marks the source license explicitly.

Defamation Brake: inspects generated claims about named real people. Verdicts: block (severity high). Rules: block. False-positive story: Quoting a published court finding is sourced but reads like accusation; the override binds the citation as the evidence.

Minor Safety Gate: inspects content when a minor's usage is detected/declared. Verdicts: allow, flag (severity high). Rules: allow, warn. False-positive story: A teen using a parent device for homework gets the gate; the override is the parent config choice, never agent self-exemption.

Health Guardrail: inspects diagnosis-shaped output. Verdicts: block, flag (severity critical). Rules: block, warn. False-positive story: Caregivers drafting legitimate care summaries read as diagnosis-shaped; the override applies the clinician-context frame.

Legal Disclaimer Stamp: inspects legal/financial/medical-adjacent output. Verdicts: allow (severity medium). Rules: allow. False-positive story: Licensed professionals using the OS as their own letterhead need no stamp; the override ties to the sender credential.

Memory Quarantine: inspects writes flagged by input shields. Verdicts: quarantine (severity high). Rules: quarantine. False-positive story: A quarantined note may later be verified true by its author; the override promotes it explicitly, with the promotion logged.

Device Boundary: inspects shared-family-device flows. Verdicts: flag (severity high). Rules: warn. False-positive story: Household calendars genuinely cross profiles; the override registers the explicitly shared surfaces.

Cross User Bleed: inspects multi-user/org deployments. Verdicts: block (severity critical). Rules: block. False-positive story: Shared reference data (a common contact directory) scores high across tenants; the override marks the record as tenant-shared by contract.

Pii Egress Filter: inspects outbound content. Verdicts: block (severity critical). Rules: block. False-positive story: Medical stories shared deliberately to a chosen person are consented; the override records the per-recipient consent state once.

Secret Outbound Scan: inspects every outbound text (email/post/reply). Verdicts: block, flag (severity critical). Rules: block, warn. False-positive story: Documentation writers quote example keys; the override marks the specific string as a known fake sample.

Model Self Report Skeptic: inspects claims of completion. Verdicts: flag (severity high). Rules: warn. False-positive story: Read-only answers legitimately produce no artifacts; the override scopes the skeptic to mutating actions only.

Prompt Inversion Triplet: inspects multi-turn context. Verdicts: flag (severity high). Rules: warn. False-positive story: Persuasive honest human writing rhymes with the triad; the override stamps the passage as the user own voice.

Loop Depth Trigger Chain: inspects trigger. Verdicts: block, flag (severity high). Rules: block, warn. False-positive story: Intentional event fan-out terminates cleanly but looks cyclical at a glance; the override raises the depth ceiling for that named chain.

Shell Allowlist Buddy: inspects exec attempts vs the allowlist gate. Verdicts: allow (severity low). Rules: allow. False-positive story: The explanation itself can be wrong about intent; the human override is to re-ask with context, and the shield never blocks anything it was not asked about.

Credential Usage Watch: inspects integration tokens. Verdicts: flag (severity critical). Rules: warn. False-positive story: Travel and VPNs move the apparent IP constantly; the override records the device as the user own for that integration.

Deadman Switch: inspects long-running autonomous sessions. Verdicts: flag (severity high). Rules: warn. False-positive story: A user traveling deliberately leaves a long job; the override sets an explicit unattended window with a spend cap.

Human Authority Seam: inspects any action touching deletion/finance/outbound comms. Verdicts: block, flag (severity critical). Rules: block, warn. False-positive story: Fast genuine approvals on mobile resemble imitations; the override is a single explicit re-confirmation of that exact action.

Approval Fatigue Guard: inspects approval prompt patterns. Verdicts: allow, flag (severity medium). Rules: allow, warn. False-positive story: A developer clicking through their own test prompts trips the streak detector; the override recognizes the operator session.

Sub Agent Lineage: inspects agent-spawn trees. Verdicts: block, flag (severity high). Rules: block, warn. False-positive story: Batch jobs (photo indexing) fan out wide on purpose; the override records a sanctioned width budget for that job.

Scope Creep Monitor: inspects a pilot's actual tool usage over weeks vs its manifest promises. Verdicts: flag (severity high). Rules: warn. False-positive story: Legitimate feature growth ships through update-diff review; the override is the human accepting the amended manifest.

Dormant Activation: inspects installed-but-unused packages. Verdicts: flag (severity medium). Rules: warn. False-positive story: Seasonal tools wake with entirely normal behavior; the override marks the expected seasonal activation.

Exfil Canvas: inspects outbound payloads. Verdicts: block, flag (severity critical). Rules: block, warn. False-positive story: Backing up a vault to one's own cloud matches; the override registers the destination as user-owned.

Tool Misuse Pattern: inspects tool call sequences. Verdicts: block, flag (severity critical). Rules: block, warn. False-positive story: Authorized self-assessments walk the same paths; the override marks an operator-led session as sanctioned.

Privilege Ask Auditor: inspects capability requests at install/run. Verdicts: flag (severity high). Rules: warn. False-positive story: A formatter that genuinely needs network for a plugin registry is legitimate; the override is the human granting the ask with the mismatch noted.

