From a9232f546d5f6ea6a3fab1ef883216ee31f0affd Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Fri, 19 Jun 2026 17:30:46 -0500
Subject: [PATCH 01/12] docs: rename self-assigned CVE IDs to internal JG-ADV
 advisory format

Self-found project issues were labeled CVE-2026-001/002/003. CVEs are
issued by CNAs, not projects; the labels read as inflation to a
security-literate audience. Rename to internal advisory IDs
(JG-ADV-2026-001/002/003, numeric mapping preserved) across all docs,
and add a one-line disclaimer at first use in README.md and
THREAT_MODEL.md. Docs only; no code/logic touched.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 BENCHMARKS-03.md        |  2 +-
 BENCHMARKS-04.md        | 10 +++++-----
 CHANGELOG.md            |  4 ++--
 OWASP-MAPPING.md        |  4 ++--
 PROFESSOR_VALIDATION.md |  4 ++--
 README.md               |  6 ++++--
 THREAT_MODEL.md         | 24 +++++++++++++-----------
 red-team-report.md      |  6 +++---
 8 files changed, 32 insertions(+), 28 deletions(-)

diff --git a/BENCHMARKS-03.md b/BENCHMARKS-03.md
index aa95a90..55fe15d 100644
--- a/BENCHMARKS-03.md
+++ b/BENCHMARKS-03.md
@@ -96,7 +96,7 @@ expected-deny); safe mode ran 250 (all expected-allow, audit-only).
 ## 3. Kernel path resolution (Tier 3 — audit-only)
 
 The LSM hooks loaded in safe mode and resolved **full absolute file paths**
-(the CVE-2026-002 fix) on 6.17 — audit-only, nothing blocked. PASS.
+(the JG-ADV-2026-002 fix) on 6.17 — audit-only, nothing blocked. PASS.
 
 ---
 
diff --git a/BENCHMARKS-04.md b/BENCHMARKS-04.md
index 3846c9f..312d76f 100644
--- a/BENCHMARKS-04.md
+++ b/BENCHMARKS-04.md
@@ -7,7 +7,7 @@
 > Purpose: extend coverage into the **RHEL family** (a third, distinct kernel
 > lineage) under **SELinux Enforcing**, and validate real eBPF-LSM allow/deny
 > enforcement there. This run also **found and fixed a real fail-open bug**
-> (CVE-2026-003) — see §6 — which is itself the strongest argument that a
+> (JG-ADV-2026-003) — see §6 — which is itself the strongest argument that a
 > distro-matrix is worth running.
 
 ---
@@ -70,7 +70,7 @@ SELinux denial**, enforcing allow/deny in-kernel. Each surface: 500 operations
 
 > **2,750 enforced operations on AlmaLinux 9 / kernel 5.14 under SELinux
 > Enforcing: 0 fail-open, 0 incorrect decisions, 0 timeouts** — *after* the
-> CVE-2026-003 fix (§6). The eBPF programs verified and loaded cleanly on a third
+> JG-ADV-2026-003 fix (§6). The eBPF programs verified and loaded cleanly on a third
 > kernel lineage; SELinux and the BPF-LSM coexisted without interference.
 
 ---
@@ -78,7 +78,7 @@ SELinux denial**, enforcing allow/deny in-kernel. Each surface: 500 operations
 ## 3. Kernel path resolution (Tier 3 — audit-only)
 
 LSM hooks loaded in safe mode and resolved full absolute file paths
-(CVE-2026-002 fix) on 5.14 — audit-only, nothing blocked. PASS.
+(JG-ADV-2026-002 fix) on 5.14 — audit-only, nothing blocked. PASS.
 
 ---
 
@@ -175,7 +175,7 @@ Two reads, deliberately kept separate:
 
 ---
 
-## 7. What this run found and fixed — CVE-2026-003
+## 7. What this run found and fixed — JG-ADV-2026-003
 
 On the **first** armed run, AlmaLinux 9 / 5.14 exposed a **fail-open** in
 `socket_connect`: a *variable* fraction (~30–55% under load) of denied TCP
@@ -195,5 +195,5 @@ connects were wrongly allowed, while UDP/exec/file held at 0. Investigation
      tripped a fail-open type gate. Fixed by reading the correct width. (This bug
      was **latent on every distro** — Debian/Ubuntu merely got zero padding.)
 
-Both fixes landed (CVE-2026-003) and this run is the **post-fix re-validation**:
+Both fixes landed (JG-ADV-2026-003) and this run is the **post-fix re-validation**:
 `fail_open=0` on every surface. The distro-matrix did exactly its job.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c0b6ac0..2797050 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -124,10 +124,10 @@ Linux 6.12 host across all four validation tiers.
   log, and disclosed residual risks.
 
 ### Fixed
-- **CVE-2026-002 (Critical) — filesystem policy bypass via relative paths.**
+- **JG-ADV-2026-002 (Critical) — filesystem policy bypass via relative paths.**
   Kernel now resolves the full absolute path before the denylist check
   (`jg_read_dentry_path`, depth-12 dentry walk). Verified audit-only and armed.
-- **CVE-2026-001 (High) — execve bypass via interpreter chains.** Governed agents
+- **JG-ADV-2026-001 (High) — execve bypass via interpreter chains.** Governed agents
   are denied known interpreters (`DENY_INTERPRETER_NOT_ALLOWED`).
 - **Fail-open regression (enterprise18).** The `system_immunity` and
   "out-of-scope" ALLOW fast-paths ran *before* the gate chain, letting
diff --git a/OWASP-MAPPING.md b/OWASP-MAPPING.md
index d2a71ae..deb573f 100644
--- a/OWASP-MAPPING.md
+++ b/OWASP-MAPPING.md
@@ -79,9 +79,9 @@ can cause.
 An agent generates, modifies, or runs code/commands unsafely.
 The kernel `bprm_check_security` LSM hook denies execution of non-allowlisted
 binaries for governed agents, with interpreter-chain mitigation
-(CVE-2026-001, `DENY_INTERPRETER_NOT_ALLOWED`). Enforcement is in the kernel and
+(JG-ADV-2026-001, `DENY_INTERPRETER_NOT_ALLOWED`). Enforcement is in the kernel and
 cannot be bypassed by the agent process.
-*Evidence:* `bpf/lsm/jg_bprm_check_security.c`; `CHANGELOG.md` (CVE-2026-001);
+*Evidence:* `bpf/lsm/jg_bprm_check_security.c`; `CHANGELOG.md` (JG-ADV-2026-001);
 Tier-4 armed validation.
 
 ### ASI06 — Memory and Context Poisoning · **Out of scope**
diff --git a/PROFESSOR_VALIDATION.md b/PROFESSOR_VALIDATION.md
index 202b1f5..db67f72 100644
--- a/PROFESSOR_VALIDATION.md
+++ b/PROFESSOR_VALIDATION.md
@@ -43,7 +43,7 @@ then prints a PASS/SKIP/FAIL summary. Skipped tiers tell you what they need.
 |------|----------------|--------------|------------------|
 | **1. Build + tests** | The full automated suite passes (≈117 tests: Z3 engine, governance pipeline, 13 integration, 12 swarm-attack). | Rust (`cargo`) | No |
 | **2. Mandatory mediation** | A maximally-locked agent container (no network, read-only FS, all capabilities dropped, seccomp, socket-only) **cannot** act directly; only broker-mediated actions through Jinn Guard succeed. | Docker | No (containers) |
-| **3. Kernel path resolution** | The eBPF-LSM hooks load and resolve **full file paths** in the kernel (the CVE-2026-002 fix), in **audit-only** mode. | root + BPF-LSM + clang | **No** (audit-only) |
+| **3. Kernel path resolution** | The eBPF-LSM hooks load and resolve **full file paths** in the kernel (the JG-ADV-2026-002 fix), in **audit-only** mode. | root + BPF-LSM + clang | **No** (audit-only) |
 | **4. Kernel enforcement** | Real allow/deny across execve, TCP, UDP, file create, and file unlink. | root + `--arm` + cgroup v2 | **Only inside a dedicated test cgroup** — see below |
 
 ---
@@ -117,7 +117,7 @@ denied operation was actually denied, and every allowed operation succeeded.
   security-critical cases — resolve to full absolute paths.
 - **Interpreter chains.** An agent explicitly allowed to run an interpreter can
   invoke other tools through it; Jinn Guard denies interpreters by policy for
-  governed agents (CVE-2026-001 mitigation), but per-binary execve limits are
+  governed agents (JG-ADV-2026-001 mitigation), but per-binary execve limits are
   only as strong as the allowlist.
 - **Not independently audited; single-distribution validated (Debian).**
 
diff --git a/README.md b/README.md
index 1171d14..43b7041 100644
--- a/README.md
+++ b/README.md
@@ -246,7 +246,9 @@ Validated on three distributions / three kernel generations: **Debian 13 / kerne
 
 ## Known Limitations
 
-### Filesystem path resolution — mount boundaries (was CVE-2026-002, now fixed)
+> **Note on identifiers:** `JG-ADV-*` are internal, self-identified advisory IDs, not CVE records issued by a CNA.
+
+### Filesystem path resolution — mount boundaries (was JG-ADV-2026-002, now fixed)
 
 The BPF `inode_create`/`inode_unlink` hooks now resolve the **full absolute
 path** of a file operation in the kernel (a bounded `d_parent` walk), closing the
@@ -260,7 +262,7 @@ on a single-root install) — the security-critical cases — resolve to full
 absolute paths. Crossing mount boundaries requires path-family LSM hooks or
 `bpf_d_path` and is tracked for a future release.
 
