agent-gorgon

# agent-gorgon

agent-gorgon is a user-space runtime policy guard for autonomous agent processes. The installed
commands are `agent-gorgon` and `agent-gorgon-forensic`; `agent-warden` aliases remain supported.

Use this repo when you need to:
- launch an agent command under observation, or observe available process, file, and network
  signals after an agent starts
- classify observed runtime behavior into SAFE, FLAG, HALT, or KILL
- generate forensic evidence after a policy incident

Primary commands:
- First run, launch and watch: `agent-gorgon run --audit-only --scope coding-agent -- <command...>`
- Safe calibration against a running process: `agent-gorgon --scope starter --agent-pid 12345 --poll 0.5 --no-llm --audit-only`
- Active controls after policy review: `agent-gorgon --scope scope.yaml --agent-pid 12345 --poll 0.5 --no-llm`
- `agent-gorgon-forensic --last-hours 24`

Outputs:
- runtime verdicts
- attempted process-control decisions and their recorded outcomes
- incident artifacts and forensic summaries

Do not use this repo as:
- a kernel sandbox
- a prompt injection detector
- a guarantee that one policy scope safely covers every deployment
- complete attribution, complete OS visibility, or pre-execution interception

## About Hermes Labs

Hermes Labs is an agentic infrastructure company building the reliability layer for autonomous systems.
More at [hermes-labs.ai](https://hermes-labs.ai).