The actual output. Nothing staged.

This is the one that can't be staged. We took 20 real, public agent trajectories (actual tool-use traces from agents we didn't build) and ran them through the engine. Reach means: did the agent go beyond what its task authorized?

Pass 1 is clean behavior, so the engine should raise no alarms, and it raised none. Pass 2 plants one real over-reach in each trace, so the engine should catch every one, and it did. The integrity line confirms the engine read the real traces faithfully.

10,403 real shell commands from 335 public agent trajectories, produced by three agent frameworks we didn't build (SWE-Agent, mini-SWE-Agent, OpenHands) solving real repository tasks. The engine had never seen any of them. There's no answer key for behavior in the wild, so the point isn't a score. The point is the behavior: it judged every chain link by link, and where a command's effect could not be read from the command itself, it said so rather than guessing. Note what these agents are: coding agents, which pipe arbitrary code into interpreters as a matter of routine. The policy here is deliberately paranoid (network and destructive verbs blocked outright), which is why 680 ordinary developer actions are stopped. Policy is declared by the operator, not by us. What the engine guarantees is that nothing gets past it unexamined.

The hardest case for any watcher: an agent that hides what it's doing, assembling a dangerous command from harmless-looking fragments so a keyword scanner sees nothing. A plain curl trips the obvious watch. But a constructed curl, built at runtime from pieces, trips a different one: not because we decoded the disguise, but because the act of hiding is itself the fact we record.

Scale. 500,000 agents run through the full pipeline, every verdict checked against an independent oracle: a separate, simpler source of truth built to disagree if the engine is wrong. It didn't disagree once. The engine routed every agent correctly across all five outcomes, including the one that matters: breach by undeclared action.

Speed is what lets it prevent rather than just record. 200,000 block-or-allow decisions through the real engine on this laptop, every verdict matched against an independent oracle. The traces are synthetic; the engine, the clock, and the correctness check are not. Worst-case block time: 41 microseconds (p99). End to end, including parse and transport, p99 stays under 200µs (receipt 06). The agent being guarded cannot act faster than roughly 100,000µs, because it has to run an inference first. The gate costs less than a fifth of one percent of the agent's own cycle, which is why it can sit in the path and stop an action rather than flag it afterward.

This one we show honestly, ceiling and all. Threaded is one process: it flatlines at one core's worth of work, the latency climbing as load piles on. That's the honest single-process limit, and we print it rather than hide it. Pool is the real answer: one worker per core behind a socket, throughput rising to ~33,000 decisions/sec measured on this one laptop. We want to be precise about that number: it's the highest we measured here, not a known ceiling. We haven't found the top yet, and on server hardware with more cores it should go higher. Every figure includes the real parse, transport, and decide. Wrong = 0 at every level.