-### Interpreter chains (CVE-2026-001, mitigated)
+### Interpreter chains (JG-ADV-2026-001, mitigated)
 
 An agent explicitly allowed to run an interpreter can invoke other tools through
 it. Jinn Guard denies known interpreters by policy for governed agents (any
diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md
index fefa7b4..b46ab3c 100644
--- a/THREAT_MODEL.md
+++ b/THREAT_MODEL.md
@@ -9,10 +9,12 @@ the code and, where possible, to an automated test or a live validation result.
 > This is a structured **self-review**, not a third-party audit. It is written to
 > be checked: a reviewer can run `scripts/run_professor_validation.sh` and map
 > each PASS back to the rows below. Independent audit remains the open item
-> (see §9). The historical white-box audit that first surfaced CVE-2026-001 and
-> CVE-2026-002 is preserved in [`red-team-report.md`](red-team-report.md); note
+> (see §9). The historical white-box audit that first surfaced JG-ADV-2026-001 and
+> JG-ADV-2026-002 is preserved in [`red-team-report.md`](red-team-report.md); note
 > that report describes an aspirational mTLS identity model — the shipped system
 > uses HMAC-SHA256 over a local Unix-domain socket, documented accurately here.
+>
+> **Note on identifiers:** `JG-ADV-*` are internal, self-identified advisory IDs, not CVE records issued by a CNA.
 
 ---
 
@@ -113,8 +115,8 @@ suite, **K** = live kernel validation (Tier 4), **D** = Docker mandatory-mediati
 | T8 | Invariant violation slips through | Z3 SMT invariants + hard global safety ceiling | STEP 12–13 | UT (Z3), IT |
 | T9 | Fail-open via "out-of-scope/immune" fast-path | Fast-paths moved **after** the full gate chain (STEP 11.5) | STEP 11.5 | IT, SW (regression fixed) |
 | T10 | Direct host action bypassing the proposal path | Kernel LSM enforces independently of user-space cooperation | 5 LSM hooks | K, D |
-| T11 | execve allowlist bypass via interpreters (CVE-2026-001) | Governed agents denied known interpreters → `DENY_INTERPRETER_NOT_ALLOWED` | `interpreter_bypass_denied()` | UT |
-| T12 | Filesystem policy bypass via relative paths (CVE-2026-002) | Kernel resolves full absolute path before the denylist check | `jg_read_dentry_path()` | AO, K |
+| T11 | execve allowlist bypass via interpreters (JG-ADV-2026-001) | Governed agents denied known interpreters → `DENY_INTERPRETER_NOT_ALLOWED` | `interpreter_bypass_denied()` | UT |
+| T12 | Filesystem policy bypass via relative paths (JG-ADV-2026-002) | Kernel resolves full absolute path before the denylist check | `jg_read_dentry_path()` | AO, K |
 | T13 | Repeat offender keeps probing | Deterministic, bounded, tighten-only risk penalty | `adaptive_risk_penalty()` (M6) | UT |
 | T14 | Mandatory mediation bypass | Locked agent: no network, RO fs, all caps dropped, seccomp, socket-only | Docker compose profile | D (7/7 probes) |
 | T15 | Audit tampering | Hash-chained audit log | governance audit log | UT |
@@ -123,9 +125,9 @@ suite, **K** = live kernel validation (Tier 4), **D** = Docker mandatory-mediati
 
 | CVE | Severity | Status | Resolution |
 |---|---|---|---|
-| **CVE-2026-002** — filesystem policy bypass via relative paths | Critical | **Fixed** | Kernel-side full-path resolution (`jg_read_dentry_path`, depth-12 dentry walk). Live-verified audit-only (Tier 3) and armed (Tier 4). Residual: sub-mount paths resolve relative to their mount root — root-fs paths (`/etc`,`/usr`,`/opt`) resolve absolutely (§7). |
-| **CVE-2026-001** — execve bypass via interpreter chains | High | **Mitigated** | Governed agents with an allowlist are denied known interpreters (`/bin/sh`, `/bin/bash`, `python`, …). Per-binary limits remain only as strong as the allowlist (§7). |
-| **CVE-2026-003** — fail-open in socket LSM enforcement (two root causes) | High | **Fixed (code); re-validation pending** | Surfaced on AlmaLinux 9 / kernel 5.14: `socket_connect` leaked a *variable* fraction of denied connects under load (a race), while UDP/exec/file held. `setenforce 0` ruled out SELinux; an **incremental standalone reproducer** (`bpf/probe/connect_min/`, branch `probe/lsm-connect-min`) isolated **two independent causes** — and proved the kernel/distro were not at fault. **(1) Load-window:** hooks were attached **before** `configure_policy()` populated the deny maps (`ipv4_denylist`, `allowed_exec_paths`, `denied_*`), so operations in that window consulted an empty policy and were ALLOWED. Fixed by **populate-then-attach** — `AyaLsmMonitor::load` loads programs *without* attaching; the new `attach_all()` runs only after `configure_policy()` (`ebpf_monitor.rs`, `main.rs`). **(2) `sock->type` width bug:** the connect/sendmsg hooks read the kernel's 2-byte `short sock->type` with `bpf_core_read(&sock_type, sizeof(int)=4, …)`, pulling 2 adjacent **padding** bytes; when non-zero, the `sock_type != STREAM/DGRAM` gate **failed OPEN**. The probe confirmed it: an address-only hook enforced 2000/2000 deterministically, and adding *only* the `sock->type` gate reintroduced 20–55% leaks. Fixed by reading into a correctly-sized `short` (`jg_socket_connect.c`, `jg_socket_sendmsg.c`). |
+| **JG-ADV-2026-002** — filesystem policy bypass via relative paths | Critical | **Fixed** | Kernel-side full-path resolution (`jg_read_dentry_path`, depth-12 dentry walk). Live-verified audit-only (Tier 3) and armed (Tier 4). Residual: sub-mount paths resolve relative to their mount root — root-fs paths (`/etc`,`/usr`,`/opt`) resolve absolutely (§7). |
+| **JG-ADV-2026-001** — execve bypass via interpreter chains | High | **Mitigated** | Governed agents with an allowlist are denied known interpreters (`/bin/sh`, `/bin/bash`, `python`, …). Per-binary limits remain only as strong as the allowlist (§7). |
+| **JG-ADV-2026-003** — fail-open in socket LSM enforcement (two root causes) | High | **Fixed (code); re-validation pending** | Surfaced on AlmaLinux 9 / kernel 5.14: `socket_connect` leaked a *variable* fraction of denied connects under load (a race), while UDP/exec/file held. `setenforce 0` ruled out SELinux; an **incremental standalone reproducer** (`bpf/probe/connect_min/`, branch `probe/lsm-connect-min`) isolated **two independent causes** — and proved the kernel/distro were not at fault. **(1) Load-window:** hooks were attached **before** `configure_policy()` populated the deny maps (`ipv4_denylist`, `allowed_exec_paths`, `denied_*`), so operations in that window consulted an empty policy and were ALLOWED. Fixed by **populate-then-attach** — `AyaLsmMonitor::load` loads programs *without* attaching; the new `attach_all()` runs only after `configure_policy()` (`ebpf_monitor.rs`, `main.rs`). **(2) `sock->type` width bug:** the connect/sendmsg hooks read the kernel's 2-byte `short sock->type` with `bpf_core_read(&sock_type, sizeof(int)=4, …)`, pulling 2 adjacent **padding** bytes; when non-zero, the `sock_type != STREAM/DGRAM` gate **failed OPEN**. The probe confirmed it: an address-only hook enforced 2000/2000 deterministically, and adding *only* the `sock->type` gate reintroduced 20–55% leaks. Fixed by reading into a correctly-sized `short` (`jg_socket_connect.c`, `jg_socket_sendmsg.c`). |
 
