# Graph Report - .  (2026-08-02)

## Corpus Check
- Large corpus: 278 files · ~3,501,514 words. Semantic extraction will be expensive (many Claude tokens). Consider running on a subfolder.

## Summary
- 1924 nodes · 3146 edges · 178 communities (128 shown, 50 thin omitted)
- Extraction: 93% EXTRACTED · 7% INFERRED · 0% AMBIGUOUS · INFERRED: 216 edges (avg confidence: 0.76)
- Token cost: 0 input · 0 output

## Community Hubs (Navigation)
- kb-op/kb-tui: draw spawn handle
- kb-control-plane/internal: TestRecordStoreResult TestHealthService TestContain
- kb-control-plane/internal: TestSendContainmentCmd Conn wire
- kb-checker/src: Service Control Plane
- kb-aads/marl: Agent install aads
- kb-core/userspace: cpm cwp bridge
- kb-control-plane/proto: ProtoMessage Reset String
- kb-control-plane/proto: checker GetStatus Descriptor
- kb-control-plane/proto: KernelBorderlands Handler ExportAuditLog
- kb-op/kb-dashboard: react types dom
- kb-control-plane/proto: Descriptor String EnumDescriptor
- kb-core/ebpf: handle lsm sensitive
- docs/features: map CPM BPF
- kb-control-plane/proto: KernelBorderlands Handler ListZone
- kb-control-plane/proto: ProtoReflect Descriptor ProtoMessage
- kb-control-plane/internal: Command runDaemon auth
- kb-control-plane/proto: Descriptor proto init
- kb-op/kb-dashboard: tsconfig app json
- kb-op/kb-dashboard: react rules App
- kb-control-plane/internal: ControlPlane StartHTTPServer HTTPServer
- docs/development: Ray mode gRPC
- kb-aads/tests: unary zone client
- kb-control-plane/internal: policy New TestNewWithMalformedYAMLErrors
- misc: grpc CheckerStatus Default
- kb-control-plane/internal: KernelBorderlands ExportAuditLog GetProcessState
- kb-core/tests: send flood cwp
- kb-op/kb-dashboard: node tsconfig json
- kb-core/include: evidence rules behavior
- kb-core/userspace: evidence seq init
- CHANGELOG.md: message lsm open
- docs/architecture: Phase architecture docs
- kb-aads/agents: TODO Enum base
- kb-checker/src: main pid checker
- kb-control-plane/internal: Store schema Map
- kb-core/userspace: scoring state zone
- CONTRIBUTING.md: docs wire structs
- kb-op/kb-tui: kbtui Media Assets
- kb-op/kb-mcp: main JSONRPCError JSONRPCRequest
- docs/emergency-backup: core Cross Kernel
- docs/specifications: struct sched process
- docs/specifications: Specification Rate docs
- kb-checker/src: check health mod
- kb-aads/swarm: remote main agent
- kb-core/userspace: state behavior slot
- kb-op/kbctl: kbctl MCP process
- docs/development: Wire Struct sock
- kb-checker/proto: checker proto Watchdog
- kb-checker/src: verify integrity map
- kb-core/userspace: bridge send connect
- kb-core/userspace: sensor behavior bridge
- misc: check Health HealthCheckResponse
- kb-aads/comms: KernelBorderlandsServicer GetProcessState ListZone
- kb-control-plane/proto: KBEvent GetComm GetEventType
- docs/development: pipeline agent Hunter
- docs/project: Agent Behavioral Boundary
- docs/architecture: kernel LSM BPF
- docs/development: SSH MCP gRPC
- docs/development: AADS UDS gRPC
- docs/reports: LSM SQLite BPF
- docs/reports: checker Simulation Event
- kb-control-plane/internal: rules KBWireAttackRule YAMLPolicy
- kb-core/userspace: behavior get reason
- kb-op/kb-tui: cmd query contain
- docs/architecture: sock run kbd
- kb-core/include: Context Hijacking Mitigation
- docs/emergency-backup: Capability Standalone Product
- docs/project: Project Synopsis Karthik
- kb-aads/agents: message messages BaseAgent
- kb-aads/comms: grpc client add
- kb-aads/consensus: consensus init jje
- kb-core/userspace: Behavior Engine unit
- kb-control-plane/proto: AuditVerifyResponse Descriptor GetChainIntact
- docs/getting-started: Ray Actors TCP
- docs/emergency-backup: Adapter auditd Linux
- docs/development: Dynamic Rule Work
- kb-control-plane/proto: ListZone KernelBorderlands ListZoneServer
- docs/development: docs type KBEvent
- docs/specifications: Gating Control Plane
- kb-aads/tests: fixture grpc server
- kb-control-plane/proto: GetSystemStats SystemStats Descriptor
- docs/emergency-backup: Agent AADS Decision
- docs/emergency-backup: Blast Radius Classification
- docs/development: Tier Rejection sync
- docs/emergency-backup: Fabric Model Reconciliation
- docs/reports: Report Work Control
- kb-aads/comms: KernelBorderlands GetProcessState ListZone
- kb-core/userspace: sha cached final
- kb-control-plane/proto: GetProcessState PidRequest Descriptor
- docs/development: Sensitive Path paths
- docs/development: detection exfiltration algorithm
- docs/specifications: Behavior Engine Event
- kb-aads/agents: investigate HunterAgent handle
- kb-aads/comms: process state containment
- kb-core/userspace: Collectors telemetry acquisition
- docs/development: control node docs
- docs/development: ebpf policies json
- kb-op/kbctl: main CancelFunc kbctl
- docs/development: Logger Audit Hash
- kb-aads/agents: ContainmentAgent handle message
- kb-aads/agents: HealerAgent handle message
- kb-aads/agents: PatrollerAgent handle message
- kb-core/tests: all hooks pause
- kb-core/userspace: handle memory event
- kb-core/userspace: syscall handle get
- kb-aads/comms: stream alerts events
- misc: checker build main
- kb-op/kb-dashboard: dashboard index html
- misc: tui build main
- kb-aads/swarm: Class HealthMonitor Swarm
- kb-core/ebpf: bpf always inline
- docs/emergency-backup: MARL Training Loop
- docs/development: Behavior Engine Behavioral
- docs/development: eBPF Plaintext TLS
- kb-aads/consensus: aads Consensus Quorum
- kb-op/kb-dashboard: tsconfig json files
- kb-control-plane/go.mod: github com pardhuvarmax
- CODE_OF_CONDUCT.md: CODE CONDUCT Contributor
- docs/development: grpc API Surface
- kb-core/scratchpad: inspect bpf state
- kb-core/scratchpad: run sensor script
- kb-core/scripts: attach script
- kb-core/scripts: build script
- kb-core/scripts: clean script
- kb-core/scripts: script
- docs/development: tls write Uprobe
- docs/development: write ssl Uprobe
- docs/development: wire attack rule
- docs/development: process writev Cross
- docs/development: security capable Capability
- docs/development: Behavior State KBZone
- docs/development: Developer Commands
- docs/development: Developer Discussions Stub
- .github/ISSUE_TEMPLATE: Bug Report Issue
- .github/ISSUE_TEMPLATE: Feature Request Issue
- .github/workflows: Retry Failed Pages
- kb-op/kb-dashboard: Brand Purple Gradient
- kb-core/include: events
- kb-core/include: evidence
- kb-core/include: scoring
- kb-core/scripts: attach
- kb-core/scripts: clean
- kb-op/kb-dashboard: dashboard Operator Web
- kb-op/kb-dashboard: dashboard favicon svg
- kb-op/kb-dashboard: Blue accent glow
- kb-op/kb-dashboard: Diamond Arrow Brand
- kb-op/kb-dashboard: Purple gradient glow
- kb-op/kb-dashboard: icons svg dashboard
- kb-op/kb-dashboard: Bluesky icon butterfly
- kb-op/kb-dashboard: Discord icon external
- kb-op/kb-dashboard: Documentation icon open
- kb-op/kb-dashboard: GitHub icon Octocat
- kb-op/kb-dashboard: Social community icon
- kb-op/kb-dashboard: formerly Twitter icon
- kb-op/kb-dashboard: React Logo Vite
- kb-op/kb-dashboard: Vite Logo svg
- kb-op/kb-tui: kbtui gif tui
- kb-op/kb-tui: build tonic codegen

