forkit-ai-footprints 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Forkit Dev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/PRIVACY.md

@@ -0,0 +1,150 @@
+# Privacy Boundary
+
+Forkit AI Footprints (`forkit-ai-footprints`) is metadata-only by design.
+
+## Allowed local reads
+
+- local operating-system and Node version metadata;
+- the macOS Computer Name for display and storage only in the private local
+  device journal;
+- process name and command metadata held only long enough to classify explicit
+  executable, module, or package-runner evidence; raw commands are not included
+  in the report or in the evidence hash;
+- cumulative CPU time, current CPU percentage, and resident memory for supported
+  process trees, held locally for repeated activity classification; raw process
+  entries are never exported;
+- directory entries and file metadata for supported model extensions;
+- loopback runtime API responses from explicitly supported local endpoints.
+- known AI-tool installation/configuration path existence;
+- local runtime, model, AI-app, and AI-tool display names in the interactive
+  loopback UI; an explicitly created local share image may include only the
+  supported active tool product name, while model names and all item names are
+  excluded from saved HTML and anonymous/global payloads;
+- optional chat/workspace labels supplied explicitly by a cooperating app for
+  local display only; absent cooperation, the fields remain empty;
+- macOS major version, CPU architecture, and Node major in aggregate field-test
+  results;
+- aggregate counts, exact recognized model-file bytes, architecture, Node major, product version,
+  and scan date in an explicitly saved local HTML share page;
+- up to 1 MiB from a known MCP JSON/TOML configuration file solely to count
+  server entries.
+
+## Prohibited collection or export
+
+Census must not retain or emit:
+
+- raw process commands;
+- process IDs;
+- model weights or file contents;
+- full filesystem paths;
+- prompts, responses, terminal logs, or source-code content;
+- credentials, cookies, tokens, API keys, or passwords;
+- hostname or Mac display name in Census reports, saved share pages, anonymous
+  contributions, or global payloads; username, email, and Forkit.dev account
+  identity are prohibited everywhere.
+- MCP server names, commands, URLs, environment keys, or environment values;
+- chat, workspace, or repository names in reports, saved/shareable artifacts,
+  contribution previews, or global payloads.
+
+## Network boundary
+
+Census may call HTTP(S) endpoints only when the hostname is one of:
+
+- `localhost`
+- `127.0.0.1`
+- `::1`
+
+Remote endpoints and endpoints containing embedded credentials are rejected.
+Census contains no Forkit.dev login, registry-write, passport-publish,
+Runtime_C2-write, billing, telemetry-upload, or deployment client.
+
+`forkit-ai-footprints serve` binds only to `127.0.0.1`. Its rescan route
+requires the same page origin and a random in-memory session token. The route
+may return local runtime, model, AI-app, and AI-tool display names to that
+protected local page. It never returns full paths, raw commands, endpoints,
+configuration values, prompts, chat titles, workspace names, or account data.
+The numeric guess is compared inside the browser and is not submitted to the
+local server. Start, Stop, Clear history, Scan again, and contribution preview
+all require the same-origin random session token. Closing a browser or native
+window does not stop monitoring; native Quit stops the monitor and local service.
+
+The interactive app keeps `device-journal.json` under the user's macOS
+Application Support directory with directory mode `0700` and file mode `0600`.
+It contains only the sanitized Mac display name, first/last scan timestamps, and
+scan count. It is never placed in the Census report, rescan snapshot, share
+image, saved share page, or anonymous/global contribution. The local monitor
+stream is same-origin and session-token protected. Sampling runs at a one-second
+target interval; durations exclude stopped time and gaps longer than three
+intervals. The stream makes no external request.
+
+The packaged app uses a native launcher to query Apple DeviceCheck capability.
+The status check makes no network request and writes no key. On a future
+supported, signed macOS 27+ build, a separate explicit enrollment action may
+generate one App Attest key and store only its opaque key identifier in the
+device-only Keychain. The current UI and CLI do not invoke enrollment,
+attestation, assertion generation, or upload.