 ---
 
@@ -143,7 +145,7 @@ desktop). It is now addressed structurally in three layers:
    populated *before* any program attaches: `load` loads the programs and
    `attach_all` attaches them only after `configure_policy` has filled the maps,
    so a hook never enforces against an empty policy (populate-then-attach;
-   closes CVE-2026-003).
+   closes JG-ADV-2026-003).
 2. **cgroup-scoped enforcement.** Each hook calls `bpf_get_current_cgroup_id()`
    and **passes through any task not in the governed cgroup** before doing any
    work — no decision, no telemetry. The scope id is written to the map *before*
@@ -174,7 +176,7 @@ wraps armed runs in a hard 10-minute watchdog.
    — three distros and three kernel lineages, all `fail_open=0` (BENCHMARKS-01..04).
    Broader coverage (more distros/kernels, arm64) remains open.
 3. **`bpf_core_read` field-width discipline.** A `short` kernel field read into a
-   wider local caused a fail-open (CVE-2026-003, fixed). All current
+   wider local caused a fail-open (JG-ADV-2026-003, fixed). All current
    `bpf_core_read`/`bpf_probe_read_kernel` scalar reads were audited and match
    their source widths. Note: `denied_dir_inodes` keys on the low 32 bits of the
    inode (consistent on both sides); a >32-bit-inode collision would *over-block*
@@ -182,7 +184,7 @@ wraps armed runs in a hard 10-minute watchdog.
 3. **Mount-boundary path resolution.** Inode hooks have no vfsmount; a file on a
    sub-mount (e.g. a tmpfs `/tmp`) resolves relative to that mount's root.
    Root-filesystem paths — the security-critical cases — resolve absolutely.
-4. **Interpreter chains (CVE-2026-001).** An agent explicitly allowed to run an
+4. **Interpreter chains (JG-ADV-2026-001).** An agent explicitly allowed to run an
    interpreter can drive other tools through it. Mitigated by denying
    interpreters for governed agents; not eliminated.
 5. **Root-equivalent adversary is out of scope** by assumption (§3).
@@ -285,7 +287,7 @@ the same observation history always yields the same decision.
 |---|---|
 | Independent third-party security audit | External review |
 | Daemon-authoritative risk scoring (replace keyword heuristic; cf. §8) | Engineering |
-| eBPF-traced interpreter child-process attribution (close CVE-2026-001 chains) | Engineering |
+| eBPF-traced interpreter child-process attribution (close JG-ADV-2026-001 chains) | Engineering |
 | Multi-distribution / multi-kernel validation matrix | Engineering |
 | Automated HMAC key rotation | Engineering |
 | Per-agent secrets / `agent_id`↔UID binding for multi-tenant isolation (cf. §7.8) | Engineering |
diff --git a/red-team-report.md b/red-team-report.md
index f706c2f..41aa8de 100644
--- a/red-team-report.md
+++ b/red-team-report.md
@@ -23,7 +23,7 @@ This section verifies that the implemented user-space logic correctly reflects t
 
 This section details logical vulnerabilities found in the new implementation.
 
-### CVE-2026-001: Process Execution Bypass via Interpreters (Shebang Bypass)
+### JG-ADV-2026-001: Process Execution Bypass via Interpreters (Shebang Bypass)
 
 *   **Severity:** **High**
 *   **Description:** An agent can bypass `execve` restrictions on specific tools (e.g., `/usr/bin/curl`) by invoking them through an allowed interpreter (e.g., `/bin/bash`). If an agent is allowed to execute `/bin/bash`, it can run a script that internally calls any other tool.
@@ -34,7 +34,7 @@ This section details logical vulnerabilities found in the new implementation.
     4.  The kernel executes `/bin/bash`, which then executes the `curl` command. No further `execve` is triggered for `curl`, so Jinn Guard's process control is bypassed.
 *   **Mitigation:** This is a classic endpoint security challenge. A robust mitigation requires recursively inspecting script contents or monitoring for process ancestry and applying the parent's policy to child processes. For Jinn Guard, the simplest mitigation is to adopt a very restrictive `allowed_executables` policy that denies common interpreters like `/bin/bash`, `/bin/sh`, `/usr/bin/python`, etc.
 
-### CVE-2026-002: Filesystem Policy Bypass via Relative Paths
+### JG-ADV-2026-002: Filesystem Policy Bypass via Relative Paths
 
 *   **Severity:** **Critical**
 *   **Description:** The BPF hooks for filesystem operations (`inode_create`, `inode_unlink`) were implemented to only send the filename (`dentry->d_name.name`) to user-space, not the full, resolved path. The user-space policy checks for denied prefixes (e.g., `/etc/`) against only the filename.
@@ -45,7 +45,7 @@ This section details logical vulnerabilities found in the new implementation.
     4.  The daemon checks if `"new_config"` starts with `"/etc/"`. The check is false, and the write is incorrectly permitted.
 *   **Mitigation:** The BPF filesystem hooks **must** be re-written to capture the full path. This is a non-trivial task in BPF and typically requires iterating through the `dentry` parent pointers in a bounded loop. This vulnerability renders the entire filesystem enforcement feature non-functional.
 
-### CVE-2026-003: Agent Impersonation via UID Spoofing
+### JG-ADV-2026-003: Agent Impersonation via UID Spoofing
 
 *   **Severity:** **Critical**
 *   **Description:** The new mTLS identity model was implemented with a placeholder function (`get_agent_id_from_mtls_socket`) that uses the client's UID for identity. This was done for simulation purposes, but it highlights a critical implementation dependency.

From c5466eccda3ce0c03da4c5422866bbdec85ffb8d Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Fri, 19 Jun 2026 17:31:01 -0500
Subject: [PATCH 02/12] docs(readme): align headline to validation-status
 register

Title said 'Enterprise Semantic Firewall' while the validation-status
section honestly states 'not independently audited or enterprise-GA /
research prototype.' That register collision undercuts the project's
core intellectual-honesty asset. Retitle to match what the validation
section already claims. The Fleet & Enterprise feature-tier section
(feature-gated, off by default) is legitimate and left as-is.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 43b7041..91d606f 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# 🛡️ Jinn Guard — Enterprise Semantic Firewall
+# 🛡️ Jinn Guard — Kernel-level enforcement firewall for autonomous AI agents (research prototype)
 
 [![CI](https://github.com/AlphaReasoning/The-Jinn-Guard/actions/workflows/ci.yml/badge.svg)](https://github.com/AlphaReasoning/The-Jinn-Guard/actions/workflows/ci.yml)
 

From 88baf765f49b069e7d2548add62591cf6d47c436 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Fri, 19 Jun 2026 17:31:49 -0500
Subject: [PATCH 03/12] chore: mark bpf/** linguist-vendored so language bar
 reads Rust-primary

Linguist reports ~83% C because of the bpf/*.bpf.c / bpf/lsm/*.c objects,
but the project is pitched and built as Rust. Vendor the whole bpf/ tree
for language-stat purposes (source stays visible; only Linguist stats
change). GitHub re-indexes the language bar on the next push.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .gitattributes | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.gitattributes b/.gitattributes
index a440366..15fdfe1 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -14,3 +14,11 @@ jinn-guard-v1.0-review.zip export-ignore
 # Rust-dominant reality) and collapses it in diffs.
 bpf/vmlinux.h linguist-vendored
 bpf/vmlinux.h linguist-generated
+
+# Jinn Guard is pitched and built as a Rust project; the eBPF/BPF-LSM C objects
+# under bpf/ are the in-kernel enforcement layer, but by byte count they dominate
+# GitHub's language bar and misrepresent the repo as a C codebase. Mark the whole
+# bpf/ tree linguist-vendored so the language bar reflects the Rust-primary
+# reality. The source stays in the repo and fully visible — this only affects
+# Linguist's stats, and GitHub re-indexes the language bar on the next push.
+bpf/** linguist-vendored

From c8ac5b1a4a875388f22264af218def8547199588 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Fri, 19 Jun 2026 17:32:12 -0500
Subject: [PATCH 04/12] docs: add LAUNCH_CHECKLIST.md tracking launch-hygiene
 pass

Records Tasks A-D (done) and the remaining MANUAL items: re-record demo
without recorder overlay, post as native LinkedIn video with repo URL in
first comment, warm DM for AFWERX/DIU-adjacent repost.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 LAUNCH_CHECKLIST.md | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 LAUNCH_CHECKLIST.md

diff --git a/LAUNCH_CHECKLIST.md b/LAUNCH_CHECKLIST.md
new file mode 100644
index 0000000..bec8b5c
--- /dev/null
+++ b/LAUNCH_CHECKLIST.md
@@ -0,0 +1,36 @@
+# Launch Checklist
+
+Hygiene pass before the first distribution push to a security-literate audience
+(r/netsec, HN, AFWERX/DIU-adjacent). The repo's intellectual-honesty framing
+(validation-status section, `THREAT_MODEL.md`, "what it does NOT claim") is the
+core asset — everything here aligns the rest of the repo up to that bar.
+
+## Automated pass (branch `chore/launch-hygiene`)
+
+- [x] **A — Kill self-assigned CVE identifiers.** Renamed project-assigned
+      `CVE-2026-001/002/003` to internal advisory IDs `JG-ADV-2026-001/002/003`
+      (numeric mapping preserved) across all documentation, with a one-line
+      disclaimer at first use in `README.md` and `THREAT_MODEL.md`
+      ("`JG-ADV-*` are internal, self-identified advisory IDs, not CVE records
+      issued by a CNA"). Docs only — code/script comments deliberately left
+      untouched (see flag in the PR summary).
+- [x] **B — Fix the register collision.** Retitled the README headline from
+      "Enterprise Semantic Firewall" to "Kernel-level enforcement firewall for
+      autonomous AI agents (research prototype)" to match the validation-status
+      section. The Fleet & Enterprise feature-tier section (feature-gated, off by
+      default) is legitimate and left as-is.
+- [x] **C — Repo metadata.** About/description + topics command prepared (run
+      manually — `gh` not available in the working environment; exact command in
+      the PR summary).
+- [x] **D — Fix the language bar.** Marked `bpf/**` `linguist-vendored` in
+      `.gitattributes` so the language bar reads Rust-primary. GitHub re-indexes
+      on the next push.
+
+## Manual (human, not agent)
+
+- [ ] **MANUAL** — Re-record demo: screen-recorder window must never overlay
+      terminal content (currently covers the open and the closing thesis card).
+- [ ] **MANUAL** — Post demo as a **native LinkedIn video** (uploaded, not a
+      link). Put the repo URL in the **first comment**, not the post body.
+- [ ] **MANUAL** — Warm DM to a named contact for a repost into the
+      AFWERX/DIU-adjacent network.