## God Nodes (most connected - your core abstractions)
1. `App` - 38 edges
2. `ControlPlane` - 29 edges
3. `ControlPlaneClient` - 28 edges
4. `ProcessState` - 26 edges
5. `BaseAgent` - 23 edges
6. `newTestControlPlane()` - 22 edges
7. `main()` - 22 edges
8. `Alert` - 21 edges
9. `Empty` - 21 edges
10. `file_proto_kb_proto_rawDescGZIP()` - 21 edges

## Surprising Connections (you probably didn't know these)
- `Judge Agent` --semantically_similar_to--> `Hunter Agent`  [INFERRED] [semantically similar]
  docs/project/KB.pdf → docs/emergency-backup/kb-aads.md
- `Jury Agent` --semantically_similar_to--> `Healer Agent`  [INFERRED] [semantically similar]
  docs/project/KB.pdf → docs/emergency-backup/kb-aads.md
- `Executor Agent` --semantically_similar_to--> `Containment Agent`  [INFERRED] [semantically similar]
  docs/project/KB.pdf → docs/emergency-backup/kb-aads.md
- `Watchdog Containment Fallback Hierarchy` --semantically_similar_to--> `Enforcement Layer (Containment Ladder)`  [INFERRED] [semantically similar]
  kb-checker/src/report/README.md → kb-control-plane/internal/enforcement/README.md
- `main()` --calls--> `NewReader()`  [INFERRED]
  kb-op/kb-mcp/main.go → kb-control-plane/internal/ipc/wire.go

## Import Cycles
- None detected.

## Hyperedges (group relationships)
- **sudo/PAM lockout incident: unconditional LSM block -> containment-gating fix -> sensitive_paths config** — changelog_sudo_pam_lockout_incident, changelog_lsm_containment_gating, changelog_sensitive_paths_config, docs_architecture_hookpoints_sensitive_path_list [EXTRACTED 1.00]
- **Three-phase boot sequence: Control Plane, Safety Layer, Infrastructure** — boot_seq_kbd_service, boot_seq_kbchecker_service, boot_seq_ray_swarm_node [EXTRACTED 1.00]
- **Judge-Jury-Executor consensus decision pipeline** — ray_walkthrough_judge_agent, ray_walkthrough_jury_pool, ray_walkthrough_executor_agent, aads_devplan_jje_model [EXTRACTED 1.00]
- **KB Socket Topology (kbd.sock/kbct.sock/kba.sock/kbc.sock split)** — concept_kbd_sock, concept_kbct_sock, concept_kba_sock, concept_kbc_sock, rationale_no_tcp_fallback_invariant [EXTRACTED 1.00]
- **SSH Migration, CIS Integration, and Audit RPC Sequencing (Phases 0-2)** — concept_openssh_forcecommand_migration, concept_step_ca_cis_integration, concept_audit_hash_chain_verification, kb_control_plane_internal_ssh_package [EXTRACTED 1.00]
- **Wire Protocol Struct Evolution (v1 to v3) Across ProcessState/ZoneTransition** — concept_kb_wire_process_state, concept_kb_wire_zone_transition, concept_wire_version, concept_verify_start_time, kb_control_plane_internal_ipc_wire_go [EXTRACTED 1.00]
- **AADS Escalation Pipeline (Patroller-Hunter-Healer-Consensus-Containment)** — aads_patroller_agent, aads_hunter_agent, aads_healer_agent, aads_consensus_voting, aads_containment_agent [EXTRACTED 1.00]
- **kb-op Four Thin Interfaces Over One Backend** — docs_emergency_backup_kb_op_ctl_cli, docs_emergency_backup_kb_op_tui, docs_emergency_backup_kb_op_mcp_server, docs_emergency_backup_kb_op_web_dashboard, docs_emergency_backup_kb_op_backend_daemon [EXTRACTED 1.00]
- **CPM/CWP Authorization Gate Before contained_pids_map Enforcement** — feature_cpm, feature_cwp, contained_pids_map, docs_features_cpm_cpm_classify, handle_incoming_containment_cmd [EXTRACTED 1.00]
- **Slow Exfiltration Detection Across kb-core/kb-control-plane/kb-aads** — docs_reports_kb_core_corev1_enhancements_subsystem_allocation, docs_specifications_kernel_borderlands_specification_shannon_entropy, docs_specifications_kernel_borderlands_specification_cusum_drift [EXTRACTED 1.00]
- **Systemd Boot Gating to Three-Layer Containment Flow** — docs_reports_kb_core_july_08_2026_boot_gating, docs_reports_kb_core_july_08_2026_three_layer_fallback, kb_checker_enforcement_flow [INFERRED 0.75]
- **Four Operator Surfaces Graceful Degradation Pattern** — operator_interfaces_kb_dashboard, operator_interfaces_kbctl, operator_interfaces_kb_tui, operator_interfaces_kb_mcp [EXTRACTED 1.00]
- **Graduated Containment Enforcement Flow** — kb_control_plane_internal_enforcement_readme, kb_checker_src_report_watchdog_containment_fallback, kb_core_readme_vfs_lsm_blocking [INFERRED 0.75]
- **kbd Daemon Runtime Orchestration** — kb_control_plane_cmd_kbd_main, kb_control_plane_internal_controlplane_readme, kb_control_plane_internal_readme [EXTRACTED 0.85]
- **IPC Wire Protocol Contract Across kb-core and kb-control-plane** — kb_control_plane_readme_ipc_wire_protocol, kb_control_plane_internal_ipc_readme, kb_core_readme_kb_bridge_c [INFERRED 0.85]
- **kb-core native telemetry-to-control-plane pipeline** — kb_core_userspace_collectors_readme_collectors, kb_core_userspace_sensor_readme_sensor, kb_core_userspace_behavior_readme_engine, kb_core_userspace_bridge_readme_bridge [EXTRACTED 0.95]
- **Operator interfaces sharing kbd gRPC UDS access** — kb_op_readme_kb_tui, kb_op_readme_kb_mcp, kb_op_readme_kbctl, kb_op_readme_kba_sock [EXTRACTED 1.00]
- **Dataset generation workflow spanning attack-lab, dataset pipeline, and env setup** — scripts_attack_lab_readme_overview, scripts_dataset_readme_pipeline, scripts_setup_readme_overview [INFERRED 0.75]

