Observe. Report. Contain. Restore.
A defensive console built around a twin-shadow witness: one layer watches files, text, hashes, and signals; the second layer watches the first layer for drift, false certainty, and boundary bleed.
SHADOW
CORE
Defense model
The console follows the Witness Survival Kernel: observe reality, report drift, contain uncertainty, and return operation without losing state.
Surface Shadow
Collects local signals: file names, sizes, hashes, text patterns, entropy estimates, and boundary pressure.
Witness Shadow
Explains what changed and why it matters. No silent action, no hidden escalation, no remote calls.
Shadow Shadow
Audits the watcher. If confidence is low, it folds findings into a 00 pocket rather than overclaiming.
Local defense console
Drop files or paste suspicious text. Analysis happens in your browser. This page does not upload data.
Inputs
Paste text, logs, emails, or prompts for pattern review.
Witness report
Event log
Twin shadow / shadow shadow
The second shadow does not duplicate the first. It questions it. This prevents single-watcher tunnel vision.
Primary observer
Measures external artifacts: hashes, size anomalies, suspicious strings, risky wording, repeated urgency, encoded-looking blobs, and file-type mismatch clues.
Watcher of the watcher
Checks whether the first shadow is overconfident, under-evidenced, or leaking across boundaries. If so, it forces containment.
Containment ladder
Every finding maps to a reversible state. Nothing becomes destructive. The safest move is always available.
Proceed. Log and continue.
Unclear or suspicious. Preserve evidence, stop assumptions.
Quarantine recommendation. Export report. Human review required.
Return to coherent operation only after report is understood.
Kernel
Small enough to remember. Strict enough to use.