Implement eBPF collection for execve/openat/unlink/connect/fork, three-agent sandbox and replay, PID-tree attribution, four detection rules, SQLite storage, FastAPI dashboard, prompt-to-syscall correlation, 12-scenario evaluation and documentation. Add BSD-3-Clause license, AI usage disclosure, third-party notices and submission checklist.