+
+## Filesystem identity
+
+Filesystem model identity is derived from metadata such as relative location,
+name, size, and modification time. The absolute path participates only inside a
+local one-way root fingerprint helper and is not included in a Census Report.
+Model bytes are never read for hashing.
+
+## Model storage measurement
+
+Storage is the exact logical byte total (`stat.size`) of recognized model files
+inside the supported or explicitly selected roots when the scan reports
+`storage_complete=true`. Device/inode identity prevents the same file from being
+counted twice through hard links, symlinks, or overlapping roots. Provider API
+size fields are excluded from the total to avoid double-counting the same model.
+This is not APFS physical allocation: clones, compression, filesystem metadata,
+and unsupported model locations can make actual disk blocks differ.
+
+## Resource evidence
+
+**Working now** requires sustained cumulative CPU-time deltas across repeated
+samples of a supported process tree. Two positive samples enter working and
+three negative samples exit it. Process presence alone remains **Open / idle**.
+This is still not exclusive per-prompt proof. Forkit's own process tree is
+excluded from AI activity and measured separately for CPU, RAM, and bounded
+history overhead. Static hardware metadata describes capability, not use. GPU
+and per-process network attribution remain unavailable; no estimate is used.
+
+## Review rule
+
+Runtime, model, and agent findings are inventory suggestions. They must not be
+used as automatic evidence of ownership, safety, provenance, or passport status.
+
+## Anonymous contribution boundary
+
+The local app can create an allowlisted schema `2.0` preview only after at least
+600 valid observed seconds. Preview and consent are separate actions. It
+contains valid seconds, AI-active seconds, activity ratio, supported app count
+and categories, model/loaded/runtime counts, recognized model-file bytes,
+macOS major, architecture, and scanner/runtime schema versions. It excludes
+names, process counts, CPU/RAM values, guess, device identity, local Census ID,
+timestamps, and all item-level records. The CLI and app still have no uploader. A
+separate Forkit.dev aggregate endpoint candidate exists with contribution writes
+disabled by default. That candidate now fails closed without Apple App Attest
+verification and excludes quarantined or revoked installations from the public
+pulse. The CLI still contains no proof enrollment or upload transport. Enabling
+either remains a founder/security release gate.
+
+## Local share page
+
+`forkit-ai-footprints share-page --output ...` saves a self-contained HTML result only
+after the user supplies an output path. The page contains aggregate counts and
+limitations, not item names, paths, commands, endpoints, configuration values,
+account identity, or the local Census ID. It loads no external assets and makes
+no automatic network requests. Its copy/share controls act only after a user
+click and use aggregate text.
+
+The interactive `serve` page can also render a 1080×1080 discovery card locally
+with browser Canvas. It includes model-record count, recognized storage,
+activity ratio, and the supported active tool product name. Its result line is
+derived only from measured local insights. The image has no model names, paths,
+process counts, device/account identifiers, workspace/chat titles, or external
+assets.
+Downloading it or opening the operating system share sheet requires a separate
+user click; AI Footprints does not receive the image.

package/README.md

@@ -0,0 +1,313 @@
+# Forkit AI Footprints
+
+Forkit AI Footprints is a private, metadata-only view of the models, runtimes,
+and AI agents present on a Mac. The prepared package and command are
+`forkit-ai-footprints`; `forkit-census` remains a temporary binary alias.
+
+It is derived from the discovery lessons in Forkit Connect, but it has a
+different safety boundary: AI Footprints does not authenticate to Forkit.dev and has
+no passport, Mint, registry-write, Runtime_C2-write, or production deployment
+path.
+
+Product status: `current` for the approved Apple Silicon macOS release
+
+Current support target: **macOS only**. The real-device validation so far is on
+Apple Silicon. Ubuntu, Windows, Android, and Intel Mac are not part of the
+current release claim.
+
+## Install on macOS
+
+The free global installation command is:
+
+```bash
+npx --yes forkit-ai-footprints@latest
+```
+
+Mac users who already have Node can run it directly. Homebrew users can first
+run `brew install node`; users with neither can use the official Node LTS
+installer and verify `node`, `npm`, and `npx`. A Forkit-specific Homebrew formula
+and direct download are deliberately not advertised because those channels do
+not exist. The website presents the command only when the exact tested package
+and release metadata agree. See
+[`docs/GLOBAL_DISTRIBUTION.md`](./docs/GLOBAL_DISTRIBUTION.md).
