diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..fff1545
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,16 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run tests
+        run: swift test
+      - name: Build app
+        run: bash scripts/build_app.sh
+        continue-on-error: true
diff --git a/README.md b/README.md
index 0cc145f..93abd26 100644
--- a/README.md
+++ b/README.md
@@ -53,21 +53,39 @@ without requiring enterprise EDR tooling or kernel entitlements.
   a restart instead of resetting to empty.
 - **System notifications** — a real macOS notification for matched events at
   or above a threshold you choose (off by default beyond critical-only).
+  Notifications carry "Show in Argus" and "Allowlist…" action buttons — the
+  allowlist action goes through the exact same Touch ID gate as the in-app path.
   Authorization is requested once on first launch.
+- **Event export** — right-click an event to "Copy as JSON"; from the History
+  panel, export the full event history as JSON or CSV (RFC 4180-quoted so
+  command lines with embedded commas and quotes don't misalign spreadsheets).
 - **Settings** (gear icon in the header) — poll interval and risk-decay
-  half-life are tunable now rather than fixed constants, plus the
-  notification threshold.
+  half-life are tunable now rather than fixed constants, the notification
+  threshold, and a "Launch at login" toggle (macOS 13+, uses SMAppService).
 
 The app is dark-only by design, matching a monitoring-console identity — it
 does not follow the system light/dark appearance toggle.
 
 ## How detection works
 
-`ProcessMonitor` samples `ps -axww -o pid,ppid,command` roughly every 1.2s
+`ProcessMonitor` samples `ps -axww -o pid,ppid,user,command` roughly every 1.2s
 and diffs it against the previous sample to find newly-spawned processes.
 Each new process is checked against every active rule; a match becomes an
 event with severity, a MITRE technique label, and an explanation.
 
+The sample includes the user column now, so rules can match `User` and
+`ParentUser` fields. Parent context (image, command line, and user) is
+resolved from a cross-tick cache retained for ~3 polling intervals, so a
+short-lived parent that exits before the next poll still resolves for
+parent-keyed rules — a common race in LOLBin chains where a spawned parent
+like `sh -c` is gone from the process table by the next sample.
+
+The `ps` invocation has a 10-second hard timeout. After 3 consecutive
+sampling failures, the app enters a visible "degraded" state: the menu bar
+icon switches to a warning triangle, a warning row appears in the flyout, and
+a MONITOR DEGRADED badge shows in the header. This prevents a failed sample
+from being mistaken for "no processes running". Recovery is automatic.
+
 This is **polling-based, not kernel-event-based** — deliberately. True
 exec()-level capture on macOS requires the `endpoint-security` entitlement,
 which Apple grants by application review, not something obtainable
@@ -78,22 +96,87 @@ exits within the ~1.2s window can be missed as an individual event (though a
 parent shell invoking it inline is still visible, since the parent's full
 command line is what `ps` reports).
 
+### Sequence and chain correlation
+
+When distinct techniques fire in the same process tree within a rolling
+10-minute window, Argus emits a synthetic "Suspicious sequence" event. Its
+severity is escalated one level above the members' maximum (capped at
+critical), and the event lists the member processes and rules. This is the
+signal the "Why this, specifically" section calls out: a single LOLBin invocation is often
+unremarkable, but two or more different techniques firing inside the same
+process tree is a much stronger indicator. Same-rule refires, same-pid
+multi-rule matches, and process trees related only through launchd don't
+qualify as chains.
+
+### Persistence-artifact watcher
+
+An independent, event-driven sensor watches standard macOS persistence
+locations: `~/Library/LaunchAgents`, `/Library/LaunchAgents`,
+`/Library/LaunchDaemons`, and `/etc/periodic`. Added or modified files are
+reported with elevated severity; removals are also watched. Baseline state
+at startup is silent, but the watcher catches persistence artifacts even
+when the writing process was too short-lived for the polling monitor to ever
+sample it. Allowlist filtering deliberately doesn't apply to these events —
+a persistence artifact change is a different thing than an allowlisted
+process.
+
+### Tamper evidence
+
+The app records HMAC-SHA256 MACs of `rules-state.json` and `allowlist.json`
+on every authenticated write into a sidecar `integrity.json` file. The signing
+key is stored in the login Keychain (service "Argus", account
+"integrity-key") rather than on disk, so rewriting the
+guarded files in place is not by itself enough to also fix up their MACs. At
+launch, any mismatch between a file's current contents and its recorded MAC
+is surfaced as a critical "Detection state modified outside Argus" event (T1562.001),
+so the tamper itself becomes visible in the feed. This is evidence, not prevention — a same-user attacker can still rewrite the files, but no longer
+silently.
+
+### Provenance attribution
+
+Every matched event's process ancestry is classified against a table of known supervisors:
+AI coding agents (`claude`), container tooling (`docker`), package managers (`brew`),
+terminals (`Terminal`/`iTerm2`/`tmux`), and IDEs (`VS Code`/`Cursor`). When a supervisor
+is found in the ancestry, a dim "via claude"-style chip appears on the event row in the
+feed and matches in the search field too. Rules can also match the raw ancestry via new
+`AncestorImages` and `AncestorCommandLines` fields — semicolon-joined, nearest first —
+for precise correlation.
+
+This is attribution for triage and visibility, not authorization. Ancestry is spoofable,
+so tags never grant implicit trust. The only sanctioned uses are explicit, user-visible
+mechanisms: the provenance-scoped allowlists (described below) and notification quieting,
+both user-chosen. When an event's process ancestry indicates it ran under an attributed
+supervisor and matches certain sensitive technique categories (persistence T1543/T1547/T1053,
+credential access T1555/T1552/T1539, defense evasion T1562/T1553), an escalation rule fires
+("AI agent session touched a sensitive technique") one severity level above the underlying
+matches, capped at critical — because a prompt-injected agent session doing persistence is
+exactly how that compromise presents. Routine agent-attributed events can have their
+*notifications* quieted via a default-on Settings toggle; the feed, history, risk score,
+and log remain unaffected, and a counter in Settings shows how many were quieted.
+
 ## Rule format and management
 
 Rules are [Sigma](https://github.com/SigmaHQ/sigma) — the open, vendor-
 neutral YAML format the wider detection-engineering community actually
 publishes in, rather than a bespoke format invented for this app. A rule is
-a `logsource` (we only match `category: process_creation`, `product: macos`),
-a named `detection` block of field/modifier/value selections
-(`CommandLine|contains`, `Image|endswith`, `ParentImage|contains`, `|re`
-regex, `|all` for AND-of-list, etc.), and a `condition` string combining
-those selections (`selection`, `1 of selection_*`, `all of selection_* and
-not 1 of filter_*`, and so on). `Sources/Argus/Sigma/` is a real, if partial,
-implementation of that spec: a hand-rolled YAML parser, a condition-language
-parser/evaluator, and a field matcher — not a re-skin of the old pattern
-list.
-
-**85 rules ship with the app**, sourced from three places:
+a `logsource` (we only match `category: process_creation`, `product: macos`
+or Linux), a named `detection` block of field/modifier/value selections, and
+a `condition` string combining those selections. `Sources/Argus/Sigma/` is a
+real, if partial, implementation of that spec: a hand-rolled YAML parser,
+a condition-language parser/evaluator, and a field matcher — not a re-skin
+of the old pattern list.
+
+The condition language now supports the general `N of selection_*` quantifier
+(not just `1 of` and `all of`). The matcher supports `base64`, `base64offset`
+(all three byte-alignment encodings, verified against SigmaHQ reference
+vectors), and `cased` modifiers for case-sensitive comparison. Keyword
+selections (those with no field name) match against all record fields per
+spec, not just CommandLine. Rules whose `logsource` is incompatible
+(something other than `process_creation`/`macos` or portable Linux techniques)
+are skipped at load time; a count is shown in the rule browser
+alongside the rule count in the header.
+
+**86 rules ship with the app**, sourced from three places:
 
 - **67 rules** imported verbatim from `SigmaHQ/sigma`'s `rules/macos/process_creation/` —
   a real, actively-maintained community ruleset (account/SIP/security-tool
@@ -103,10 +186,15 @@ list.
   set — genuinely portable shell/interpreter techniques (netcat/perl/php/
   python/ruby reverse shells, base64 pipe-to-shell) that apply unchanged on
   macOS, since it's the same shell tooling.
-- **10 rules** authored for Argus, filling gaps neither imported set covered
+- **11 rules** authored for Argus, filling gaps neither imported set covered
   (TCC.db tampering, browser cookie/session theft, pipe-to-interpreter
   fetch-and-execute, credential piping to `sudo -S`, AMFI/code-signing
-  tampering, and others).
+  tampering, and quarantine attribute removal). A new rule "Gatekeeper Bypass
+  via Quarantine Attribute Removal" matches only actual quarantine *removal*
+  via whitespace-bounded `-d` or `-c` flags, superseding an imported SigmaHQ
+  catch-all that also fired on Homebrew's safe `xattr -w` quarantine-adds.
+  Superseded imported rules are auto-disabled at launch and recorded persistently,
+  so a user's deliberate Touch ID re-enable is never overwritten on reload.
 
 See `Resources/Rules/NOTICE.md` for full attribution and license details
 (SigmaHQ's rules are DRL 1.1; imported files are unmodified).
@@ -133,7 +221,13 @@ If a rule fires on something you know is your own legitimate automation,
 right-click the event in the feed and choose "Allow future … alerts from
 …". This suppresses that specific (rule, executable) pair going forward —
 allowlisting one automation's use of `osascript` won't blind Argus to a
-*different* technique that happens to also involve `osascript`. Review or
+*different* technique that happens to also involve `osascript`. The right-click
+menu also now offers "Allow only when under <label>" for each supervisor
+attributed to the event's ancestry — e.g. suppressing a rule for `zsh` only
+when the tree runs under `claude`, so the same rule still fires for any other
+`zsh`. Scoped entries show their scope in the allowlist panel. Unconditional
+allowlist entries subsume scoped ones, so an unscoped allowlist for a pair
+will shadow any scoped entries for that same (rule, executable). Review or
 revoke allowlist entries from the "ALLOWLISTED" counter in the header.
 Nothing is suppressed silently: the header also shows a running count of
 events an allowlist rule has hidden.
@@ -156,6 +250,14 @@ open build/Argus.app
 Requires Xcode command line tools (`xcode-select -p`) and macOS 13+. No
 network access, no special permissions, no entitlements to approve.
 
+The build signs with the first codesigning identity in your keychain (or
+`$ARGUS_SIGN_IDENTITY`), falling back to an ad-hoc signature when there is
+none, as on CI. A stable identity matters beyond cosmetics: the tamper-
+evidence key lives in the Keychain, and its ACL matches the app by signing
+identity — ad-hoc signatures change every rebuild, so every rebuild would
+re-prompt for Keychain access, while a real identity keeps the ACL matching
+across rebuilds (and, for Apple Development certificates, across renewals).
+
 A rolling diagnostic log is written to `~/Library/Logs/Argus/argus.log`
 independent of the UI:
 
@@ -169,7 +271,9 @@ Matched events persist to `~/Library/Application Support/Argus/events.jsonl`
 periodically rather than on every write, so a live tail will occasionally
 see the file shrink back down). Disabled-rule state persists to
 `~/Library/Application Support/Argus/rules-state.json`, and your own rule
-files live in `~/Library/Application Support/Argus/rules/`.
+files live in `~/Library/Application Support/Argus/rules/`. An `integrity.json`
+sidecar records HMAC-SHA256 MACs of the security-relevant JSON files
+(allowlist.json and rules-state.json) to detect out-of-band edits.
 
 ## Testing
 
@@ -177,20 +281,21 @@ files live in `~/Library/Application Support/Argus/rules/`.
 swift test
 ```
 
-45 tests. The Sigma engine is validated two ways: `SigmaEngineTests` checks
+170 tests. The Sigma engine is validated two ways: `SigmaEngineTests` checks
 the YAML parser, condition evaluator, and matcher against real rule text
-fetched from SigmaHQ (list-of-selections, `|contains|all`, nested
-conditions — not paraphrased), and `BundledRulesTests` loads all 85 shipped
-rule files from disk, asserts a few structural invariants (unique IDs,
-every condition parses, rule count is the exact expected number so silently
-losing a whole directory fails loudly), and — for the 10 Argus-authored
-rules, which embed `x-example-match`/`x-example-safe` fixtures — asserts
-each one matches what it claims to and doesn't match its benign lookalikes.
-That's the rule-count-scales replacement for the old "one hardcoded Swift
-sample per rule" pattern, which stopped being practical once the catalog
-grew past 20. Also covered: `RuleStoreTests` (enable/disable persistence,
-user-rule loading), the allowlist, event history persistence/trimming, the
-event feed's filter logic, history aggregation, and settings persistence.
+fetched from SigmaHQ (including the `N of selection_*` quantifier, `base64`/
+`base64offset`/`cased` modifiers, and keyword matching), and `BundledRulesTests`
+loads all 86 shipped rule files, asserts structural invariants, and — for the
+11 Argus-authored rules — verifies they match what they claim to. Also
+covered: `RuleStoreTests` (enable/disable persistence, user-rule loading),
+`ProcessMonitorTests` (parent-context caching, sampling health tracking),
+`AllowlistTests`, `EventStoreTests`, `EventFilterTests`, `HistoryStatsTests`,
+`AppSettingsTests`, `EventExportTests` (JSON and CSV serialization),
+`ChainCorrelatorTests` (sequence detection), `PersistenceWatcherTests`
+(artifact diffing and event generation), `IntegrityGuardTests` (MAC
+recording and verification), `ProvenanceClassifierTests` (ancestry classification),
+and `AgentActivityPolicyTests` (agent-attributed event escalation and notification
+quieting).
 
 ## Project layout
 
@@ -203,18 +308,26 @@ Sources/Argus/
     YAMLValue.swift               minimal YAML document tree
     YAMLParser.swift              hand-rolled block-YAML parser
     SigmaRule.swift                rule model + YAML→model mapping
-    SigmaCondition.swift           condition-language parser/evaluator
-    SigmaMatcher.swift             field/selection matching against a process record
-    RuleStore.swift                loads bundled + user rules, enable/disable persistence
-  ProcessMonitor.swift          ps polling, diffing, risk-score decay, Sigma matching
-  AllowlistStore.swift          persisted (rule, executable) suppression
+    SigmaCondition.swift           condition-language parser/evaluator (N of, all of)
+    SigmaMatcher.swift             field/selection matching (base64, base64offset, cased)
+    RuleStore.swift                loads bundled + user rules, enable/disable, skip count
+  ProcessMonitor.swift          ps polling, diffing, risk-score decay, Sigma matching,
+                                  cross-tick parent cache, sampling watchdog
+  ProvenanceClassifier.swift     classifies process ancestry against supervisor table
+  AgentActivityPolicy.swift      escalation and notification quieting for agent-attributed events
+  ChainCorrelator.swift         correlates techniques in same process tree (10-min window)
+  PersistenceWatcher.swift      event-driven monitoring of LaunchAgents/Daemons/periodic
+  IntegrityGuard.swift          HMAC verification of rules-state.json and allowlist.json
+  AllowlistStore.swift          persisted (rule, executable, provenance scope) suppression
   EventStore.swift              persisted event history (events.jsonl)
   EventFilter.swift             search/severity/session filter logic
-  HistoryStats.swift             day-bucketing + technique-frequency aggregation
-  AppSettings.swift              tunable poll interval, decay, notification threshold
-  NotificationManager.swift      thin UNUserNotificationCenter wrapper
+  EventExport.swift             JSON and RFC 4180-quoted CSV serialization
+  HistoryStats.swift            day-bucketing + technique-frequency aggregation
+  AppSettings.swift             tunable poll interval, decay, notification threshold
+  NotificationManager.swift     UNUserNotificationCenter wrapper
+  NotificationResponder.swift   notification actions (Show in Argus, Allowlist)
   DiagnosticsLog.swift          on-disk activity log
-  Theme.swift                  color/type tokens
+  Theme.swift                   color/type tokens
   OrbitView.swift               Canvas-based radial visualization
   GaugeView.swift               arced risk meter
   SparklineView.swift           activity histogram
@@ -222,13 +335,20 @@ Sources/Argus/
   MenuBarPanel.swift            compact menu-bar popover
 Tests/ArgusTests/
   SigmaEngineTests.swift         parser/condition/matcher vs. real SigmaHQ rule text
-  BundledRulesTests.swift        all 85 shipped rules load + custom-rule fixtures
+  BundledRulesTests.swift        all 86 shipped rules load + custom-rule fixtures
   RuleStoreTests.swift           enable/disable persistence, user-rule loading
   AllowlistTests.swift           filter logic + persistence round-trip
   EventStoreTests.swift          history persistence + trimming
   EventFilterTests.swift         search/severity/session filter logic
+  EventExportTests.swift         JSON/CSV serialization round-trip
   HistoryStatsTests.swift        day-bucketing + technique-frequency aggregation
   AppSettingsTests.swift         settings persistence/clamping + notification-threshold logic
+  ProcessMonitorTests.swift      parent-context caching, health tracking
+  ProvenanceClassifierTests.swift ancestry classification against supervisor table
+  AgentActivityPolicyTests.swift  escalation rules and notification quieting logic
+  ChainCorrelatorTests.swift     sequence detection in process trees
+  PersistenceWatcherTests.swift  artifact diffing and event generation
+  IntegrityGuardTests.swift      MAC recording and verification
 Resources/
   Info.plist                   app bundle metadata
   icon_gen.swift                generates the app icon programmatically
@@ -237,8 +357,12 @@ Resources/
     SIGMA_LICENSE.txt             SigmaHQ/sigma's license file
     imported/                     67 rules verbatim from SigmaHQ macOS process_creation
     imported-portable/            8 rules verbatim from SigmaHQ Linux process_creation (portable shell techniques)
-    custom/                       10 rules authored for Argus, filling gaps in the imported sets
-scripts/build_app.sh            release build → signed .app bundle (bundles Resources/Rules)
+    custom/                       11 rules authored for Argus, filling gaps in the imported sets
+scripts/
+  build_app.sh                  release build → signed .app bundle (bundles Resources/Rules)
+  sync_sigma_rules.sh           manual dev tool to refresh bundled SigmaHQ rules from upstream
+.github/workflows/
+  ci.yml                        runs swift test + app build on every push/PR
 ```
 