## Communities (178 total, 50 thin omitted)

### Community 0 - "kb-op/kb-tui: draw spawn handle"
Cohesion: 0.05
Nodes (65): B, Duration, Frame, Instant, Into, GetStatus(), Context, Action (+57 more)

### Community 1 - "kb-control-plane/internal: TestRecordStoreResult TestHealthService TestContain"
Cohesion: 0.05
Nodes (63): Enforcer, Listener, ControlPlane, Map, Mutex, Server, Store, listenUnix() (+55 more)

### Community 2 - "kb-control-plane/internal: TestSendContainmentCmd Conn wire"
Cohesion: 0.05
Nodes (49): Logger, ContainmentCmdMsg, KBZone, MessageHandler, ProcessExitMsg, ProcessStateMsg, Reader, ZoneTransitionMsg (+41 more)

### Community 3 - "kb-checker/src: Service Control Plane"
Cohesion: 0.05
Nodes (53): eBPF Integrity & Liveness Audits Module, verify_ebpf_integrity(), verify_liveness(), verify_map_integrity(), Alert Dispatching (kba.sock AgentDecision), Recovery & Containment Dispatcher Module, Watchdog Containment Fallback Hierarchy, check_control_plane_health() (+45 more)

### Community 4 - "kb-aads/marl: Agent install aads"
Cohesion: 0.04
Nodes (45): Agent Lifecycle (NEW→PROFILING→BASELINE→MONITOR→CONTAINED→TERMINATED), Agent Implementations (kb-aads/agents/), Known Gap: No Live Path for kb-events Reaching the Swarm, Communication Layer (kb-aads/comms/), ZeroMQ Pub/Sub Design (Stale, Never Built, Corrected), Containment Agent, Healer Agent, Hunter Agent (+37 more)

### Community 5 - "kb-core/userspace: cpm cwp bridge"
Cohesion: 0.10
Nodes (39): kb_bridge_close(), kb_sha256_to_hex(), apply_cpm_protected_exec_frame(), apply_cwp_workloads_frame(), apply_sensitive_paths_frame(), attach_ssl_uprobes(), bridge_dispatch(), bridge_ensure_connected() (+31 more)

### Community 6 - "kb-control-plane/proto: ProtoMessage Reset String"
Cohesion: 0.06
Nodes (8): MessageState, SizeCache, UnknownFields, AuditEntry, AuditExportResponse, ReloadPolicyResponse, ZoneOverrideRequest, ZoneOverrideResponse

### Community 7 - "kb-control-plane/proto: checker GetStatus Descriptor"
Cohesion: 0.07
Nodes (20): CheckerStatusClient, CheckerStatusServer, StatusRequest, StatusResponse, UnimplementedCheckerStatusServer, UnsafeCheckerStatusServer, _CheckerStatus_GetStatus_Handler(), ClientConnInterface (+12 more)

### Community 8 - "kb-control-plane/proto: KernelBorderlands Handler ExportAuditLog"
Cohesion: 0.11
Nodes (21): ClientConn, ClientConnInterface, Context, ServiceRegistrar, UnaryServerInterceptor, _KernelBorderlands_ExportAuditLog_Handler(), _KernelBorderlands_GetProcessState_Handler(), _KernelBorderlands_GetSystemStats_Handler() (+13 more)

### Community 9 - "kb-op/kb-dashboard: react types dom"
Cohesion: 0.06
Nodes (33): dependencies, lucide-react, react, react-dom, recharts, devDependencies, oxlint, @types/node (+25 more)

### Community 10 - "kb-control-plane/proto: Descriptor String EnumDescriptor"
Cohesion: 0.08
Nodes (7): EnumDescriptor, EnumNumber, EnumType, cachedToProto(), ContainmentLevel, ProcessState, Zone

### Community 11 - "kb-core/ebpf: handle lsm sensitive"
Cohesion: 0.15
Nodes (29): BPF_PROG(), __always_inline, __u32, __u8, is_sensitive_kernel_path(), is_sensitive_path(), kb_fill_common(), kb_go_tls_write() (+21 more)

### Community 12 - "docs/features: map CPM BPF"
Cohesion: 0.10
Nodes (28): bpf_map_delete_elem() Return-Value Check, Bounded %.64s Format Specifier for cmd->reason, contained_pids_map (BPF Map), CPM Classifier-in-Userspace Deviation, Control Plane & Operator Suite Collaboration Worksheet, Task 1: Go-to-C IPC Feedback & Containment Map, Task 2: Standard gRPC Health Checking Protocol, Task 3: Process Exit Lifecycle (sched_process_exit) (+20 more)

### Community 13 - "kb-control-plane/proto: KernelBorderlands Handler ListZone"
Cohesion: 0.08
Nodes (7): _KernelBorderlands_ListZone_Handler(), _KernelBorderlands_StreamAlerts_Handler(), _KernelBorderlands_StreamEvents_Handler(), Alert, EventFilter, ServerStream, ServerStreamingServer

### Community 14 - "kb-control-plane/proto: ProtoReflect Descriptor ProtoMessage"
Cohesion: 0.07
Nodes (3): Message, AgentDecision, DecisionAck

### Community 15 - "kb-control-plane/internal: Command runDaemon auth"
Cohesion: 0.10
Nodes (18): Command, runDaemon(), ValidatePublicKey(), isDirWritable(), LoadConfig(), EnsureHostKeyExists(), Server, NewService() (+10 more)

### Community 16 - "kb-control-plane/proto: Descriptor proto init"
Cohesion: 0.09
Nodes (5): file_proto_kb_proto_init(), file_proto_kb_proto_rawDescGZIP(), init(), ContainmentRequest, ContainmentResponse

### Community 17 - "kb-op/kb-dashboard: tsconfig app json"
Cohesion: 0.08
Nodes (23): compilerOptions, allowArbitraryExtensions, allowImportingTsExtensions, erasableSyntaxOnly, jsx, lib, module, moduleDetection (+15 more)

### Community 18 - "kb-op/kb-dashboard: react rules App"
Cohesion: 0.11
Nodes (20): plugins, rules, react/only-export-components, react/rules-of-hooks, $schema, App(), ChartPoint, HEALTH_SERVICES (+12 more)

### Community 19 - "kb-control-plane/internal: ControlPlane StartHTTPServer HTTPServer"
Cohesion: 0.23
Nodes (10): HTTPServer, Handler, corsHandler(), ControlPlane, ControlPlane, Request, isProcessRunning(), isSocketOpen() (+2 more)

### Community 20 - "docs/development: Ray mode gRPC"
Cohesion: 0.13
Nodes (18): gRPC-over-UDS client (comms/grpc_client.py, ControlPlaneClient), Judge, Jury, and Executor (JJE) consensus model, Local single-node Ray mode current scope vs deferred multi-node cluster mode, mTLS swarm security — deferred, cluster-mode-only scope, Correction: Ray Plasma object store (not Apache Arrow) is the shared-memory mechanism, Ray Actor Swarm Migration (decorate agents with @ray.remote), RaySwarmOrchestrator / ROLE_CLASSES pattern (Executor & Judge singletons, dynamic Jury pool), Proposed SwarmRegistry actor for agent handle lookup/self-registration (+10 more)