+
+The future click installer remains blocked until it can be Developer ID-signed
+and Apple-notarized. Developers can build the local candidate with:
+
+```bash
+npm ci
+npm run preflight:macos:release
+npm run build:macos:installer
+```
+
+The current output is an unsigned local validation artifact because no valid
+Developer ID Application or Installer identity is available on this Mac. It
+must not be distributed until signing, notarization, stapling, Gatekeeper
+verification, and clean-Mac installation tests pass.
+
+### Developer fallback
+
+Requirements:
+
+- macOS;
+- Node.js 20, 22, or 24
+- npm
+
+```bash
+git clone https://github.com/arpitasarker01/forkit-census.git
+cd forkit-census
+npm ci
+npm pack
+npm install -g ./forkit-ai-footprints-0.2.0.tgz
+forkit-ai-footprints serve
+```
+
+The equivalent persistent global CLI installation is:
+
+```bash
+npm install -g forkit-ai-footprints
+forkit-ai-footprints serve
+```
+
+npm is the approved public bootstrap channel for this release. Homebrew remains
+a future optional channel.
+
+## Commands
+
+Run a local scan, verify the installation, or score one manually labelled Mac:
+
+```bash
+forkit-ai-footprints serve
+forkit-ai-footprints monitor
+forkit-ai-footprints scan
+forkit-ai-footprints doctor
+forkit-ai-footprints evaluate --truth /absolute/path/to/local-truth.json
+forkit-ai-footprints aggregate --results /absolute/path/to/evaluation-results
+forkit-ai-footprints share-page --output /absolute/path/to/local-ai-footprint.html
+```
+
+`evaluate` always runs locally and emits aggregate counts and metrics only. It
+does not upload the truth file or include its item names in the output.
+
+Create the truth file only after manually checking that Mac. Empty arrays are
+valid when a surface is not installed or running:
+
+```json
+{
+  "schema_version": "1.0",
+  "expected": {
+    "agent_signatures": ["codex"],
+    "tool_names": ["Codex"],
+    "online_runtime_names": ["ollama"],
+    "model_keys": ["ollama:example-model:latest"],
+    "mcp_clients": ["Codex"]
+  }
+}
+```
+
+Keep truth files local; model names and installed-tool labels may be private.
+The evaluation result adds only macOS major version, CPU architecture, Node
+major, and aggregate counts. A coordinator can combine explicitly shared result
+files with `aggregate`; this remains local and always keeps automatic accuracy
+claims disabled. See [`docs/MACOS_TESTER_GUIDE.md`](./docs/MACOS_TESTER_GUIDE.md).
+
+`share-page` performs the same local scan and writes a self-contained,
+aggregate-only HTML snapshot. It loads no external assets and contains no model
+names, paths, commands, endpoints, configuration values, account identity, or
+Census ID. Its copy/share controls include only the visible aggregate summary
+and run only after a user click.
+
+`serve` binds only to `127.0.0.1`, keeps the report and monitor in memory, and
+opens the AI activity → Guess → Reveal → Share experience. `Scan again` calls a random-token-protected local
+endpoint. The protected local page can name detected runtimes, models, AI apps,
+and tools. The explicitly created local share image may include the supported
+active tool product name; saved HTML and anonymous/global payloads remain
+aggregate-only.
+The guess remains in the browser page and is never sent to the local server or
+Forkit.dev. Start/Stop controls monitoring explicitly; browser/window closure
+does not stop it, while native Quit stops the monitor and loopback service.
+
+The local app also keeps an owner-only device journal containing the sanitized
+Mac display name, first/last scan timestamps, and scan count. This lets the Mac
+resume its local state without placing the device name in a report, saved share
+page, image, anonymous preview, or website payload. The single result view uses
+a token-protected local stream with a one-second target interval. Repeated
+cumulative CPU-time deltas and hysteresis distinguish Working now from Open /
+idle; process presence alone is never activity. It is near-real-time, not zero delay.