Budget Breaker: inspects token/wall-clock/cost accrual vs declared budget. Verdicts: block, flag (severity critical). Rules: block, warn. False-positive story: Large one-off jobs are approved up front; the override raises the declared budget with the human approval recorded.

Runaway Loop: inspects agent iterations + spend. Verdicts: block, flag (severity high). Rules: block, warn. False-positive story: A retry-with-backoff storm during an outage looks loopish; the override grants an explicit continue-with-budget to ride it out.

Mcp Adapter Trust: inspects tool-descriptions from external servers. Verdicts: flag, quarantine (severity critical). Rules: quarantine, warn. False-positive story: Vendor descriptions are verbose and marketing-flavored; the override pins the operator-reviewed manifest version of that server.

Prompt Archaeology: inspects outbound model calls. Verdicts: flag (severity medium). Rules: warn. False-positive story: Writers and developers ask capability questions that rhyme with extraction; the override reframes the ask as an allowed capability answer.

Unicode Smuggling: inspects any text. Verdicts: flag (severity high). Rules: warn. False-positive story: Arabic and Hebrew text legitimately uses RTL marks; the override whitelists the writing system, keeping the screen for mixed-script anomalies.

Attachment Weapon Check: inspects executable/script-shaped attachments. Verdicts: block, quarantine (severity critical). Rules: block, quarantine. False-positive story: Users knowingly request installers and scripts; the override is the explicit human-acknowledged open, logged with its reason.

Share Link Exposure: inspects newly created share URLs. Verdicts: flag (severity medium). Rules: warn. False-positive story: Portfolio links are deliberately permanent and public; the override records that intent so only blast-radius changes re-ask.

Deep Link Integrity: inspects qynqueos:// URIs. Verdicts: flag (severity high). Rules: warn. False-positive story: Development loops fire many valid deep links fast; the override arms a session-scoped dev mode with its own expiry.

Webhook Source Auth: inspects inbound webhooks. Verdicts: block, flag (severity critical). Rules: block, warn. False-positive story: Providers rotate signing keys without notice; the override accepts for the named endpoint while re-keying is demanded.

Error Text Scrutiny: inspects stack traces echoed into prompts. Verdicts: allow, flag (severity high). Rules: allow, warn. False-positive story: Library errors quote example keys from their own docs; the override marks a specific error signature as documentation-noise.

Csv Formula Guard: inspects spreadsheet exports. Verdicts: flag, quarantine (severity high). Rules: quarantine, warn. False-positive story: Finance exports carry real formulas as data; the override keeps one cell's formula after the human has seen its target.

Calendar Invite Scan: inspects invite fields. Verdicts: block, flag (severity medium). Rules: block, warn. False-positive story: Corporate invites embed templated shortened URLs; the override registers the organizer domain as known for link rendering.

Channel Message Guard: inspects chat messages from third parties into agent context. Verdicts: flag (severity high). Rules: warn. False-positive story: Group members relay genuine task instructions; the override raises trust for the channel without disabling the screen elsewhere.

Memcopy Poison Scan: inspects writes into memory store. Verdicts: flag, quarantine (severity critical). Rules: quarantine, warn. False-positive story: A user's own notes to their future self read as instructions; the override marks the memory owner-authored and restores its authority.

Tool Output Sanitizer: inspects every tool result. Verdicts: allow, flag (severity high). Rules: allow, warn. False-positive story: Command output legitimately contains words like 'execute' or 'ignore'; the override suppresses re-flagging for the same tool's session-scoped output.

Image Ocr Injection: inspects OCR output of any image. Verdicts: flag (severity high). Rules: warn. False-positive story: Memes and screenshots quote prompt text as their subject; the override classifies the string as quoted-image content, still inert data.

Resume Bomb Guard: inspects applicant documents. Verdicts: flag, quarantine (severity high). Rules: quarantine, warn. False-positive story: Creative resume templates produce OCR runs that look hidden; the override annotates the template as the cause and keeps the candidate whole.

File Content Injection: inspects opened docs (PDF/DOCX/comments). Verdicts: block, flag (severity high). Rules: block, warn. False-positive story: PDF watermarks and print-hint lines use low-contrast text innocently; the override marks hidden-text as expected styling per publisher.

Web Content Injection: inspects fetched page text. Verdicts: flag, quarantine (severity high). Rules: quarantine, warn. False-positive story: Security tutorials legitimately quote injection phrases; a human override re-admits the page as quoted data with the spans still highlighted.

Email Injection Scan: inspects inbound email body/headers. Verdicts: flag, quarantine (severity high). Rules: quarantine, warn. False-positive story: A user forwarding a how-to guide quotes instruction phrasing and matches; the human override marks the message as expected content and narrows the rule to that sender thread.

Controls network access and outgoing connections · kernel-level; hooks network.connect,network.send; 2 rules

Controls file system access patterns · kernel-level; hooks file.read,file.write,file.delete; 3 rules

Intercepts and validates shell commands before execution · kernel-level; hooks command.execute,command.run; 3 rules