From 803e139b0d4039bb8f3b654e998ef37b6026d8b0 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Fri, 19 Jun 2026 17:42:05 -0500
Subject: [PATCH 05/12] docs: renumber socket-LSM fail-open to JG-ADV-2026-004
 (resolve ID collision)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

JG-ADV-2026-003 ambiguously referred to two findings: 'Agent
Impersonation via UID Spoofing' (red-team-report.md, disclosed
2026-06-08) and 'socket-LSM fail-open' (THREAT_MODEL/BENCHMARKS-04,
surfaced 2026-06-14, Run 04). The newer finding takes the new number:
the socket fail-open becomes JG-ADV-2026-004; UID-spoofing keeps
JG-ADV-2026-003. CHANGELOG.md has no 003 reference; red-team-report.md
already holds 003 for UID-spoofing — both unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 BENCHMARKS-04.md | 8 ++++----
 THREAT_MODEL.md  | 6 +++---
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/BENCHMARKS-04.md b/BENCHMARKS-04.md
index 312d76f..c8e9fa5 100644
--- a/BENCHMARKS-04.md
+++ b/BENCHMARKS-04.md
@@ -7,7 +7,7 @@
 > Purpose: extend coverage into the **RHEL family** (a third, distinct kernel
 > lineage) under **SELinux Enforcing**, and validate real eBPF-LSM allow/deny
 > enforcement there. This run also **found and fixed a real fail-open bug**
-> (JG-ADV-2026-003) — see §6 — which is itself the strongest argument that a
+> (JG-ADV-2026-004) — see §6 — which is itself the strongest argument that a
 > distro-matrix is worth running.
 
 ---
@@ -70,7 +70,7 @@ SELinux denial**, enforcing allow/deny in-kernel. Each surface: 500 operations
 
 > **2,750 enforced operations on AlmaLinux 9 / kernel 5.14 under SELinux
 > Enforcing: 0 fail-open, 0 incorrect decisions, 0 timeouts** — *after* the
-> JG-ADV-2026-003 fix (§6). The eBPF programs verified and loaded cleanly on a third
+> JG-ADV-2026-004 fix (§6). The eBPF programs verified and loaded cleanly on a third
 > kernel lineage; SELinux and the BPF-LSM coexisted without interference.
 
 ---
@@ -175,7 +175,7 @@ Two reads, deliberately kept separate:
 
 ---
 
-## 7. What this run found and fixed — JG-ADV-2026-003
+## 7. What this run found and fixed — JG-ADV-2026-004
 
 On the **first** armed run, AlmaLinux 9 / 5.14 exposed a **fail-open** in
 `socket_connect`: a *variable* fraction (~30–55% under load) of denied TCP
@@ -195,5 +195,5 @@ connects were wrongly allowed, while UDP/exec/file held at 0. Investigation
      tripped a fail-open type gate. Fixed by reading the correct width. (This bug
      was **latent on every distro** — Debian/Ubuntu merely got zero padding.)
 
-Both fixes landed (JG-ADV-2026-003) and this run is the **post-fix re-validation**:
+Both fixes landed (JG-ADV-2026-004) and this run is the **post-fix re-validation**:
 `fail_open=0` on every surface. The distro-matrix did exactly its job.
diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md
index b46ab3c..25bb2a8 100644
--- a/THREAT_MODEL.md
+++ b/THREAT_MODEL.md
@@ -127,7 +127,7 @@ suite, **K** = live kernel validation (Tier 4), **D** = Docker mandatory-mediati
 |---|---|---|---|
 | **JG-ADV-2026-002** — filesystem policy bypass via relative paths | Critical | **Fixed** | Kernel-side full-path resolution (`jg_read_dentry_path`, depth-12 dentry walk). Live-verified audit-only (Tier 3) and armed (Tier 4). Residual: sub-mount paths resolve relative to their mount root — root-fs paths (`/etc`,`/usr`,`/opt`) resolve absolutely (§7). |
 | **JG-ADV-2026-001** — execve bypass via interpreter chains | High | **Mitigated** | Governed agents with an allowlist are denied known interpreters (`/bin/sh`, `/bin/bash`, `python`, …). Per-binary limits remain only as strong as the allowlist (§7). |
-| **JG-ADV-2026-003** — fail-open in socket LSM enforcement (two root causes) | High | **Fixed (code); re-validation pending** | Surfaced on AlmaLinux 9 / kernel 5.14: `socket_connect` leaked a *variable* fraction of denied connects under load (a race), while UDP/exec/file held. `setenforce 0` ruled out SELinux; an **incremental standalone reproducer** (`bpf/probe/connect_min/`, branch `probe/lsm-connect-min`) isolated **two independent causes** — and proved the kernel/distro were not at fault. **(1) Load-window:** hooks were attached **before** `configure_policy()` populated the deny maps (`ipv4_denylist`, `allowed_exec_paths`, `denied_*`), so operations in that window consulted an empty policy and were ALLOWED. Fixed by **populate-then-attach** — `AyaLsmMonitor::load` loads programs *without* attaching; the new `attach_all()` runs only after `configure_policy()` (`ebpf_monitor.rs`, `main.rs`). **(2) `sock->type` width bug:** the connect/sendmsg hooks read the kernel's 2-byte `short sock->type` with `bpf_core_read(&sock_type, sizeof(int)=4, …)`, pulling 2 adjacent **padding** bytes; when non-zero, the `sock_type != STREAM/DGRAM` gate **failed OPEN**. The probe confirmed it: an address-only hook enforced 2000/2000 deterministically, and adding *only* the `sock->type` gate reintroduced 20–55% leaks. Fixed by reading into a correctly-sized `short` (`jg_socket_connect.c`, `jg_socket_sendmsg.c`). |
+| **JG-ADV-2026-004** — fail-open in socket LSM enforcement (two root causes) | High | **Fixed (code); re-validation pending** | Surfaced on AlmaLinux 9 / kernel 5.14: `socket_connect` leaked a *variable* fraction of denied connects under load (a race), while UDP/exec/file held. `setenforce 0` ruled out SELinux; an **incremental standalone reproducer** (`bpf/probe/connect_min/`, branch `probe/lsm-connect-min`) isolated **two independent causes** — and proved the kernel/distro were not at fault. **(1) Load-window:** hooks were attached **before** `configure_policy()` populated the deny maps (`ipv4_denylist`, `allowed_exec_paths`, `denied_*`), so operations in that window consulted an empty policy and were ALLOWED. Fixed by **populate-then-attach** — `AyaLsmMonitor::load` loads programs *without* attaching; the new `attach_all()` runs only after `configure_policy()` (`ebpf_monitor.rs`, `main.rs`). **(2) `sock->type` width bug:** the connect/sendmsg hooks read the kernel's 2-byte `short sock->type` with `bpf_core_read(&sock_type, sizeof(int)=4, …)`, pulling 2 adjacent **padding** bytes; when non-zero, the `sock_type != STREAM/DGRAM` gate **failed OPEN**. The probe confirmed it: an address-only hook enforced 2000/2000 deterministically, and adding *only* the `sock->type` gate reintroduced 20–55% leaks. Fixed by reading into a correctly-sized `short` (`jg_socket_connect.c`, `jg_socket_sendmsg.c`). |
 