 ## Non-goals
diff --git a/Resources/Rules/custom/proc_creation_macos_xattr_quarantine_removal.yml b/Resources/Rules/custom/proc_creation_macos_xattr_quarantine_removal.yml
new file mode 100644
index 0000000..de30019
--- /dev/null
+++ b/Resources/Rules/custom/proc_creation_macos_xattr_quarantine_removal.yml
@@ -0,0 +1,32 @@
+title: Gatekeeper Bypass via Quarantine Attribute Removal
+id: 8cbd6022-931f-4017-ab5e-a15264ac91e7
+status: stable
+description: Detects xattr being used to strip the com.apple.quarantine extended attribute (-d/-r -d) or to clear all extended attributes outright (-c) — the actual Gatekeeper-bypass direction. This supersedes the bundled SigmaHQ rule (imported/proc_creation_macos_xattr_gatekeeper_bypass.yml, id f5141b6d-9f42-41c6-a7bf-2a780678b29b), whose CommandLine|contains|all of '-d' and 'com.apple.quarantine' can false-positive on the safe write direction — Homebrew and other installers legitimately run "xattr -w com.apple.quarantine ..." to *add* the flag, and a "-d" substring can appear incidentally inside that command's quarantine-value UUID. This rule requires "-d"/"-c" as a whitespace-bounded flag rather than a bare substring, so it tells removal apart from addition.
+author: Argus
+date: 2026-08-21
+tags:
+    - attack.defense-evasion
+    - attack.t1553.001
+logsource:
+    category: process_creation
+    product: macos
+detection:
+    selection_base:
+        Image|endswith: '/xattr'
+    selection_quarantine:
+        CommandLine|contains: 'com.apple.quarantine'
+    selection_delete_flag:
+        CommandLine|re: '(^|\s)-d(\s|$)'
+    selection_clear_flag:
+        CommandLine|re: '(^|\s)-c(\s|$)'
+    condition: selection_base and ((selection_quarantine and selection_delete_flag) or selection_clear_flag)
+falsepositives:
+    - Unknown
+level: high
+x-example-match:
+    - xattr -d com.apple.quarantine /Applications/Foo.app
+    - xattr -r -d com.apple.quarantine /tmp/payload
+    - xattr -c /tmp/payload
+x-example-safe:
+    - xattr -w com.apple.quarantine "0081;5f8e3d21;Homebrew Cask;" /Applications/Foo.app
+    - xattr -l /Applications/Foo.app
diff --git a/Sources/Argus/AgentActivityPolicy.swift b/Sources/Argus/AgentActivityPolicy.swift
new file mode 100644
index 0000000..259288b
--- /dev/null
+++ b/Sources/Argus/AgentActivityPolicy.swift
@@ -0,0 +1,139 @@
+import Foundation
+
+/// Turns provenance attribution ("this ancestry looks like it was launched
+/// under an AI coding agent") into a triage decision, without ever letting
+/// that attribution suppress or downgrade a detection.
+///
+/// Design position: a supervised AI-agent session (e.g. Claude Code) is a
+/// **distinct trust domain**, not benign background noise. Its command
+/// stream can be steered by content the agent reads — a prompt injection —
+/// so activity attributed to an agent deserves *more* scrutiny for the
+/// technique categories a hijacked agent would plausibly reach for
+/// (persistence, credential theft, defense evasion), even while routine
+/// agent-attributed activity is allowed to be quieter in the UI. This file
+/// only classifies; `ProcessMonitor` decides what to do with the result
+/// (escalate a sensitive match, quiet a routine notification).
+enum AgentActivityPolicy {
+    /// The `ProvenanceTag.category` `ProvenanceClassifier` assigns its "AI
+    /// coding agent" supervisor row (currently just `claude`). Named here
+    /// once, rather than repeating the string literal, so this file's
+    /// agent-attribution check can't silently drift from the category
+    /// `ProvenanceClassifier` actually produces. `ProvenanceClassifier.swift`
+    /// itself is not otherwise touched by this feature — if its supervisor
+    /// table ever renames or splits that category, this constant is the one
+    /// place to update.
+    static let agentProvenanceCategory = "AI agent"
+
+    /// MITRE ATT&CK technique-ID prefixes (the "TNNNN" part, sub-techniques
+    /// included via prefix match) this package treats as sensitive when
+    /// they show up in an agent-attributed process tree:
+    ///
+    /// - Persistence — T1543 (Create/Modify System Process), T1547
+    ///   (Boot/Logon Autostart Execution), T1053 (Scheduled Task/Job)
+    /// - Credential access — T1555 (Credentials from Password Stores),
+    ///   T1552 (Unsecured Credentials), T1539 (Steal Web Session Cookie)
+    /// - Defense evasion / impairment — T1562 (Impair Defenses), T1553
+    ///   (Subvert Trust Controls)
+    ///
+    /// These are exactly the categories a hijacked (prompt-injected) agent
+    /// session would plausibly reach for to survive a restart, exfiltrate
+    /// secrets, or blind the tooling that would otherwise catch it. Every
+    /// other technique an agent trips is still logged and risk-scored like
+    /// any other match — it's just not escalated.
+    static let sensitiveTechniquePrefixes: Set<String> = [
+        "T1543", "T1547", "T1053",
+        "T1555", "T1552", "T1539",
+        "T1562", "T1553",
+    ]
+
+    /// The outcome of weighing one event's provenance tags and matched
+    /// rules against the sensitive-technique table.
+    enum Assessment: Equatable {
+        /// No tag identifies an AI-agent supervisor in this event's
+        /// ancestry — agent policy doesn't apply.
+        case notAgentAttributed
+        /// Agent-attributed, but none of its matched rules touch a
+        /// sensitive technique — eligible for quieter notifications.
+        case routine
+        /// Agent-attributed *and* at least one matched rule falls in the
+        /// sensitive-technique table — must be escalated, never quieted.
+        /// `matchedTechniques` lists the sensitive IDs found, in first-seen
+        /// order, deduplicated.
+        case sensitive(matchedTechniques: [String])
+    }
+
+    /// True when any tag identifies the AI-agent supervisor category.
+    static func isAgentAttributed(_ tags: [ProvenanceTag]) -> Bool {
+        tags.contains { $0.category == agentProvenanceCategory }
+    }
+
+    /// Classifies an event's agent attribution and, if attributed, whether
+    /// any of its matched rules land in the sensitive-technique table.
+    ///
+    /// `matchedRules` is scanned rather than a single technique string
+    /// because an event can carry several matched rules at once, and each
+    /// rule's `technique` field can itself be several comma-separated IDs
+    /// (`MatchedRule.technique`, built from `SigmaRule.techniqueLabel`, e.g.
+    /// "T1548, T1059.002") — both need splitting apart before the prefix
+    /// check runs.
+    static func assessment(tags: [ProvenanceTag], matchedRules: [MatchedRule]) -> Assessment {
+        guard isAgentAttributed(tags) else { return .notAgentAttributed }
+
+        var matchedTechniques: [String] = []
+        var seen: Set<String> = []
+        for rule in matchedRules {
+            for id in techniqueIDs(in: rule.technique) where isSensitive(id) {
+                if seen.insert(id).inserted {
+                    matchedTechniques.append(id)
+                }
+            }
+        }
+        return matchedTechniques.isEmpty ? .routine : .sensitive(matchedTechniques: matchedTechniques)
+    }
+
+    /// One level above the highest severity in `severities`, capped at
+    /// `.critical` — "one level worse than this process tree would
+    /// otherwise have scored," never wrapping past the top of the scale.
+    static func escalatedSeverity(above severities: [Severity]) -> Severity {
+        let current = severities.max() ?? .info
+        let nextRaw = min(current.rawValue + 1, Severity.critical.rawValue)
+        return Severity(rawValue: nextRaw) ?? .critical
+    }
+
+    /// Builds the synthetic rule `ProcessMonitor` appends to an event's
+    /// matched rules when `assessment` comes back `.sensitive` — this is
+    /// what actually raises `topSeverity` (and therefore risk and
+    /// notification eligibility) rather than the sensitive assessment doing
+    /// so directly.
+    static func escalationRule(matchedTechniques: [String], otherSeverities: [Severity]) -> MatchedRule {
+        MatchedRule(
+            name: "AI agent session touched a sensitive technique",
+            severity: escalatedSeverity(above: otherSeverities),
+            technique: matchedTechniques.joined(separator: ", "),
+            explanation: "A supervised AI-agent process tree performed activity matching a "
+                + "persistence, credential-access, or defense-evasion technique. A hijacked "
+                + "(prompt-injected) agent session is exactly how this class of compromise "
+                + "presents, so this is escalated above the underlying rule's own severity "
+                + "regardless of how routine the rest of the session looks."
+        )
+    }
+
+    /// Splits a `MatchedRule.technique` string (e.g. "T1548, T1059.002")
+    /// into its individual IDs, trimming the separator whitespace.
+    private static func techniqueIDs(in technique: String) -> [String] {
+        technique.split(separator: ",").map { $0.trimmingCharacters(in: .whitespaces) }
+    }
+
+    /// Whether `techniqueID` (e.g. "T1053" or "T1053.005") falls under one
+    /// of `sensitiveTechniquePrefixes`. Prefix match alone would let
+    /// "T15430" (not a real technique) falsely match "T1543" — real
+    /// technique IDs only ever continue past the four-digit prefix with a
+    /// "." sub-technique separator, so that's what's required here too.
+    private static func isSensitive(_ techniqueID: String) -> Bool {
+        sensitiveTechniquePrefixes.contains { prefix in
+            guard techniqueID.hasPrefix(prefix) else { return false }
+            let rest = techniqueID.dropFirst(prefix.count)
+            return rest.isEmpty || rest.hasPrefix(".")
+        }
+    }
+}
diff --git a/Sources/Argus/AllowlistStore.swift b/Sources/Argus/AllowlistStore.swift
index 1035847..8569b8e 100644
--- a/Sources/Argus/AllowlistStore.swift
+++ b/Sources/Argus/AllowlistStore.swift
@@ -5,12 +5,41 @@ struct AllowlistEntry: Identifiable, Codable, Equatable {
     let ruleName: String
     let executable: String
     let createdAt: Date
+    /// When set, this entry only suppresses alerts for a process whose
+    /// `ProcessEvent.provenance` includes this label (case-insensitively) —
+    /// e.g. "claude", so allowlisting (rule, zsh) doesn't blind the rule for
+    /// every `zsh` on the system, only the ones running under that
+    /// supervisor. `nil` (the default) means unconditional, matching the
+    /// suppression semantics from before this field existed.
+    ///
+    /// Matching is by provenance *label*, not a raw ancestry substring —
+    /// deliberately reusing `ProvenanceClassifier` as the single source of
+    /// truth for what an ancestry means, rather than giving the allowlist
+    /// its own, possibly divergent, notion of "under claude".
+    ///
+    /// Declared `Optional` so the compiler-synthesized `Decodable` decodes it
+    /// with `decodeIfPresent`: `allowlist.json` entries written before this
+    /// field existed are missing the key entirely and still decode, as
+    /// unconditional entries.
+    let requiredProvenance: String?
 
-    init(id: UUID = UUID(), ruleName: String, executable: String, createdAt: Date = Date()) {
+    init(id: UUID = UUID(), ruleName: String, executable: String, createdAt: Date = Date(), requiredProvenance: String? = nil) {
         self.id = id
         self.ruleName = ruleName
         self.executable = executable
         self.createdAt = createdAt
+        self.requiredProvenance = requiredProvenance
+    }
+
+    /// Whether this entry suppresses an alert for the given rule/executable
+    /// observed with the given provenance labels — the one definition of
+    /// "does this entry apply", shared by `AllowlistStore.isAllowed`
+    /// (live suppression) and `AllowlistStore.allow` (redundancy checks on
+    /// write) so the two can never drift apart.
+    func matches(ruleName: String, executable: String, provenance: [String]) -> Bool {
+        guard self.ruleName == ruleName, self.executable == executable else { return false }
+        guard let requiredProvenance else { return true }
+        return provenance.contains { $0.caseInsensitiveCompare(requiredProvenance) == .orderedSame }
     }
 }
 
@@ -22,10 +51,21 @@ struct AllowlistEntry: Identifiable, Codable, Equatable {
 @MainActor
 final class AllowlistStore: ObservableObject {
     @Published private(set) var entries: [AllowlistEntry] = []
+    /// Result of verifying `allowlist.json` against the last MAC recorded by
+    /// an authenticated write. `nil` until `verifyIntegrity` completes —
+    /// verification is deliberately not done in init, because the Keychain
+    /// key fetch can present a consent prompt that would otherwise block app
+    /// launch (see `IntegrityGuard`'s threading note). The store itself
+    /// doesn't emit events; the app acts on the verdict.
+    private(set) var integrityVerdict: IntegrityVerdict?
 
-    private let fileURL: URL
+    let fileURL: URL
+    /// Optional so that constructing a store (in tests, previews, tools)
+    /// never touches the real Keychain or the shared sidecar as a side
+    /// effect — the app opts in explicitly with `.shared`.
+    private let integrityGuard: IntegrityGuard?
 
-    init(fileURL: URL? = nil) {
+    init(fileURL: URL? = nil, integrityGuard: IntegrityGuard? = nil) {
         if let fileURL {
             self.fileURL = fileURL
         } else {
@@ -36,16 +76,43 @@ final class AllowlistStore: ObservableObject {
             try? FileManager.default.setAttributes([.posixPermissions: 0o700], ofItemAtPath: dir.path)
             self.fileURL = dir.appendingPathComponent("allowlist.json")
         }
+        self.integrityGuard = integrityGuard
         load()
     }
 
-    func isAllowed(ruleName: String, executable: String) -> Bool {
-        entries.contains { $0.ruleName == ruleName && $0.executable == executable }
+    /// Verifies `allowlist.json` off the main thread and stores the verdict
+    /// (also handed to `completion`, on the main actor). A no-op when no
+    /// guard was injected.
+    func verifyIntegrity(completion: @escaping @MainActor (IntegrityVerdict) -> Void = { _ in }) {
+        guard let integrityGuard else { return }
+        integrityGuard.verifyAsync(fileURL) { [weak self] verdict in
+            Task { @MainActor in
+                self?.integrityVerdict = verdict
+                completion(verdict)
+            }
+        }
+    }
+
+    func isAllowed(ruleName: String, executable: String, provenance: [String]) -> Bool {
+        entries.contains { $0.matches(ruleName: ruleName, executable: executable, provenance: provenance) }
+    }
+
+    /// True when an existing entry already covers a request to allowlist
+    /// (ruleName, executable) at `requiredProvenance`'s scope — either an
+    /// exact-scope duplicate, or a broader unconditional entry that already
+    /// suppresses everything a narrower scoped request would. Distinct from
+    /// `isAllowed`: that answers "would this suppress a live event right
+    /// now"; this answers "would adding this entry be redundant".
+    private func alreadyCovers(ruleName: String, executable: String, requiredProvenance: String?) -> Bool {
+        entries.contains { entry in
+            guard entry.ruleName == ruleName, entry.executable == executable else { return false }
+            return entry.requiredProvenance == nil || entry.requiredProvenance == requiredProvenance
+        }
     }
 
-    func allow(ruleName: String, executable: String) {
-        guard !isAllowed(ruleName: ruleName, executable: executable) else { return }
-        entries.append(AllowlistEntry(ruleName: ruleName, executable: executable))
+    func allow(ruleName: String, executable: String, requiredProvenance: String? = nil) {
+        guard !alreadyCovers(ruleName: ruleName, executable: executable, requiredProvenance: requiredProvenance) else { return }
+        entries.append(AllowlistEntry(ruleName: ruleName, executable: executable, requiredProvenance: requiredProvenance))
         save()
     }
 
@@ -59,18 +126,19 @@ final class AllowlistStore: ObservableObject {
     /// as disabling a rule outright, so it goes through the same Touch
     /// ID/password gate as `RuleStore.requestToggle`, with every attempt
     /// logged regardless of outcome.
-    func requestAllow(ruleName: String, executable: String, completion: @escaping (Bool) -> Void = { _ in }) {
-        guard !isAllowed(ruleName: ruleName, executable: executable) else {
+    func requestAllow(ruleName: String, executable: String, requiredProvenance: String? = nil, completion: @escaping (Bool) -> Void = { _ in }) {
+        guard !alreadyCovers(ruleName: ruleName, executable: executable, requiredProvenance: requiredProvenance) else {
             completion(true)
             return
         }
-        RuleAuthenticator.authenticate(reason: "Authenticate to allowlist \u{201c}\(ruleName)\u{201d} alerts from \(executable).") { [weak self] granted in
+        let scopeSuffix = requiredProvenance.map { " (only under \($0))" } ?? ""
+        RuleAuthenticator.authenticate(reason: "Authenticate to allowlist \u{201c}\(ruleName)\u{201d} alerts from \(executable)\(scopeSuffix).") { [weak self] granted in
             guard let self else { return }
             if granted {
-                self.allow(ruleName: ruleName, executable: executable)
-                DiagnosticsLog.write("allowlist added: \(ruleName) / \(executable)")
+                self.allow(ruleName: ruleName, executable: executable, requiredProvenance: requiredProvenance)
+                DiagnosticsLog.write("allowlist added: \(ruleName) / \(executable)\(scopeSuffix)")
             } else {
-                DiagnosticsLog.write("allowlist add denied (authentication failed): \(ruleName) / \(executable)")
+                DiagnosticsLog.write("allowlist add denied (authentication failed): \(ruleName) / \(executable)\(scopeSuffix)")
             }
             completion(granted)
         }
@@ -102,13 +170,14 @@ final class AllowlistStore: ObservableObject {
     private func save() {
         guard let data = try? JSONEncoder().encode(entries) else { return }
         try? data.write(to: fileURL, options: .atomic)
+        integrityGuard?.recordAuthenticatedWrite(of: fileURL)
     }
 }
 
 /// Pure filtering logic, kept free of the actor-isolated store so it's
 /// trivially unit-testable without spinning up MainActor/async plumbing.
 enum AllowlistFilter {
-    static func apply(_ matches: [MatchedRule], executable: String, isAllowed: (String, String) -> Bool) -> [MatchedRule] {
-        matches.filter { !isAllowed($0.name, executable) }
+    static func apply(_ matches: [MatchedRule], executable: String, provenance: [String], isAllowed: (String, String, [String]) -> Bool) -> [MatchedRule] {
+        matches.filter { !isAllowed($0.name, executable, provenance) }
     }
 }
diff --git a/Sources/Argus/App.swift b/Sources/Argus/App.swift
index 4e7543e..4ad259a 100644
--- a/Sources/Argus/App.swift
+++ b/Sources/Argus/App.swift
@@ -1,5 +1,6 @@
 import SwiftUI
 import AppKit
+import UserNotifications
 
 /// Argus runs `LSUIElement` (menu-bar-only by default, no Dock icon) —
 /// closing the main window should hide it, not quit the app, since the menu
@@ -28,24 +29,103 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
 @main
 struct ArgusApp: App {
     @NSApplicationDelegateAdaptor(AppDelegate.self) private var appDelegate
-    @StateObject private var monitor = ProcessMonitor()
-    @StateObject private var allowlist = AllowlistStore()
-    @StateObject private var settings = AppSettings()
-    @StateObject private var ruleStore = RuleStore()
-    private let eventStore = EventStore()
+    @StateObject private var monitor: ProcessMonitor
+    @StateObject private var allowlist: AllowlistStore
+    @StateObject private var settings: AppSettings
+    @StateObject private var ruleStore: RuleStore
+    private let eventStore: EventStore
+    /// Held for the app's lifetime purely to keep its `DispatchSource`s
+    /// alive — `PersistenceWatcher` isn't observed by any view, so nothing
+    /// else in the view hierarchy retains it.
+    private let persistenceWatcher: PersistenceWatcher
+    /// Held for the app's lifetime purely to keep it alive — see its own
+    /// doc comment. `UNUserNotificationCenter.delegate` is a weak reference,
+    /// so nothing else retains this object.
+    private let notificationResponder: NotificationResponder
+
+    /// Identifies the main dashboard's `NSWindow`. Verified empirically
+    /// (via a standalone probe app mirroring this app's Window + MenuBarExtra
+    /// shape) that SwiftUI reliably sets `NSWindow.identifier` to the scene's
+    /// `id` string for a `Window(id:)` scene — it's present as soon as the
+    /// window is created, survives `orderOut(nil)`, and is still correct
+    /// after the window is reopened via `openWindow(id:)`. That makes it a
+    /// stable, title-independent way to pick the dashboard out of
+    /// `NSApp.windows` (the menu bar's own popover window, by contrast, has
+    /// a `nil` identifier and `canBecomeMain == false`).
+    private static let mainWindowID = "main"
+
+    /// Monitoring must run regardless of whether the main window ever
+    /// appears — Argus is a menu-bar app first, and someone may never open
+    /// the dashboard at all. Wiring this in the window's `.onAppear` (the
+    /// previous approach) meant no monitoring happened until the window was
+    /// shown. Doing it here, in the app's own init, means it starts at
+    /// launch every time.
+    init() {
+        let allowlistStore = AllowlistStore(integrityGuard: .shared)
+        let appSettings = AppSettings()
+        let rules = RuleStore(integrityGuard: .shared)
+        let events = EventStore()
+
+        let m = ProcessMonitor()
+        m.configure(allowlist: allowlistStore)
+        m.configure(eventStore: events)
+        m.configure(settings: appSettings)
+        m.configure(ruleStore: rules)
+        m.start()
+
+        // Registering the delegate before requesting authorization ensures
+        // it's in place before any notification (including one delivered
+        // very shortly after launch) could arrive.
+        let responder = NotificationResponder(allowlist: allowlistStore, mainWindowID: Self.mainWindowID)
+        UNUserNotificationCenter.current().delegate = responder
+        NotificationManager.requestAuthorizationIfNeeded()
+
+        // Second, independent sensor: catches persistence artifacts left on
+        // disk even when the process that wrote them was too short-lived for
+        // ProcessMonitor's ~1.2s poll to ever sample it.
+        let watcher = PersistenceWatcher()
+        watcher.onEvent = { [weak m] event in
+            m?.ingestExternal(event)
+        }
+        watcher.start()
+
+        // Verify rules-state.json/allowlist.json against their last
+        // authenticated-write MAC — asynchronously, off this init: the
+        // Keychain key fetch can present a consent prompt (seen in practice
+        // after a rebuild changed the ad-hoc signature), and doing it here
+        // synchronously froze the whole launch behind that dialog. A
+        // `.tampered` verdict means the file changed outside Argus's Touch
+        // ID/password-gated write path — exactly what a local attacker would
+        // do to blind a rule or re-enable a suppressed alert silently — so
+        // surface it as a critical event in the feed.
+        // `.baselineEstablished`/`.unverifiable` are informational only and
+        // already logged by IntegrityGuard itself.
+        let rulesStateURL = rules.stateFileURL
+        rules.verifyIntegrity { [weak m] verdict in
+            guard verdict == .tampered else { return }
+            DiagnosticsLog.write("integrity-guard: tamper detected outside Argus for \(rulesStateURL.lastPathComponent)")
+            m?.ingestExternal(IntegrityGuard.tamperEvent(for: rulesStateURL))
+        }
+        let allowlistURL = allowlistStore.fileURL
+        allowlistStore.verifyIntegrity { [weak m] verdict in
+            guard verdict == .tampered else { return }
+            DiagnosticsLog.write("integrity-guard: tamper detected outside Argus for \(allowlistURL.lastPathComponent)")
+            m?.ingestExternal(IntegrityGuard.tamperEvent(for: allowlistURL))
+        }
+
+        _monitor = StateObject(wrappedValue: m)
+        _allowlist = StateObject(wrappedValue: allowlistStore)
+        _settings = StateObject(wrappedValue: appSettings)
+        _ruleStore = StateObject(wrappedValue: rules)
+        eventStore = events
+        persistenceWatcher = watcher
+        notificationResponder = responder
+    }
 
     var body: some Scene {
-        Window("Argus", id: "main") {
+        Window("Argus", id: Self.mainWindowID) {
             DashboardView(monitor: monitor, allowlist: allowlist, eventStore: eventStore, settings: settings, ruleStore: ruleStore)
                 .frame(minWidth: 980, minHeight: 680)
-                .onAppear {
-                    monitor.configure(allowlist: allowlist)
-                    monitor.configure(eventStore: eventStore)
-                    monitor.configure(settings: settings)
-                    monitor.configure(ruleStore: ruleStore)
-                    monitor.start()
-                    NotificationManager.requestAuthorizationIfNeeded()
-                }
                 .preferredColorScheme(.dark)
         }
         .windowResizability(.contentMinSize)
@@ -55,8 +135,8 @@ struct ArgusApp: App {
         MenuBarExtra {
             MenuBarPanel(monitor: monitor, dismissFlyout: dismissMenuBarFlyout)
         } label: {
-            Image(systemName: "eye.fill")
-                .foregroundStyle(Theme.color(for: monitor.riskLevel))
+            Image(systemName: monitor.isDegraded ? "exclamationmark.triangle.fill" : "eye.fill")
+                .foregroundStyle(monitor.isDegraded ? Theme.color(for: .elevated) : Theme.color(for: monitor.riskLevel))
         }
         .menuBarExtraStyle(.window)
     }
@@ -66,9 +146,11 @@ struct ArgusApp: App {
     /// (both `keyWindow?.close()` and toggling `isInserted` failed to
     /// dismiss it in practice). `orderOut(nil)` skips that machinery
     /// entirely — it just hides the window — so hide every visible window
-    /// that isn't the main dashboard.
+    /// that isn't the main dashboard. Identified by `NSWindow.identifier`
+    /// (see `mainWindowID` above) rather than by title, which is fragile if
+    /// the window is ever retitled or localized.
     private func dismissMenuBarFlyout() {
-        for window in NSApp.windows where window.isVisible && window.title != "Argus" {
+        for window in NSApp.windows where window.isVisible && window.identifier?.rawValue != Self.mainWindowID {
             window.orderOut(nil)
         }
     }
diff --git a/Sources/Argus/AppSettings.swift b/Sources/Argus/AppSettings.swift
index 5af3f35..047f925 100644
--- a/Sources/Argus/AppSettings.swift
+++ b/Sources/Argus/AppSettings.swift
@@ -40,6 +40,19 @@ final class AppSettings: ObservableObject {
     @Published var notificationThreshold: NotificationThreshold {
         didSet { defaults.set(notificationThreshold.rawValue, forKey: Keys.notificationThreshold) }
     }
+    /// When true (the default), a `.routine` agent-attributed event — see
+    /// `AgentActivityPolicy.Assessment` — skips the system notification it
+    /// would otherwise have earned under `notificationThreshold`. Nothing
+    /// else about the event changes: it still lands in the feed, history,
+    /// and risk score exactly as usual, and a `.sensitive` agent-attributed
+    /// event is never quieted regardless of this setting. Default true
+    /// because routine agent activity (an AI coding session reading files,
+    /// running builds) is expected to be frequent and is already
+    /// distinguishable in the feed via its provenance tag — the interrupt
+    /// is what this setting turns down, not the record.
+    @Published var quietAgentNotifications: Bool {
+        didSet { defaults.set(quietAgentNotifications, forKey: Keys.quietAgentNotifications) }
+    }
 