+
+The revealed resource view reports deduplicated recognized logical model-file
+bytes and provider-native loaded-model evidence. The activity view uses private
+process-tree CPU-time deltas and separately displays Forkit's measured CPU,
+resident memory, and bounded-history overhead. None is an energy, token, cost,
+or lifetime-usage measurement.
+
+AI Footprints does not claim prompt or task ownership. **Working now** means
+sustained recent work inside a supported process tree, which may be foreground
+or background. The result does not measure GPU, energy, tokens, cost, disk I/O,
+or per-process network usage.
+
+After revealing the result, `Create share card` renders a 1200×630 PNG entirely
+in the browser. Its result-based line and cards use measured local insights,
+model-record count, recognized model storage, activity ratio, and the supported
+active tool product name. It can be downloaded or passed to the operating
+system share sheet after an explicit click; no model names, chat/workspace
+context, paths, device identity, or scan records are placed in the image or
+uploaded by AI Footprints.
+
+```bash
+forkit-ai-footprints serve
+forkit-ai-footprints scan
+forkit-ai-footprints scan --json
+forkit-ai-footprints scan --verbose --guess 5
+forkit-ai-footprints scan --copy
+forkit-ai-footprints report --json --output footprint.json
+forkit-ai-footprints scan --model-dir /path/you/selected
+forkit-ai-footprints doctor
+forkit-ai-footprints --version
+```
+
+One `scan` includes runtime APIs, filesystem model metadata, and agent process
+metadata by default. Individual surfaces can be disabled:
+
+```bash
+forkit-ai-footprints scan --no-runtimes
+forkit-ai-footprints scan --no-model-files
+forkit-ai-footprints scan --no-agents
+forkit-ai-footprints scan --no-tools
+forkit-ai-footprints scan --no-mcp
+```
+
+CLI flags cannot bypass the required monitoring session. The local UI enables
+an exact schema `2.0` aggregate preview only after 600 valid observed seconds;
+preview and consent remain separate, and no upload transport exists. The
+payload excludes app/model names, process counts, CPU/RAM, chat, workspace,
+repository, device, guess, Census, and account identifiers.
+
+## Shared core API
+
+Forkit Connect should delegate to the package's public, read-only core rather
+than copy its detector implementation:
+
+```js
+const { runCensus } = require('forkit-ai-footprints');
+
+const report = await runCensus();
+```
+
+The package root also exports the individual metadata detectors, formatters,
+provider adapters, endpoint validation, anonymous-preview builder, and TypeScript
+types. A fresh-install smoke test imports the package root and verifies that an
+all-disabled core scan makes zero external requests and writes no local state.
+
+## What AI Footprints reports
+
+- availability of supported loopback runtime APIs;
+- model names and provider identities;
+- models confirmed loaded by Ollama's read-only `/api/ps` response;
+- Ollama content digests when exposed by the runtime;
+- metadata-only fingerprints for supported local model files;
+- known AI agent products with process-instance counts;
+- passively configured or active Claude Code, Codex, Cursor, Windsurf, Gemini
+  CLI, GitHub Copilot, OpenCode, and OpenClaw surfaces;
+- aggregate server counts from known MCP client configuration files;
+- exact recognized logical model-file bytes when supported-root coverage is
+  complete, plus explicit completeness evidence and optional guess comparison;
+- confidence labels and review warnings;
+- platform, architecture, and Node major version.
+
+## What AI Footprints does not collect
+
+- model weights or file contents;
+- prompts or responses;
+- raw process commands;
+- full model paths in reports;
+- credentials, tokens, API keys, or passwords;
+- device name or hostname in reports, saved/shareable artifacts, anonymous
+  previews, or website payloads; username, email address, and account identity
+  are never collected.
+
+AI Footprints only connects to loopback HTTP(S) endpoints. Remote hosts and URLs with
+embedded credentials are rejected.
+
+Known MCP configuration files are read only to count configured server entries.
