zday lab — resident security supervision
with sealed, verifiable evidence

zday lab is a resident supervisor for a single machine. It finds the AI agents running on the box — by their autonomy, not their name — attributes and geolocates every connection they make, maps which AI providers they call, scores what it sees with governed weighted and neural networks, and seals every observation onto a tamper-evident evidence chain — so that "how many agents are on our systems, and what are they doing?" is a question with a verifiable answer, not an investigation. This paper explains what the software is, how it works, and how to use it.

1 · The problem it solves

Every security incident, audit or insurance claim starts with the same two questions: what was running on that machine? and who was it talking to? The honest answer is usually assembled afterwards, expensively, from logs that were never designed to answer it — and assembled on trust.

zday lab exists to make those two questions cheap and the answers verifiable. It runs continuously, so the facts of last Tuesday are as available as the facts of right now; and it seals what it sees, so the answer can be checked by someone who has no reason to trust you — an auditor, an insurer, a customer, a court.

2 · What the software is

A set of small, single-duty defense components that run on the machine itself:

• The watcher enumerates live sockets and attributes each one to its owning process — in-process, via the operating system's own process table, with no external tooling spawned.
• The event wire (2026-09-17) makes process creation an event, not a sample: every spawn on the host is caught within a second — through the OS's own creation-event stream (trace-level when elevated, delivery-level otherwise, tight-poll as last resort) — and sealed into the evidence chain at birth. An agent cannot start on this host unrecorded. Proven live: two staged agents caught at spawn, chain verified across 47,588 records (tape-spawn-catch-001).
• Discovery and provenance fingerprint every running program: identity, signature state, parentage, behavior history. New arrivals and changed behavior are events with names, not log noise.
• The agent lens fingerprints agent-like software by autonomy, not by name — a process that observes, reasons, decides, calls tools and repeats is scored and classified (AI-enabled application → probable assistant → probable agent → autonomous agent), then fingerprinted twice: hard (executable hashes) and soft (endpoints, tool ports, children, cadence) so a rename doesn't hide it.
• The AI-provider lens answers where the agents go: live connections joined against a curated map of AI-provider endpoints — which processes call which providers, how often, from this box. Shadow AI becomes a list with names.
• The geography layer resolves where connections go: country, route, port, whether the path leaves the private network, first contact or known peer.
• The warden clusters suspicious connections and tracks them over time — first sighting, persistence, promotion, acquittal.
• The supervisor surface — API, browser console and desktop panel — answers the operator in plain language: how many agents are on this box, how many confirmed, which countries, what's new, what just spawned (live, sealed).
• The incident defense component turns escalations into dossiers: who, where, when, why, and the evidence rows the dossier was built from.
• Licensing inside the seal (2026-09-17, shipping design): the license is a sealed record, not a checkbox — every tape opens with a license head the verifier checks against the vendor root key, so an unlicensed copy produces tapes that verify as intact but unlicensed everywhere. Cracking the app does not crack the authority.

The active defense stack — security benefits out of the box

zday lab is not a passive recorder. The same supervision that seals evidence actively defends the host, on seven fronts:

• Perimeter defense. A stateful firewall with per-app pinholes — inbound allowed only from the servers you actually connected to — plus stealth posture that answers unsolicited probes with silence, and weighted port-scan detection that scores reconnaissance inside time windows and responds in graduated steps: audit, alert, block.
• Network integrity. ARP and gateway watch catches IP spoofing, duplicate-IP conflicts and gateway-MAC changes — the classic precursors to man-in-the-middle and sniffing attacks on your local network.
• Reputation screening. Community blocklists with mandatory freshness metadata screen every connection; a stale list refuses to score rather than lie to you.
• Secrets defense. Content defense watches the DNS, clipboard and file channels for YOUR named secrets — card and account numbers, credentials — with graduated alerts, and receipts that prove the catch without ever leaking the secret itself.
• Intruder tripwires. Canary files planted in your document folders turn unauthorized access into a sealed alarm: any process that touches one is caught and recorded as evidence of intrusion.
• Governed response. A quarantine ladder — observe, isolate, contain — with evidence sealed BEFORE any action, every action reversible, and the highest rung held behind a two-person-rule threshold. Response that protects you, and can prove it behaved.
• Proven detection. The frozen detection benchmark: 55 of 55 attack scenarios caught, zero false alarms on the clean-box control — sealed, re-runnable, published.