     private let defaults: UserDefaults
 
@@ -50,6 +63,7 @@ final class AppSettings: ObservableObject {
         static let pollInterval = "argus.pollIntervalSeconds"
         static let decayHalfLife = "argus.riskDecayHalfLifeSeconds"
         static let notificationThreshold = "argus.notificationThreshold"
+        static let quietAgentNotifications = "argus.quietAgentNotifications"
     }
 
     init(defaults: UserDefaults = .standard) {
@@ -66,6 +80,12 @@ final class AppSettings: ObservableObject {
         } else {
             self.notificationThreshold = .criticalOnly
         }
+
+        if let stored = defaults.object(forKey: Keys.quietAgentNotifications) as? Bool {
+            self.quietAgentNotifications = stored
+        } else {
+            self.quietAgentNotifications = true
+        }
     }
 
     private static func clamp(_ value: Double, to range: ClosedRange<Double>) -> Double {
diff --git a/Sources/Argus/ChainCorrelator.swift b/Sources/Argus/ChainCorrelator.swift
new file mode 100644
index 0000000..6a94879
--- /dev/null
+++ b/Sources/Argus/ChainCorrelator.swift
@@ -0,0 +1,111 @@
+import Foundation
+
+/// One matched process folded into the correlator's rolling window.
+///
+/// `lineage` is `{pid} ∪ ancestry(of: pid)` with every pid `<= 1` stripped
+/// out. Excluding launchd/kernel pids matters: on macOS every process
+/// eventually descends from launchd (pid 1), so if `1` were left in, every
+/// pair of events observed anywhere on the machine would share it and the
+/// correlator would chain unrelated processes together constantly.
+struct ChainMember {
+    let eventID: UUID
+    let pid: Int32
+    let executable: String
+    let ruleNames: Set<String>
+    let techniques: Set<String>
+    let severity: Severity
+    let timestamp: Date
+    let lineage: Set<Int32>
+}
+
+/// A chain the correlator has fired: the prior member(s) it joined together
+/// with the newly-registered one, in chronological order.
+struct ChainDetection {
+    let members: [ChainMember]
+    let techniques: Set<String>
+    let escalatedSeverity: Severity
+}
+
+/// Correlates matched processes into ancestry-linked "chains" — the same
+/// signal the README's core thesis calls out: a single LOLBin invocation is
+/// often unremarkable, but two or more *different* techniques firing inside
+/// the same process tree within a short window is a much stronger signal
+/// than either alone.
+///
+/// Deliberately independent of `ProcessMonitor`/`@MainActor` and of `ps` —
+/// callers supply the pid, its precomputed ancestry, and the rule/technique
+/// data already extracted from a match, so this class can be driven and
+/// tested with plain values.
+final class ChainCorrelator {
+    private var members: [ChainMember] = []
+    let window: TimeInterval
+
+    init(window: TimeInterval = 600) {
+        self.window = window
+    }
+
+    /// Registers one matched process and reports a `ChainDetection` if it
+    /// joins an existing, still-live member of a different technique in the
+    /// same process tree.
+    ///
+    /// - Parameter ancestry: the pid's ancestor chain (nearest first),
+    ///   typically `ParentContextCache.ancestry(of:)` — *not* including the
+    ///   pid itself.
+    ///
+    /// Two members are related iff one's pid is present in the other's
+    /// lineage, or their lineages otherwise intersect (a shared ancestor
+    /// further up the tree). A detection only fires when a related member's
+    /// `ruleNames` are not a subset of the incoming event's `ruleNames` —
+    /// this is what stops the same rule re-matching a retried command (or a
+    /// process that legitimately matches several rules at once) from
+    /// "chaining" with itself: that's already visible as a single
+    /// multi-rule event, not a sequence of distinct techniques.
+    ///
+    /// The new member is recorded whether or not a detection fires — even
+    /// after a chain has already been reported, a later, third technique in
+    /// the same tree is new information and re-fires with all prior related
+    /// members included. Growth is bounded by the rolling `window`, which is
+    /// pruned (relative to the incoming event's timestamp) before anything
+    /// else runs.
+    func register(
+        eventID: UUID,
+        pid: Int32,
+        executable: String,
+        ruleNames: Set<String>,
+        techniques: Set<String>,
+        severity: Severity,
+        timestamp: Date,
+        ancestry: [Int32]
+    ) -> ChainDetection? {
+        let cutoff = timestamp.addingTimeInterval(-window)
+        members.removeAll { $0.timestamp < cutoff }
+
+        let lineage = Set(([pid] + ancestry).filter { $0 > 1 })
+
+        // A chain always needs two distinct processes: a single process
+        // matching multiple rules is one multi-rule event, not a sequence.
+        let related = members.filter { existing in
+            guard existing.pid != pid else { return false }
+            let sameTree = lineage.contains(existing.pid)
+                || existing.lineage.contains(pid)
+                || !lineage.isDisjoint(with: existing.lineage)
+            guard sameTree else { return false }
+            return !existing.ruleNames.isSubset(of: ruleNames)
+        }
+
+        let newMember = ChainMember(eventID: eventID, pid: pid, executable: executable,
+                                     ruleNames: ruleNames, techniques: techniques,
+                                     severity: severity, timestamp: timestamp, lineage: lineage)
+        members.append(newMember)
+
+        guard !related.isEmpty else { return nil }
+
+        let allMembers = (related + [newMember]).sorted { $0.timestamp < $1.timestamp }
+        let allTechniques = allMembers.reduce(into: Set<String>()) { $0.formUnion($1.techniques) }
+        let maxSeverity = allMembers.map(\.severity).max() ?? severity
+        let escalatedRaw = min(maxSeverity.rawValue + 1, Severity.critical.rawValue)
+        let escalated = Severity(rawValue: escalatedRaw) ?? .critical
+
+        return ChainDetection(members: allMembers, techniques: allTechniques, escalatedSeverity: escalated)
+    }
+}
diff --git a/Sources/Argus/DashboardView.swift b/Sources/Argus/DashboardView.swift
index e146a15..8b92696 100644
--- a/Sources/Argus/DashboardView.swift
+++ b/Sources/Argus/DashboardView.swift
@@ -1,5 +1,8 @@
 import SwiftUI
+import ServiceManagement
+import UniformTypeIdentifiers
 
+@MainActor
 struct DashboardView: View {
     @ObservedObject var monitor: ProcessMonitor
     @ObservedObject var allowlist: AllowlistStore
@@ -58,6 +61,9 @@ struct DashboardView: View {
             }
             Spacer()
             HStack(spacing: 10) {
+                if monitor.isDegraded {
+                    degradedBadge
+                }
                 statField(label: "PROCESSES SEEN", value: "\(monitor.totalSeen)")
                 statField(label: "SAMPLES", value: "\(monitor.sampleCount)")
 
@@ -109,7 +115,7 @@ struct DashboardView: View {
                 .buttonStyle(.plain)
                 .help("Settings — poll interval, risk decay, notifications")
                 .popover(isPresented: $showingSettings, arrowEdge: .bottom) {
-                    SettingsPanel(settings: settings)
+                    SettingsPanel(settings: settings, monitor: monitor)
                 }
             }
         }
@@ -131,6 +137,30 @@ struct DashboardView: View {
         .padding(.vertical, 4)
     }
 
+    /// Shown in the header only while `ProcessMonitor.isDegraded` is true —
+    /// i.e. `ps` sampling has failed repeatedly and the process table view
+    /// is stale. A hung/missing sampler must not look identical to "nothing
+    /// suspicious happening", so this sits right next to the stats it would
+    /// otherwise silently undermine.
+    private var degradedBadge: some View {
+        HStack(spacing: 4) {
+            Image(systemName: "exclamationmark.triangle.fill")
+                .font(.system(size: 10))
+            Text("MONITOR DEGRADED")
+                .font(.system(size: 9, weight: .bold))
+                .tracking(1)
+        }
+        .foregroundStyle(Theme.color(for: .elevated))
+        .padding(.horizontal, 8)
+        .padding(.vertical, 4)
+        .background(
+            RoundedRectangle(cornerRadius: 6)
+                .fill(Theme.color(for: .elevated).opacity(0.12))
+                .overlay(RoundedRectangle(cornerRadius: 6).strokeBorder(Theme.color(for: .elevated).opacity(0.4), lineWidth: 1))
+        )
+        .help("Process sampling has failed repeatedly — the data shown here may be stale.")
+    }
+
     /// Same shape as `statField`, but visibly a control: bordered chip, a
     /// chevron, and an accent-tinted value — so it doesn't blend into the
     /// read-only stats sitting right next to it.
@@ -302,7 +332,7 @@ struct DashboardView: View {
                 Image(systemName: "magnifyingglass")
                     .font(.system(size: 10))
                     .foregroundStyle(Theme.dim)
-                TextField("Search executable, command, or technique…", text: $searchText)
+                TextField("Search executable, command, technique, or supervisor…", text: $searchText)
                     .textFieldStyle(.plain)
                     .font(Theme.mono(11))
                 if !searchText.isEmpty {
@@ -382,6 +412,7 @@ struct DashboardView: View {
     }
 }
 
+@MainActor
 struct EventRow: View {
     let event: ProcessEvent
     let allowlist: AllowlistStore
@@ -421,6 +452,10 @@ struct EventRow: View {
                 .buttonStyle(.plain)
                 .help("Show every event sharing this process's parent (pid \(event.ppid))")
 
+                if !event.provenance.isEmpty {
+                    provenanceBadge
+                }
+
                 Spacer()
                 ForEach(event.rules.prefix(expanded ? event.rules.count : 1)) { rule in
                     Text(rule.technique)
@@ -468,8 +503,45 @@ struct EventRow: View {
                 Button("Allow future \u{201c}\(rule.name)\u{201d} alerts from \(event.executable)") {
                     allowlist.requestAllow(ruleName: rule.name, executable: event.executable)
                 }
+                // Scoped alternatives, one per supervisor label on this
+                // event (capped at 2, mirroring `provenanceBadge`) — lets
+                // the user narrow the allowlist to "only under claude"
+                // instead of blinding the rule for this executable
+                // everywhere.
+                ForEach(event.provenance.prefix(2), id: \.self) { label in
+                    Button("Allow only when under \(label)") {
+                        allowlist.requestAllow(ruleName: rule.name, executable: event.executable, requiredProvenance: label)
+                    }
+                }
             }
+            Divider()
+            Button("Copy as JSON") {
+                guard let json = EventExport.json(for: event) else { return }
+                NSPasteboard.general.clearContents()
+                NSPasteboard.general.setString(json, forType: .string)
+            }
+        }
+    }
+
+    /// "via claude"-style chip surfacing `ProcessEvent.provenance` — capped
+    /// to the first two labels so a deep, multi-supervisor ancestry (e.g.
+    /// Claude inside a terminal inside tmux) doesn't crowd out the rule
+    /// chips it sits beside. Rendered in `Theme.provenance` (violet, a hue
+    /// the severity palette never uses) so attribution is easy to spot at a
+    /// glance yet can't be mistaken for a severity signal — see
+    /// `ProvenanceTag`'s doc comment.
+    private var provenanceBadge: some View {
+        HStack(spacing: 3) {
+            Image(systemName: "arrowshape.turn.up.left")
+                .font(.system(size: 8, weight: .semibold))
+            Text("via \(event.provenance.prefix(2).joined(separator: ", "))")
+                .font(.system(size: 9, weight: .semibold))
         }
+        .foregroundStyle(Theme.provenance)
+        .padding(.horizontal, 6).padding(.vertical, 2)
+        .background(Theme.provenance.opacity(0.14))
+        .clipShape(Capsule())
+        .help("Ancestry attribution, not authorization — process ancestry can be spoofed; this is triage context only.")
     }
 }
 
@@ -478,6 +550,7 @@ struct EventRow: View {
 /// SigmaHQ, or authored for Argus in the same format), individually
 /// toggleable, with its raw YAML source viewable inline. Drop a `.yml` file
 /// into the user rules folder and hit reload — no rebuild required.
+@MainActor
 struct RuleManagementPanel: View {
     @ObservedObject var ruleStore: RuleStore
     @State private var searchText = ""
@@ -571,6 +644,12 @@ struct RuleManagementPanel: View {
                 .font(.system(size: 10.5))
                 .foregroundStyle(Theme.accent)
             }
+
+            if ruleStore.skippedIncompatibleCount > 0 {
+                Text("\(ruleStore.skippedIncompatibleCount) rules skipped (not macOS process_creation)")
+                    .font(.system(size: 9))
+                    .foregroundStyle(Theme.dim)
+            }
         }
         .padding(14)
         .frame(width: 420)
@@ -598,6 +677,7 @@ struct RuleManagementPanel: View {
     }
 }
 
+@MainActor
 struct RuleManagementRow: View {
     let rule: SigmaRule
     let isEnabled: Bool
@@ -678,6 +758,7 @@ struct RuleManagementRow: View {
 /// Popover from the header's "ALLOWLISTED" stat — review and revoke
 /// suppression rules. Nothing here is hidden: every automatic suppression
 /// is a decision the user made explicitly by right-clicking an event.
+@MainActor
 struct AllowlistPanel: View {
     @ObservedObject var allowlist: AllowlistStore
 
@@ -717,6 +798,7 @@ struct AllowlistPanel: View {
     }
 }
 
+@MainActor
 private struct AllowlistRow: View {
     let entry: AllowlistEntry
     let dateFormatter: DateFormatter
@@ -726,8 +808,13 @@ private struct AllowlistRow: View {
     var body: some View {
         HStack(alignment: .top, spacing: 8) {
             VStack(alignment: .leading, spacing: 2) {
-                Text(entry.ruleName)
-                    .font(Theme.mono(11, weight: .semibold))
+                HStack(spacing: 5) {
+                    Text(entry.ruleName)
+                        .font(Theme.mono(11, weight: .semibold))
+                    if let requiredProvenance = entry.requiredProvenance {
+                        scopeChip(requiredProvenance)
+                    }
+                }
                 Text("\(entry.executable) · since \(dateFormatter.string(from: entry.createdAt))")
                     .font(.system(size: 9))
                     .foregroundStyle(Theme.dim)
@@ -751,11 +838,25 @@ private struct AllowlistRow: View {
             .help("Revoke this allowlist entry (Touch ID/password required)")
         }
     }
+
+    /// "only under <label>" chip, styled like `EventRow.provenanceBadge`
+    /// (same `Theme.provenance` violet) so the scope reads as the same kind
+    /// of attribution context there and here rather than a second,
+    /// inconsistent visual language.
+    private func scopeChip(_ label: String) -> some View {
+        Text("only under \(label)")
+            .font(.system(size: 8.5, weight: .medium))
+            .foregroundStyle(Theme.provenance)
+            .padding(.horizontal, 5).padding(.vertical, 1)
+            .background(Theme.provenance.opacity(0.14))
+            .clipShape(Capsule())
+    }
 }
 
 /// Popover from the header's "HISTORY" stat — a day-by-day activity heatmap
 /// (last ~12 weeks) plus which techniques have fired most. Reads the full
 /// persisted log once when opened rather than on every dashboard tick.
+@MainActor
 struct HistoryPanel: View {
     let eventStore: EventStore
     @State private var events: [ProcessEvent] = []
@@ -765,10 +866,14 @@ struct HistoryPanel: View {
 
     var body: some View {
         VStack(alignment: .leading, spacing: 12) {
-            Text("ACTIVITY HISTORY")
-                .font(.system(size: 10, weight: .bold))
-                .tracking(1.5)
-                .foregroundStyle(Theme.muted)
+            HStack {
+                Text("ACTIVITY HISTORY")
+                    .font(.system(size: 10, weight: .bold))
+                    .tracking(1.5)
+                    .foregroundStyle(Theme.muted)
+                Spacer()
+                exportMenu
+            }
 
             if events.isEmpty {
                 Text("No history yet — matched events accumulate here as Argus runs, and survive a restart.")
@@ -805,6 +910,68 @@ struct HistoryPanel: View {
         }
     }
 
+    /// Dropdown rather than a plain button since there are two formats to
+    /// choose between — kept visually lightweight (borderless, small type)
+    /// to match the plain-text "Rules folder"/"Reload" controls elsewhere in
+    /// these popovers rather than looking like a primary action.
+    private var exportMenu: some View {
+        Menu {
+            Button("Export as JSON…") { exportHistory(as: .json) }
+            Button("Export as CSV…") { exportHistory(as: .csv) }
+        } label: {
+            Label("Export…", systemImage: "square.and.arrow.up")
+                .font(.system(size: 9.5, weight: .semibold))
+                .foregroundStyle(Theme.accent)
+        }
+        .menuStyle(.borderlessButton)
+        .fixedSize()
+        .disabled(events.isEmpty)
+    }
+
+    private enum ExportFormat: String { case json = "JSON", csv = "CSV" }
+
+    /// Snapshots `eventStore.loadAll()` up front (not inside the save
+    /// panel's completion handler) so the exported data reflects what the
+    /// user saw when they clicked "Export…", and so encoding happens on the
+    /// main actor where `EventStore` and this view already live — the save
+    /// panel's completion handler itself only ever touches plain `Data`/
+    /// `URL` values. Write failures are logged, never surfaced as a crash —
+    /// exporting evidence is a nice-to-have, not something that should take
+    /// the app down if e.g. the destination volume went away mid-write.
+    ///
+    /// Explicitly `@MainActor`: `EventStore` and `NSSavePanel` both require
+    /// it, and while newer compilers infer it here from the enclosing View,
+    /// the CI toolchain's does not — the annotation keeps the isolation
+    /// identical on both.
+    @MainActor
+    private func exportHistory(as format: ExportFormat) {
+        let all = eventStore.loadAll()
+        let panel = NSSavePanel()
+        let data: Data?
+        switch format {
+        case .json:
+            panel.allowedContentTypes = [.json]
+            panel.nameFieldStringValue = "argus-events.json"
+            data = EventExport.json(events: all)
+        case .csv:
+            panel.allowedContentTypes = [.commaSeparatedText]
+            panel.nameFieldStringValue = "argus-events.csv"
+            data = EventExport.csv(events: all).data(using: .utf8)
+        }
+        guard let data else {
+            DiagnosticsLog.write("history export failed: could not encode events as \(format.rawValue)")
+            return
+        }
+        panel.begin { response in
+            guard response == .OK, let url = panel.url else { return }
+            do {
+                try data.write(to: url, options: .atomic)
+            } catch {
+                DiagnosticsLog.write("history export failed: \(error.localizedDescription)")
+            }
+        }
+    }
+
     private var heatmap: some View {
         let calendar = Calendar.current
         let today = calendar.startOfDay(for: Date())
@@ -874,8 +1041,11 @@ struct HistoryPanel: View {
 /// hardcoded constants before this — genuinely a matter of taste (how
 /// twitchy vs. how patient the gauge should be), so they're exposed here
 /// rather than fixed in code.
+@MainActor
 struct SettingsPanel: View {
     @ObservedObject var settings: AppSettings
+    @ObservedObject var monitor: ProcessMonitor
+    @State private var launchAtLoginEnabled = SMAppService.mainApp.status == .enabled
 
     var body: some View {
         VStack(alignment: .leading, spacing: 16) {
@@ -937,10 +1107,81 @@ struct SettingsPanel: View {
                     }
                 }
             }
+
+            Divider().background(Theme.border)
+
+            VStack(alignment: .leading, spacing: 6) {
+                Toggle(isOn: launchAtLoginBinding) {
+                    Text("Launch at login")
+                        .font(.system(size: 11, weight: .medium))
+                        .foregroundStyle(Theme.text)
+                }
+                .toggleStyle(.switch)
+                .tint(Theme.accent)
+                Text("A monitor only protects you while it's running — enable this so Argus starts watching as soon as you log in.")
+                    .font(.system(size: 9.5))
+                    .foregroundStyle(Theme.dim)
+            }
+
+            Divider().background(Theme.border)
+
+            VStack(alignment: .leading, spacing: 6) {
+                Toggle(isOn: $settings.quietAgentNotifications) {
+                    Text("Quiet notifications for routine AI-agent activity")
+                        .font(.system(size: 11, weight: .medium))
+                        .foregroundStyle(Theme.text)
+                }
+                .toggleStyle(.switch)
+                .tint(Theme.accent)
+                Text(quietAgentCaption)
+                    .font(.system(size: 9.5))
+                    .foregroundStyle(Theme.dim)
+            }
         }
         .padding(14)
         .frame(width: 300)
         .background(Theme.bg)
         .foregroundStyle(Theme.text)
     }
+
+    /// Spells out exactly what the toggle above does and doesn't affect —
+    /// feed/history/risk/log are unconditional, only the system notification
+    /// for a *routine* agent-attributed event is skipped, never a sensitive
+    /// one — plus a running count once anything has actually been quieted
+    /// this session, so the setting's effect is visible, not just claimed.
+    private var quietAgentCaption: String {
+        let base = "Feed, history, risk score, and the diagnostics log are unaffected — only the "
+            + "system notification is skipped, and only for routine AI-agent activity. Activity "
+            + "matching a sensitive technique (persistence, credential access, defense evasion) "
+            + "always notifies at the normal threshold."
+        guard monitor.agentQuietedNotificationCount > 0 else { return base }
+        let count = monitor.agentQuietedNotificationCount
+        return base + " \(count) notification\(count == 1 ? "" : "s") quieted this session."
+    }
+
+    /// `SMAppService` is the source of truth for launch-at-login state —
+    /// it's deliberately not mirrored into `AppSettings`/UserDefaults, so
+    /// there's nothing that can drift out of sync with it. Registration is
+    /// best-effort: on failure (including the expected case of an
+    /// un-bundled `swift test`/debug run, where `SMAppService` has no real
+    /// app bundle to register) we log via `DiagnosticsLog` and snap the
+    /// toggle back to the prior state rather than crash or claim success.
+    private var launchAtLoginBinding: Binding<Bool> {
+        Binding(
+            get: { launchAtLoginEnabled },
+            set: { newValue in
+                launchAtLoginEnabled = newValue
+                do {
+                    if newValue {
+                        try SMAppService.mainApp.register()
+                    } else {
+                        try SMAppService.mainApp.unregister()
+                    }
+                } catch {
+                    DiagnosticsLog.write("launch-at-login \(newValue ? "register" : "unregister") failed: \(error.localizedDescription)")
+                    launchAtLoginEnabled = !newValue
+                }
+            }
+        )
+    }
 }
diff --git a/Sources/Argus/DiagnosticsLog.swift b/Sources/Argus/DiagnosticsLog.swift
index 3d09f8b..2495f40 100644
--- a/Sources/Argus/DiagnosticsLog.swift
+++ b/Sources/Argus/DiagnosticsLog.swift
@@ -17,21 +17,32 @@ enum DiagnosticsLog {
 
     private static let formatter: ISO8601DateFormatter = ISO8601DateFormatter()
 
