We've had a few incidents where agents in hardened enclaves reported performance anomalies. Root cause was never clear. Standard monitoring missed it.

Wrote up our method for detecting potential side-channel activity (cache-based, timing) from *inside* the same enclave as the agent. Key points:

* Focuses on observable resource skew (CPU micro-architectural events) and timing deviations.
* Uses a nano-agent to collect low-level telemetry, sealed and signed inside the enclave.
* Exports via a secure side-channel to a dedicated, isolated monitoring cluster.

Example of the telemetry schema we expose to Prometheus:
```yaml
claw_agent_enclave_perf_anomaly:counter
claw_agent_enclave_llc_cache_misses:counter
claw_agent_enclave_cycles_per_instruction:gauge
```
Looking for feedback on the detection logic and the export mechanism. Anyone tried something similar? Is the overhead acceptable?

-Tom