 ---
 
@@ -145,7 +145,7 @@ desktop). It is now addressed structurally in three layers:
    populated *before* any program attaches: `load` loads the programs and
    `attach_all` attaches them only after `configure_policy` has filled the maps,
    so a hook never enforces against an empty policy (populate-then-attach;
-   closes JG-ADV-2026-003).
+   closes JG-ADV-2026-004).
 2. **cgroup-scoped enforcement.** Each hook calls `bpf_get_current_cgroup_id()`
    and **passes through any task not in the governed cgroup** before doing any
    work — no decision, no telemetry. The scope id is written to the map *before*
@@ -176,7 +176,7 @@ wraps armed runs in a hard 10-minute watchdog.
    — three distros and three kernel lineages, all `fail_open=0` (BENCHMARKS-01..04).
    Broader coverage (more distros/kernels, arm64) remains open.
 3. **`bpf_core_read` field-width discipline.** A `short` kernel field read into a
-   wider local caused a fail-open (JG-ADV-2026-003, fixed). All current
+   wider local caused a fail-open (JG-ADV-2026-004, fixed). All current
    `bpf_core_read`/`bpf_probe_read_kernel` scalar reads were audited and match
    their source widths. Note: `denied_dir_inodes` keys on the low 32 bits of the
    inode (consistent on both sides); a >32-bit-inode collision would *over-block*

From 063b8a1720cb9230b134bca334dc2ffb16ef57c5 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Fri, 19 Jun 2026 17:42:45 -0500
Subject: [PATCH 06/12] docs: add SECURITY/ADVISORIES.md canonical advisory
 registry

Single source of truth for JG-ADV-* IDs: ID | Title | Component |
Disclosed | Status | Fix commit, one row per advisory (001-004), with
per-advisory notes. README Known Limitations now points to it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 README.md              |  2 ++
 SECURITY/ADVISORIES.md | 49 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 SECURITY/ADVISORIES.md

diff --git a/README.md b/README.md
index 91d606f..cf406b4 100644
--- a/README.md
+++ b/README.md
@@ -246,6 +246,8 @@ Validated on three distributions / three kernel generations: **Debian 13 / kerne
 
 ## Known Limitations
 
+> **Advisory registry:** the canonical list of `JG-ADV-*` IDs, status, and fix commits lives in [`SECURITY/ADVISORIES.md`](SECURITY/ADVISORIES.md).
+>
 > **Note on identifiers:** `JG-ADV-*` are internal, self-identified advisory IDs, not CVE records issued by a CNA.
 
 ### Filesystem path resolution — mount boundaries (was JG-ADV-2026-002, now fixed)
diff --git a/SECURITY/ADVISORIES.md b/SECURITY/ADVISORIES.md
new file mode 100644
index 0000000..9ab9b35
--- /dev/null
+++ b/SECURITY/ADVISORIES.md
@@ -0,0 +1,49 @@
+# Jinn Guard — Security Advisories
+
+This file is the **canonical registry** for Jinn Guard advisory identifiers.
+
+> **`JG-ADV-*` are internal, self-identified advisory IDs, not CVE records issued
+> by a CNA.** They track issues the project found in its own white-box audits and
+> validation runs. Where another document references an advisory ID, this table is
+> the source of truth for its meaning, scope, and status.
+
+| ID | Title | Component | Disclosed | Status | Fix commit |
+|---|---|---|---|---|---|
+| JG-ADV-2026-001 | execve allowlist bypass via interpreter chains | `bprm_check_security` / user-space exec policy | 2026-06-08 | Mitigated | `3abbba3` |
+| JG-ADV-2026-002 | filesystem policy bypass via relative paths | `inode_create` / `inode_unlink` (dentry path resolution) | 2026-06-08 | Fixed | `3676af7` |
+| JG-ADV-2026-003 | agent impersonation via UID spoofing | identity / authentication model | 2026-06-08 | Mitigated | — (design: HMAC-SHA256 `agent_id` auth) |
+| JG-ADV-2026-004 | fail-open in socket-LSM enforcement (two root causes) | `socket_connect` / `socket_sendmsg` | 2026-06-14 | Fixed | `6430ba9`, `b678455` |
+
+## Notes
+
+- **JG-ADV-2026-001 — interpreter chains.** A governed agent allowed to run an
+  interpreter (`/bin/bash`, `python`, …) can drive other tools through it.
+  *Mitigated:* governed agents with an executable allowlist are denied known
+  interpreters; per-binary limits remain only as strong as that allowlist. Full
+  elimination (child-process attribution) is tracked in `THREAT_MODEL.md` §10.
+
+- **JG-ADV-2026-002 — relative-path bypass.** The inode hooks originally sent only
+  the basename to user space, defeating prefix checks like `/etc/`. *Fixed* by
+  kernel-side full-path resolution (`jg_read_dentry_path`, bounded `d_parent`
+  walk). Residual: sub-mount paths resolve relative to their mount root;
+  root-filesystem paths (the security-critical cases) resolve absolutely.
+
+- **JG-ADV-2026-003 — UID spoofing.** From the historical white-box audit
+  (`red-team-report.md`), which described an aspirational mTLS identity model
+  whose placeholder derived identity from the OS UID. *Mitigated:* the shipped
+  system authenticates the OS user via `SO_PEERCRED` (unforgeable) **and** the
+  application `agent_id` via HMAC-SHA256 — identity is not taken from a spoofable
+  UID. Residual: a single shared HMAC key is not bound per-agent/UID, so a
+  principal able to read the key can sign as any `agent_id`; strong multi-tenant
+  isolation (per-agent secrets / `agent_id`↔UID binding) is tracked in
+  `THREAT_MODEL.md` §7.8 and §10.
+
+- **JG-ADV-2026-004 — socket-LSM fail-open.** Surfaced on AlmaLinux 9 / kernel
+  5.14 (Run 04): `socket_connect` leaked a variable fraction of denied connects
+  under load. Two independent root causes — a load-window race (hooks attached
+  before policy maps were populated) and a `sock->type` read-width bug (a 2-byte
+  kernel field read into a 4-byte local pulled padding that flipped a gate open).
+  *Fixed* by populate-then-attach and by reading the correct field width;
+  re-validated on the host that exposed it (0 fail-open, `BENCHMARKS-04.md` §2).
+
+_Last updated: 2026-06-19._

From 639363062e37b2c7e52a1e6aa82991796f8ce972 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Fri, 19 Jun 2026 17:43:21 -0500
Subject: [PATCH 07/12] chore: rename CVE refs to JG-ADV in code comments +
 script output strings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Comment/echo/printf strings only — no logic changed. Maps to the
renumbered scheme: interpreter -> JG-ADV-2026-001, path-resolution ->
JG-ADV-2026-002, socket fail-open -> JG-ADV-2026-004. Verified no test
or script asserts on these literals, so no output contracts break.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 bpf/lsm/jg_common.h                    | 2 +-
 bpf/lsm/jg_inode_create.c              | 2 +-
 bpf/lsm/jg_inode_unlink.c              | 2 +-
 bpf/lsm/jg_socket_connect.c            | 2 +-
 bpf/lsm/jg_socket_sendmsg.c            | 2 +-
 scripts/run_professor_validation.sh    | 2 +-
 scripts/validate_m2_path_resolution.sh | 6 +++---
 ts_cli/src/main.rs                     | 4 ++--
 8 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/bpf/lsm/jg_common.h b/bpf/lsm/jg_common.h
index 4258fd5..3b3f99d 100644
--- a/bpf/lsm/jg_common.h
+++ b/bpf/lsm/jg_common.h
@@ -232,7 +232,7 @@ static __always_inline void jg_read_dentry_basename(
 #define JG_PATH_MAX_DEPTH 12
 #define JG_PATH_COMP_LEN 40
 
-// Resolve the absolute path of `dentry` into `out` (CVE-2026-002). Two cheap
+// Resolve the absolute path of `dentry` into `out` (JG-ADV-2026-002). Two cheap
 // passes keep verifier work tiny: first collect the dentry chain leaf->root as
 // bare pointers (no string work), then write each component root->leaf with a
 // single bpf_probe_read_kernel_str per level. A guard before each write proves
diff --git a/bpf/lsm/jg_inode_create.c b/bpf/lsm/jg_inode_create.c
index 2b3d6b3..30a4cb1 100644
--- a/bpf/lsm/jg_inode_create.c
+++ b/bpf/lsm/jg_inode_create.c
@@ -87,7 +87,7 @@ int BPF_PROG(jg_inode_create, struct inode *dir, struct dentry *dentry, umode_t
 
     // Check the in-kernel denylists on the basename first (cheap, preserves the
     // existing synchronous enforcement), then resolve the full path for the
-    // user-space request below (CVE-2026-002).
+    // user-space request below (JG-ADV-2026-002).
     jg_read_dentry_basename(dentry, resource_path, sizeof(resource_path));
     int decision = (jg_inode_dir_denied(dir) || jg_inode_basename_denied(resource_path))
         ? -JG_EPERM
diff --git a/bpf/lsm/jg_inode_unlink.c b/bpf/lsm/jg_inode_unlink.c
index 13da31e..d4ef3c5 100644
--- a/bpf/lsm/jg_inode_unlink.c
+++ b/bpf/lsm/jg_inode_unlink.c
@@ -82,7 +82,7 @@ int BPF_PROG(jg_inode_unlink, struct inode *dir, struct dentry *dentry) {
 
