We considered 3 architectures: in-agent plugin (rejected — requires per-framework code changes), sidecar container (rejected — Docker dependency), and transparent proxy (chosen — zero code changes, any LLM backend). The proxy intercepts on port 11435, forwards to your LLM on 11434. Your agent doesn't know it's being protected. Same Swiss Cheese Model (James Reason, 1990) used in aviation safety.

🪟 What We Protect — Full Defense Grid

✅ Conversation Layer: Prompt injection, goal drift, jailbreaks, persona hijacking, multi-turn escalation, encoded payloads, financial action gating, multi-agent trust chain (POAW).
✅ API Anti-Bypass: 4-Layer Anti-Extraction Shield — φ-jittered confidence noise (differential privacy), probe-pattern anomaly detection, canary layer randomization, session entropy budgets. Extracting thresholds takes 3.5+ years while Stellschrauben rotate every ~2 weeks.
✅ Runtime Memory: 5-Layer FORTRESS — immutable config (deep freeze), mutation blocking (proxy guards), V8 inspector disablement, core dump protection, SHA3-256 integrity heartbeat (60s cycle).
✅ Network: CORS whitelisting, rate limiting (ThrottlerGuard), API key entropy guards, Post-Quantum Cryptography (ML-DSA/ML-KEM).
✅ Meta-Detection: SIREN Bypass Detection Correlator — meta-detector that catches attacks specifically designed to circumvent individual layers.
❌ Out of scope: Physical hardware attacks (Spectre/Meltdown-class), pre-installed OS-level rootkits, and cold-boot memory forensics on the host machine. These require hardware-level TPM solutions beyond software scope.

🔴 OWASP ASI — Honest Self-Assessment

We mapped against all 10 OWASP agentic categories and believe we have coverage. But: this is our self-assessment, not an external audit. No Cure53 or Trail of Bits review yet. Your independent validation helps close that gap.

📊 Verify, Don't Trust

V91 Benchmark: 8.06M prompts | TPR 95.48% | FPR 3.78% | 7,801 p/s (peak 76,726) | 28 CPU + 1 NPU bridge. These are our numbers, not independent verification. That's why the consortium exists — we need YOUR numbers.

🌍 Why We Dress Your Agent for Free

247,000 GitHub stars on OpenClaw. Zero safety layers. This isn't a market opportunity — it's a responsibility. The consortium exists because we need engineering proof, not marketing proof. "Vertrauen verkauft, nicht Pitches." — Trust sells, pitches fade.