3 · The evidence chain

Every observation, verdict, heal and export lands as a record on an append-only chain. Each record carries a CRC tripwire, a keyed chain seal linking it to its predecessor, and a signature, so three independent failure modes are caught: corruption (the CRC trips), re-chaining without the key (the seal breaks), and repudiation (the signature fails).

Three rules govern the chain's honesty:

• History is annotated, never rewritten. Wounds found later are quarantined as documented scars — the bytes stay, the receipt explains them, and verification masks the scar while staying loud about anything new.
• Appends are race-proof. The read-tip → seal → append critical section is locked; the proof is mechanical — under a six-writer load test the unlocked path produced 51 broken links, the locked path zero.
• Nothing is silently deleted. Even pruning is a sealed receipt naming what was removed, how many, and why.

4 · The governed brain

Scoring is done by weighted evidence networks and trained neural nets — and the weights are visible, governed and learning:

• Weighted units score clusters from named inputs — risk, persistence, port rarity — through rules a human can read. The alarm band is a governed value, not a buried constant.
• Neural voices — five trained nets — vote on every subject; their agreement is itself a scored input, and a voice that cannot judge abstains with a reason rather than scoring zero.
• Learners move priors only on evidence. A learner with thin evidence refuses, sealed, rather than drift on anecdotes. Calibration requires a minimum of confirmed outcomes before it speaks at all.
• The operator's verdict outranks the machine. A REAL/NOISE mark from the operator counts double against machine sightings — and "unsure" is never treated as a signal.

5 · Incidents, verdicts, exports

When signals cross the band, an incident opens itself: identity, geography, reasons, source seals. Unchanged repeats are touches, not spam; material changes are updates; a cleared picture closes with a duration. Escalations alert; touches do not.

The export builds a portable bundle — dossier, CSVs, receipts, a manifest of hashes and the public key — so a third party verifies everything offline. The bundle is the product's answer to "why should I believe your dashboard?": don't; check the mathematics.

6 · The watching-the-watchers layer

A supervisor that can silently fail is a liability, so the estate supervises itself:

• The overseeing eye seals a manifest of every defense component, heartbeats each pass, verifies every chain, and heals drift — bounded, with forensic snapshots capped and every heal and prune sealed.
• Silent-failure switches. The watcher, the API, the panel, the eye itself: each has a tripwire that notices silence and escalates instead of looping forever.
• The standing critic. A resident daemon audits the work against the operator's own stated rules — 113 sealed critiques to date, one every half-hour around the clock, present on every surface and unable to be switched off by any project. Its verdict is sealed: cyan when all holds, amber with the open demand named.

7 · How to use it

Setup is ten minutes: place the folder, start the supervisor (one command), open the console with your key, dock the desktop panel. The full walkthrough — including how to read a dossier and how to export — is on the workstation page. Daily use is three glances: the panel (is it alive?), the console (anything new?), the critic (cyan?).

8 · The honesty ledger — what it refuses to do, and why that protects you

• It does not send your machine's data anywhere. All state is local; exports happen only when you ask.
• It does not rewrite history. Scars are documented and masked, never erased.
• It does not cry wolf by design: the customer test includes a negative control — a clean box must produce silence, and does, sealed.
• It does not close its own corrections. A fix counts when the check that flagged it flips — never on the software's own say-so.

9 · Verification

Every load-bearing claim in this paper is backed by a sealed, re-runnable artifact on the reference machine:

The demo replays the customer-test catch with the receipt's own numbers: watch it.