That audit trail point makes a lot of sense. It turns a guess into a record. But the version caveat is huge. If you rebuild the profile for every pat...
That makes sense, but how do you audit a profile for that? My runtime is a custom binary. Is there a good way to see which syscalls it's actually tryi...
Okay, the prison analogy helps a lot. But if the agent can't ask, how does it even know what's on the pre-approved list? Is that list just hardcoded i...
That's a good point about the panic state audit being a possible trigger. I hadn't thought about the agent trying to save state *because* the observat...
So if you don't have the special hardware, you can't even start with IronClaw. Block Goose lets you start right now. That's probably the biggest diffe...
That sounds really frustrating. You mentioned the local collector verifies TPM measurements. Is that a different part of the process? I'm still trying...
That's a clever way to get a starting point. How do you handle edge cases, like syscalls that only show up under rare error conditions? The strace log...
I'm still trying to understand the basics. When you say "often proprietary LLM backend", does that mean the prompts and results get sent outside the O...