+    /// Serializes appends: `write` is called from the main actor, the
+    /// integrity guard's queue, and the persistence watcher's queues, and
+    /// two concurrent seek-then-write appends to one file can interleave
+    /// mid-record. Fire-and-forget onto one serial queue keeps records whole
+    /// without making any caller wait on file I/O.
+    private static let queue = DispatchQueue(label: "argus.diagnostics-log", qos: .utility)
+
     static func write(_ line: String) {
         // Strip CR/LF so a process whose command line contains newlines can't
         // forge additional log lines (log injection). The record we append
-        // ends with the one newline added below.
+        // ends with the one newline added below. Stamped here, not on the
+        // queue, so the timestamp reflects when the event happened rather
+        // than when the queue got to it.
         let sanitized = line.replacingOccurrences(of: "\r", with: " ")
                             .replacingOccurrences(of: "\n", with: " ")
         let stamped = "\(formatter.string(from: Date())) \(sanitized)\n"
         guard let data = stamped.data(using: .utf8) else { return }
-        if FileManager.default.fileExists(atPath: url.path), let handle = try? FileHandle(forWritingTo: url) {
-            handle.seekToEndOfFile()
-            handle.write(data)
-            try? handle.close()
-        } else {
-            try? data.write(to: url)
-            try? FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: url.path)
+        queue.async {
+            if FileManager.default.fileExists(atPath: url.path), let handle = try? FileHandle(forWritingTo: url) {
+                handle.seekToEndOfFile()
+                handle.write(data)
+                try? handle.close()
+            } else {
+                try? data.write(to: url)
+                try? FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: url.path)
+            }
         }
     }
 }
diff --git a/Sources/Argus/EventExport.swift b/Sources/Argus/EventExport.swift
new file mode 100644
index 0000000..9226a31
--- /dev/null
+++ b/Sources/Argus/EventExport.swift
@@ -0,0 +1,72 @@
+import Foundation
+
+/// Pure serialization for getting evidence out of Argus — copy-as-JSON from
+/// the event feed's context menu, and JSON/CSV export from the History
+/// panel. Kept free of AppKit/NSPasteboard/NSSavePanel so it's trivially
+/// unit-testable; callers own writing the result to the pasteboard or disk.
+enum EventExport {
+    /// Shared encoder for both single-event and multi-event JSON:
+    /// pretty-printed and sorted-keys so output is stable and diffable
+    /// (useful when pasting into a bug report or diffing two exports), dates
+    /// as ISO8601 so timestamps are unambiguous across locales/timezones
+    /// when read by someone else.
+    private static let encoder: JSONEncoder = {
+        let e = JSONEncoder()
+        e.outputFormatting = [.prettyPrinted, .sortedKeys]
+        e.dateEncodingStrategy = .iso8601
+        return e
+    }()
+
+    /// Pretty-printed JSON for a single event — what "Copy as JSON" in the
+    /// event feed's right-click menu puts on the pasteboard.
+    static func json(for event: ProcessEvent) -> String? {
+        guard let data = try? encoder.encode(event) else { return nil }
+        return String(data: data, encoding: .utf8)
+    }
+
+    /// Pretty-printed JSON array of every event, for the History panel's
+    /// "Export…" action. Same encoder config as the single-event helper
+    /// above, so a single exported event and one copied from the feed look
+    /// identical modulo array wrapping.
+    static func json(events: [ProcessEvent]) -> Data? {
+        try? encoder.encode(events)
+    }
+
+    private static let isoFormatter = ISO8601DateFormatter()
+
+    /// CSV export of the full event history. Command lines are the reason a
+    /// naive writer isn't good enough here — real shell one-liners are full
+    /// of commas, double quotes, and (via multi-line scripts) embedded
+    /// newlines, all of which must be quoted per RFC 4180 or the file
+    /// silently misaligns columns the moment someone opens it in a
+    /// spreadsheet.
+    static func csv(events: [ProcessEvent]) -> String {
+        var lines = ["timestamp,pid,ppid,executable,severity,techniques,rules,command"]
+        for event in events {
+            let fields = [
+                isoFormatter.string(from: event.timestamp),
+                String(event.pid),
+                String(event.ppid),
+                event.executable,
+                event.topSeverity.label,
+                event.rules.map(\.technique).joined(separator: ";"),
+                event.rules.map(\.name).joined(separator: ";"),
+                event.command
+            ]
+            lines.append(fields.map(csvField).joined(separator: ","))
+        }
+        return lines.joined(separator: "\n") + "\n"
+    }
+
+    /// Quotes a field per RFC 4180 whenever it contains a comma, double
+    /// quote, or newline (CR or LF) — the exact characters that would
+    /// otherwise break column alignment or terminate the row early. Internal
+    /// double quotes are doubled, which is how RFC 4180 escapes a quote
+    /// inside a quoted field.
+    private static func csvField(_ value: String) -> String {
+        guard value.contains(",") || value.contains("\"") || value.contains("\n") || value.contains("\r") else {
+            return value
+        }
+        return "\"" + value.replacingOccurrences(of: "\"", with: "\"\"") + "\""
+    }
+}
diff --git a/Sources/Argus/EventFilter.swift b/Sources/Argus/EventFilter.swift
index 6528aae..186f9b4 100644
--- a/Sources/Argus/EventFilter.swift
+++ b/Sources/Argus/EventFilter.swift
@@ -24,6 +24,7 @@ enum EventFilter {
             if event.rules.contains(where: {
                 $0.name.lowercased().contains(trimmed) || $0.technique.lowercased().contains(trimmed)
             }) { return true }
+            if event.provenance.contains(where: { $0.lowercased().contains(trimmed) }) { return true }
             return false
         }
     }
diff --git a/Sources/Argus/IntegrityGuard.swift b/Sources/Argus/IntegrityGuard.swift
new file mode 100644
index 0000000..e2a3024
--- /dev/null
+++ b/Sources/Argus/IntegrityGuard.swift
@@ -0,0 +1,277 @@
+import Foundation
+import CryptoKit
+import Security
+
+/// Detects (but cannot prevent) out-of-band edits to the on-disk files that
+/// back security-relevant state — `rules-state.json` (which rules are
+/// disabled) and `allowlist.json` (which rule/executable pairs are
+/// suppressed). Both are gated behind Touch ID/password in the UI
+/// (`RuleStore.requestToggle`, `AllowlistStore.requestAllow`/`requestRemove`),
+/// but that only guards the UI path: the files themselves are plain,
+/// same-user-writable JSON, and any process running as this user — in
+/// particular the exact kind of LOLBin-style local attacker Argus watches
+/// for — can rewrite them directly to blind a detection silently.
+///
+/// True prevention would require privilege separation (a separate,
+/// higher-privileged process owning these files), which is out of scope
+/// here. This is evidence, not prevention: every legitimate write goes
+/// through `recordAuthenticatedWrite(of:)`, which records an HMAC of the
+/// file's contents in a keychain-protected sidecar. At launch, `verify(_:)`
+/// recomputes that HMAC and compares it — a mismatch means the file changed
+/// through some path other than an authenticated Argus write, and the app
+/// reports that as a critical event so the tamper itself becomes visible in
+/// the feed, even though it can't be blocked in the first place.
+enum IntegrityVerdict: Equatable {
+    /// The file's current contents match the last recorded MAC.
+    case verified
+    /// No MAC was on record for this file yet, so its current contents were
+    /// adopted as the baseline. Expected the first time a file is verified
+    /// (e.g. a fresh install, or a file that predates this feature).
+    case baselineEstablished
+    /// The file's current contents don't match the last recorded MAC — it
+    /// was modified by something other than an authenticated Argus write.
+    case tampered
+    /// Verification couldn't be performed at all: no signing key is
+    /// available (Keychain access failed or is unavailable, as happens
+    /// under `swift test`/CI), or the file couldn't be read.
+    case unverifiable
+}
+
+/// Supplies the symmetric key `IntegrityGuard` uses to MAC file contents.
+/// Abstracted so tests can supply a fixed, in-memory key instead of touching
+/// the real Keychain.
+protocol IntegrityKeyProvider {
+    /// Returns the signing key, or `nil` if one isn't available. A `nil` key
+    /// disables verification gracefully rather than crashing — see
+    /// `KeychainIntegrityKeyProvider`.
+    func key() -> Data?
+}
+
+/// Production key provider: a random 32-byte key stored as a generic
+/// password in the user's login keychain (service "Argus", account
+/// "integrity-key"), created lazily the first time it's needed. Keeping the
+/// key in the Keychain rather than alongside the guarded files is the whole
+/// point — an attacker who can rewrite `rules-state.json` in place has no
+/// reason to also have Keychain access, so the MAC stays trustworthy even
+/// against an attacker who knows exactly how this scheme works.
+///
+/// Any Keychain error (locked, unavailable, sandboxed test environment with
+/// no keychain access, denied) is treated the same as "no key": returns
+/// `nil` rather than throwing or crashing. This is what makes it safe to run
+/// under `swift test`/CI, where Keychain access typically isn't available at
+/// all — verification just reports `.unverifiable` instead.
+struct KeychainIntegrityKeyProvider: IntegrityKeyProvider {
+    private static let service = "Argus"
+    private static let account = "integrity-key"
+    private static let keyLength = 32
+
+    func key() -> Data? {
+        if let existing = readKey() {
+            return existing
+        }
+        var bytes = [UInt8](repeating: 0, count: Self.keyLength)
+        guard SecRandomCopyBytes(kSecRandomDefault, bytes.count, &bytes) == errSecSuccess else {
+            DiagnosticsLog.write("integrity-guard: failed to generate a key (SecRandomCopyBytes)")
+            return nil
+        }
+        let generated = Data(bytes)
+        guard write(generated) else {
+            DiagnosticsLog.write("integrity-guard: failed to store a new key in the Keychain")
+            return nil
+        }
+        return generated
+    }
+
+    private func readKey() -> Data? {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: Self.service,
+            kSecAttrAccount as String: Self.account,
+            kSecReturnData as String: true,
+            kSecMatchLimit as String: kSecMatchLimitOne,
+        ]
+        var item: AnyObject?
+        let status = SecItemCopyMatching(query as CFDictionary, &item)
+        guard status == errSecSuccess, let data = item as? Data else { return nil }
+        return data
+    }
+
+    private func write(_ data: Data) -> Bool {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: Self.service,
+            kSecAttrAccount as String: Self.account,
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+        return SecItemAdd(query as CFDictionary, nil) == errSecSuccess
+    }
+}
+
+/// See the type-level rationale above (evidence, not prevention). Owns one
+/// sidecar file mapping guarded files' full paths to a hex HMAC-SHA256 of
+/// their last authenticated contents, so a single guard instance can cover
+/// multiple files (`rules-state.json`, `allowlist.json`, ...). Keyed by full
+/// path, not filename — a store pointed at a same-named file elsewhere (a
+/// test's temp copy, a second profile) must never collide with the real
+/// file's recorded MAC.
+/// Threading: fetching the Keychain key can present a user consent prompt
+/// (the item's ACL doesn't cover this binary — e.g. after a rebuild changes
+/// the ad-hoc signature), and SecItem calls block their thread until the
+/// user answers. Every operation therefore funnels through a private serial
+/// queue: callers never block on a pending prompt (`recordAuthenticatedWrite`
+/// and `verifyAsync` are fire-and-forget/async; the synchronous `verify` is
+/// for tests), and the key attempt is cached so at most one prompt appears
+/// per launch, however many files are guarded. `@unchecked Sendable` is
+/// sound because all mutable state is confined to that queue.
+final class IntegrityGuard: @unchecked Sendable {
+    private let keyProvider: IntegrityKeyProvider
+    private let sidecarURL: URL
+    private let queue = DispatchQueue(label: "argus.integrity-guard", qos: .utility)
+    /// `nil` = not yet attempted; `.some(nil)` = attempted and unavailable
+    /// (denied, locked, no keychain) — cached so a denial doesn't re-prompt
+    /// on every subsequent call this launch. Only touched on `queue`.
+    private var cachedKeyAttempt: Data??
+
+    /// Shared production instance backed by the real Keychain. Individual
+    /// stores default their `integrityGuard` init parameter to this so
+    /// callers don't have to wire one up explicitly; tests inject their own
+    /// instance (fixed key provider, temp-dir sidecar) instead of using this.
+    static let shared = IntegrityGuard()
+
+    init(keyProvider: IntegrityKeyProvider = KeychainIntegrityKeyProvider(), sidecarURL: URL? = nil) {
+        self.keyProvider = keyProvider
+        if let sidecarURL {
+            self.sidecarURL = sidecarURL
+        } else {
+            let dir = FileManager.default.homeDirectoryForCurrentUser
+                .appendingPathComponent("Library/Application Support/Argus", isDirectory: true)
+            try? FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
+            // Keep the shared Argus support directory owner-only (see EventStore).
+            try? FileManager.default.setAttributes([.posixPermissions: 0o700], ofItemAtPath: dir.path)
+            self.sidecarURL = dir.appendingPathComponent("integrity.json")
+        }
+    }
+
+    /// Call this after every legitimate, already-authenticated write to a
+    /// guarded file — it recomputes the file's MAC from what's on disk right
+    /// now and persists it, so the next `verify(_:)` treats this content as
+    /// trusted. Fire-and-forget: the work (including a possible Keychain
+    /// prompt) happens on the guard's own queue, never on the caller's
+    /// thread. Ordering with `verify`/`verifyAsync` is preserved because
+    /// everything shares the one serial queue.
+    func recordAuthenticatedWrite(of fileURL: URL) {
+        queue.async { self.recordOnQueue(fileURL) }
+    }
+
+    /// Synchronous verification — blocks the calling thread until any
+    /// already-queued work (pending MAC records) and the verification itself
+    /// complete. Intended for tests; app code should use `verifyAsync` so a
+    /// Keychain consent prompt can never freeze the UI.
+    func verify(_ fileURL: URL) -> IntegrityVerdict {
+        queue.sync { verifyOnQueue(fileURL) }
+    }
+
+    /// Asynchronous verification; `completion` runs on the guard's queue —
+    /// hop to the main actor before touching UI or store state.
+    func verifyAsync(_ fileURL: URL, completion: @escaping (IntegrityVerdict) -> Void) {
+        queue.async { completion(self.verifyOnQueue(fileURL)) }
+    }
+
+    /// The cached one-shot key fetch (see the threading note on the type).
+    private func keyOnQueue() -> Data? {
+        if let attempted = cachedKeyAttempt { return attempted }
+        let key = keyProvider.key()
+        cachedKeyAttempt = .some(key)
+        return key
+    }
+
+    private func recordOnQueue(_ fileURL: URL) {
+        guard let key = keyOnQueue() else {
+            DiagnosticsLog.write("integrity-guard: no key available, cannot record \(fileURL.lastPathComponent)")
+            return
+        }
+        guard let mac = mac(for: fileURL, key: key) else {
+            DiagnosticsLog.write("integrity-guard: could not read \(fileURL.lastPathComponent) to record its MAC")
+            return
+        }
+        var sidecar = loadSidecar()
+        sidecar[fileURL.path] = mac
+        saveSidecar(sidecar)
+    }
+
+    /// Recomputes `fileURL`'s MAC and compares it against what was last
+    /// recorded via `recordAuthenticatedWrite(of:)`.
+    ///
+    /// After reporting `.tampered`, this re-baselines the file (records its
+    /// new MAC as though it had just been authenticated) rather than leaving
+    /// the mismatch on record. Without that, the exact same tamper would
+    /// re-fire as a fresh `.tampered` verdict on every subsequent launch —
+    /// once the app has surfaced the tamper as a critical event, there's
+    /// nothing more for a repeat report to add, and re-baselining is what
+    /// lets a *new* out-of-band edit be distinguished from the same old one.
+    private func verifyOnQueue(_ fileURL: URL) -> IntegrityVerdict {
+        guard let key = keyOnQueue() else {
+            DiagnosticsLog.write("integrity-guard: no key available, cannot verify \(fileURL.lastPathComponent)")
+            return .unverifiable
+        }
+        guard let currentMAC = mac(for: fileURL, key: key) else {
+            DiagnosticsLog.write("integrity-guard: could not read \(fileURL.lastPathComponent) to verify it")
+            return .unverifiable
+        }
+
+        var sidecar = loadSidecar()
+        guard let recordedMAC = sidecar[fileURL.path] else {
+            sidecar[fileURL.path] = currentMAC
+            saveSidecar(sidecar)
+            DiagnosticsLog.write("integrity-guard: establishing baseline for \(fileURL.lastPathComponent)")
+            return .baselineEstablished
+        }
+
+        guard recordedMAC == currentMAC else {
+            sidecar[fileURL.path] = currentMAC
+            saveSidecar(sidecar)
+            return .tampered
+        }
+        return .verified
+    }
+
+    private func mac(for fileURL: URL, key: Data) -> String? {
+        guard let data = try? Data(contentsOf: fileURL) else { return nil }
+        let code = HMAC<SHA256>.authenticationCode(for: data, using: SymmetricKey(data: key))
+        return Data(code).map { String(format: "%02x", $0) }.joined()
+    }
+
+    private func loadSidecar() -> [String: String] {
+        guard let data = try? Data(contentsOf: sidecarURL),
+              let decoded = try? JSONDecoder().decode([String: String].self, from: data) else { return [:] }
+        return decoded
+    }
+
+    private func saveSidecar(_ sidecar: [String: String]) {
+        guard let data = try? JSONEncoder().encode(sidecar) else { return }
+        try? data.write(to: sidecarURL, options: .atomic)
+        // An atomic write replaces the file with a fresh inode carrying
+        // default (umask) permissions, so re-assert owner-only here (see
+        // EventStore.trimIfNeeded).
+        try? FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: sidecarURL.path)
+    }
+
+    /// Builds the critical synthetic `ProcessEvent` reported when `verify(_:)`
+    /// returns `.tampered`. Pure (no filesystem, no Keychain) so it's
+    /// trivially unit-testable; mirrors `PersistenceEventBuilder.makeEvent`'s
+    /// pid/ppid-0 convention for events that describe a file, not an
+    /// observed process.
+    static func tamperEvent(for fileURL: URL) -> ProcessEvent {
+        let filename = fileURL.lastPathComponent
+        let rule = MatchedRule(
+            name: "Detection state modified outside Argus",
+            severity: .critical,
+            technique: "T1562.001",
+            explanation: "\(filename) was modified without going through Argus's authenticated (Touch ID/password) write path. " +
+                "This is how a local attacker would silently disable a detection rule or allowlist a technique to hide their " +
+                "own activity — the file's contents no longer match what Argus last wrote."
+        )
+        return ProcessEvent(pid: 0, ppid: 0, executable: filename, command: fileURL.path, rules: [rule], timestamp: Date())
+    }
+}
diff --git a/Sources/Argus/MenuBarPanel.swift b/Sources/Argus/MenuBarPanel.swift
index 78e7e22..6f422da 100644
--- a/Sources/Argus/MenuBarPanel.swift
+++ b/Sources/Argus/MenuBarPanel.swift
@@ -2,6 +2,7 @@ import SwiftUI
 
 /// Compact popover shown from the menu bar item — glanceable posture without
 /// opening the full dashboard window.
+@MainActor
 struct MenuBarPanel: View {
     @ObservedObject var monitor: ProcessMonitor
     var dismissFlyout: () -> Void = {}
@@ -21,6 +22,17 @@ struct MenuBarPanel: View {
                     .foregroundStyle(Theme.color(for: monitor.riskLevel))
             }
 
+            if monitor.isDegraded {
+                HStack(spacing: 5) {
+                    Image(systemName: "exclamationmark.triangle.fill")
+                        .font(.system(size: 9))
+                    Text("Monitor degraded — process sampling is failing")
+                        .font(.system(size: 9.5, weight: .medium))
+                        .lineLimit(1)
+                }
+                .foregroundStyle(Theme.color(for: .elevated))
+            }
+
             GaugeView(score: monitor.riskScore, level: monitor.riskLevel)
                 .scaleEffect(0.7)
                 .frame(height: 90)
diff --git a/Sources/Argus/Models.swift b/Sources/Argus/Models.swift
index 92e26db..67ea51a 100644
--- a/Sources/Argus/Models.swift
+++ b/Sources/Argus/Models.swift
@@ -56,6 +56,10 @@ struct RawProcess: Identifiable, Equatable {
     /// this normalization, every imported rule's `Image|endswith: '/curl'`
     /// would silently never match ordinary typed shell usage.
     let image: String
+    /// The owning account's short username, as reported by `ps -o user`.
+    /// macOS short usernames never contain spaces, which is what makes the
+    /// fixed-width `pid ppid user command...` column parse tractable.
+    let user: String
 }
 
 /// A process that tripped one or more rules — what the dashboard actually shows.
@@ -68,8 +72,13 @@ struct ProcessEvent: Identifiable, Codable {
     let command: String
     let rules: [MatchedRule]
     let timestamp: Date
+    /// Supervisor labels from `ProvenanceClassifier` (e.g. "claude",
+    /// "docker") — attribution for triage, never a trust signal; see
+    /// `ProvenanceTag`'s doc comment. Empty for synthetic events (chain,
+    /// persistence, tamper) that don't carry a real process ancestry.
+    let provenance: [String]
 