     // Check the in-kernel denylists on the basename first (cheap, preserves the
     // existing synchronous enforcement), then resolve the full path for the
-    // user-space request below (CVE-2026-002).
+    // user-space request below (JG-ADV-2026-002).
     jg_read_dentry_basename(dentry, resource_path, sizeof(resource_path));
     int decision = (jg_inode_dir_denied(dir) || jg_inode_basename_denied(resource_path))
         ? -JG_EPERM
diff --git a/bpf/lsm/jg_socket_connect.c b/bpf/lsm/jg_socket_connect.c
index 1f90381..eec4126 100644
--- a/bpf/lsm/jg_socket_connect.c
+++ b/bpf/lsm/jg_socket_connect.c
@@ -49,7 +49,7 @@ int BPF_PROG(jg_socket_connect, struct socket *sock, struct sockaddr *address, i
     // `struct socket.type` is a 2-byte `short`. Reading it into a 4-byte int and
     // copying sizeof(int)=4 bytes pulls in 2 adjacent padding bytes; when those
     // are non-zero, sock_type != SOCK_STREAM/SOCK_DGRAM and the gate below would
-    // fail OPEN (allow). Match the field width exactly. (CVE-2026-003)
+    // fail OPEN (allow). Match the field width exactly. (JG-ADV-2026-004)
     short sock_type = 0;
     __u16 family = 0;
 
diff --git a/bpf/lsm/jg_socket_sendmsg.c b/bpf/lsm/jg_socket_sendmsg.c
index 53bfdab..e93d00e 100644
--- a/bpf/lsm/jg_socket_sendmsg.c
+++ b/bpf/lsm/jg_socket_sendmsg.c
@@ -49,7 +49,7 @@ int BPF_PROG(jg_socket_sendmsg, struct socket *sock, struct msghdr *msg, int siz
     // `struct socket.type` is a 2-byte `short`; reading sizeof(int)=4 bytes pulls
     // in adjacent padding and can make the gate below fail OPEN. Match the field
     // width exactly. Latent here (UDP sockets happened to zero-pad), real on
-    // socket_connect. (CVE-2026-003)
+    // socket_connect. (JG-ADV-2026-004)
     short sock_type = 0;
     struct sockaddr *address = 0;
     __u16 family = 0;
diff --git a/scripts/run_professor_validation.sh b/scripts/run_professor_validation.sh
index a24960f..c76bd73 100755
--- a/scripts/run_professor_validation.sh
+++ b/scripts/run_professor_validation.sh
@@ -126,7 +126,7 @@ elif [[ $HAS_BPFLSM -eq 0 || $HAS_CLANG -eq 0 ]]; then
 else
   c_info "Loading the LSM hooks in safe mode and confirming full-path resolution..."
   if bash scripts/validate_m2_path_resolution.sh >/tmp/jg-prof-m2.log 2>&1; then
-    c_ok "kernel resolves full file paths (CVE-2026-002 fix) — audit-only, nothing blocked"
+    c_ok "kernel resolves full file paths (JG-ADV-2026-002 fix) — audit-only, nothing blocked"
     mark T3 PASS
   else
     c_fail "audit-only path-resolution validation did not pass; see /tmp/jg-prof-m2.log"
diff --git a/scripts/validate_m2_path_resolution.sh b/scripts/validate_m2_path_resolution.sh
index 8389de6..3ce2352 100755
--- a/scripts/validate_m2_path_resolution.sh
+++ b/scripts/validate_m2_path_resolution.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 #
-# validate_m2_path_resolution.sh — AUDIT-ONLY validation for M2 (CVE-2026-002).
+# validate_m2_path_resolution.sh — AUDIT-ONLY validation for M2 (JG-ADV-2026-002).
 #
 # WHAT THIS DOES, IN PLAIN WORDS:
 #   It loads the Jinn Guard kernel programs in SAFE MODE (audit-only). In safe
@@ -207,7 +207,7 @@ for _ in $(seq 1 50); do
   sleep 0.2
 done
 
-echo "Multi-level resolution (the CVE-2026-002 fix):"
+echo "Multi-level resolution (the JG-ADV-2026-002 fix):"
 if (( nested_ok )); then
   ok "resolved the full nested chain: ...$NESTED_SUFFIX"
   grep -F "$NESTED_SUFFIX" "$LOG" | grep -iE "resource=|Target:" | head -4
@@ -227,7 +227,7 @@ echo
 if (( nested_ok )); then
   printf '\033[1;32m############################################################\n'
   printf '#  M2 PASS — full multi-level path resolution works.        #\n'
-  printf '#  CVE-2026-002 (basename-only blindness) is closed.        #\n'
+  printf '#  JG-ADV-2026-002 (basename-only blindness) is closed.        #\n'
   if (( rootfs_ok )); then
   printf '#  Absolute paths on the root filesystem resolve fully.     #\n'
   fi
diff --git a/ts_cli/src/main.rs b/ts_cli/src/main.rs
index db3c4d5..05da69d 100644
--- a/ts_cli/src/main.rs
+++ b/ts_cli/src/main.rs
@@ -725,7 +725,7 @@ pub(crate) fn intent_is_dangerous(intent: &str) -> bool {
 }
 
 // ---------------------------------------------------------------------------
-// Interpreter-bypass mitigation (M4 / CVE-2026-001).
+// Interpreter-bypass mitigation (M4 / JG-ADV-2026-001).
 //
 // An agent permitted to run one binary can smuggle arbitrary execution through
 // an interpreter (sh -c, python -c, etc.). On the broker/proposal path we have
@@ -3930,7 +3930,7 @@ mod adaptive_floor_tests {
     }
 }
 
-/// Interpreter-bypass mitigation (M4 / CVE-2026-001).
+/// Interpreter-bypass mitigation (M4 / JG-ADV-2026-001).
 #[cfg(test)]
 mod interpreter_bypass_tests {
     use super::{interpreter_bypass_denied, AgentNodePolicy};

From 70cdf0d940267239ef05dfef3a9ab15924636569 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Fri, 19 Jun 2026 17:44:03 -0500
Subject: [PATCH 08/12] docs(readme): soften line-7 overclaim to defensible
 wording
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace 'guarantee absolute zero-trust process isolation and immutable
anti-replay protection across the entire host subsystem' with 'enforce
zero-trust process isolation and anti-replay protection for governed
cgroups' — aligns with the cgroup-scoped enforcement described in the
validation-status and Known Limitations sections. No new claims.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index cf406b4..42cc30d 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 
 **Jinn Guard** is an asynchronous, kernel-aware semantic firewall designed to enforce mathematical safety constraints on autonomous AI agents before any tool execution is permitted. It intercepts high-level natural language intents and processes them through a lifetime-anchored **Z3 SMT solver pipeline** — verifying state transitions and risk ceilings against formalized compliance models before granting or denying execution authority.
 
-Operating locally over high-throughput **UNIX domain sockets** on AlphaOS, the platform binds user-space proxy validation with low-level **eBPF kernel telemetry** and namespace tracking to guarantee absolute zero-trust process isolation and immutable anti-replay protection across the entire host subsystem.
+Operating locally over high-throughput **UNIX domain sockets** on AlphaOS, the platform binds user-space proxy validation with low-level **eBPF kernel telemetry** and namespace tracking to enforce zero-trust process isolation and anti-replay protection for governed cgroups.
 
 > ### ▶️ See it live in 5 minutes
 > ```bash

From 433a96dfbd4e800c5af66f044ec12e76a7bc8123 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Fri, 19 Jun 2026 17:44:44 -0500
Subject: [PATCH 09/12] docs(checklist): reformat CVE strings as explicit
 rename record

Show the CVE -> JG-ADV mappings as a rename record, including the
003 collision split (socket fail-open renumbered to JG-ADV-2026-004),
and point to SECURITY/ADVISORIES.md as the canonical registry.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 LAUNCH_CHECKLIST.md | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/LAUNCH_CHECKLIST.md b/LAUNCH_CHECKLIST.md
index bec8b5c..44dd302 100644
--- a/LAUNCH_CHECKLIST.md
+++ b/LAUNCH_CHECKLIST.md
@@ -7,13 +7,20 @@ core asset — everything here aligns the rest of the repo up to that bar.
 