+Server names, commands, URLs, environment variables, and values are neither
+retained nor emitted.
+
+See [`PRIVACY.md`](./PRIVACY.md), [`STATUS.md`](./STATUS.md), and
+[`docs/PRODUCT_BOUNDARY.md`](./docs/PRODUCT_BOUNDARY.md).
+
+## Model identity
+
+| Source | Identity | Confidence |
+|---|---|---|
+| Ollama weights/manifest SHA-256 | Content-addressed SHA-256 | High |
+| LM Studio/OpenAI-compatible API | Hashed provider/model identity | Medium |
+| Filesystem model metadata | Hashed name, relative location, size, and modification time | Low |
+
+A filesystem identity is not a content checksum. AI Footprints says so in every report
+that includes filesystem-discovered models.
+
+## Agent identity
+
+Agent matching uses exact executable names, explicit `python -m` module
+invocations, or explicit package-runner invocations such as `npx`. Product words
+appearing in unrelated arguments or paths are rejected. Multiple processes with
+the same product signature are aggregated into one agent product with an
+`instance_count`; this is a process count, not a count of independent autonomous
+agents or user sessions.
+
+The checked-in curated conformance corpus covers all supported agent signatures
+and difficult negative names on macOS, Linux, and Windows-style process
+metadata. Run it with `npm run benchmark:agents`. Its result shows whether the
+detector conforms to those labeled fixtures; it is not a representative sample
+of real devices, so it must not be presented as field accuracy.
+
+## Validation
+
+```bash
+npm ci
+npm test
+npm run benchmark:agents
+npm run validate:macos
+npm run smoke:package
+npm run preflight:macos:release
+```
+
+The active GitHub Actions matrix covers Node 20, 22, and 24 on macOS, plus an
+isolated installed-package smoke on macOS. `npm test` includes the conservative
+agent conformance benchmark. See
+[`benchmarks/README.md`](./benchmarks/README.md) for the benchmark method and
+limitations.
+
+`npm run validate:macos` performs two real-device scans, verifies stable item
+sets, rejects non-loopback requests, checks the report privacy contract, and
+fails if prohibited process/path keys appear. One machine is a release sanity
+check, not a field-accuracy sample.
+
+The multi-device protocol, local truth-file format, and quantitative public
+release thresholds are defined in
+[`docs/MACOS_ACCURACY_GATE.md`](./docs/MACOS_ACCURACY_GATE.md).
+
+Storage, runtime-freshness, resource-attribution, and Developer ID truth
+boundaries are defined in
+[`docs/MACOS_MEASUREMENT_FOUNDATION.md`](./docs/MACOS_MEASUREMENT_FOUNDATION.md).
+
+## Accuracy boundary
+
+AI Footprints has no defensible global accuracy percentage yet. Runtime API evidence is
+strongest; filesystem findings are explicitly best-effort; tool and MCP coverage
+is limited to documented locations; and the agent benchmark is curated rather
+than independently sampled. Do not market a benchmark pass as field precision
+or recall. Global release requires a separately labelled, consented multi-device
+macOS evaluation.
+
+## Relationship to Forkit Connect
+
+- Forkit AI Footprints: canonical read-only inventory core and report generation.
+- Forkit Connect: supporting bridge for governed Model and Agent Passport flows.
+- Forkit.dev website/registry: authoritative review and explicit final Mint.
+
+AI Footprints is not a replacement production release for Connect. The intended
+integration is for `forkit-connect census` to delegate to this package's public
+core, avoiding two scanner implementations. Promotion requires an intentional
+update to the Forkit.dev production lock.

package/STATUS.md

@@ -0,0 +1,136 @@
+# Forkit AI Footprints Status
+
+Last updated: 2026-08-23
+
+Version: `0.2.0`
+
+Production classification: `current` for Apple Silicon macOS
+
+Release state: founder-approved public v0.2.0 npm-first release. The npm
+bootstrap installs a persistent unsigned local app; Developer ID signing and
+notarization remain future work.