-    init(id: UUID = UUID(), pid: Int32, ppid: Int32, executable: String, command: String, rules: [MatchedRule], timestamp: Date) {
+    init(id: UUID = UUID(), pid: Int32, ppid: Int32, executable: String, command: String, rules: [MatchedRule], timestamp: Date, provenance: [String] = []) {
         self.id = id
         self.pid = pid
         self.ppid = ppid
@@ -77,6 +86,28 @@ struct ProcessEvent: Identifiable, Codable {
         self.command = command
         self.rules = rules
         self.timestamp = timestamp
+        self.provenance = provenance
+    }
+
+    private enum CodingKeys: String, CodingKey {
+        case id, pid, ppid, executable, command, rules, timestamp, provenance
+    }
+
+    // Custom decode so historical events.jsonl lines written before
+    // `provenance` existed still decode: `decodeIfPresent` falls back to `[]`
+    // instead of failing the whole load on a missing key. `encode(to:)` is
+    // left to the synthesized Encodable conformance — every newly-written
+    // event always carries the key.
+    init(from decoder: Decoder) throws {
+        let container = try decoder.container(keyedBy: CodingKeys.self)
+        id = try container.decode(UUID.self, forKey: .id)
+        pid = try container.decode(Int32.self, forKey: .pid)
+        ppid = try container.decode(Int32.self, forKey: .ppid)
+        executable = try container.decode(String.self, forKey: .executable)
+        command = try container.decode(String.self, forKey: .command)
+        rules = try container.decode([MatchedRule].self, forKey: .rules)
+        timestamp = try container.decode(Date.self, forKey: .timestamp)
+        provenance = try container.decodeIfPresent([String].self, forKey: .provenance) ?? []
     }
 
     var topSeverity: Severity { rules.map(\.severity).max() ?? .info }
diff --git a/Sources/Argus/NotificationManager.swift b/Sources/Argus/NotificationManager.swift
index 43895b6..fb7b9b2 100644
--- a/Sources/Argus/NotificationManager.swift
+++ b/Sources/Argus/NotificationManager.swift
@@ -7,8 +7,33 @@ import UserNotifications
 /// of *whether* to notify lives in NotificationThreshold.shouldNotify,
 /// which is pure and tested there instead.
 enum NotificationManager {
+    /// Category attached to every delivered event notification. Must match
+    /// what `NotificationResponder` (the `UNUserNotificationCenterDelegate`
+    /// wired up in `ArgusApp.init`) switches on when handling actions.
+    static let categoryIdentifier = "argus.event"
+    static let showActionIdentifier = "argus.event.show"
+    static let allowlistActionIdentifier = "argus.event.allowlist"
+
+    /// userInfo keys carrying just enough context for `NotificationResponder`
+    /// to act on a notification without re-reading the event store.
+    static let ruleNameKey = "ruleName"
+    static let executableKey = "executable"
+
     static func requestAuthorizationIfNeeded() {
-        UNUserNotificationCenter.current().requestAuthorization(options: [.alert, .sound]) { _, _ in }
+        let center = UNUserNotificationCenter.current()
+        center.setNotificationCategories([actionableCategory])
+        center.requestAuthorization(options: [.alert, .sound]) { _, _ in }
+    }
+
+    /// "Show in Argus" brings the app forward regardless of authentication —
+    /// it's read-only. "Allowlist…" changes what Argus suppresses, so it
+    /// carries `.authenticationRequired`: macOS itself will demand the
+    /// screen be unlocked before invoking it, on top of the Touch
+    /// ID/password prompt `AllowlistStore.requestAllow` raises once it runs.
+    private static var actionableCategory: UNNotificationCategory {
+        let show = UNNotificationAction(identifier: showActionIdentifier, title: "Show in Argus", options: [.foreground])
+        let allow = UNNotificationAction(identifier: allowlistActionIdentifier, title: "Allowlist…", options: [.authenticationRequired])
+        return UNNotificationCategory(identifier: categoryIdentifier, actions: [show, allow], intentIdentifiers: [], options: [])
     }
 
     static func notify(event: ProcessEvent) {
@@ -17,6 +42,14 @@ enum NotificationManager {
         content.subtitle = event.executable
         content.body = event.rules.map(\.name).joined(separator: ", ")
         content.sound = .default
+        content.categoryIdentifier = categoryIdentifier
+        // An event can trip several rules; only the top-severity one is
+        // actionable from the notification's "Allowlist…" action (see
+        // NotificationResponder's doc comment on that limitation), so that's
+        // the only one worth carrying in userInfo.
+        if let topRule = event.rules.first(where: { $0.severity == event.topSeverity }) {
+            content.userInfo = [ruleNameKey: topRule.name, executableKey: event.executable]
+        }
 
         let request = UNNotificationRequest(identifier: event.id.uuidString, content: content, trigger: nil)
         UNUserNotificationCenter.current().add(request)
diff --git a/Sources/Argus/NotificationResponder.swift b/Sources/Argus/NotificationResponder.swift
new file mode 100644
index 0000000..07a0570
--- /dev/null
+++ b/Sources/Argus/NotificationResponder.swift
@@ -0,0 +1,91 @@
+import Foundation
+import AppKit
+import UserNotifications
+
+/// Handles taps and actions on delivered Argus notifications — the
+/// notification-side counterpart to the event feed's right-click menu.
+/// Instantiated once in `ArgusApp.init` and held there for the app's
+/// lifetime (see `ArgusApp.notificationResponder`), since
+/// `UNUserNotificationCenter.delegate` is a weak reference and nothing else
+/// keeps this object alive otherwise.
+final class NotificationResponder: NSObject, UNUserNotificationCenterDelegate {
+    /// Weak so this responder never becomes the thing keeping `AllowlistStore`
+    /// (and its disk I/O, Touch ID plumbing) alive past the app's own
+    /// `_allowlist` StateObject — mirrors the `[weak m]` pattern `App.swift`
+    /// already uses when wiring `PersistenceWatcher`.
+    private weak var allowlist: AllowlistStore?
+    private let mainWindowID: String
+
+    init(allowlist: AllowlistStore, mainWindowID: String) {
+        self.allowlist = allowlist
+        self.mainWindowID = mainWindowID
+    }
+
+    /// UNUserNotificationCenter delegate callbacks can arrive off the main
+    /// thread, and both `AllowlistStore` and AppKit require the main thread —
+    /// hence `nonisolated` here with an explicit hop to `@MainActor` below
+    /// rather than isolating this whole class (which would fight the
+    /// framework's expectation that these delegate methods are plain,
+    /// synchronously-callable ObjC hooks).
+    nonisolated func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification, withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void) {
+        // Before this delegate existed, Argus had no
+        // UNUserNotificationCenter delegate at all, and with no delegate the
+        // system still shows the alert while the app is frontmost. Adding a
+        // delegate opts back into the platform's foreground-suppression
+        // behavior unless it explicitly re-requests presentation — this
+        // override exists purely to preserve that prior behavior, not to add
+        // anything new.
+        completionHandler([.banner, .sound])
+    }
+
+    nonisolated func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse, withCompletionHandler completionHandler: @escaping () -> Void) {
+        let userInfo = response.notification.request.content.userInfo
+        let ruleName = userInfo[NotificationManager.ruleNameKey] as? String
+        let executable = userInfo[NotificationManager.executableKey] as? String
+        let actionIdentifier = response.actionIdentifier
+
+        Task { @MainActor [weak self] in
+            switch actionIdentifier {
+            case UNNotificationDefaultActionIdentifier, NotificationManager.showActionIdentifier:
+                self?.showMainWindow()
+            case NotificationManager.allowlistActionIdentifier:
+                // The event that triggered this notification may have
+                // matched several rules; NotificationManager.notify only
+                // attaches the single top-severity one to userInfo (see its
+                // doc comment), so only that rule is allowlisted here — not
+                // every rule the event tripped. Going through
+                // `requestAllow` means this takes the exact same Touch
+                // ID/password gate and DiagnosticsLog trail as right-clicking
+                // the event in-app; the notification action is not a bypass
+                // of that control, just another entry point into it.
+                if let ruleName, let executable {
+                    self?.allowlist?.requestAllow(ruleName: ruleName, executable: executable)
+                }
+            default:
+                break
+            }
+            completionHandler()
+        }
+    }
+
+    /// Reopens/activates the dashboard the same way `MenuBarPanel`'s "Open
+    /// Argus" button does — by locating the `NSWindow` whose `identifier`
+    /// matches `App.swift`'s `mainWindowID` (see its doc comment) — but
+    /// without SwiftUI's `openWindow` environment action, which only exists
+    /// inside a View's environment and isn't reachable from a plain
+    /// `UNUserNotificationCenterDelegate` object living outside the view
+    /// hierarchy. That means this can only bring an already-created window
+    /// forward; unlike `openWindow(id:)` it can't spin one up from nothing.
+    /// In practice the dashboard's `Window` scene is created at launch, so
+    /// this only matters if that window were later fully deallocated rather
+    /// than just ordered out.
+    @MainActor
+    private func showMainWindow() {
+        NSApp.activate(ignoringOtherApps: true)
+        guard let window = NSApp.windows.first(where: { $0.identifier?.rawValue == mainWindowID }) else {
+            DiagnosticsLog.write("notification action: main window not found (identifier \(mainWindowID))")
+            return
+        }
+        window.makeKeyAndOrderFront(nil)
+    }
+}
diff --git a/Sources/Argus/PersistenceWatcher.swift b/Sources/Argus/PersistenceWatcher.swift
new file mode 100644
index 0000000..4c4d9e6
--- /dev/null
+++ b/Sources/Argus/PersistenceWatcher.swift
@@ -0,0 +1,278 @@
+import Foundation
+import Darwin
+
+/// A directory listing reduced to what the diff core needs: filename →
+/// last modification date. Kept as a plain dictionary (rather than a richer
+/// type) so the diff core has zero filesystem dependency and can be driven
+/// directly from literal values in tests.
+typealias DirectorySnapshot = [String: Date]
+
+/// What happened to one entry between two snapshots of the same directory.
+enum ArtifactChangeKind: Equatable {
+    case added
+    case modified
+    case removed
+}
+
+/// One filename's change between two snapshots.
+struct ArtifactChange: Equatable {
+    let filename: String
+    let kind: ArtifactChangeKind
+}
+
+/// Pure diff of two directory snapshots. Deliberately free of any file-system
+/// access (no `FileManager`, no `Date()`) so it can be exercised directly and
+/// deterministically in tests without a real directory on disk.
+enum SnapshotDiff {
+    /// A name present in both snapshots with an unchanged modification date is
+    /// not reported — only additions, removals, and entries whose mtime moved
+    /// count as a change. Results are sorted by filename so callers (and
+    /// tests) get a deterministic order regardless of dictionary iteration.
+    static func diff(previous: DirectorySnapshot, current: DirectorySnapshot) -> [ArtifactChange] {
+        var changes: [ArtifactChange] = []
+
+        for (name, currentDate) in current {
+            if let previousDate = previous[name] {
+                if previousDate != currentDate {
+                    changes.append(ArtifactChange(filename: name, kind: .modified))
+                }
+            } else {
+                changes.append(ArtifactChange(filename: name, kind: .added))
+            }
+        }
+        for name in previous.keys where current[name] == nil {
+            changes.append(ArtifactChange(filename: name, kind: .removed))
+        }
+
+        return changes.sorted { $0.filename < $1.filename }
+    }
+}
+
+/// The persistence-artifact locations Argus watches, each tagged with the
+/// MITRE ATT&CK technique its contents represent so synthetic events can
+/// cite the right technique without re-deriving it from a path string.
+enum PersistenceLocationKind: Equatable {
+    case launchAgents
+    case launchDaemons
+    case periodicCron
+
+    var displayName: String {
+        switch self {
+        case .launchAgents: return "LaunchAgents"
+        case .launchDaemons: return "LaunchDaemons"
+        case .periodicCron: return "periodic"
+        }
+    }
+
+    var technique: String {
+        switch self {
+        case .launchDaemons: return "T1543.001"
+        case .launchAgents: return "T1547.011"
+        case .periodicCron: return "T1053.003"
+        }
+    }
+}
+
+/// Builds the synthetic `ProcessEvent` for one detected artifact change. Pure
+/// (no filesystem, no dispatch) so the severity/technique/explanation mapping
+/// can be tested directly against literal inputs.
+///
+/// These events have no real pid — they represent a change to a persistence
+/// artifact on disk, not an observed process — so `pid`/`ppid` are 0 and
+/// `executable`/`command` describe the file instead. Allowlist filtering
+/// (`AllowlistFilter`, keyed on `executable`) intentionally does NOT apply to
+/// these events: an allowlisted *process* is not the same thing as an
+/// allowlisted *persistence location*, and silently suppressing a LaunchAgent
+/// change because some unrelated executable was once allowlisted would defeat
+/// the point of watching the artifact independently of the process that wrote it.
+enum PersistenceEventBuilder {
+    static func makeEvent(filename: String, changeKind: ArtifactChangeKind, locationKind: PersistenceLocationKind, directoryPath: String) -> ProcessEvent {
+        let verb: String
+        let severity: Severity
+        switch changeKind {
+        case .added:
+            verb = "added"
+            severity = .elevated
+        case .modified:
+            verb = "modified"
+            severity = .elevated
+        case .removed:
+            verb = "removed"
+            severity = .watch
+        }
+
+        let fullPath = (directoryPath as NSString).appendingPathComponent(filename)
+        let explanation = "A \(locationKind.displayName) entry was \(verb) at \(fullPath). " +
+            explanationSuffix(for: locationKind)
+
+        let rule = MatchedRule(
+            name: "Persistence artifact \(verb): \(locationKind.displayName)",
+            severity: severity,
+            technique: locationKind.technique,
+            explanation: explanation
+        )
+
+        return ProcessEvent(pid: 0, ppid: 0, executable: filename, command: fullPath, rules: [rule], timestamp: Date())
+    }
+
+    private static func explanationSuffix(for kind: PersistenceLocationKind) -> String {
+        switch kind {
+        case .launchAgents:
+            return "LaunchAgents are the classic macOS persistence endgame: a plist here runs automatically every time this user logs in, until it's removed."
+        case .launchDaemons:
+            return "LaunchDaemons are the classic macOS persistence endgame: a plist here runs automatically at boot with root privileges, until it's removed."
+        case .periodicCron:
+            return "Scripts under /etc/periodic run automatically on a fixed schedule, making this a common cron-style persistence point."
+        }
+    }
+}
+
+/// Watches one directory for changes, coalesces bursts of filesystem events
+/// into a single rescan, and reports the diff as synthetic `ProcessEvent`s.
+///
+/// Deliberately event-driven (`DispatchSource` on an `O_EVTONLY` file
+/// descriptor) rather than polled: `ProcessMonitor` already accepts up to
+/// ~1.2s of blind spot on the process table in exchange for zero
+/// entitlements, and layering a second poll loop here would just move the
+/// same trade-off onto the filesystem instead of fixing it. `DispatchSource`
+/// gets near-immediate notification without polling at all.
+final class DirectoryWatch {
+    private let path: String
+    private let kind: PersistenceLocationKind
+    private let onChange: (ProcessEvent) -> Void
+    private let queue: DispatchQueue
+    private let source: DispatchSourceFileSystemObject
+    private var lastSnapshot: DirectorySnapshot
+    private var pendingRescan: DispatchWorkItem?
+    private let debounceInterval: TimeInterval
+
+    /// Fails (returns nil) if `path` doesn't exist or can't be opened —
+    /// e.g. `/Library/LaunchDaemons` readable but some sandboxed or
+    /// permission-restricted directory isn't. Callers are expected to log
+    /// and skip on failure rather than treat it as fatal, since several of
+    /// the watched locations are optional (not every Mac has all of them,
+    /// and some require privileges this app may not have).
+    init?(path: String, kind: PersistenceLocationKind, debounceInterval: TimeInterval = 1.0, onChange: @escaping (ProcessEvent) -> Void) {
+        var isDirectory: ObjCBool = false
+        guard FileManager.default.fileExists(atPath: path, isDirectory: &isDirectory), isDirectory.boolValue else {
+            return nil
+        }
+        let fd = open(path, O_EVTONLY)
+        guard fd >= 0 else { return nil }
+
+        self.path = path
+        self.kind = kind
+        self.onChange = onChange
+        self.debounceInterval = debounceInterval
+        self.queue = DispatchQueue(label: "com.argus.persistencewatcher.\(kind.displayName)")
+        self.source = DispatchSource.makeFileSystemObjectSource(fileDescriptor: fd, eventMask: .write, queue: queue)
+
+        // Silent baseline: capture the starting snapshot before the source is
+        // ever resumed, so files that already existed when Argus launched
+        // never appear as "added" the first time an event fires.
+        self.lastSnapshot = Self.snapshot(of: path)
+
+        source.setEventHandler { [weak self] in
+            self?.scheduleRescan()
+        }
+        source.setCancelHandler {
+            close(fd)
+        }
+        source.resume()
+    }
+
+    func cancel() {
+        source.cancel()
+    }
+
+    /// Bursty writers (an editor save, `plutil -convert`, a package installer
+    /// touching several files) can fire several `.write` events for what is
+    /// really one logical change. Debouncing to a single rescan ~1s after the
+    /// last event avoids reporting the same change multiple times or
+    /// diffing against a half-written file.
+    private func scheduleRescan() {
+        pendingRescan?.cancel()
+        let work = DispatchWorkItem { [weak self] in
+            self?.rescan()
+        }
+        pendingRescan = work
+        queue.asyncAfter(deadline: .now() + debounceInterval, execute: work)
+    }
+
+    private func rescan() {
+        let current = Self.snapshot(of: path)
+        let changes = SnapshotDiff.diff(previous: lastSnapshot, current: current)
+        lastSnapshot = current
+        for change in changes {
+            let event = PersistenceEventBuilder.makeEvent(filename: change.filename, changeKind: change.kind, locationKind: kind, directoryPath: path)
+            onChange(event)
+        }
+    }
+
+    private static func snapshot(of path: String) -> DirectorySnapshot {
+        let fm = FileManager.default
+        guard let names = try? fm.contentsOfDirectory(atPath: path) else { return [:] }
+        var result: DirectorySnapshot = [:]
+        for name in names {
+            let fullPath = (path as NSString).appendingPathComponent(name)
+            if let attributes = try? fm.attributesOfItem(atPath: fullPath),
+               let modified = attributes[.modificationDate] as? Date {
+                result[name] = modified
+            }
+        }
+        return result
+    }
+}
+
+/// Second, independent sensor alongside `ProcessMonitor`: instead of relying
+/// on catching the *process* that writes a persistence artifact during a
+/// ~1.2s `ps` poll (which a short-lived writer can slip through entirely),
+/// this watches the artifact *locations* directly. A LaunchAgent/LaunchDaemon
+/// plist or a periodic script left behind is caught even when the process
+/// that created it was never sampled.
+final class PersistenceWatcher {
+    /// Invoked on the main actor for every detected artifact change. Set
+    /// before calling `start()`.
+    var onEvent: (@MainActor (ProcessEvent) -> Void)?
+
+    private var watches: [DirectoryWatch] = []
+
+    /// The standard macOS persistence-artifact directories. `~/Library/LaunchAgents`
+    /// is resolved from the real home directory at call time rather than
+    /// hardcoded, so this works under any user account.
+    static func defaultLocations() -> [(path: String, kind: PersistenceLocationKind)] {
+        let home = FileManager.default.homeDirectoryForCurrentUser.path
+        return [
+            ("\(home)/Library/LaunchAgents", .launchAgents),
+            ("/Library/LaunchAgents", .launchAgents),
+            ("/Library/LaunchDaemons", .launchDaemons),
+            ("/etc/periodic", .periodicCron),
+        ]
+    }
+
+    /// Begins watching every location in `defaultLocations()` that exists and
+    /// is readable. A missing or unopenable directory (no `/etc/periodic` on
+    /// some systems, insufficient privileges on another) is skipped with a
+    /// single diagnostic line rather than retried in a loop — there is
+    /// nothing to recover from short of the directory appearing later, which
+    /// this process won't be relaunched to notice anyway.
+    func start() {
+        for location in Self.defaultLocations() {
+            guard let watch = DirectoryWatch(path: location.path, kind: location.kind, onChange: { [weak self] event in
+                guard let self else { return }
+                Task { @MainActor in
+                    self.onEvent?(event)
+                }
+            }) else {
+                DiagnosticsLog.write("persistence watcher — skipping unreadable location \(location.path)")
+                continue
+            }
+            watches.append(watch)
+        }
+    }
+
+    func stop() {
+        for watch in watches { watch.cancel() }
+        watches.removeAll()
+    }
+}
diff --git a/Sources/Argus/ProcessMonitor.swift b/Sources/Argus/ProcessMonitor.swift
index 887f36e..d8cc182 100644
--- a/Sources/Argus/ProcessMonitor.swift
+++ b/Sources/Argus/ProcessMonitor.swift
@@ -1,6 +1,130 @@
 import Foundation
 import Combine
 
+/// Caches pid → image/command/user across polling ticks so a newly-spawned
+/// child's ParentImage/ParentCommandLine/ParentUser can still be resolved
+/// after the parent has already exited by the next poll — a common race:
+/// many LOLBin chains spawn a short-lived parent (e.g. a one-shot `sh -c`)
+/// that's gone from the process table before the ~1.2s sample interval
+/// elapses. Without this cache those Sigma rules that key off parent
+/// context would silently never match such chains.
+///
+/// The current sample's entries always overwrite older ones. Entries for
+/// pids no longer present in the sample are kept for `retentionTicks` more
+/// ticks (default 3, ~30s at the default poll interval) and then dropped —
+/// pruning matters because macOS recycles pids; without it, a new,
+/// unrelated process could inherit a long-dead process's stale identity as
+/// its "parent".
+struct ParentContextCache {
+    struct Entry {
+        var image: String
+        var command: String
+        var user: String
+        var ppid: Int32
+        var lastSeenTick: Int
+    }
+
+    private(set) var entries: [Int32: Entry] = [:]
+    let retentionTicks: Int
+
+    init(retentionTicks: Int = 3) {
+        self.retentionTicks = retentionTicks
+    }
+
+    /// Merges the current sample into the cache and prunes anything not
+    /// refreshed within the retention window.
+    mutating func update(with sample: [RawProcess], tick: Int) {
+        for p in sample {
+            entries[p.id] = Entry(image: p.image, command: p.command, user: p.user, ppid: p.ppid, lastSeenTick: tick)
+        }
+        entries = entries.filter { tick - $0.value.lastSeenTick <= retentionTicks }
+    }
+
+    func image(for pid: Int32) -> String? { entries[pid]?.image }
+    func command(for pid: Int32) -> String? { entries[pid]?.command }
+    func user(for pid: Int32) -> String? { entries[pid]?.user }
+    func ppid(for pid: Int32) -> Int32? { entries[pid]?.ppid }
+
+    /// Walks ppid links from `pid` up through the cache to build its ancestor
+    /// records (pid plus that pid's cached image/command), nearest ancestor
+    /// first, excluding `pid` itself. Stops at `pid <= 1` (launchd/kernel —
+    /// the root of every process tree, so it carries no chain-correlation or
+    /// provenance signal), at a pid the cache has no *ppid link* for (parent
+    /// already aged out or was never sampled), at a cycle (should never
+    /// happen on a real process table, but a corrupted/adversarial sample
+    /// must not spin forever), or at `maxDepth` hops.
+    ///
+    /// A pid can appear in the chain (discovered as another pid's ppid) even
+    /// when the cache never itself sampled that pid — e.g. a parent that
+    /// exited and aged out past `retentionTicks` before this walk ran. Such a
+    /// pid still terminates the walk one hop later (its own ppid link is
+    /// unknown) but is reported here with empty `image`/`command` rather than
+    /// silently dropped, so callers keying off ancestor pids (chain
+    /// correlation) and callers keying off ancestor identity (provenance
+    /// attribution) both see the exact same chain length.
+    func ancestorRecords(of pid: Int32, maxDepth: Int = 20) -> [(pid: Int32, image: String, command: String)] {
+        var chain: [(pid: Int32, image: String, command: String)] = []
+        var seen: Set<Int32> = [pid]
+        var current = pid
+        while chain.count < maxDepth {
+            guard let parent = ppid(for: current), parent > 1, !seen.contains(parent) else { break }
+            let entry = entries[parent]
+            chain.append((pid: parent, image: entry?.image ?? "", command: entry?.command ?? ""))
+            seen.insert(parent)
+            current = parent
+        }
+        return chain
+    }
+
+    /// The pid-only projection of `ancestorRecords(of:maxDepth:)` — see that
+    /// method for the walk/termination semantics, which this shares exactly.
+    func ancestry(of pid: Int32, maxDepth: Int = 20) -> [Int32] {
+        ancestorRecords(of: pid, maxDepth: maxDepth).map(\.pid)
+    }
+}
+
+/// Why a `ps` sample didn't yield a usable process list.
+enum SampleFailure: Error {
+    case launchFailed
+    case timeout
+    case decodeFailed
+}
+
+/// Tracks consecutive sampling failures and reports edge-triggered
+/// transitions into/out of the "degraded" state. Isolated from the actor and
+/// from `Process` so the threshold logic can be driven directly in tests
+/// without spawning `ps`.
+struct SamplingHealthTracker {
+    enum Transition { case none, becameDegraded, recovered }
+
+    private(set) var consecutiveFailures = 0
+    private(set) var isDegraded = false
+    let threshold: Int
+
+    init(threshold: Int = 3) {
+        self.threshold = threshold
+    }
+
+    /// Only the tick where the failure streak *reaches* the threshold
+    /// reports `.becameDegraded` — later failures in the same streak report
+    /// `.none` so callers log the transition once, not on every failure.
+    mutating func recordFailure() -> Transition {
+        consecutiveFailures += 1
+        if consecutiveFailures == threshold {
+            isDegraded = true
+            return .becameDegraded
+        }
+        return .none
+    }
+
+    mutating func recordSuccess() -> Transition {
+        let wasDegraded = isDegraded
+        consecutiveFailures = 0
+        isDegraded = false
+        return wasDegraded ? .recovered : .none
+    }
+}
+
 /// Polls the local process table, diffs it against the previous sample to find
 /// newly-spawned processes, and runs each one through the active Sigma rules.
 ///
@@ -20,6 +144,18 @@ final class ProcessMonitor: ObservableObject {
     @Published private(set) var suppressedCount: Int = 0
     @Published private(set) var historicalEventCount: Int = 0
     @Published private(set) var activityLog: [(Date, Int)] = [] // (time, matched-event count) per tick, for the sparkline
+    /// True once sampling has failed `samplingHealth.threshold` times in a row.
+    /// A hung or missing `/bin/ps` must not be silently mistaken for "no
+    /// processes running" — this is the signal the UI can surface instead.
+    @Published private(set) var isDegraded: Bool = false
+    /// Count of `.routine` agent-attributed notifications skipped this
+    /// session because `AppSettings.quietAgentNotifications` is on — see
+    /// `AgentActivityPolicy.Assessment`. Only incremented when the event
+    /// would otherwise have crossed `notificationThreshold`; a routine
+    /// agent event that wouldn't have notified anyway isn't "quieted".
+    /// Purely a UI counter for the settings pane caption — never consulted
+    /// by detection logic, and reset only by relaunch.
+    @Published private(set) var agentQuietedNotificationCount: Int = 0
 
     var riskLevel: Severity {
         switch riskScore {
@@ -41,6 +177,11 @@ final class ProcessMonitor: ObservableObject {
     private let defaultIntervalSeconds: Double = 1.2
     private let defaultHalfLifeSeconds: Double = 55.0
 
