Monitors coding-agent activity locally on an endpoint without requiring a cloud service. It combines hooks, OTLP logs, and session artifacts into a common event format and applies local CEL rules for alerts, forensic timelines, and supported pre-action blocking.