Evidence-first operational intelligence
Built a local-first layer for normalized trace events, parent lineage, redaction before persistence, explicit target scope, incidents, mission capsules and capability-state evidence.
- Defined a canonical event model with trace and parent identifiers instead of relying on unstructured logs alone.
- Kept HTTP target scope fail-closed and Frida device/process allowlists empty by default.
- Exposed a narrow MCP STDIO surface for observation, retrieval and evidence operations rather than arbitrary shell execution.
- Recorded baseline: 37 local tests passed; a new repository CI run retests the published source independently.