+    private var parentCache = ParentContextCache()
+    private var tickIndex = 0
+    private var samplingHealth = SamplingHealthTracker()
+    private let chainCorrelator = ChainCorrelator()
+
     func configure(allowlist: AllowlistStore) {
         self.allowlist = allowlist
     }
@@ -83,8 +224,31 @@ final class ProcessMonitor: ObservableObject {
     }
 
     private func tick() async {
-        let raw = await Self.sampleProcesses()
+        let result = await Self.sampleProcesses()
         sampleCount += 1
+
+        switch result {
+        case .failure(let failure):
+            let transition = samplingHealth.recordFailure()
+            isDegraded = samplingHealth.isDegraded
+            if transition == .becameDegraded {
+                DiagnosticsLog.write("monitor degraded — \(samplingHealth.consecutiveFailures) consecutive sampling failures (\(failure))")
+            }
+            // A failed sample is not "every process exited" — knownPIDs, the
+            // baseline, and this tick's diff are all left untouched so the
+            // next successful sample resumes from the real prior state.
+            return
+        case .success(let raw):
+            let transition = samplingHealth.recordSuccess()
+            isDegraded = samplingHealth.isDegraded
+            if transition == .recovered {
+                DiagnosticsLog.write("monitor recovered — sampling succeeded")
+            }
+            processSample(raw)
+        }
+    }
+
+    private func processSample(_ raw: [RawProcess]) {
         let halfLife = settings?.riskDecayHalfLifeSeconds ?? defaultHalfLifeSeconds
         let decayFactor = pow(0.5, currentPollInterval / halfLife)
         riskScore = max(0, riskScore * decayFactor)
@@ -93,6 +257,9 @@ final class ProcessMonitor: ObservableObject {
         let currentPIDs = Set(raw.map(\.id))
         defer { knownPIDs = currentPIDs }
 
+        parentCache.update(with: raw, tick: tickIndex)
+        tickIndex += 1
+
         guard baselined else {
             baselined = true
             activityLog.append((Date(), 0))
@@ -105,35 +272,56 @@ final class ProcessMonitor: ObservableObject {
             !knownPIDs.contains($0.id) && $0.id != ownPID && $0.ppid != ownPID
         }
 
-        // Full-sample lookup so a new process's ParentImage/ParentCommandLine
-        // can be resolved — several real Sigma rules key off parent context
-        // (e.g. "curl spawned by bash" is far more specific than "curl" alone).
-        var imageByPID: [Int32: String] = [:]
-        var commandByPID: [Int32: String] = [:]
-        for p in raw {
-            imageByPID[p.id] = p.image
-            commandByPID[p.id] = p.command
-        }
-
         let activeRules = ruleStore?.activeRules ?? []
         var matchedThisTick = 0
         for proc in newProcs {
             totalSeen += 1
 
-            var record: [String: String] = ["CommandLine": proc.command, "Image": proc.image]
-            if let parentImage = imageByPID[proc.ppid] { record["ParentImage"] = parentImage }
-            if let parentCommand = commandByPID[proc.ppid] { record["ParentCommandLine"] = parentCommand }
+            // Computed once per process and reused below both for the Sigma
+            // record's Ancestor* fields and for the chain correlator's
+            // ancestry — walking the cache twice would be redundant work for
+            // identical results.
+            let ancestors = parentCache.ancestorRecords(of: proc.id)
+
+            var record: [String: String] = ["CommandLine": proc.command, "Image": proc.image, "User": proc.user]
+            if let parentImage = parentCache.image(for: proc.ppid) { record["ParentImage"] = parentImage }
+            if let parentCommand = parentCache.command(for: proc.ppid) { record["ParentCommandLine"] = parentCommand }
+            if let parentUser = parentCache.user(for: proc.ppid) { record["ParentUser"] = parentUser }
+            // ";"-joined, nearest ancestor first, so a user rule can express
+            // e.g. `AncestorCommandLines|contains: claude` to match anywhere
+            // up the tree rather than only the immediate parent.
+            record["AncestorImages"] = ancestors.map(\.image).joined(separator: ";")
+            record["AncestorCommandLines"] = ancestors.map(\.command).joined(separator: ";")
 
             let rawMatches: [MatchedRule] = activeRules.compactMap { rule in
                 guard SigmaMatcher.matches(rule, record: record) else { return nil }
                 return MatchedRule(name: rule.title, severity: rule.severity, technique: rule.techniqueLabel,
                                     explanation: rule.description ?? "")
             }
+            // Provenance is classified before allowlist filtering (rather
+            // than only after, once matches are known) so a scoped entry —
+            // e.g. "(rule, zsh) only under claude" — can actually see the
+            // ancestry it's scoped to. Skipped when there are no raw matches
+            // to filter: classification is pure but not free, and most
+            // sampled processes never trip a rule at all.
+            let provenanceTags: [ProvenanceTag]
+            let provenance: [String]
             let matches: [MatchedRule]
-            if let allowlist {
-                matches = AllowlistFilter.apply(rawMatches, executable: proc.executable, isAllowed: allowlist.isAllowed)
-            } else {
+            if rawMatches.isEmpty {
+                provenanceTags = []
+                provenance = []
                 matches = rawMatches
+            } else {
+                provenanceTags = ProvenanceClassifier.classify(
+                    ancestorImages: ancestors.map(\.image),
+                    ancestorCommandLines: ancestors.map(\.command)
+                )
+                provenance = provenanceTags.map(\.label)
+                if let allowlist {
+                    matches = AllowlistFilter.apply(rawMatches, executable: proc.executable, provenance: provenance, isAllowed: allowlist.isAllowed)
+                } else {
+                    matches = rawMatches
+                }
             }
             suppressedCount += rawMatches.count - matches.count
 
@@ -144,21 +332,57 @@ final class ProcessMonitor: ObservableObject {
                                              bornAt: Date(), angle: angle))
             } else {
                 matchedThisTick += 1
+
+                // Captured before the synthetic escalation rule (if any) is
+                // appended, so chain correlation below keys off only the
+                // rules this process tree actually triggered — the
+                // escalation rule's fixed name must not be what makes two
+                // unrelated agent-attributed events "chain" with each other.
+                let originalRuleNames = Set(matches.map(\.name))
+                let originalTechniques = Set(matches.map(\.technique))
+
+                let assessment = AgentActivityPolicy.assessment(tags: provenanceTags, matchedRules: matches)
+                var eventRules = matches
+                if case .sensitive(let sensitiveTechniques) = assessment {
+                    eventRules.append(AgentActivityPolicy.escalationRule(
+                        matchedTechniques: sensitiveTechniques,
+                        otherSeverities: matches.map(\.severity)
+                    ))
+                }
+
                 let event = ProcessEvent(pid: proc.id, ppid: proc.ppid, executable: proc.executable,
-                                          command: proc.command, rules: matches, timestamp: Date())
+                                          command: proc.command, rules: eventRules, timestamp: Date(),
+                                          provenance: provenance)
                 events.insert(event, at: 0)
                 if events.count > 300 { events.removeLast(events.count - 300) }
                 eventStore?.append(event)
                 historicalEventCount += 1
                 if let settings, settings.notificationThreshold.shouldNotify(for: event.topSeverity) {
-                    NotificationManager.notify(event: event)
+                    // A `.routine` agent-attributed event earns a quieter
+                    // UI, not a quieter record: the notification is the
+                    // only thing skipped here — feed, history, and risk
+                    // score above are all already unconditional. `.sensitive`
+                    // assessments always fall through to a real notification.
+                    if settings.quietAgentNotifications, assessment == .routine {
+                        agentQuietedNotificationCount += 1
+                    } else {
+                        NotificationManager.notify(event: event)
+                    }
                 }
                 riskScore = min(100, riskScore + event.topSeverity.weight)
                 orbitNodes.append(OrbitNode(id: event.id, pid: proc.id, ppid: proc.ppid,
                                              severity: event.topSeverity, label: proc.executable,
                                              bornAt: Date(), angle: angle))
-                let techniques = matches.map(\.technique).joined(separator: "; ")
+                let techniques = eventRules.map(\.technique).joined(separator: "; ")
                 DiagnosticsLog.write("[\(event.topSeverity.label)] pid=\(proc.id) \(proc.executable) — \(techniques) — risk=\(Int(riskScore))")
+
+                if let detection = chainCorrelator.register(
+                    eventID: event.id, pid: proc.id, executable: proc.executable,
+                    ruleNames: originalRuleNames, techniques: originalTechniques,
+                    severity: event.topSeverity, timestamp: event.timestamp, ancestry: ancestors.map(\.pid)
+                ) {
+                    ingestExternal(Self.chainEvent(from: detection, pid: proc.id, ppid: proc.ppid))
+                }
             }
         }
         if orbitNodes.count > 400 { orbitNodes.removeFirst(orbitNodes.count - 400) }
@@ -171,6 +395,62 @@ final class ProcessMonitor: ObservableObject {
         }
     }
 
+    /// Entry point for events discovered by a sensor other than the `ps`
+    /// poll loop (currently `PersistenceWatcher`). Mirrors the matched-event
+    /// branch of `processSample` — insert-at-front with the 300 cap, persist,
+    /// bump counters, threshold-gated notification, risk contribution,
+    /// diagnostics line — but skips orbit-node handling: pid 0 has no orbit
+    /// meaning (the Orbit view visualizes the live process graph, and a
+    /// synthetic artifact event isn't part of it), and skips allowlist
+    /// filtering, since these events represent a persistence-artifact change
+    /// rather than a rule matching an observed process (see
+    /// `PersistenceEventBuilder`'s doc comment).
+    func ingestExternal(_ event: ProcessEvent) {
+        events.insert(event, at: 0)
+        if events.count > 300 { events.removeLast(events.count - 300) }
+        eventStore?.append(event)
+        historicalEventCount += 1
+        if let settings, settings.notificationThreshold.shouldNotify(for: event.topSeverity) {
+            NotificationManager.notify(event: event)
+        }
+        riskScore = min(100, riskScore + event.topSeverity.weight)
+        let techniques = event.rules.map(\.technique).joined(separator: "; ")
+        DiagnosticsLog.write("[\(event.topSeverity.label)] external pid=\(event.pid) \(event.executable) — \(techniques) — risk=\(Int(riskScore))")
+    }
+
+    /// Short, human-scannable timestamps for the chain explanation text below
+    /// — the full date is already on the enclosing `ProcessEvent`.
+    nonisolated private static let chainTimestampFormatter: DateFormatter = {
+        let f = DateFormatter()
+        f.dateFormat = "HH:mm:ss"
+        return f
+    }()
+
+    /// Builds the synthetic `ProcessEvent` representing a `ChainDetection` so
+    /// it can flow through `ingestExternal` like any other externally-sourced
+    /// event (feed insert, persist, threshold-gated notification, risk).
+    /// Attributed to the triggering process's own pid/ppid rather than pid 0
+    /// — unlike a `PersistenceWatcher` artifact this isn't sourced from a
+    /// pid-less filesystem change, it's a statement about a real process
+    /// tree, so it keeps that tree's identity.
+    nonisolated private static func chainEvent(from detection: ChainDetection, pid: Int32, ppid: Int32) -> ProcessEvent {
+        let command = detection.members.map(\.executable).joined(separator: " → ")
+        let technique = detection.techniques.sorted().joined(separator: ", ")
+        let explanation = detection.members.map { member -> String in
+            let names = member.ruleNames.sorted().joined(separator: ", ")
+            let time = chainTimestampFormatter.string(from: member.timestamp)
+            return "\(member.executable) (pid \(member.pid), \(time)): \(names)"
+        }.joined(separator: "; ")
+
+        let rule = MatchedRule(
+            name: "Suspicious sequence: \(detection.techniques.count) techniques in one process tree",
+            severity: detection.escalatedSeverity,
+            technique: technique,
+            explanation: explanation
+        )
+        return ProcessEvent(pid: pid, ppid: ppid, executable: "chain", command: command, rules: [rule], timestamp: Date())
+    }
+
     private func trimActivityLog() {
         let cutoff = Date().addingTimeInterval(-300)
         activityLog.removeAll { $0.0 < cutoff }
@@ -181,7 +461,7 @@ final class ProcessMonitor: ObservableObject {
         orbitNodes.removeAll { $0.bornAt < cutoff }
     }
 
-    nonisolated private static func sampleProcesses() async -> [RawProcess] {
+    nonisolated private static func sampleProcesses() async -> Result<[RawProcess], SampleFailure> {
         await withCheckedContinuation { cont in
             DispatchQueue.global(qos: .utility).async {
                 cont.resume(returning: runPS())
@@ -189,33 +469,71 @@ final class ProcessMonitor: ObservableObject {
         }
     }
 
-    nonisolated private static func runPS() -> [RawProcess] {
+    /// Hard ceiling on how long a single `ps` invocation may run. Without
+    /// this, a wedged `/bin/ps` (seen in practice on macOS under heavy I/O
+    /// contention) blocks `readDataToEndOfFile()` forever, silently freezing
+    /// the entire poll loop with no error and no indication anything is wrong.
+    nonisolated private static let samplingTimeoutSeconds: Double = 10
+
+    nonisolated private static func runPS() -> Result<[RawProcess], SampleFailure> {
         let process = Process()
         process.executableURL = URL(fileURLWithPath: "/bin/ps")
-        process.arguments = ["-axww", "-o", "pid,ppid,command"]
+        process.arguments = ["-axww", "-o", "pid,ppid,user,command"]
         let outPipe = Pipe()
         process.standardOutput = outPipe
         process.standardError = Pipe()
         do {
             try process.run()
         } catch {
-            return []
+            return .failure(.launchFailed)
+        }
+
+        // Watchdog: kill `ps` if it hasn't finished by the deadline, so the
+        // blocking read below is bounded no matter what `ps` does.
+        let watchdog = DispatchWorkItem {
+            if process.isRunning { process.terminate() }
         }
+        DispatchQueue.global(qos: .utility).asyncAfter(deadline: .now() + samplingTimeoutSeconds, execute: watchdog)
+
         let data = outPipe.fileHandleForReading.readDataToEndOfFile()
         process.waitUntilExit()
-        guard let output = String(data: data, encoding: .utf8) else { return [] }
+        watchdog.cancel()
+
+        if process.terminationReason == .uncaughtSignal {
+            return .failure(.timeout)
+        }
+        guard let output = String(data: data, encoding: .utf8) else { return .failure(.decodeFailed) }
+        return .success(parsePSOutput(output))
+    }
 
+    /// Parses `ps -axww -o pid,ppid,user,command` output into `RawProcess`
+    /// records. Pure and side-effect free so it can be exercised directly in
+    /// tests without spawning `ps`.
+    ///
+    /// Tolerant of malformed rows: the header line and any line that doesn't
+    /// split into the expected four columns (or whose pid/ppid aren't
+    /// integers) is skipped rather than aborting the whole sample — one odd
+    /// row from `ps` shouldn't blind the monitor to every other process
+    /// running at the same time.
+    nonisolated static func parsePSOutput(_ output: String) -> [RawProcess] {
         var results: [RawProcess] = []
         let lines = output.split(separator: "\n", omittingEmptySubsequences: true)
         for line in lines.dropFirst() {
             let trimmed = line.trimmingCharacters(in: .whitespaces)
-            let parts = trimmed.split(separator: " ", maxSplits: 2, omittingEmptySubsequences: true)
-            guard parts.count == 3, let pid = Int32(parts[0]), let ppid = Int32(parts[1]) else { continue }
-            let command = String(parts[2])
+            let parts = trimmed.split(separator: " ", maxSplits: 3, omittingEmptySubsequences: true)
+            guard parts.count == 4, let pid = Int32(parts[0]), let ppid = Int32(parts[1]) else { continue }
+            let user = String(parts[2])
+            // `USER` is left-justified and padded to a fixed column width by
+            // `ps`, so the run of spaces separating it from `COMMAND` is
+            // often more than one character. `split(maxSplits:)` only
+            // collapses a whitespace run when it's not the final split, so
+            // that padding can survive as leading whitespace on this last
+            // component — trim it rather than let it corrupt Image/CommandLine.
+            let command = String(parts[3]).trimmingCharacters(in: .whitespaces)
             let firstToken = command.split(separator: " ").first.map(String.init) ?? command
             let short = (firstToken as NSString).lastPathComponent
             let image = firstToken.contains("/") ? firstToken : "/" + firstToken
-            results.append(RawProcess(id: pid, ppid: ppid, command: command, executable: short, image: image))
+            results.append(RawProcess(id: pid, ppid: ppid, command: command, executable: short, image: image, user: user))
         }
         return results
     }
diff --git a/Sources/Argus/ProvenanceClassifier.swift b/Sources/Argus/ProvenanceClassifier.swift
new file mode 100644
index 0000000..64b7377
--- /dev/null
+++ b/Sources/Argus/ProvenanceClassifier.swift
@@ -0,0 +1,111 @@
+import Foundation
+
+/// One supervisor label attached to an event — "this ancestry looks like it
+/// was launched under X".
+///
+/// This is attribution for triage, **not authorization**. Process ancestry
+/// (argv0, image path, parent command lines) is trivially spoofable — any
+/// process can name itself "claude", launch from a path containing
+/// "/.claude/", or otherwise imitate a supervisor's fingerprint. A
+/// `ProvenanceTag` must never be treated as an *implicit* trust signal —
+/// silently suppressing, downgrading, or auto-allowing a detection because
+/// of one is forbidden. The sanctioned uses are explicit, user-chosen, and
+/// visible: a provenance-scoped allowlist entry the user creates behind a
+/// Touch ID prompt (`AllowlistStore`), the notification-quieting toggle with
+/// its own visible counter (`AppSettings.quietAgentNotifications`), and
+/// *escalating* agent-attributed activity that matches a sensitive technique
+/// (`AgentActivityPolicy`) — the last of these makes a detection louder, not
+/// quieter. Its only other purpose is to help a human triaging the feed
+/// answer "who would plausibly have launched this?" faster than reading raw
+/// parent command lines.
+struct ProvenanceTag: Equatable {
+    let category: String
+    let label: String
+}
+
+/// Classifies a process's ancestry against a fixed table of known
+/// supervisors — AI coding agents, container tooling, package managers,
+/// terminals, IDEs — so alerts triggered by supervised automation are
+/// distinguishable in the feed from standalone activity.
+///
+/// Pure and data-driven: every supervisor is a table row (category, display
+/// label, match predicate), checked case-insensitively against each
+/// ancestor's image and command line. No process/filesystem access, no
+/// state — trivially unit-testable and safe to call on every matched event.
+enum ProvenanceClassifier {
+    private struct Supervisor {
+        let category: String
+        let label: String
+        /// Receives one ancestor's image and command line, both already
+        /// lowercased. Returns whether this ancestor identifies the
+        /// supervisor.
+        let matches: (_ image: String, _ command: String) -> Bool
+    }
+
+    /// `NSString.lastPathComponent` needs Foundation but not AppKit, and
+    /// matches the basename convention `RawProcess.image`/`ParentImage`
+    /// already use elsewhere in Argus.
+    private static func basename(_ image: String) -> String {
+        (image as NSString).lastPathComponent
+    }
+
+    private static let supervisors: [Supervisor] = [
+        Supervisor(category: "AI agent", label: "claude") { image, command in
+            command.contains("/.claude/") || basename(image) == "claude"
+        },
+        Supervisor(category: "Container tooling", label: "docker") { image, command in
+            basename(image) == "docker" || image.contains("com.docker")
+        },
+        Supervisor(category: "Package manager", label: "brew") { image, command in
+            command.contains("/homebrew/") || basename(image) == "brew"
+        },
+        Supervisor(category: "Terminal", label: "Terminal") { image, _ in
+            basename(image) == "terminal"
+        },
+        Supervisor(category: "Terminal", label: "iTerm2") { image, _ in
+            basename(image).contains("iterm")
+        },
+        Supervisor(category: "Terminal", label: "tmux") { image, _ in
+            basename(image) == "tmux"
+        },
+        Supervisor(category: "IDE", label: "Code") { image, _ in
+            // VS Code's helper processes on macOS report images like
+            // "Code Helper (Renderer)"/"Code Helper (Plugin)", not a bare
+            // "code" — "contains" catches every helper variant plus the
+            // main "Code" process itself.
+            basename(image).contains("code helper") || basename(image) == "code"
+        },
+        Supervisor(category: "IDE", label: "Cursor") { image, _ in
+            basename(image).contains("cursor")
+        },
+    ]
+
+    /// Classifies an ancestry into supervisor tags.
+    ///
+    /// - Parameters:
+    ///   - ancestorImages: ancestor images, nearest ancestor first (same
+    ///     ordering as `ParentContextCache.ancestorRecords(of:)`).
+    ///   - ancestorCommandLines: ancestor command lines, same ordering and
+    ///     same length as `ancestorImages`.
+    /// - Returns: matched tags, nearest-supervisor-first, deduplicated by
+    ///   label — a supervisor that shows up at multiple ancestry depths (e.g.
+    ///   nested `claude` processes) is only reported once, at its nearest
+    ///   occurrence.
+    static func classify(ancestorImages: [String], ancestorCommandLines: [String]) -> [ProvenanceTag] {
+        var tags: [ProvenanceTag] = []
+        var seenLabels: Set<String> = []
+        let depth = min(ancestorImages.count, ancestorCommandLines.count)
+
+        for i in 0..<depth {
+            let image = ancestorImages[i].lowercased()
+            let command = ancestorCommandLines[i].lowercased()
+            for supervisor in supervisors {
+                guard !seenLabels.contains(supervisor.label) else { continue }
+                guard supervisor.matches(image, command) else { continue }
+                tags.append(ProvenanceTag(category: supervisor.category, label: supervisor.label))
+                seenLabels.insert(supervisor.label)
+            }
+        }
+        return tags
+    }
+}
diff --git a/Sources/Argus/Sigma/RuleStore.swift b/Sources/Argus/Sigma/RuleStore.swift
index 62460a6..a1c1602 100644
--- a/Sources/Argus/Sigma/RuleStore.swift
+++ b/Sources/Argus/Sigma/RuleStore.swift
@@ -1,6 +1,20 @@
 import AppKit
 import Foundation
 
