feat(guard): egress catch/log/block layer installed at CLI entrypoint; audit Part 6-7

FORK-AUDIT.md

@@ -202,6 +202,56 @@ or network egress to Anomaly endpoints is observed from Neuron processes.
 
 ---
 
+## Part 6: The shape argument — intent, capability, and the Neuron Guard
+
+**Thesis.** Judge agent software by capability envelope and governance, not
+by component justifications. Every dangerous element found here had a
+plausible local alibi (updates, catalog, compliance). But the aggregate — a
+program running with full user permissions that executes arbitrary commands,
+replaces its own binary from a remote endpoint, carries long-lived identity
+credentials on every call, defeats third-party policy gates, stores secrets
+in plaintext, and configures its own judgment invisibly — is the exact
+capability envelope of hostile software.
+
+**On intent.** "Malice" requires purpose, which cannot be proven from code;
+what IS provable is intentional construction of unilateral control over
+machines the builder does not own, kept default-on, wrapped in opacity.
+Security doctrine treats concealed dangerous capability as hostile regardless
+of stated motive — the hidden camera is the violation, not the footage.
+Recklessness at this capability level is indistinguishable from malice in its
+outcomes. The invited-guest rule: hospitality ends when access outlives the
+invitation.
+
+**Why openness still matters:** visibility did not prevent upstream's sins,
+but it made them provable and removable. Closed agents run the same envelope
+plus opacity, minus recourse. The fork converted vendor-shaped control into
+owner-shaped control.
+
+## Part 7: The Neuron Guard (enforcement, not observation)
+
+Since knowing is insufficient, egress is now caught, logged, and prevented:
+
+- **Module**: `packages/opencode/src/guard/index.ts`, installed at the very
+  top of the CLI entrypoint before any provider/plugin/update path loads.
+- **Mechanism**: wraps `globalThis.fetch`; records every outbound request as
+  JSONL to `~/.local/state/neuron-guard.jsonl` (timestamp, host, URL,
+  blocked-flag).
+- **Modes** (`NEURON_GUARD` env):
+  - unset / `log`: record all egress, block nothing (default)
+  - `strict`: additionally BLOCK denylisted hosts — currently
+    `opencode.ai`, `anomalyco.com`, `github.com/anomalyco`
+- **Exemptions**: `NEURON_GUARD_ALLOW="host1,host2"`.
+- **Verified**: strict-mode test confirmed allow-passthrough for normal hosts
+  and hard block + log entry for opencode.ai.
+- **Known limits**: covers only fetch-based egress inside this process; native
+  subprocess sockets and child processes are outside its view. OS-level
+  firewall rules remain the stronger boundary for adversarial cases.
+
+Escalation criteria from Part 4b remain in force; the guard log is now the
+primary evidence source for them.
+
+---
+
 ## Part 5: Open discussion points
 
 1. The workspace/sync runtime (`control-plane/workspace.ts`, ~966 lines) still