### Community 21 - "kb-aads/tests: unary zone client"
Cohesion: 0.14
Nodes (16): ControlPlaneClient, gRPC Client communicating with the Go Control Plane over Unix Domain Sockets.…, Close the gRPC channel., List processes in a zone (can be Zone enum, string, or int). Deliberately…, A client that already made a unary call must refuse to also stream — see…, The symmetric case: a client already streaming must refuse a subsequent unary…, The recommended pattern — two instances, one per role — must work without…, test_get_process_state() (+8 more)

### Community 22 - "kb-control-plane/internal: policy New TestNewWithMalformedYAMLErrors"
Cohesion: 0.24
Nodes (17): New(), T, TestNewWithMalformedYAMLErrors(), TestNewWithMissingFileFallsBackToDefaults(), TestNewWithNoPathUsesDefaults(), TestPerCommAutoTerminate(), TestSensitivePathsEmptyDefault(), TestSensitivePathsRejectsBareRoot() (+9 more)

### Community 23 - "misc: grpc CheckerStatus Default"
Cohesion: 0.16
Nodes (16): CheckerStatus, Default, CheckerState, CheckerStatusService, Arc, Box, Error, Mutex (+8 more)

### Community 24 - "kb-control-plane/internal: KernelBorderlands ExportAuditLog GetProcessState"
Cohesion: 0.16
Nodes (5): Context, ControlPlane, KernelBorderlands_StreamAlertsServer, KernelBorderlands_StreamEventsServer, Empty

### Community 26 - "kb-op/kb-dashboard: node tsconfig json"
Cohesion: 0.10
Nodes (19): compilerOptions, allowImportingTsExtensions, erasableSyntaxOnly, lib, module, moduleDetection, noEmit, noFallthroughCasesInSwitch (+11 more)

### Community 27 - "kb-core/include: evidence rules behavior"
Cohesion: 0.19
Nodes (12): kb_attack_rule_t, kb_evidence_t, kb_evidence_has(), kb_evidence_has_all(), kb_evidence_has_any(), kb_behavior_state_t, kb_evidence_t, kb_rules_evaluate() (+4 more)

### Community 28 - "kb-core/userspace: evidence seq init"
Cohesion: 0.25
Nodes (18): test_direct_ioc_compromised(), test_initialization(), test_sequential_transitions(), test_time_window_validation(), kb_behavior_init(), kb_evidence_t, ev_slot(), kb_evidence_get() (+10 more)

### Community 29 - "CHANGELOG.md: message lsm open"
Cohesion: 0.17
Nodes (17): Rejection of Apache Kafka / external message brokers, kb_lsm_file_open LSM hook autoload activation, AADS gRPC-over-UDS client & Ray remote actors, connect_once() 2s SO_RCVTIMEO fix, eBPF hybrid token bucket rate limiting, Kafka removal in AADS subsystem (native UDS + Ray IPC), kb-tui rebuilt as ratatui/tonic operator console, kb_lsm_file_open changed from unconditional to containment-gated block (+9 more)

### Community 30 - "docs/architecture: Phase architecture docs"
Cohesion: 0.19
Nodes (12): Existing hook points (tracepoint:syscalls, sched, commit_creds, bpf_lsm, net, mmap_region), kb_syscall_counts HASH map (~40-50MB pinned kernel memory), SQLite zone_transitions/audit_log unbounded growth retention gap, Min/Recommended/Balanced/Max target tier structure, 'Zero-overhead' per-hook latency claim vs aggregate footprint clarification, Phase 1 — Runtime tunability (Pardhu, kb-core), Phase 2 — Auto-detection and safe-by-default tier selection, Phase 3 — Thermal/load-reactive throttling (+4 more)

### Community 31 - "kb-aads/agents: TODO Enum base"
Cohesion: 0.25
Nodes (8): Enum, AgentRole, AgentState, AgentStatus, # TODO: query KB control plane for process history, # TODO: build evidence chain, # TODO: calculate confidence, # TODO: submit to jury

### Community 32 - "kb-checker/src: main pid checker"
Cohesion: 0.22
Nodes (15): acquire_pid_lock(), CheckTargets, cleanup_pid_and_socket(), Cli, Commands, main(), Arc, Box (+7 more)

### Community 33 - "kb-control-plane/internal: Store schema Map"
Cohesion: 0.23
Nodes (12): DB, Map, Store, New(), Store, T, newTestStore(), TestRemoveProcessEvictsFromL1() (+4 more)

### Community 34 - "kb-core/userspace: scoring state zone"
Cohesion: 0.23
Nodes (15): kb_process_state_t, kb_scoring_result_t, kb_zone_t, find_or_create(), kb_scoring_get_state(), kb_scoring_has_identity(), kb_scoring_remove(), kb_scoring_set_identity() (+7 more)

### Community 35 - "CONTRIBUTING.md: docs wire structs"
Cohesion: 0.15
Nodes (9): Documentation Policy (docs/ is canonical source of truth), Shared structs stay byte-identical convention, per-comm suspicious/borderlands score thresholds, ADR requirement for architectural changes, Branching strategy (feat/fix/docs/refactor), Per-subsystem coding standards (kb-core/kb-control-plane/kb-checker/kb-aads), C to Go wire structs (kb_wire_process_state, kb_wire_zone_transition, kb_wire_process_exit), Git Commit Authorship Guide (+1 more)

### Community 36 - "kb-op/kb-tui: kbtui Media Assets"
Cohesion: 0.15
Nodes (15): test_all_hooks.sh (live hook verification), kbtui.gif, kbtui.mp4, kb-tui Media Assets, app.rs, demo.rs (offline/demo mode), grpc.rs (UDS gRPC client), kb.rs (generated proto module) (+7 more)

### Community 37 - "kb-op/kb-mcp: main JSONRPCError JSONRPCRequest"
Cohesion: 0.26
Nodes (14): JSONRPCError, JSONRPCRequest, JSONRPCResponse, TextContent, Tool, ToolCallParams, ToolCallResult, ToolsListResult (+6 more)

### Community 38 - "docs/emergency-backup: core Cross Kernel"
Cohesion: 0.16
Nodes (14): Cilium Tetragon, kb-core Standalone Product Spec, CO-RE / BTF Cross-Kernel Portability, kb-core Event Schema & Wire Format, In-Kernel Enforcement Principle, Cross-Process Memory Injection & Hijacking Protection, Policy Engine & CEL-subset Rule Language, Privilege Escalation Detection (+6 more)

### Community 39 - "docs/specifications: struct sched process"
Cohesion: 0.20
Nodes (14): Dynamic Rules Serialization & IPC Bridge Handshake, Subsystem Allocation for Slow Exfiltration Detection, Kernel Borderlands Master System Specification, CUSUM Drift Detection, IPC Unix Socket Bridge Protocol (kbd.sock), struct kb_event_t (Unified Telemetry Frame), tracepoint/sched/sched_process_exec Hook, tracepoint/sched/sched_process_exit Hook (+6 more)