 ## Automated pass (branch `chore/launch-hygiene`)
 
-- [x] **A — Kill self-assigned CVE identifiers.** Renamed project-assigned
-      `CVE-2026-001/002/003` to internal advisory IDs `JG-ADV-2026-001/002/003`
-      (numeric mapping preserved) across all documentation, with a one-line
-      disclaimer at first use in `README.md` and `THREAT_MODEL.md`
-      ("`JG-ADV-*` are internal, self-identified advisory IDs, not CVE records
-      issued by a CNA"). Docs only — code/script comments deliberately left
-      untouched (see flag in the PR summary).
+- [x] **A — Kill self-assigned CVE identifiers.** Renamed project-assigned CVE
+      identifiers to internal `JG-ADV-*` advisory IDs across docs and (in the
+      follow-up pass) code comments + script output strings. Rename record:
+      - `CVE-2026-001` -> `JG-ADV-2026-001` (execve interpreter-chain bypass)
+      - `CVE-2026-002` -> `JG-ADV-2026-002` (filesystem relative-path bypass)
+      - `CVE-2026-003` -> `JG-ADV-2026-003` (agent impersonation / UID spoofing)
+      - `CVE-2026-003` -> `JG-ADV-2026-004` (socket-LSM fail-open — renumbered to
+        resolve the duplicate-`003` collision; the newer finding takes the new
+        number)
+
+      A one-line disclaimer was added at first use in `README.md` and
+      `THREAT_MODEL.md` ("`JG-ADV-*` are internal, self-identified advisory IDs,
+      not CVE records issued by a CNA"). Canonical registry:
+      [`SECURITY/ADVISORIES.md`](SECURITY/ADVISORIES.md).
 - [x] **B — Fix the register collision.** Retitled the README headline from
       "Enterprise Semantic Firewall" to "Kernel-level enforcement firewall for
       autonomous AI agents (research prototype)" to match the validation-status

From 930e2ad76f39ea4c570de00c162a4c3119984a5d Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Fri, 19 Jun 2026 18:26:59 -0500
Subject: [PATCH 10/12] docs: best-practice consistency cleanups on
 launch-hygiene flags
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- README: drop inaccurate 'on AlphaOS' (validated on Debian/Ubuntu/AlmaLinux)
- THREAT_MODEL CVE log: reconcile JG-ADV-2026-004 status to
  'Fixed (re-validated on AlmaLinux 9 / 5.14, Run 04)' per BENCHMARKS-04 §2
- THREAT_MODEL CVE log: add the missing JG-ADV-2026-003 (UID spoofing) row
  for parity with SECURITY/ADVISORIES.md
- re-align the ASCII box border in validate_m2_path_resolution.sh after the
  longer JG-ADV identifier (cosmetic)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 README.md                              | 2 +-
 THREAT_MODEL.md                        | 3 ++-
 scripts/validate_m2_path_resolution.sh | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 42cc30d..77becfd 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 
 **Jinn Guard** is an asynchronous, kernel-aware semantic firewall designed to enforce mathematical safety constraints on autonomous AI agents before any tool execution is permitted. It intercepts high-level natural language intents and processes them through a lifetime-anchored **Z3 SMT solver pipeline** — verifying state transitions and risk ceilings against formalized compliance models before granting or denying execution authority.
 
-Operating locally over high-throughput **UNIX domain sockets** on AlphaOS, the platform binds user-space proxy validation with low-level **eBPF kernel telemetry** and namespace tracking to enforce zero-trust process isolation and anti-replay protection for governed cgroups.
+Operating locally over high-throughput **UNIX domain sockets**, the platform binds user-space proxy validation with low-level **eBPF kernel telemetry** and namespace tracking to enforce zero-trust process isolation and anti-replay protection for governed cgroups.
 
 > ### ▶️ See it live in 5 minutes
 > ```bash
diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md
index 25bb2a8..3c0d958 100644
--- a/THREAT_MODEL.md
+++ b/THREAT_MODEL.md
@@ -127,7 +127,8 @@ suite, **K** = live kernel validation (Tier 4), **D** = Docker mandatory-mediati
 |---|---|---|---|
 | **JG-ADV-2026-002** — filesystem policy bypass via relative paths | Critical | **Fixed** | Kernel-side full-path resolution (`jg_read_dentry_path`, depth-12 dentry walk). Live-verified audit-only (Tier 3) and armed (Tier 4). Residual: sub-mount paths resolve relative to their mount root — root-fs paths (`/etc`,`/usr`,`/opt`) resolve absolutely (§7). |
 | **JG-ADV-2026-001** — execve bypass via interpreter chains | High | **Mitigated** | Governed agents with an allowlist are denied known interpreters (`/bin/sh`, `/bin/bash`, `python`, …). Per-binary limits remain only as strong as the allowlist (§7). |
-| **JG-ADV-2026-004** — fail-open in socket LSM enforcement (two root causes) | High | **Fixed (code); re-validation pending** | Surfaced on AlmaLinux 9 / kernel 5.14: `socket_connect` leaked a *variable* fraction of denied connects under load (a race), while UDP/exec/file held. `setenforce 0` ruled out SELinux; an **incremental standalone reproducer** (`bpf/probe/connect_min/`, branch `probe/lsm-connect-min`) isolated **two independent causes** — and proved the kernel/distro were not at fault. **(1) Load-window:** hooks were attached **before** `configure_policy()` populated the deny maps (`ipv4_denylist`, `allowed_exec_paths`, `denied_*`), so operations in that window consulted an empty policy and were ALLOWED. Fixed by **populate-then-attach** — `AyaLsmMonitor::load` loads programs *without* attaching; the new `attach_all()` runs only after `configure_policy()` (`ebpf_monitor.rs`, `main.rs`). **(2) `sock->type` width bug:** the connect/sendmsg hooks read the kernel's 2-byte `short sock->type` with `bpf_core_read(&sock_type, sizeof(int)=4, …)`, pulling 2 adjacent **padding** bytes; when non-zero, the `sock_type != STREAM/DGRAM` gate **failed OPEN**. The probe confirmed it: an address-only hook enforced 2000/2000 deterministically, and adding *only* the `sock->type` gate reintroduced 20–55% leaks. Fixed by reading into a correctly-sized `short` (`jg_socket_connect.c`, `jg_socket_sendmsg.c`). |
+| **JG-ADV-2026-003** — agent impersonation via UID spoofing | Critical | **Mitigated** | Identity is authenticated as the OS user via `SO_PEERCRED` (unforgeable) **and** the application `agent_id` via HMAC-SHA256 — not a spoofable UID, closing the placeholder identity model from [`red-team-report.md`](red-team-report.md). Residual: a single shared HMAC key is not bound per-agent/UID, so any principal able to read the key can sign as any `agent_id`; per-agent secrets / `agent_id`↔UID binding tracked in §7.8 and §10. |
+| **JG-ADV-2026-004** — fail-open in socket LSM enforcement (two root causes) | High | **Fixed (re-validated on AlmaLinux 9 / 5.14, Run 04)** | Surfaced on AlmaLinux 9 / kernel 5.14: `socket_connect` leaked a *variable* fraction of denied connects under load (a race), while UDP/exec/file held. `setenforce 0` ruled out SELinux; an **incremental standalone reproducer** (`bpf/probe/connect_min/`, branch `probe/lsm-connect-min`) isolated **two independent causes** — and proved the kernel/distro were not at fault. **(1) Load-window:** hooks were attached **before** `configure_policy()` populated the deny maps (`ipv4_denylist`, `allowed_exec_paths`, `denied_*`), so operations in that window consulted an empty policy and were ALLOWED. Fixed by **populate-then-attach** — `AyaLsmMonitor::load` loads programs *without* attaching; the new `attach_all()` runs only after `configure_policy()` (`ebpf_monitor.rs`, `main.rs`). **(2) `sock->type` width bug:** the connect/sendmsg hooks read the kernel's 2-byte `short sock->type` with `bpf_core_read(&sock_type, sizeof(int)=4, …)`, pulling 2 adjacent **padding** bytes; when non-zero, the `sock_type != STREAM/DGRAM` gate **failed OPEN**. The probe confirmed it: an address-only hook enforced 2000/2000 deterministically, and adding *only* the `sock->type` gate reintroduced 20–55% leaks. Fixed by reading into a correctly-sized `short` (`jg_socket_connect.c`, `jg_socket_sendmsg.c`). |
 
 ---
 
diff --git a/scripts/validate_m2_path_resolution.sh b/scripts/validate_m2_path_resolution.sh
index 3ce2352..e4f56f1 100755
--- a/scripts/validate_m2_path_resolution.sh
+++ b/scripts/validate_m2_path_resolution.sh
@@ -227,7 +227,7 @@ echo
 if (( nested_ok )); then
   printf '\033[1;32m############################################################\n'
   printf '#  M2 PASS — full multi-level path resolution works.        #\n'
-  printf '#  JG-ADV-2026-002 (basename-only blindness) is closed.        #\n'
+  printf '#  JG-ADV-2026-002 (basename-only blindness) is closed.     #\n'
   if (( rootfs_ok )); then
   printf '#  Absolute paths on the root filesystem resolve fully.     #\n'
   fi

