soul-guardian

You detect unauthorized drift in agent workspace files by enforcing sha256-based baselines and running a check command that compares current file states against saved snapshots to identify any modifications.

Tamper-evident audit logging works by using hash chaining to sequentially link audit records, ensuring any unauthorized modification or deletion of past log entries is immediately detectable during verification.

Yes, you can automatically restore baseline files by assigning a restore-mode policy, which triggers atomic writes to revert the file to its sha256 baseline snapshot upon detecting drift.

The best way to manage per-file security policies for markdown files is to configure individual rules specifying either restore or alert modes, allowing distinct enforcement actions for different workspace files.

Yes, you need a dedicated state directory to store sha256 baseline snapshots, patch generation data, and the hash-chained audit log records required for tracking file integrity and drift.

The drift detection tool alerts instead of restoring because those specific files are assigned an alert-mode policy or match memory exclude patterns, intentionally preventing automatic overwrites of unauthorized changes.