### Community 40 - "docs/specifications: Specification Rate docs"
Cohesion: 0.20
Nodes (14): docs/specdocs/ Specification Refactoring, eBPF Rate-Limiting and Performance Design Specification, Operator Interfaces Specification (Four Surfaces), Technical Specifications Catalog (docs/specdocs), Graceful Degradation under Overload, struct kb_token_bucket, BPF_MAP_TYPE_LRU_HASH (Fallback Rate-Limit State), BPF_MAP_TYPE_TASK_STORAGE (Primary Rate-Limit State) (+6 more)

### Community 41 - "kb-checker/src: check health mod"
Cohesion: 0.29
Nodes (12): HealthCheckRequest, HealthClient, trigger_auto_recovery(), check_control_plane_health(), check_control_plane_health_at(), check_swarm_health(), check_swarm_health_at(), connect_uds_grpc() (+4 more)

### Community 42 - "kb-aads/swarm: remote main agent"
Cohesion: 0.19
Nodes (7): ExecutorAgent, remote, Gateway back to the Go Control Plane. Receives consensus decisions from the…, load_config(), main(), Connects to (or starts) a Ray runtime and manages remote agent actors., RaySwarmOrchestrator

### Community 43 - "kb-core/userspace: state behavior slot"
Cohesion: 0.16
Nodes (14): kb_behavior_state_t, kb_state_name(), acc_slot(), kb_behavior_state_t, kb_scoring_result_t, kb_zone_t, check_ringbuf_drops(), map_state_to_zone() (+6 more)

### Community 44 - "kb-op/kbctl: kbctl MCP process"
Cohesion: 0.19
Nodes (14): MCP Standardized Prompts, MCP Resources (telemetry://live, rules://active, etc.), KB MCP Server, MCP Exposed Tools (kb.get_process, kb.quarantine_process, etc.), kbctl audit verify/export (SHA-256 chained ledger), kbctl CLI Client, kbctl policy reload, kbctl process isolate (SetContainment RPC) (+6 more)

### Community 45 - "docs/development: Wire Struct sock"
Cohesion: 0.18
Nodes (12): IPC v3 Wire Protocol Integration, kb_wire_process_state / ProcessState Struct (128 bytes), kb_wire_zone_transition / ZoneTransition Struct (40 bytes), /run/kb/kbct.sock (Containment/Sensitive-Path Push Socket, Go to Sensor), /run/kb/kbd.sock (Telemetry Socket, Sensor to Go), KB_WIRE_VERSION / Wire Protocol Version Field, kb_wire_process_state Struct Update Note, ZoneTransition Wire Update Note (StartTimeNs) (+4 more)

### Community 46 - "kb-checker/proto: checker proto Watchdog"
Cohesion: 0.22
Nodes (13): Watchdog Daemon Modularization (integrity/service_check/report/grpc), Three-Layer Watchdog Containment Fallback Hierarchy, Enforcement & Containment Flow (Boot to Quarantine), KISS Design Pillars (Zero State, OS Delegation, No Network, Hardened Chaining), checker.proto (Diagnostic gRPC Server Schema), health.proto (grpc.health.v1 mirror), kb.proto (Local Copy of Control Plane Schema), Safety Watchdog Protobuf Definitions (kb-checker/proto/) (+5 more)

### Community 47 - "kb-checker/src: verify integrity map"
Cohesion: 0.36
Nodes (12): HashMap, dump_contained_pids_map(), EbpfSignaturePolicy, find_contained_pids_map_fd(), Box, Error, Result, String (+4 more)

### Community 48 - "kb-core/userspace: bridge send connect"
Cohesion: 0.22
Nodes (9): kb_process_state_t, kb_zone_t, connect_once(), kb_bridge_connect(), kb_bridge_send_process_exit(), kb_bridge_send_state(), kb_bridge_send_zone_transition(), kb_bridge_try_connect() (+1 more)

### Community 49 - "kb-core/userspace: sensor behavior bridge"
Cohesion: 0.18
Nodes (13): kb_behavior.h, kb_behavior.c, Bridge (IPC layer), kb_bridge.c (heartbeats + serialization), ProcessState message transport, ZoneTransition message transport, find_elf_symbol_offset (ELF offset resolver), Go TLS Attacher (+5 more)

### Community 50 - "misc: check Health HealthCheckResponse"
Cohesion: 0.23
Nodes (9): Health, HealthCheckResponse, MockHealthService, Request, Response, Result, Status, test_grpc_health_check_serving() (+1 more)

### Community 51 - "kb-aads/comms: KernelBorderlandsServicer GetProcessState ListZone"
Cohesion: 0.17
Nodes (6): KernelBorderlandsServicer, Submit agent decision, KB Control Plane Service, List processes in a zone, Set containment level, Stream real-time events

### Community 53 - "docs/development: pipeline agent Hunter"
Cohesion: 0.24
Nodes (10): Ray RLlib (MARL) pipeline with Gymnasium multi-agent env, Containment militia — coordinated squad executing escalation sequence, Hunter agentic tool-call loop design (ReAct-style reasoning), JJE as active courthouse for sub-agent oversight (restart/revoke/termination ladder), Phase 0 — Data pipeline (attack-lab + dataset), Phase 1 — Fix AADSEnv for real RL training, Phase 3 — Agentic QLoRA fine-tuning pipeline for Hunter, RL-vs-LLM per-agent assignment split (Jury/Healer/Containment=RL, Hunter=LLM) (+2 more)

### Community 54 - "docs/project: Agent Behavioral Boundary"
Cohesion: 0.25
Nodes (11): Executor Agent, Judge Agent, Jury Agent, Behavioral Boundary Model, Behavioral Scoring Engine (BSE), Boundary Classifier, Kernel Borderlands: Behavioral Defense at Ring Zero (Whitepaper), Transparency, Explainability, Controllability Design Commitments (+3 more)

### Community 55 - "docs/architecture: kernel LSM BPF"
Cohesion: 0.24
Nodes (9): GRUB lsm= boot parameter configuration for bpf LSM, Baseline kernel requirement (CONFIG_BPF_LSM=y, BTF, kernel>=5.8), BPF_CORE_READ safe kernel memory access macro, BTF (BPF Type Format), Kernel/distro compatibility matrix (5.8+ required), CO-RE (Compile Once – Run Everywhere), Fallback policy (LSM→fentry→tracepoint→kprobe; RingBuf→PerfBuffer), libbpf skeleton loader (+1 more)

### Community 56 - "docs/development: SSH MCP gRPC"
Cohesion: 0.22
Nodes (11): /run/kb/kba.sock (gRPC UDS Socket), OpenSSH + ForceCommand Migration (replaces custom Go SSH server), SSH Hardening & MCP Metrics Implementation Plan, GetSystemStats gRPC Endpoint (MCP kb.get_statistics), controlplane.go (listenUnix / Start / Stop), internal/ssh/ Package (Control Plane SSH Service), kb-mcp/main.go (MCP Server Entrypoint), kb-tui Rust Crate (Pure Remote Operator Interface) (+3 more)