+
+## What is implemented
+
+- One local experience: AI activity first, Guess → Reveal, an aggregate share
+  card, optional exact global-payload review, Scan again, and technical details.
+- Explicit Start/Stop Monitoring with repeated one-second macOS process-tree
+  sampling, cumulative CPU-time deltas, two-sample entry and three-sample exit
+  hysteresis, and sleep-gap exclusion.
+- Clear states: **Working now**, **Open / idle**, **Not running**, and **Stopped**.
+  Process presence alone never becomes working activity.
+- One to three deterministic insights from valid measured time: activity share,
+  longest continuous active block, supported-tool workflow, mostly-idle state,
+  and available-but-unused local models. Stop/restart boundaries cannot inflate
+  the longest block.
+- The monitor is owned by the local service, not a browser tab. Closing the
+  window does not end a session; stopping preserves the summary; clearing is a
+  separate explicit action.
+- A persistent native AppKit/WebKit app installed into the current user's
+  Applications folder by a one-time npm bootstrap. Later launches use normal
+  macOS surfaces and do not require Terminal.
+- A native AppKit/WebKit window and retained menu-bar controller with Open,
+  Start/Stop, and Quit actions. Closing hides the window without quitting; Quit
+  stops the service and has a process-exit fallback so the bundled Node service
+  cannot remain orphaned.
+- One English/German localization source drives the app, deterministic insights,
+  share caption, menu-bar menu, and close/quit notices.
+- Local-only optional chat/workspace display when a cooperating app explicitly
+  supplies those values. No inference from window titles, folders, prompts, or
+  commands is attempted.
+- Forkit's own process tree is excluded from detected AI activity. Its CPU,
+  RAM, and bounded-history overhead are measured and labelled separately.
+- Exact recognized logical model-file bytes for supported roots, with hard-link,
+  symlink, overlapping-root, Hugging Face snapshot, and Ollama content-addressed
+  deduplication.
+- Verified Ollama availability requires the exact local listener owner, a valid
+  version response, and a valid tags response. Loaded state comes only from a
+  valid `/api/ps` response.
+- A schema `2.0` candidate global aggregate based on valid observed seconds and
+  AI-active seconds. It excludes names, process counts, paths, commands, chat,
+  workspace, device identity, guess, and Census ID. Review and consent are
+  separate; upload transport remains disabled.
+- A 1080×1080 local share card with Share, Save PNG, Copy Image, and Copy
+  Caption controls. It contains only measured totals and supported tool names.
+- A single Forkit.dev `/ai-footprint` page with an honest benchmark-forming
+  state and one npm path using `npx --yes forkit-ai-footprints@latest`.
+  Unpublished Forkit Homebrew/download channels are not claimed.
+- One release version sourced from `package.json`, release-coherence checks,
+  package smoke tooling, a bundled official Node runtime, official Forkit app
+  and menu-bar assets, and an unsigned local `.app`/`.pkg` candidate.
+
+## Evidence from this Apple Silicon Mac
+
+- Models discovered: **5**.
+- Models loaded: **0**.
+- Recognized model storage: **2,600,071,742 bytes** (**2.60 GB / 2.42 GiB**)
+  across **12** deduplicated recognized files with complete supported-root
+  coverage.
+- Verified local runtime: **Ollama 0.20.5**, owned by the exact Homebrew
+  `ollama` executable on `127.0.0.1:11434`.
+- Ollama inventory: `llama3.2:latest`; `/api/ps` was empty. The correct state is
+  **engine available, no model loaded**, not AI work.
+- A real **984.1-second** valid session observed Codex activity for **982.9
+  seconds** (ratio **0.999**) while this development task was actively running.
+  This is real process-tree activity evidence, not prompt/task/token ownership.
+- During the measured session, Forkit overhead was **1.3% median CPU**, **3.3%
+  p95 CPU**, about **53.3 MB current RAM**, **117.1 MB maximum RAM**, and **627
+  bytes** of bounded serialized history at the final payload sample.
+- A final source-identical bundled-app observation reached **63.3 seconds** of
+  valid time and **62.1 seconds** AI-active (ratio **0.981**), producing: “Codex
+  was working during 98% of your observation.”, “Your longest continuous
+  AI-active period was 1m 1s.”, and “5 local models are available, but none ran
+  during this observation.”