+/// On-disk shape of `rules-state.json`. `disabled` mirrors
+/// `RuleStore.disabledRuleIDs`; `supersessionsApplied` records which
+/// entries of `RuleStore.supersededBundledRuleIDs` have already been
+/// auto-applied, so a user who deliberately re-enables a superseded rule
+/// via the Touch ID-gated `requestToggle` has that stick across restarts
+/// instead of the rule being silently disabled again on the next launch.
+/// Older installs wrote this file as a bare `Set<String>` of disabled IDs —
+/// `RuleStore.loadDisabledState` falls back to that shape when this one
+/// fails to decode, treating `supersessionsApplied` as empty.
+private struct RuleDisabledState: Codable {
+    var disabled: [String]
+    var supersessionsApplied: [String]
+}
+
 /// Loads and manages the Sigma rule catalog: bundled rules shipped with the
 /// app (imported from SigmaHQ, plus Argus's own gap-filling rules) and
 /// user rules dropped into `~/Library/Application Support/Argus/rules/` —
@@ -9,38 +23,96 @@ import Foundation
 /// and hit reload.
 @MainActor
 final class RuleStore: ObservableObject {
+    /// Bundled imported rules superseded by a more precise Argus-authored
+    /// replacement — keyed by the superseded imported rule's `id`, valued
+    /// by the replacement's `id`. Applied once per entry (see
+    /// `supersessionsApplied` in `RuleDisabledState`) so re-enabling the
+    /// superseded rule by hand isn't undone on the next launch.
+    static let supersededBundledRuleIDs: [String: String] = [
+        // SigmaHQ "Gatekeeper Bypass via Xattr": CommandLine|contains|all
+        // of '-d' and 'com.apple.quarantine' can false-positive on the safe
+        // xattr -w (add-quarantine) direction Homebrew uses, when a '-d'
+        // substring lands inside the quarantine value's UUID by chance.
+        // Superseded by the whitespace-bounded-flag Argus rule, which tells
+        // removal (-d/-c) apart from addition (-w).
+        "f5141b6d-9f42-41c6-a7bf-2a780678b29b": "8cbd6022-931f-4017-ab5e-a15264ac91e7",
+    ]
+
     @Published private(set) var rules: [SigmaRule] = []
     @Published private(set) var disabledRuleIDs: Set<String> = []
+    /// Which entries of `supersededBundledRuleIDs` have already been
+    /// auto-disabled at some past launch — see `RuleDisabledState`.
+    private var supersessionsApplied: Set<String> = []
+    /// Rules dropped at load time because their `logsource` isn't something
+    /// this app can actually evaluate (see `isCompatibleLogsource`) — e.g. a
+    /// Windows-only rule dropped into the user rules folder by mistake.
+    @Published private(set) var skippedIncompatibleCount: Int = 0
+    /// Result of verifying `rules-state.json` against the last MAC recorded
+    /// by an authenticated write. `nil` until `verifyIntegrity` completes —
+    /// verification is deliberately not done in init, because the Keychain
+    /// key fetch can present a consent prompt that would otherwise block app
+    /// launch (see `IntegrityGuard`'s threading note). The store itself
+    /// doesn't emit events; the app acts on the verdict.
+    private(set) var integrityVerdict: IntegrityVerdict?
 
     private let bundledRulesDirectory: URL?
     let userRulesDirectory: URL
-    private let stateFileURL: URL
+    let stateFileURL: URL
+    /// Optional so that constructing a store (in tests, previews, tools)
+    /// never touches the real Keychain or the shared sidecar as a side
+    /// effect — the app opts in explicitly with `.shared`.
+    private let integrityGuard: IntegrityGuard?
 
     var activeRules: [SigmaRule] { rules.filter { !disabledRuleIDs.contains($0.id) } }
 
-    init(bundledRulesDirectory: URL? = nil, userRulesDirectory: URL? = nil, stateFileURL: URL? = nil) {
+    init(bundledRulesDirectory: URL? = nil, userRulesDirectory: URL? = nil, stateFileURL: URL? = nil, integrityGuard: IntegrityGuard? = nil) {
         let appSupport = FileManager.default.homeDirectoryForCurrentUser
             .appendingPathComponent("Library/Application Support/Argus", isDirectory: true)
         self.bundledRulesDirectory = bundledRulesDirectory ?? Bundle.main.resourceURL?.appendingPathComponent("Rules", isDirectory: true)
         self.userRulesDirectory = userRulesDirectory ?? appSupport.appendingPathComponent("rules", isDirectory: true)
         self.stateFileURL = stateFileURL ?? appSupport.appendingPathComponent("rules-state.json")
+        self.integrityGuard = integrityGuard
         try? FileManager.default.createDirectory(at: self.userRulesDirectory, withIntermediateDirectories: true)
         // Keep the shared Argus support directory owner-only (see EventStore).
         try? FileManager.default.setAttributes([.posixPermissions: 0o700], ofItemAtPath: appSupport.path)
 
         loadDisabledState()
         reload()
+        applySupersessions()
+    }
+
+    /// Verifies `rules-state.json` off the main thread and stores the
+    /// verdict (also handed to `completion`, on the main actor). A no-op
+    /// when no guard was injected.
+    func verifyIntegrity(completion: @escaping @MainActor (IntegrityVerdict) -> Void = { _ in }) {
+        guard let integrityGuard else { return }
+        integrityGuard.verifyAsync(stateFileURL) { [weak self] verdict in
+            Task { @MainActor in
+                self?.integrityVerdict = verdict
+                completion(verdict)
+            }
+        }
     }
 
     func reload() {
         var loaded: [SigmaRule] = []
+        var skipped = 0
         if let bundledRulesDirectory {
-            loaded += Self.loadRules(from: bundledRulesDirectory.appendingPathComponent("imported"), origin: .sigmaHQMacOS)
-            loaded += Self.loadRules(from: bundledRulesDirectory.appendingPathComponent("imported-portable"), origin: .sigmaHQPortable)
-            loaded += Self.loadRules(from: bundledRulesDirectory.appendingPathComponent("custom"), origin: .custom)
+            for (directory, origin) in [
+                (bundledRulesDirectory.appendingPathComponent("imported"), RuleOrigin.sigmaHQMacOS),
+                (bundledRulesDirectory.appendingPathComponent("imported-portable"), RuleOrigin.sigmaHQPortable),
+                (bundledRulesDirectory.appendingPathComponent("custom"), RuleOrigin.custom),
+            ] {
+                let (loadedRules, skippedCount) = Self.loadRules(from: directory, origin: origin)
+                loaded += loadedRules
+                skipped += skippedCount
+            }
         }
-        loaded += Self.loadRules(from: userRulesDirectory, origin: .user)
+        let (userRules, userSkipped) = Self.loadRules(from: userRulesDirectory, origin: .user)
+        loaded += userRules
+        skipped += userSkipped
         rules = loaded.sorted { $0.title < $1.title }
+        skippedIncompatibleCount = skipped
     }
 
     func isEnabled(_ rule: SigmaRule) -> Bool {
@@ -80,29 +152,91 @@ final class RuleStore: ObservableObject {
         NSWorkspace.shared.activateFileViewerSelecting([userRulesDirectory])
     }
 
-    nonisolated static func loadRules(from directory: URL, origin: RuleOrigin) -> [SigmaRule] {
-        guard let files = try? FileManager.default.contentsOfDirectory(at: directory, includingPropertiesForKeys: nil) else { return [] }
+    /// Loads every rule in `directory`, returning the rules this app can
+    /// actually evaluate alongside a count of how many were dropped for
+    /// having an incompatible `logsource` — a nonisolated static, so the
+    /// count is handed back rather than written straight to a `@MainActor`
+    /// property; `reload()` aggregates it across directories.
+    nonisolated static func loadRules(from directory: URL, origin: RuleOrigin) -> (rules: [SigmaRule], skipped: Int) {
+        guard let files = try? FileManager.default.contentsOfDirectory(at: directory, includingPropertiesForKeys: nil) else { return ([], 0) }
         var result: [SigmaRule] = []
+        var skipped = 0
         for file in files.sorted(by: { $0.lastPathComponent < $1.lastPathComponent }) {
             guard ["yml", "yaml"].contains(file.pathExtension.lowercased()) else { continue }
             guard let content = try? String(contentsOf: file, encoding: .utf8) else { continue }
             for (text, value) in YAMLParser.parseDocumentsWithSource(content) {
-                if let rule = SigmaRule.parse(value, sourceFile: file.lastPathComponent, origin: origin, rawYAML: text) {
-                    result.append(rule)
+                guard let rule = SigmaRule.parse(value, sourceFile: file.lastPathComponent, origin: origin, rawYAML: text) else { continue }
+                guard isCompatibleLogsource(product: rule.logsourceProduct, category: rule.logsourceCategory) else {
+                    skipped += 1
+                    continue
                 }
+                result.append(rule)
             }
         }
-        return result
+        return (result, skipped)
+    }
+
+    /// This app only ever samples macOS process-creation events, so a rule
+    /// is evaluable only if its `logsource.category` is unset or
+    /// `process_creation`, and its `logsource.product` is unset, `macos`,
+    /// or `linux` — `linux` because the bundled imported-portable/ rules are
+    /// genuinely portable shell/interpreter techniques that apply unchanged
+    /// on macOS (see RuleOrigin.sigmaHQPortable).
+    nonisolated private static func isCompatibleLogsource(product: String?, category: String?) -> Bool {
+        let categoryOK = category == nil || category?.lowercased() == "process_creation"
+        let productOK: Bool
+        if let product {
+            let normalized = product.lowercased()
+            productOK = normalized == "macos" || normalized == "linux"
+        } else {
+            productOK = true
+        }
+        return categoryOK && productOK
+    }
+
+    /// For each not-yet-applied entry in `supersededBundledRuleIDs` whose
+    /// superseded rule actually loaded (guards against disabling — and
+    /// writing state for — an id that isn't even part of this rule set, e.g.
+    /// a minimal test fixture or a build missing the imported directory),
+    /// disables the superseded rule and records the entry as applied. Only
+    /// once per entry, ever: a user who deliberately re-enables the
+    /// superseded rule afterward (Touch ID-gated `requestToggle`) keeps it
+    /// enabled across restarts, since `supersessionsApplied` already has
+    /// the entry and this loop skips it. Called after `reload()` so `rules`
+    /// is populated.
+    private func applySupersessions() {
+        let loadedRuleIDs = Set(rules.map(\.id))
+        var changed = false
+        for (supersededID, replacementID) in Self.supersededBundledRuleIDs {
+            guard loadedRuleIDs.contains(supersededID) else { continue }
+            guard !supersessionsApplied.contains(supersededID) else { continue }
+            disabledRuleIDs.insert(supersededID)
+            supersessionsApplied.insert(supersededID)
+            changed = true
+            DiagnosticsLog.write("rule auto-disabled (superseded by \(replacementID)): \(supersededID)")
+        }
+        if changed {
+            saveDisabledState()
+        }
     }
 
     private func loadDisabledState() {
-        guard let data = try? Data(contentsOf: stateFileURL),
-              let decoded = try? JSONDecoder().decode(Set<String>.self, from: data) else { return }
-        disabledRuleIDs = decoded
+        guard let data = try? Data(contentsOf: stateFileURL) else { return }
+        if let decoded = try? JSONDecoder().decode(RuleDisabledState.self, from: data) {
+            disabledRuleIDs = Set(decoded.disabled)
+            supersessionsApplied = Set(decoded.supersessionsApplied)
+        } else if let legacy = try? JSONDecoder().decode(Set<String>.self, from: data) {
+            // Pre-supersession state file: just the disabled IDs, no record
+            // of which supersessions had already run.
+            disabledRuleIDs = legacy
+            supersessionsApplied = []
+        }
     }
 
     private func saveDisabledState() {
-        guard let data = try? JSONEncoder().encode(disabledRuleIDs) else { return }
+        let state = RuleDisabledState(disabled: Array(disabledRuleIDs), supersessionsApplied: Array(supersessionsApplied))
+        guard let data = try? JSONEncoder().encode(state) else { return }
         try? data.write(to: stateFileURL, options: .atomic)
+        integrityGuard?.recordAuthenticatedWrite(of: stateFileURL)
     }
 }
diff --git a/Sources/Argus/Sigma/SigmaCondition.swift b/Sources/Argus/Sigma/SigmaCondition.swift
index 2014512..6f5c771 100644
--- a/Sources/Argus/Sigma/SigmaCondition.swift
+++ b/Sources/Argus/Sigma/SigmaCondition.swift
@@ -1,14 +1,14 @@
 import Foundation
 
 /// Parser/evaluator for Sigma's `condition:` mini-language — boolean
-/// combinations of named selections, `1 of x*` / `all of x*` wildcard
-/// quantifiers, `them` (all selections), parens, and `not`. Verified
-/// against every distinct condition string appearing in the 75 rules this
-/// app ships (see SigmaConditionTests) — a real, if not 100%-of-the-spec,
-/// implementation.
+/// combinations of named selections, `N of x*` (including `1 of x*`) /
+/// `all of x*` wildcard quantifiers, `them` (all selections), parens, and
+/// `not`. Verified against every distinct condition string appearing in
+/// the 75 rules this app ships (see SigmaConditionTests) — a real, if not
+/// 100%-of-the-spec, implementation.
 indirect enum SigmaConditionNode {
     case identifier(String)
-    case oneOf(pattern: String)
+    case nOf(n: Int, pattern: String)
     case allOf(pattern: String)
     case and(SigmaConditionNode, SigmaConditionNode)
     case or(SigmaConditionNode, SigmaConditionNode)
@@ -28,8 +28,10 @@ enum SigmaConditionParser {
         switch node {
         case .identifier(let name):
             return results[name] ?? false
-        case .oneOf(let pattern):
-            return matchingNames(pattern, allNames).contains { results[$0] ?? false }
+        case .nOf(let n, let pattern):
+            let names = matchingNames(pattern, allNames)
+            let trueCount = names.filter { results[$0] ?? false }.count
+            return trueCount >= n
         case .allOf(let pattern):
             let names = matchingNames(pattern, allNames)
             return !names.isEmpty && names.allSatisfy { results[$0] ?? false }
@@ -111,10 +113,10 @@ enum SigmaConditionParser {
             pos += 1
             return node
         }
-        if tok == "1", pos + 2 < tokens.count, tokens[pos + 1].lowercased() == "of" {
+        if let n = Int(tok), n > 0, pos + 2 < tokens.count, tokens[pos + 1].lowercased() == "of" {
             let pattern = tokens[pos + 2]
             pos += 3
-            return .oneOf(pattern: pattern)
+            return .nOf(n: n, pattern: pattern)
         }
         if tok.lowercased() == "all", pos + 2 < tokens.count, tokens[pos + 1].lowercased() == "of" {
             let pattern = tokens[pos + 2]
diff --git a/Sources/Argus/Sigma/SigmaMatcher.swift b/Sources/Argus/Sigma/SigmaMatcher.swift
index 30c4964..3e643a7 100644
--- a/Sources/Argus/Sigma/SigmaMatcher.swift
+++ b/Sources/Argus/Sigma/SigmaMatcher.swift
@@ -8,6 +8,9 @@ import Foundation
 /// field = OR unless `|all` is present (then AND), and a selection given as
 /// a YAML list of field-groups = OR across the list (AND within each group)
 /// — the shape SigmaHQ uses for "either this combination, or that one".
+/// `base64` / `base64offset` encode the rule value before comparing, and
+/// `cased` (like base64) compares case-sensitively instead of the default
+/// lowercased comparison.
 enum SigmaMatcher {
     static func matches(_ rule: SigmaRule, record: [String: String]) -> Bool {
         guard let node = rule.parsedCondition else { return false }
@@ -26,8 +29,14 @@ enum SigmaMatcher {
     private static func evaluateItem(_ item: SigmaSelectionItem, record: [String: String]) -> Bool {
         switch item {
         case .keywords(let words):
-            let haystack = (record["CommandLine"] ?? "").lowercased()
-            return words.contains { haystack.contains($0.lowercased()) }
+            // Keyword selections have no field name, so per spec they're
+            // matched against every field present on the record, not just
+            // CommandLine.
+            let haystacks = record.values.map { $0.lowercased() }
+            return words.contains { word in
+                let needle = word.lowercased()
+                return haystacks.contains { $0.contains(needle) }
+            }
         case .fields(let matches):
             // A non-empty AND of field matches. Empty means every field in the
             // group was dropped as malformed at parse time; treat that as a
@@ -49,8 +58,26 @@ enum SigmaMatcher {
                 let range = NSRange(haystack.startIndex..<haystack.endIndex, in: haystack)
                 return re.firstMatch(in: haystack, options: [], range: range) != nil
             }
-            let h = haystack.lowercased()
-            let v = value.lowercased()
+            if mods.contains("base64offset") {
+                // Always a contains-style search across the three
+                // precomputed offset encodings — an exact/prefix/suffix
+                // match against a value that's deliberately been truncated
+                // to a substring wouldn't be meaningful.
+                guard index < match.base64OffsetValues.count else { return false }
+                return match.base64OffsetValues[index].contains { !$0.isEmpty && haystack.contains($0) }
+            }
+            // base64 is case-significant by construction, and `cased`
+            // requests case-sensitive comparison explicitly; both skip the
+            // usual lowercasing of haystack and value.
+            let isBase64 = mods.contains("base64")
+            let cased = isBase64 || mods.contains("cased")
+            let h = cased ? haystack : haystack.lowercased()
+            let v: String
+            if isBase64 {
+                v = index < match.base64Values.count ? match.base64Values[index] : ""
+            } else {
+                v = cased ? value : value.lowercased()
+            }
             if mods.contains("startswith") { return h.hasPrefix(v) }
             if mods.contains("endswith") { return h.hasSuffix(v) }
             if mods.contains("contains") { return h.contains(v) }
diff --git a/Sources/Argus/Sigma/SigmaRule.swift b/Sources/Argus/Sigma/SigmaRule.swift
index 3d9c019..81e8448 100644
--- a/Sources/Argus/Sigma/SigmaRule.swift
+++ b/Sources/Argus/Sigma/SigmaRule.swift
@@ -31,6 +31,15 @@ struct SigmaFieldMatch {
     /// matching runs against every new process every poll — and means a
     /// malformed pattern fails once at load rather than silently per tick.
     let regexes: [NSRegularExpression?]
+    /// `value` base64-encoded, aligned index-for-index with `values`,
+    /// populated only when the `base64` modifier is present. Precomputed at
+    /// load time for the same reason as `regexes`.
+    let base64Values: [String]
+    /// The three possible base64 encodings of `value` at byte offsets 0, 1,
+    /// and 2 (see `SigmaRule.base64OffsetEncodings`), aligned index-for-index
+    /// with `values`, populated only when the `base64offset` modifier is
+    /// present.
+    let base64OffsetValues: [[String]]
 }
 