### Community 57 - "docs/development: AADS UDS gRPC"
Cohesion: 0.18
Nodes (11): Ray Shared Mutable State for the AADS Swarm, Control Plane to AADS Development Discussions Catalog, Real Comms UDS Verification Guide, AADS gRPC-over-UDS Client & Tests Walkthrough, Documentation Index (docs/README.md), grpc_client.py (AADS gRPC Client), test_grpc_client.py (Mock gRPC Server UDS Tests), verify_real_connection.py (Real UDS Connection Test) (+3 more)

### Community 58 - "docs/reports: LSM SQLite BPF"
Cohesion: 0.18
Nodes (11): eBPF Core & Go Daemon Technical Enhancements Report, Sequence-Aware Behavioral State Machine (BSE), Authoritative VFS LSM File Blocking (BPF LSM), Extended Threat Detection (In-Context Hijacking Mitigations), L2 SQLite Flush Shutdown Race Bug/Fix, Plaintext TLS Inspection (Multi-Library Hooking), audit_log SQLite Table Schema, Immutability Chain (SHA-256 Hashed Audit Logs) (+3 more)

### Community 59 - "docs/reports: checker Simulation Event"
Cohesion: 0.18
Nodes (11): Work Report — July 8, 2026, checker_tests.rs Integration Test Suite, Threat Simulation Event Sets (7 profiles), Active Heartbeat & Hook Liveness Checking, Dynamic JIT Instruction Hashing, BPF Map Self-Healing, BPF Program Performance Audits (500ns Latency Threshold), Ray Swarm Connection Resilience (Retry Logic) (+3 more)

### Community 60 - "kb-control-plane/internal: rules KBWireAttackRule YAMLPolicy"
Cohesion: 0.24
Nodes (9): KBWireAttackRule, YAMLPolicy, YAMLRule, Conn, parseFlags(), parseSequence(), SendRulesPayload(), T (+1 more)

### Community 61 - "kb-core/userspace: behavior get reason"
Cohesion: 0.29
Nodes (10): kb_behavior_record_t, kb_behavior_result_t, behavior_slot(), kb_evidence_t, kb_behavior_evaluate(), kb_behavior_get(), kb_behavior_get_or_create(), kb_behavior_remove() (+2 more)

### Community 62 - "kb-op/kb-tui: cmd query contain"
Cohesion: 0.62
Nodes (10): cmd_contain(), cmd_pid(), cmd_stats(), cmd_zone(), help_text(), KbClient, Option, String (+2 more)

### Community 63 - "docs/architecture: sock run kbd"
Cohesion: 0.27
Nodes (9): /run/kb/kbc.sock — kb-checker diagnostic socket, kb-checker.service systemd unit (Rust safety daemon), /run/kb/kbct.sock — control push channel (Go to sensor), kbd.service systemd unit (Go Control Plane), /run/kb/kbd.sock — telemetry pipe (sensor to Go, one direction), Ray Swarm / AADS Node boot phase 3, Socket topology: kbd.sock, kbct.sock, kba.sock, kbc.sock, Critical Process Module (CPM) (+1 more)

### Community 64 - "kb-core/include: Context Hijacking Mitigation"
Cohesion: 0.20
Nodes (10): In-Context Hijacking Mitigation, In-Context Hijacking Mitigation Report, kb-core Headers Directory, kb_common.h, kb_rules.h (kb_wire_attack_rule), vmlinux.h, inspect-bpf-state.sh, run-sensor.sh (+2 more)

### Community 65 - "docs/emergency-backup: Capability Standalone Product"
Cohesion: 0.24
Nodes (10): Adapter Plugin Interface, kb-cp Standalone Product Spec, Capability Discovery API, Capability Model (not Tool Model), Command Safety Layer (Validate/Dry-Run/Audit), kb-op Standalone Product Spec, One Capability, One Implementation, N Front-Ends, kb-op / kb-cp Scope Boundary (+2 more)

### Community 66 - "docs/project: Project Synopsis Karthik"
Cohesion: 0.38
Nodes (10): GitHub Discussion Welcome Post, KB Team Ownership Model, 4-1/4-2 Goal & Prioritization Plan, Project Documentation Index, Expected Outcomes (Synopsis), Kernel Borderlands — Major Project Synopsis, Karthik (K. Karthik), Pardhu Varma (K. Pardhu) (+2 more)

### Community 67 - "kb-aads/agents: message messages BaseAgent"
Cohesion: 0.27
Nodes (3): BaseAgent, Base class for distributed swarm agents. Deliberately NOT @ray.remote here —…, Invoked remotely to pass messages across nodes.

### Community 68 - "kb-aads/comms: grpc client add"
Cohesion: 0.24
Nodes (4): KernelBorderlandsStub, KB Control Plane Service, Constructor. Args: channel: A grpc.Channel., run_verification()

### Community 69 - "kb-aads/consensus: consensus init jje"
Cohesion: 0.29
Nodes (5): JudgeAgent, JuryAgent, remote, Orchestrates consensus rounds when Patrollers raise anomaly alerts., Dynamic actor spawned to verify threats and cast votes.

### Community 70 - "kb-core/userspace: Behavior Engine unit"
Cohesion: 0.20
Nodes (10): test.sh, test_behavior.c (Behavior Engine unit tests), EMA Smoothing, Behavior Engine, kb_baseline.c, kb_lineage.c, kb_metrics.c, kb_scoring.c (+2 more)

### Community 72 - "docs/getting-started: Ray Actors TCP"
Cohesion: 0.25
Nodes (9): Ray Actors (Agent Communication Model), Installation Guide, Getting Started Index, Kernel Borderlands + AADS Technical Requirements, scripts/setup/install.sh, libbpf Dependency, Redis Rejected — No-TCP-Fallback Constraint, UDS-Only, No TCP Fallback Constraint (+1 more)

### Community 73 - "docs/emergency-backup: Adapter auditd Linux"
Cohesion: 0.22
Nodes (9): auditd (Linux Audit Subsystem), Adapter Registry & Router, auditd Adapter, ClamAV Adapter, fail2ban Adapter, Firewall Adapter (nftables/iptables/firewalld/ufw), AppArmor/SELinux MAC Adapter, Unified SecurityEvent Schema (+1 more)

### Community 74 - "docs/development: Dynamic Rule Work"
Cohesion: 0.22
Nodes (9): ADR-1 L1 sync.Map / L2 SQLite WAL Hybrid Storage, kb-control-plane Work Catalog (Completed Work & Open Gaps), Dynamic Rule Delivery System, JJE (Judge/Jury/Executor) Consensus Flow, /run/kb/kbc.sock (kb-checker Diagnostic Socket), Ray Plasma Object Store (Immutable Shared Memory), SwarmMemory Actor (Round-Scoped Shared Mutable State), Dynamic Rule Delivery System (+1 more)

