Default-deny. Dangerous actions (rm -rf, sudo, curl | sh, network admin)
are blocked. Warn rules produce a non-blocking warning.
Append-only JSONL: data/audit.jsonl.
Trajectory observations are redacted for common secret formats (GitHub/OAuth/
OpenAI keys, AWS access keys, private keys, password=).
subprocess (default) or docker (network disabled by default, memory limits).