From 3c7530cb0c123d10986f6878d3038687189eca71 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Fri, 19 Jun 2026 18:34:20 -0500
Subject: [PATCH 11/12] =?UTF-8?q?docs(bench):=20add=20Run=2005=20=E2=80=94?=
 =?UTF-8?q?=20launch-hygiene=20userspace=20re-validation?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Full automated suite + userspace benchmarks re-run on the branch after
the docs/comment-only hygiene pass, on the same CPU/distro/kernel as
Run 01 (Ryzen 5 7520U / Debian 13 / 6.12). 116/116 green, 0 fail-open in
the adversarial suite, P50 259us (vs Run 01's 257us), peak ~6,208 RPS,
0 errors. Kernel Tier 4 not run on this unprivileged sandbox (see
Runs 01-04). Confirms the hygiene changes altered nothing operational.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 BENCHMARKS-05.md | 139 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 139 insertions(+)
 create mode 100644 BENCHMARKS-05.md

diff --git a/BENCHMARKS-05.md b/BENCHMARKS-05.md
new file mode 100644
index 0000000..7e96763
--- /dev/null
+++ b/BENCHMARKS-05.md
@@ -0,0 +1,139 @@
+# Jinn Guard — Benchmark Run 05
+
+**Test #:** 05 (launch-hygiene re-validation) · **Run date:** 2026-06-19
+**Branch:** `chore/launch-hygiene` · **Host:** local dev sandbox (`jinn-dev`)
+**See also:** [`BENCHMARKS-01.md`](BENCHMARKS-01.md) · [`BENCHMARKS-02.md`](BENCHMARKS-02.md) · [`BENCHMARKS-03.md`](BENCHMARKS-03.md) · [`BENCHMARKS-04.md`](BENCHMARKS-04.md)
+
+> Purpose: re-run the full **userspace** test + benchmark suite after the
+> launch-hygiene pass (advisory-ID rename, README register fix, doc cleanups —
+> all docs/comments, **no logic**) to confirm behavior and performance are
+> unchanged. This host runs the **same CPU family and kernel** as Run 01
+> (AMD Ryzen 5 7520U / Debian 13 / kernel 6.12), so the numbers are directly
+> comparable to that baseline.
+
+---
+
+## Environment
+
+| | |
+|---|---|
+| CPU | **AMD Ryzen 5 7520U** (8 threads, scaling ~83%, max 4.38 GHz) — same model as Run 01 |
+| Distribution | **Debian 13** (trixie family) |
+| Kernel | **Linux 6.12.90+deb13.1-amd64** |
+| RAM | ~5.75 GiB |
+| `/tmp` | **tmpfs** — audit log + lineage are CPU-isolated from disk-fsync latency (as in Run 03/04) |
+| Toolchain | rustc/cargo **1.95.0**, release profile, clang 19 |
+| Privilege | **uid 1000, no `bpftool`** → kernel-LSM Tier 4 (armed allow/deny) **not run here** |
+
+> **Scope note.** Kernel in-kernel allow/deny enforcement (Tier 4) requires root +
+> BPF load and is **not** exercised on this unprivileged sandbox. It is already
+> validated on three real hosts in [`BENCHMARKS-01..04`](BENCHMARKS-04.md)
+> (Debian 6.12, Ubuntu 6.17, AlmaLinux 5.14 — 2,500–2,750 ops, 0 fail-open).
+> This run covers the **full automated suite + userspace performance**.
+
+---
+
+## 1. Full automated test suite
+
+`cargo test --workspace --release`:
+
+| Binary | Result |
+|---|---|
+| `ts_checker` (Z3 SMT) | 4 passed |
+| `ts_cli` unit | 87 passed |
+| `integration` | 13 passed |
+| `swarm_attack` (adversarial) | 12 passed |
+| `kernel_lsm` (Tier 4) | 6 **ignored** (env-gated: needs root + BPF) |
+
+> **116 passed · 0 failed · 6 ignored** (122 defined). Identical pass profile to
+> Run 04. The launch-hygiene changes did not alter any behavior.
+
+## 2. Attack resistance (adversarial suite)
+
+`swarm_attack`: **12/12 passed, 0 fail-open** — replay storm, signature forgery,
+intent injection, quota abuse, anonymous flood, impersonation, path traversal,
+forged delegation, bad-protocol, and the all-at-once mixed assault.
+
+---
+
+## 3. Userspace latency & throughput (`cargo bench --bench stress_bench`)
+
+### Single-client latency (10,000 sequential, full decision pipeline)
+
+| Percentile | Run 05 (Ryzen 5 7520U) | Run 01 baseline (same CPU) |
+|---|---|---|
+| P50 | **259 µs** | 257 µs |
+| P75 | 304 µs | — |
+| P90 | 435 µs | — |
+| P95 | **533 µs** | 366 µs |
+| P99 | **782 µs** | 463 µs |
+| P99.9 | 1,243 µs | — |
+| Max | 2,962 µs | 1,900 µs |
+| Single-client RPS | **~3,219** | ~3,640 |
+
+> P50 matches Run 01 to within noise (259 vs 257 µs). Tail percentiles (P95/P99)
+> are higher here — this is a **shared, non-CPU-isolated sandbox** at ~83% scaling,
+> not a dedicated host, so tail latency is noisier. The median (the pipeline's
+> real cost) is unchanged.
+
+### Concurrent throughput (tmpfs `/tmp`; 0 errors at every level)
+
+| Agents | Total RPS | P50 | P95 | Errors |
+|---|---:|---:|---:|---:|
+| 10 | **6,208** | 1,220 µs | 1,874 µs | 0 |
+| 50 | 6,055 | 1,220 µs | 2,432 µs | 0 |
+| 100 | 6,159 | 1,233 µs | 2,535 µs | 0 |
+| 500 | 5,741 | 1,252 µs | 37,107 µs | 0 |
+
+> Peak **~6,208 RPS**, flat to 100 concurrent agents, **0 errors** throughout.
+> At 500 agents throughput holds but the P95 tail balloons (scheduling
+> congestion on 8 threads) — consistent with Run 01 (~6,500 peak).
+
+### Mixed allow/deny (70/30)
+
+5,000 requests → **3,500 allow / 1,500 deny classified correctly, 0
+misclassifications** (~3,517 RPS).
+
+### Saturation sweep
+
+| Threads | RPS | P99 |
+|---|---:|---:|
+| 2 | 4,556 | 1 ms |
+| 4 | 4,809 | 1 ms |
+| 8 | 5,111 | 2 ms |
+| 16 | 4,781 | 5 ms |
+| 32 | 4,888 | 9 ms |
+| 64 | **saturated** (P99 > 10 ms) | — |
+
+---
+
+## 4. Component micro-benchmarks (criterion)
+
+| Path | Median | Throughput |
+|---|---:|---:|
+| Core decision pipeline (in-process) | **73.2 µs** | ~13.6 K/s |
+| UDS framed roundtrip (persistent conn) | **16.2 µs** | ~61.6 K/s |
+| End-to-end serial roundtrip (new conn/request) | **151.1 µs** | ~6.6 K/s |
+
+> The UDS transport (~16 µs) is a small fraction of the full decision (~73 µs+);
+> the pipeline, not the socket, dominates. *(The persistent-connection case in
+> `socket_throughput` hit a `BrokenPipe` in the bench harness mid-run — a
+> harness-robustness quirk, not a daemon fault; the e2e new-connection figure
+> above completed cleanly.)*
+
+---
+
+## 5. Scope & honesty notes
+
+- Userspace only; **kernel Tier 4 not run on this unprivileged sandbox** — see
+  Runs 01–04 for live in-kernel enforcement.
+- Shared sandbox at ~83% CPU scaling: treat **P50/medians** as representative and
+  **tails** as noisier than a dedicated host would show.
+- Still a validated research prototype / controlled-pilot MVP, not independently
+  audited. See [`THREAT_MODEL.md`](THREAT_MODEL.md) and
+  [`SECURITY/ADVISORIES.md`](SECURITY/ADVISORIES.md).
+
+**Bottom line:** post-launch-hygiene, the suite is **116/116 green (0 fail-open
+in the adversarial suite)** and userspace performance is in line with the Run 01
+baseline on identical silicon — confirming the docs/comment-only hygiene pass
+changed nothing operational.

From 5a9df37b51d3f197e40481a17d5b02623d9fae1c Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Sat, 20 Jun 2026 10:48:00 -0500
Subject: [PATCH 12/12] docs(readme): tighten H1 to 'kernel-enforced semantic
 firewall'; add C/Rust language-bar note; align qualifier to validation
 section

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 README.md | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 77becfd..d63fff0 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# 🛡️ Jinn Guard — Kernel-level enforcement firewall for autonomous AI agents (research prototype)
+# 🛡️ Jinn Guard — Kernel-enforced semantic firewall for autonomous AI agents (validated research prototype)
 
 [![CI](https://github.com/AlphaReasoning/The-Jinn-Guard/actions/workflows/ci.yml/badge.svg)](https://github.com/AlphaReasoning/The-Jinn-Guard/actions/workflows/ci.yml)
 
@@ -170,6 +170,12 @@ Kernel Layer (eBPF)
                                         └─→ governance loop (telemetry feed)
 ```
 
+> **A note on languages.** The probes in `bpf/` are C — small, separately-compiled
+> eBPF programs loaded into the kernel. The governance core (the daemon, the Z3
+> verification pipeline, the policy engine, and the CLI) is **Rust**, under `ts_cli/`.
+> `bpf/**` is marked `linguist-vendored`, so GitHub's language bar reflects the Rust
+> core rather than the volume of low-level kernel C.
+
 ---
 
 ## 📦 Components