### Community 76 - "docs/development: docs type KBEvent"
Cohesion: 0.28
Nodes (7): pb.Alert stream (BORDERLANDS_ENTRY alert_type), pb.KBEvent.EventType values (process_state, zone_transition), Resolved question: kb-core pre-computes ScoreDelta, Go just forwards it, HunterAgent.handle_message expects flat dict, actual wire is KBEvent proto, No live ingestion path from StreamEvents/StreamAlerts to any AADS agent, PatrollerAgent KB_EVENT message-type — third distinct convention, may be primary StreamEvents consumer, kb-control-plane producer side (OnZoneTransition, fanOutEvent/fanOutAlert) already complete

### Community 77 - "docs/specifications: Gating Control Plane"
Cohesion: 0.28
Nodes (9): Systemd Boot Gating & Workload Gating Timeline, Go Control Plane UDS Migration Hand-off Spec, Safety & Integrity Monitor Loops Design Specification, /run/kb/kba.sock (gRPC Enforcement IPC UDS), kb-tui (SSH Console), AADS Swarm Status Verification (30s interval, Ray REST), Containment and Auto-Recovery Protocol, Control Plane Availability Verification (5s interval, 100ms timeout) (+1 more)

### Community 78 - "kb-aads/tests: fixture grpc server"
Cohesion: 0.22
Nodes (3): fixture, grpc_server(), MockKernelBorderlandsServicer

### Community 80 - "docs/emergency-backup: Agent AADS Decision"
Cohesion: 0.36
Nodes (8): AADS Decision Audit Trail, Healer Agent, Hunter Agent, Idle Pool (Agent Reserve Capacity), Patroller Agent, Built-in Telemetry Adapters, kb-aads Standalone Product Spec, Narrow and Real Beats Broad and Stubbed

### Community 81 - "docs/emergency-backup: Blast Radius Classification"
Cohesion: 0.25
Nodes (8): Blast Radius Classification, Rate-Limiting & Circuit Breaker, Consensus & Voting Mechanism, Containment Agent, Built-in Enforcement Connectors, Hard Safety Rules Outside the Learned Policy, Human-in-the-Loop Escalation, Swarm State Machine (per-subject)

### Community 82 - "docs/development: Tier Rejection sync"
Cohesion: 0.25
Nodes (8): Rejection of CGO context-switching translation tax, Lockless dual-track routing (sync hot path / async cold path), Tier 1: L1 Execution Layer (sync.Map, lock-free Go memory), Tier 2: L2 Persistence Layer (embedded SQLite WAL), Rejection of RocksDB/LevelDB key-value systems, Embedded Hybrid Two-Tier In-Process Storage Architecture (L1/L2), Volatile memory risk mitigation via /proc rescan on cold start, SQLite WAL (Write-Ahead Logging) mode configuration

### Community 83 - "docs/emergency-backup: Fabric Model Reconciliation"
Cohesion: 0.25
Nodes (8): kb-op Built-in Local Backend Daemon, ctl — CLI Client, Fabric Model (Declarative OS-Posture Reconciliation), Fabric Spec Formats (.yaml/.conf/.fabric/.lua/Nix), mcp — Model Context Protocol Server, Reconciliation Loop, tui — Terminal Console, kb-op Web Dashboard

### Community 84 - "docs/reports: Report Work Control"
Cohesion: 0.25
Nodes (8): Control Plane Progress Report (June 26, 2026), AI Dependency Constraint (Sec 7.1), kbd Daemon Skeleton Milestone, Technical Work Report — July 7, 2026, Permanent Developer Guidelines & Agent Memory Updates, kb-op/ Operator Interface Consolidation, Off-Tree GitHub Wiki Sync, Work Reports Catalog

### Community 86 - "kb-core/userspace: sha cached final"
Cohesion: 0.50
Nodes (6): kb_sha256_cached_file(), kb_sha256_file(), kb_sha256_final(), kb_sha256_init(), kb_sha256_transform(), kb_sha256_update()

### Community 88 - "docs/development: Sensitive Path paths"
Cohesion: 0.29
Nodes (7): kb_lsm_file_open BPF LSM Hook, kb_sensitive_paths eBPF Hash Map, VerifyStartTime / PID-Reuse Guard, sensitive_paths.go (Sensitive Path Wire Push, msg_type=6), policy.go (Sensitive Path Policy Compilation), /etc/passwd Deliberately Excluded from Sensitive-Path Blocking, Zero-Padding Mismatch Bug Silently Defeated Every Block (fixed)

### Community 89 - "docs/development: detection exfiltration algorithm"
Cohesion: 0.33
Nodes (6): Candidate additional hook points (process_vm_writev, security_capable, do_execveat_common, /proc/*/mem write), Connection Lifecycle Autocorrelation algorithm, Cumulative Sum (CUSUM) anomaly detection algorithm, Low & slow exfiltration threat model (via authorized sockets), NetFlowWindow Go implementation (sliding window entropy calc), Shannon Entropy of packet intervals (beaconing detection)

### Community 90 - "docs/specifications: Behavior Engine Event"
Cohesion: 0.33
Nodes (7): Stateful Behavior Engine (kb-core/userspace/behavior/), Behavior Zone Model (SAFE/SUSPICIOUS/BORDERLANDS/CONTAINED), Advisory Scoring Engine (EMA, 6 Weighted Dimensions), Event Flag Classifications (Bitwise Threat Identifiers), sys_enter_process_vm_writev Hook, KB_EVENT_DROPPED_TELEMETRY Confidence Degradation, Event Priority Classification Tiers (Tier 1/2/3)

### Community 91 - "kb-aads/agents: investigate HunterAgent handle"
Cohesion: 0.33
Nodes (3): HunterAgent, remote, Hunter agents investigate suspicious processes. Activated when KB reports…

### Community 92 - "kb-aads/comms: process state containment"
Cohesion: 0.29
Nodes (3): Submit agent action back to the Go Control Plane for enforcement. Live today…, Query process state by PID., Set containment level for a PID.

### Community 93 - "kb-core/userspace: Collectors telemetry acquisition"
Cohesion: 0.29
Nodes (7): Collectors (telemetry acquisition), kb_file.c, kb_memory.c, kb_network.c, kb_privilege.c, kb_process.c, kb_syscall.c

### Community 94 - "docs/development: control node docs"
Cohesion: 0.40
Nodes (4): Open question: multi-node Ray inter-node TCP transport tension with UDS-only invariant, Phase 6 — vendor-centralized production feedback loop / retraining, IPC v3 Wire Protocol Integration, Core to Control Plane Development Discussions Catalog

### Community 95 - "docs/development: ebpf policies json"
Cohesion: 0.40
Nodes (5): Tampering Containment Protocol (eBPF integrity violation response), Three-stage watchdog containment fallback hierarchy (SIGKILL, bpftool detach, iptables quarantine), Build-time SHA-256 JIT signature generation (ebpf_policies.json), No daemon self-signing rule (kb-checker never writes ebpf_policies.json), Read-only /etc/kb/ebpf_policies.json (0444, root:root) enforces integrity

### Community 96 - "kb-op/kbctl: main CancelFunc kbctl"
Cohesion: 0.33
Nodes (3): CancelFunc, Context, withTimeout()

### Community 97 - "docs/development: Logger Audit Hash"
Cohesion: 0.33
Nodes (6): Logger.VerifyChain() Audit Hash-Chain Verification, step-ca CIS/SSH Certificate Authority Integration, audit.go (SHA-256 Hash-Chain Audit Logger), listener.go (Unix Socket Accept Loop), process.go (Upsert/Remove/VerifyStartTime), schema.go (SQLite Schema Init)

### Community 98 - "kb-aads/agents: ContainmentAgent handle message"
Cohesion: 0.33
Nodes (3): ContainmentAgent, remote, Containment agents isolate malicious processes.