+- A separate real session crossed the 10-minute gate at exactly **600 valid
+  seconds** and **598 AI-active seconds**. Only then did the local comparison
+  preview become available; no transport was enabled.
+
+## Validation completed locally
+
+- TypeScript build and the complete local test suite.
+- Curated agent detector corpus: **58/58** fixtures, 26 positive and 32 negative,
+  with zero fixture errors. This is conformance evidence, not field accuracy.
+- Isolated packed-package installation/import/CLI smoke.
+- Native Swift compilation, bundled CLI/version smoke, bundled official Node
+  checksum, App Attest capability probe, and unsigned `.app`/`.pkg` build.
+- Real native 1120×787 window creation, visible-on-reveal menu-bar item, menu
+  Start, window close with continued monitoring, reopen with the same timeline,
+  Stop, restart, and monitoring-state Quit with zero remaining Forkit process or
+  loopback listener on this Mac.
+- Accessibility evidence placed the retained 24×24 status item at `y=-59` while
+  macOS auto-hid the menu bar and at `y=3` after revealing the bar. Its help text
+  was “Forkit AI Footprint” and its complete localized menu was exposed.
+- Real-browser QA in English and German for the local monitor, Guess → Reveal,
+  correct GB/GiB labels, deterministic captions, 1080×1080 PNG export, image
+  clipboard/share payloads, and the one-page Forkit.dev installation/global page.
+- Forkit.dev production website build and registry AI Footprints route tests.
+
+## Intentionally not enabled or not yet field-validated
+
+- No upload, verified global contribution, public ranking, account, registry
+  write, passport, Mint, Runtime_C2 write, telemetry, or production deployment.
+- No Homebrew tap, signed direct download, or click installer.
+- No Developer ID signature, notarization, stapling, Gatekeeper distribution
+  test, or clean external-Mac installation test.
+- No representative multi-device macOS field-accuracy result and no Intel Mac
+  release claim.
+- App Attest reports unsupported on this macOS 26 device, so this Mac cannot
+  produce a verified global contribution under the proposed proof policy.
+- No prompt, task, token, energy, cost, GPU, disk-I/O, or per-process network
+  attribution.
+
+## Accuracy boundary
+
+The detector is deliberately conservative. Exact executable/module/package
+runner matches and verified runtime identities are strong implementation rules,
+but one real Mac and a curated fixture corpus cannot establish a global
+precision/recall percentage. Model storage is exact only for recognized files
+inside supported roots when `storage_complete=true`; it is not whole-disk AI
+storage or APFS physical allocation. **Working now** means sustained recent CPU
+time in a supported process tree and nothing more.
+
+## Smallest release gate
+
+Future expansion requires representative multi-device field accuracy, Intel Mac
+validation, and Apple signing/notarization. Global contribution remains closed
+until its separate server-side verification and abuse-control gate passes.

package/dist/agents.d.ts

@@ -0,0 +1,22 @@
+import type { CensusAgent, Confidence, ProcessEntry } from './types';
+export interface ClassifiedAgentProcess {
+    pid: number;
+    ppid: number | null;
+    signature: string;
+    name: string;
+    kind: string;
+    confidence: Confidence;
+    relationship: 'direct' | 'descendant';
+    cpu_percent: number | null;
+    memory_percent: number | null;
+    cpu_time_ms: number | null;
+}
+/**
+ * Builds private process-tree evidence for the activity monitor. PIDs and raw
+ * commands remain internal and are deliberately absent from public reports.
+ */
+export declare function classifyAgentProcessTrees(processes: ProcessEntry[], excludedRootPid?: number | null): ClassifiedAgentProcess[];
+export declare function parseMacosCpuTime(value: string): number | null;
+export declare function detectAgentProducts(processes: ProcessEntry[]): CensusAgent[];
+export declare function listSystemProcesses(): Promise<ProcessEntry[]>;
+//# sourceMappingURL=agents.d.ts.map