ZidoCode

Write-ahead ledger for agent side effects, with an OWASP Agentic Top 10 posture scorer. Disclosure — records the arguments (up to 4000 chars: terminal commands, file contents, MCP args) and a 300-char result digest of every state-changing tool call in a local plaintext SQLite ledger under HERMES_HOME/plugin-data/agent-ledger/ that is never pruned; injects a warning listing this session's unconfirmed calls into the next turn's context; an optional policy engine (off by default; you add policy.json and set policy_mode) can refuse matching tool calls before they run; the optional posture_daily.py script, run from your own cron, sends a score summary to Telegram with the bot token you give it.

Context-window forensics: per-turn input/output token estimates, the single largest tool output of each turn, oversized tool calls (args over 50 KB), and compaction events, recorded as metadata only (tool name, byte length, ids, timestamps — never args or results) in a local SQLite DB under HERMES_HOME/plugin-data/context-audit/. Adds a /context-audit slash command that prints the top 5 context eaters over a window with one mitigation per entry.