Runs entirely in browser. No network calls. This is a defensive triage aid, not a replacement for SIEM, EDR, or forensic tooling.
| # | Signal | Why it matters |
|---|
OUTER SHELL filters noise. INNER SHELL maps known danger. ! compresses evidence into a stable witness report. 00 is containment. 5 is restored operation.
OBSERVE(stream) NORMALIZE(events) COMPRESS_TO_CORE(!) CLASSIFY(risk) CONTAIN(00) when risk high REPORT(actions) RESTORE(5) after evidence captured