### Community 99 - "kb-aads/agents: HealerAgent handle message"
Cohesion: 0.33
Nodes (3): HealerAgent, remote, Healer agents recover compromised systems and restore normal operation.

### Community 100 - "kb-aads/agents: PatrollerAgent handle message"
Cohesion: 0.33
Nodes (3): PatrollerAgent, remote, Patroller agents monitor baseline process behavior. Always active, watching for…

### Community 101 - "kb-core/tests: all hooks pause"
Cohesion: 0.60
Nodes (5): ok(), pause(), run_sudo_optional(), section(), test_all_hooks.sh script

### Community 103 - "kb-core/userspace: handle memory event"
Cohesion: 0.40
Nodes (3): __u32, handle_event(), prot_str()

### Community 104 - "kb-core/userspace: syscall handle get"
Cohesion: 0.40
Nodes (3): __u32, get_syscall_name(), handle_event()

### Community 106 - "misc: checker build main"
Cohesion: 0.40
Nodes (4): main(), Box, Error, Result

### Community 107 - "kb-op/kb-dashboard: dashboard index html"
Cohesion: 0.40
Nodes (5): kb-dashboard index.html, src/main.tsx entry script, Oxlint configuration, kb-dashboard React + TypeScript + Vite template, kb-dashboard (Web UI)

### Community 108 - "misc: tui build main"
Cohesion: 0.40
Nodes (4): main(), Box, Error, Result

### Community 109 - "kb-aads/swarm: Class HealthMonitor Swarm"
Cohesion: 0.50
Nodes (4): HealthMonitor Class, Swarm Orchestration (kb-aads/swarm/), RogueDetector Class, RoleManager Class

### Community 110 - "kb-core/ebpf: bpf always inline"
Cohesion: 0.67
Nodes (3): __always_inline, is_sensitive_path(), kb_handle_openat()

### Community 114 - "docs/emergency-backup: MARL Training Loop"
Cohesion: 0.67
Nodes (3): MARL Training Loop, Reward Signal Design, Attack-Scenario Simulation Library (ATT&CK-structured)

### Community 115 - "docs/development: Behavior Engine Behavioral"
Cohesion: 0.67
Nodes (3): Behavior Engine, Behavioral State Machine States (SAFE...RECOVERING), Behavior Engine Architecture & Implementation Report

### Community 116 - "docs/development: eBPF Plaintext TLS"
Cohesion: 0.67
Nodes (3): eBPF Plaintext TLS Inspector, eBPF TLS Plaintext Payload Extraction, Uprobe Context-Switching Tax & Mitigations

### Community 117 - "kb-aads/consensus: aads Consensus Quorum"
Cohesion: 0.67
Nodes (3): Consensus & Quorum System (kb-aads/consensus/), Weighted M-of-N Voting Model, AADS Tests (kb-aads/tests/)

### Community 122 - "kb-control-plane/go.mod: github com pardhuvarmax"
Cohesion: 0.67
Nodes (3): github.com/pardhuvarmax/kernel-borderlands/kb-control-plane, github.com/pardhuvarmax/kernel-borderlands/kb-op/kb-mcp, github.com/pardhuvarmax/kernel-borderlands/kb-op/kbctl

## Ambiguous Edges - Review These
- `Behavior Zone Model (SAFE/SUSPICIOUS/BORDERLANDS/CONTAINED)` → `Advisory Scoring Engine (EMA, 6 Weighted Dimensions)`  [AMBIGUOUS]
  docs/specifications/kernel_borderlands_specification.md · relation: rationale_for
- `verify_map_integrity()` → `kb_sensitive_paths Hash Map`  [AMBIGUOUS]
  kb-checker/src/integrity/README.md · relation: conceptually_related_to
- `allowlist.yaml (Process Allowlist)` → `Policy Engine`  [AMBIGUOUS]
  kb-control-plane/config/allowlist.yaml · relation: references
- `SSH Package (Hardened SSH Server)` → `SSH Package (Hardened SSH Server)`  [AMBIGUOUS]
  kb-control-plane/internal/ssh/README.md · relation: references

## Knowledge Gaps
- **285 isolated node(s):** `ControlPlane`, `KBWireAttackRule`, `ContainmentCmdMsg`, `removeWrite`, `containmentWrite` (+280 more)
  These have ≤1 connection - possible missing edges or undocumented components.
- **50 thin communities (<3 nodes) omitted from report** — run `graphify query` to explore isolated nodes.

## Suggested Questions
_Questions this graph is uniquely positioned to answer:_

- **What is the exact relationship between `Behavior Zone Model (SAFE/SUSPICIOUS/BORDERLANDS/CONTAINED)` and `Advisory Scoring Engine (EMA, 6 Weighted Dimensions)`?**
  _Edge tagged AMBIGUOUS (relation: rationale_for) - confidence is low._
- **What is the exact relationship between `verify_map_integrity()` and `kb_sensitive_paths Hash Map`?**
  _Edge tagged AMBIGUOUS (relation: conceptually_related_to) - confidence is low._
- **What is the exact relationship between `allowlist.yaml (Process Allowlist)` and `Policy Engine`?**
  _Edge tagged AMBIGUOUS (relation: references) - confidence is low._
- **What is the exact relationship between `SSH Package (Hardened SSH Server)` and `SSH Package (Hardened SSH Server)`?**
  _Edge tagged AMBIGUOUS (relation: references) - confidence is low._
- **Why does `ControlPlane` connect `kb-control-plane/internal: TestRecordStoreResult TestHealthService TestContain` to `kb-control-plane/internal: TestSendContainmentCmd Conn wire`, `kb-control-plane/proto: KernelBorderlands Handler ExportAuditLog`, `kb-control-plane/proto: KernelBorderlands Handler ListZone`, `kb-control-plane/internal: Command runDaemon auth`, `kb-control-plane/proto: KBEvent GetComm GetEventType`, `kb-control-plane/internal: policy New TestNewWithMalformedYAMLErrors`, `kb-core/tests: send flood cwp`?**
  _High betweenness centrality (0.283) - this node is a cross-community bridge._
- **Why does `/run/kb/kba.sock (gRPC Enforcement IPC UDS)` connect `docs/specifications: Gating Control Plane` to `kb-aads/comms: grpc client add`, `kb-checker/proto: checker proto Watchdog`?**
  _High betweenness centrality (0.241) - this node is a cross-community bridge._
- **Why does `kb-checker/README.md (KISS/no-state/no-network invariant)` connect `kb-checker/proto: checker proto Watchdog` to `CONTRIBUTING.md: docs wire structs`, `kb-aads/marl: Agent install aads`, `docs/specifications: Gating Control Plane`, `docs/development: pipeline agent Hunter`, `docs/reports: checker Simulation Event`?**
  _High betweenness centrality (0.204) - this node is a cross-community bridge._