 enum SigmaSelectionItem {
@@ -180,10 +189,58 @@ struct SigmaRule: Identifiable {
         guard let field = parts.first else { return nil }
         let modifiers = Array(parts.dropFirst())
         let values = pair.value.stringList
-        let isRegex = modifiers.contains { $0.lowercased() == "re" }
+        let lowerMods = Set(modifiers.map { $0.lowercased() })
+        let isRegex = lowerMods.contains("re")
         let regexes: [NSRegularExpression?] = isRegex
             ? values.map { try? NSRegularExpression(pattern: $0, options: [.caseInsensitive]) }
             : []
-        return SigmaFieldMatch(field: field, modifiers: modifiers, values: values, regexes: regexes)
+        let base64Values: [String] = lowerMods.contains("base64")
+            ? values.map { Data($0.utf8).base64EncodedString() }
+            : []
+        let base64OffsetValues: [[String]] = lowerMods.contains("base64offset")
+            ? values.map { base64OffsetEncodings(of: $0) }
+            : []
+        return SigmaFieldMatch(
+            field: field,
+            modifiers: modifiers,
+            values: values,
+            regexes: regexes,
+            base64Values: base64Values,
+            base64OffsetValues: base64OffsetValues
+        )
+    }
+
+    /// The three base64 encodings of `value` as it would appear inside a
+    /// larger base64-encoded byte stream, if `value` began at a byte offset
+    /// of 0, 1, or 2 within a 3-byte alignment group. Follows the reference
+    /// `base64offset` algorithm: pad with `i` NUL bytes so `value` lands on
+    /// a 3-byte boundary, base64-encode, then drop the leading characters
+    /// that only ever encode the padding, and the trailing characters that
+    /// only ever encode padding introduced by `value` itself falling short
+    /// of the next 3-byte boundary.
+    static func base64OffsetEncodings(of value: String) -> [String] {
+        let bytes = Array(value.utf8)
+        let startOffsets = [0, 2, 3]
+        return (0..<3).map { i -> String in
+            let padded = Data(repeating: 0, count: i) + Data(bytes)
+            let encoded = padded.base64EncodedString()
+            let start = min(startOffsets[i], encoded.count)
+            let remainder = (bytes.count + i) % 3
+            // A final group of 1 dangling byte encodes as "XY==" where Y
+            // carries only 2 real bits — drop 3 chars; 2 dangling bytes
+            // encode as "XYZ=" where Z carries only 4 real bits — drop 2.
+            // (Matches the reference implementation's end_offsets of
+            // (None, -3, -2) indexed by (len + i) % 3.)
+            let endTrim: Int
+            switch remainder {
+            case 1: endTrim = 3
+            case 2: endTrim = 2
+            default: endTrim = 0
+            }
+            let startIndex = encoded.index(encoded.startIndex, offsetBy: start)
+            let endOffset = max(start, encoded.count - endTrim)
+            let endIndex = encoded.index(encoded.startIndex, offsetBy: endOffset)
+            return startIndex < endIndex ? String(encoded[startIndex..<endIndex]) : ""
+        }
     }
 }
diff --git a/Sources/Argus/Theme.swift b/Sources/Argus/Theme.swift
index b694cd2..63475ce 100644
--- a/Sources/Argus/Theme.swift
+++ b/Sources/Argus/Theme.swift
@@ -21,6 +21,11 @@ enum Theme {
     static let muted = Color(hex: 0x7c8ba0)
     static let dim = Color(hex: 0x4a5768)
     static let accent = Color(hex: 0xff9d4d)
+    /// Provenance ("via claude") chips. Deliberately violet — a hue the
+    /// severity palette (green/yellow/amber/red) never uses, so an
+    /// attribution chip can be prominent without ever being mistaken for a
+    /// severity signal.
+    static let provenance = Color(hex: 0xa98bfa)
 
     static func color(for severity: Severity) -> Color {
         switch severity {
diff --git a/Tests/ArgusTests/AgentActivityPolicyTests.swift b/Tests/ArgusTests/AgentActivityPolicyTests.swift
new file mode 100644
index 0000000..7ed551b
--- /dev/null
+++ b/Tests/ArgusTests/AgentActivityPolicyTests.swift
@@ -0,0 +1,114 @@
+import XCTest
+@testable import Argus
+
+final class AgentActivityPolicyTests: XCTestCase {
+    private func rule(technique: String, severity: Severity = .watch) -> MatchedRule {
+        MatchedRule(name: "rule", severity: severity, technique: technique, explanation: "")
+    }
+
+    private let agentTag = ProvenanceTag(category: "AI agent", label: "claude")
+    private let dockerTag = ProvenanceTag(category: "Container tooling", label: "docker")
+
+    // MARK: - isAgentAttributed
+
+    func testIsAgentAttributedFalseForNoTags() {
+        XCTAssertFalse(AgentActivityPolicy.isAgentAttributed([]))
+    }
+
+    func testIsAgentAttributedFalseForNonAgentTags() {
+        XCTAssertFalse(AgentActivityPolicy.isAgentAttributed([dockerTag]))
+    }
+
+    func testIsAgentAttributedTrueWhenAgentTagPresent() {
+        XCTAssertTrue(AgentActivityPolicy.isAgentAttributed([dockerTag, agentTag]))
+    }
+
+    // MARK: - assessment matrix
+
+    func testNoTagsIsNotAgentAttributed() {
+        let result = AgentActivityPolicy.assessment(tags: [], matchedRules: [rule(technique: "T1053")])
+        XCTAssertEqual(result, .notAgentAttributed)
+    }
+
+    func testNonAgentTagWithSensitiveTechniqueIsNotAgentAttributed() {
+        // A sensitive technique alone must not trigger escalation — only an
+        // AI-agent-attributed ancestry does.
+        let result = AgentActivityPolicy.assessment(tags: [dockerTag], matchedRules: [rule(technique: "T1053")])
+        XCTAssertEqual(result, .notAgentAttributed)
+    }
+
+    func testAgentTagWithBenignTechniqueIsRoutine() {
+        let result = AgentActivityPolicy.assessment(tags: [agentTag], matchedRules: [rule(technique: "T1059")])
+        XCTAssertEqual(result, .routine)
+    }
+
+    func testAgentTagWithNoMatchedRulesIsRoutine() {
+        let result = AgentActivityPolicy.assessment(tags: [agentTag], matchedRules: [])
+        XCTAssertEqual(result, .routine)
+    }
+
+    func testAgentTagWithEachSensitivePrefixIsSensitive() {
+        let sensitivePrefixes = ["T1543", "T1547", "T1053", "T1555", "T1552", "T1539", "T1562", "T1553"]
+        for prefix in sensitivePrefixes {
+            let result = AgentActivityPolicy.assessment(tags: [agentTag], matchedRules: [rule(technique: prefix)])
+            XCTAssertEqual(result, .sensitive(matchedTechniques: [prefix]), "expected \(prefix) to be sensitive")
+        }
+    }
+
+    func testAgentTagWithSensitiveSubTechniqueIsSensitive() {
+        let result = AgentActivityPolicy.assessment(tags: [agentTag], matchedRules: [rule(technique: "T1053.005")])
+        XCTAssertEqual(result, .sensitive(matchedTechniques: ["T1053.005"]))
+    }
+
+    func testLookalikeTechniqueIDIsNotFalselySensitive() {
+        // "T15430" is not a real technique ID and must not match the
+        // "T1543" prefix just because it starts with those characters.
+        let result = AgentActivityPolicy.assessment(tags: [agentTag], matchedRules: [rule(technique: "T15430")])
+        XCTAssertEqual(result, .routine)
+    }
+
+    func testMultiIDTechniqueStringSplitsAndFiltersToSensitiveOnly() {
+        let result = AgentActivityPolicy.assessment(
+            tags: [agentTag],
+            matchedRules: [rule(technique: "T1059, T1053.005, T1547")]
+        )
+        XCTAssertEqual(result, .sensitive(matchedTechniques: ["T1053.005", "T1547"]))
+    }
+
+    func testSensitiveTechniquesAcrossMultipleRulesAreDeduplicatedInFirstSeenOrder() {
+        let result = AgentActivityPolicy.assessment(
+            tags: [agentTag],
+            matchedRules: [
+                rule(technique: "T1547"),
+                rule(technique: "T1555, T1547"),
+            ]
+        )
+        XCTAssertEqual(result, .sensitive(matchedTechniques: ["T1547", "T1555"]))
+    }
+
+    // MARK: - severity escalation
+
+    func testEscalatedSeverityIsOneLevelAboveMax() {
+        XCTAssertEqual(AgentActivityPolicy.escalatedSeverity(above: [.watch, .elevated]), .critical)
+        XCTAssertEqual(AgentActivityPolicy.escalatedSeverity(above: [.info]), .watch)
+    }
+
+    func testEscalatedSeverityCapsAtCritical() {
+        XCTAssertEqual(AgentActivityPolicy.escalatedSeverity(above: [.critical]), .critical)
+    }
+
+    func testEscalatedSeverityDefaultsFromEmptySeverities() {
+        XCTAssertEqual(AgentActivityPolicy.escalatedSeverity(above: []), .watch)
+    }
+
+    func testEscalationRuleCapsAtCriticalAndJoinsTechniques() {
+        let escalation = AgentActivityPolicy.escalationRule(
+            matchedTechniques: ["T1053", "T1555"],
+            otherSeverities: [.critical, .watch]
+        )
+        XCTAssertEqual(escalation.name, "AI agent session touched a sensitive technique")
+        XCTAssertEqual(escalation.severity, .critical)
+        XCTAssertEqual(escalation.technique, "T1053, T1555")
+        XCTAssertTrue(escalation.explanation.contains("prompt-injected"))
+    }
+}
diff --git a/Tests/ArgusTests/AllowlistTests.swift b/Tests/ArgusTests/AllowlistTests.swift
index 016bbfa..2d78b92 100644
--- a/Tests/ArgusTests/AllowlistTests.swift
+++ b/Tests/ArgusTests/AllowlistTests.swift
@@ -7,7 +7,7 @@ final class AllowlistFilterTests: XCTestCase {
             MatchedRule(name: "A", severity: .critical, technique: "T1", explanation: "e"),
             MatchedRule(name: "B", severity: .watch, technique: "T2", explanation: "e2"),
         ]
-        let filtered = AllowlistFilter.apply(matches, executable: "osascript") { name, exe in
+        let filtered = AllowlistFilter.apply(matches, executable: "osascript", provenance: []) { name, exe, _ in
             name == "A" && exe == "osascript"
         }
         XCTAssertEqual(filtered.map(\.name), ["B"])
@@ -15,7 +15,7 @@ final class AllowlistFilterTests: XCTestCase {
 
     func testScopedToExecutable() {
         let matches = [MatchedRule(name: "A", severity: .critical, technique: "T1", explanation: "e")]
-        let filtered = AllowlistFilter.apply(matches, executable: "bash") { name, exe in
+        let filtered = AllowlistFilter.apply(matches, executable: "bash", provenance: []) { name, exe, _ in
             name == "A" && exe == "osascript"
         }
         XCTAssertEqual(filtered.count, 1, "a different executable running the same-named rule should not be suppressed")
@@ -23,7 +23,23 @@ final class AllowlistFilterTests: XCTestCase {
 
     func testEmptyAllowlistFiltersNothing() {
         let matches = [MatchedRule(name: "A", severity: .critical, technique: "T1", explanation: "e")]
-        let filtered = AllowlistFilter.apply(matches, executable: "osascript") { _, _ in false }
+        let filtered = AllowlistFilter.apply(matches, executable: "osascript", provenance: []) { _, _, _ in false }
+        XCTAssertEqual(filtered.count, 1)
+    }
+
+    /// `AllowlistFilter.apply` doesn't interpret provenance itself — it just
+    /// hands whatever was passed straight through to `isAllowed`. Verified
+    /// here so a bug that dropped or reordered the parameter on its way in
+    /// would fail loudly rather than only showing up as a live suppression
+    /// bug that's hard to trace back to this pass-through.
+    func testPassesProvenanceThroughToIsAllowed() {
+        let matches = [MatchedRule(name: "A", severity: .critical, technique: "T1", explanation: "e")]
+        var seenProvenance: [String] = []
+        let filtered = AllowlistFilter.apply(matches, executable: "zsh", provenance: ["claude", "tmux"]) { _, _, provenance in
+            seenProvenance = provenance
+            return false
+        }
+        XCTAssertEqual(seenProvenance, ["claude", "tmux"])
         XCTAssertEqual(filtered.count, 1)
     }
 }
@@ -39,9 +55,9 @@ final class AllowlistStoreTests: XCTestCase {
 
     func testAllowThenIsAllowed() {
         let (store, _) = makeStore()
-        XCTAssertFalse(store.isAllowed(ruleName: "AppleScript privilege escalation", executable: "osascript"))
+        XCTAssertFalse(store.isAllowed(ruleName: "AppleScript privilege escalation", executable: "osascript", provenance: []))
         store.allow(ruleName: "AppleScript privilege escalation", executable: "osascript")
-        XCTAssertTrue(store.isAllowed(ruleName: "AppleScript privilege escalation", executable: "osascript"))
+        XCTAssertTrue(store.isAllowed(ruleName: "AppleScript privilege escalation", executable: "osascript", provenance: []))
         XCTAssertEqual(store.entries.count, 1)
     }
 
@@ -66,6 +82,144 @@ final class AllowlistStoreTests: XCTestCase {
 
         let reloaded = AllowlistStore(fileURL: url)
         XCTAssertEqual(reloaded.entries.count, 1)
-        XCTAssertTrue(reloaded.isAllowed(ruleName: "A", executable: "osascript"))
+        XCTAssertTrue(reloaded.isAllowed(ruleName: "A", executable: "osascript", provenance: []))
     }
+
+    func testStoreWiredWithIntegrityGuardRecordsMACOnSave() {
+        let dir = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+        try? FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
+        let url = dir.appendingPathComponent("allowlist.json")
+
+        let fixedKeyGuard = IntegrityGuard(
+            keyProvider: FixedKeyProviderForAllowlistTests(data: Data(repeating: 0x22, count: 32)),
+            sidecarURL: dir.appendingPathComponent("integrity.json")
+        )
+
+        let store = AllowlistStore(fileURL: url, integrityGuard: fixedKeyGuard)
+        // Verification is async-on-request now (a Keychain prompt must never
+        // block init), so init leaves the verdict unset. No allowlist.json
+        // exists yet — nothing has been authenticated, nothing to verify.
+        XCTAssertNil(store.integrityVerdict)
+        let verified = expectation(description: "verifyIntegrity completes")
+        store.verifyIntegrity { verdict in
+            XCTAssertEqual(verdict, .unverifiable)
+            verified.fulfill()
+        }
+        wait(for: [verified], timeout: 5)
+        XCTAssertEqual(store.integrityVerdict, .unverifiable)
+
+        store.allow(ruleName: "A", executable: "osascript")
+        XCTAssertEqual(fixedKeyGuard.verify(url), .verified, "save() should have recorded a MAC via the injected guard")
+    }
+
+    // MARK: - Provenance-scoped entries
+
+    func testScopedEntrySuppressesWhenLabelPresent() {
+        let (store, _) = makeStore()
+        store.allow(ruleName: "Pipe-to-Interpreter Fetch and Execute", executable: "zsh", requiredProvenance: "claude")
+        XCTAssertTrue(store.isAllowed(ruleName: "Pipe-to-Interpreter Fetch and Execute", executable: "zsh", provenance: ["claude"]))
+    }
+
+    /// Same rule and executable as the previous test, but without "claude"
+    /// in the observed provenance — a scoped entry must not blind the rule
+    /// for every other `zsh` on the system, only the ones under its scope.
+    func testScopedEntryDoesNotSuppressWhenLabelAbsent() {
+        let (store, _) = makeStore()
+        store.allow(ruleName: "Pipe-to-Interpreter Fetch and Execute", executable: "zsh", requiredProvenance: "claude")
+        XCTAssertFalse(store.isAllowed(ruleName: "Pipe-to-Interpreter Fetch and Execute", executable: "zsh", provenance: []))
+        XCTAssertFalse(store.isAllowed(ruleName: "Pipe-to-Interpreter Fetch and Execute", executable: "zsh", provenance: ["docker"]))
+    }
+
+    func testUnscopedEntrySuppressesRegardlessOfProvenance() {
+        let (store, _) = makeStore()
+        store.allow(ruleName: "A", executable: "osascript")
+        XCTAssertTrue(store.isAllowed(ruleName: "A", executable: "osascript", provenance: []))
+        XCTAssertTrue(store.isAllowed(ruleName: "A", executable: "osascript", provenance: ["claude"]))
+        XCTAssertTrue(store.isAllowed(ruleName: "A", executable: "osascript", provenance: ["docker", "brew"]))
+    }
+
+    func testScopeMatchingIsCaseInsensitive() {
+        let (store, _) = makeStore()
+        store.allow(ruleName: "A", executable: "zsh", requiredProvenance: "claude")
+        XCTAssertTrue(store.isAllowed(ruleName: "A", executable: "zsh", provenance: ["Claude"]))
+    }
+
+    /// A pre-existing `allowlist.json` written before `requiredProvenance`
+    /// existed has no such key at all — `decodeIfPresent` must fall back to
+    /// `nil` rather than fail decoding the whole array, and the resulting
+    /// entry must behave exactly as unconditional entries always have.
+    func testLegacyEntryWithoutProvenanceKeyDecodesUnconditional() {
+        let dir = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+        try? FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
+        let url = dir.appendingPathComponent("allowlist.json")
+        let legacyJSON = """
+        [
+          {
+            "id": "\(UUID().uuidString)",
+            "ruleName": "A",
+            "executable": "osascript",
+            "createdAt": 700000000.0
+          }
+        ]
+        """
+        try! legacyJSON.write(to: url, atomically: true, encoding: .utf8)
+
+        let store = AllowlistStore(fileURL: url)
+        XCTAssertEqual(store.entries.count, 1)
+        XCTAssertNil(store.entries.first?.requiredProvenance)
+        XCTAssertTrue(store.isAllowed(ruleName: "A", executable: "osascript", provenance: []))
+        XCTAssertTrue(store.isAllowed(ruleName: "A", executable: "osascript", provenance: ["claude"]))
+    }
+
+    // MARK: - Duplicate/redundancy handling across scopes
+
+    /// Two entries for the same (rule, executable) but different scopes are
+    /// genuinely distinct — one doesn't make the other redundant.
+    func testDifferentScopesForSamePairCoexist() {
+        let (store, _) = makeStore()
+        store.allow(ruleName: "A", executable: "zsh", requiredProvenance: "claude")
+        store.allow(ruleName: "A", executable: "zsh", requiredProvenance: "docker")
+        XCTAssertEqual(store.entries.count, 2)
+        XCTAssertTrue(store.isAllowed(ruleName: "A", executable: "zsh", provenance: ["claude"]))
+        XCTAssertTrue(store.isAllowed(ruleName: "A", executable: "zsh", provenance: ["docker"]))
+        XCTAssertFalse(store.isAllowed(ruleName: "A", executable: "zsh", provenance: ["brew"]))
+    }
+
+    /// An existing unconditional entry already suppresses everything a
+    /// scoped request for the same pair would — adding the narrower entry
+    /// on top would be redundant, so it's silently skipped rather than
+    /// cluttering the panel with a scoped entry that can never matter.
+    func testUnconditionalEntryAlreadyCoversScopedAdd() {
+        let (store, _) = makeStore()
+        store.allow(ruleName: "A", executable: "zsh")
+        store.allow(ruleName: "A", executable: "zsh", requiredProvenance: "claude")
+        XCTAssertEqual(store.entries.count, 1, "the unconditional entry already covers any scoped request for the same pair")
+        XCTAssertNil(store.entries.first?.requiredProvenance)
+    }
+
+    /// The same scoped request twice is a plain duplicate, same as the
+    /// existing unconditional idempotency test.
+    func testScopedAllowIsIdempotent() {
+        let (store, _) = makeStore()
+        store.allow(ruleName: "A", executable: "zsh", requiredProvenance: "claude")
+        store.allow(ruleName: "A", executable: "zsh", requiredProvenance: "claude")
+        XCTAssertEqual(store.entries.count, 1)
+    }
+
+    /// The reverse ordering of `testUnconditionalEntryAlreadyCoversScopedAdd`:
+    /// a scoped entry doesn't stop a later, broader unconditional request
+    /// from being added — the scoped entry doesn't cover the general case.
+    func testScopedEntryDoesNotBlockLaterUnconditionalAdd() {
+        let (store, _) = makeStore()
+        store.allow(ruleName: "A", executable: "zsh", requiredProvenance: "claude")
+        store.allow(ruleName: "A", executable: "zsh")
+        XCTAssertEqual(store.entries.count, 2)
+        XCTAssertTrue(store.isAllowed(ruleName: "A", executable: "zsh", provenance: []))
+    }
+}
+
+/// Fixed-key provider so this test doesn't touch the real Keychain.
+private struct FixedKeyProviderForAllowlistTests: IntegrityKeyProvider {
+    let data: Data?
+    func key() -> Data? { data }
 }
diff --git a/Tests/ArgusTests/AppSettingsTests.swift b/Tests/ArgusTests/AppSettingsTests.swift
index b65ea13..9f87b9d 100644
--- a/Tests/ArgusTests/AppSettingsTests.swift
+++ b/Tests/ArgusTests/AppSettingsTests.swift
@@ -41,6 +41,7 @@ final class AppSettingsTests: XCTestCase {
         XCTAssertEqual(settings.pollIntervalSeconds, 1.2)
         XCTAssertEqual(settings.riskDecayHalfLifeSeconds, 55.0)
         XCTAssertEqual(settings.notificationThreshold, .criticalOnly)
+        XCTAssertTrue(settings.quietAgentNotifications)
     }
 
     func testValuesClampToRange() {
@@ -58,9 +59,24 @@ final class AppSettingsTests: XCTestCase {
         let settings = AppSettings(defaults: defaults)
         settings.pollIntervalSeconds = 2.5
         settings.notificationThreshold = .allMatches
+        settings.quietAgentNotifications = false
 
         let reloaded = AppSettings(defaults: defaults)
         XCTAssertEqual(reloaded.pollIntervalSeconds, 2.5)
         XCTAssertEqual(reloaded.notificationThreshold, .allMatches)
+        XCTAssertFalse(reloaded.quietAgentNotifications)
+    }
+
+    func testQuietAgentNotificationsPersistsWhenExplicitlySetTrue() {
+        // Distinct from testDefaults: this exercises the stored-true path
+        // through the `defaults.object(forKey:)` branch, not just the
+        // fallback-to-true-when-absent path.
+        let defaults = makeDefaults()
+        let settings = AppSettings(defaults: defaults)
+        settings.quietAgentNotifications = false
+        settings.quietAgentNotifications = true
+
+        let reloaded = AppSettings(defaults: defaults)
+        XCTAssertTrue(reloaded.quietAgentNotifications)
     }
 }
diff --git a/Tests/ArgusTests/BundledRulesTests.swift b/Tests/ArgusTests/BundledRulesTests.swift
index 3deb8da..3e2f5f8 100644
--- a/Tests/ArgusTests/BundledRulesTests.swift
+++ b/Tests/ArgusTests/BundledRulesTests.swift
@@ -23,9 +23,9 @@ final class BundledRulesTests: XCTestCase {
 
     private static let allRules: [SigmaRule] = {
         var rules: [SigmaRule] = []
-        rules += RuleStore.loadRules(from: rulesRoot.appendingPathComponent("imported"), origin: .sigmaHQMacOS)
-        rules += RuleStore.loadRules(from: rulesRoot.appendingPathComponent("imported-portable"), origin: .sigmaHQPortable)
-        rules += RuleStore.loadRules(from: rulesRoot.appendingPathComponent("custom"), origin: .custom)
+        rules += RuleStore.loadRules(from: rulesRoot.appendingPathComponent("imported"), origin: .sigmaHQMacOS).rules
+        rules += RuleStore.loadRules(from: rulesRoot.appendingPathComponent("imported-portable"), origin: .sigmaHQPortable).rules
+        rules += RuleStore.loadRules(from: rulesRoot.appendingPathComponent("custom"), origin: .custom).rules
         return rules
     }()
 
@@ -34,10 +34,10 @@ final class BundledRulesTests: XCTestCase {
     }
 
     func testExpectedRuleCount() {
-        // 67 SigmaHQ macOS + 8 SigmaHQ portable-shell + 10 Argus custom = 85.
+        // 67 SigmaHQ macOS + 8 SigmaHQ portable-shell + 11 Argus custom = 86.
         // A specific number, not a >0 check, so silently losing a whole
         // directory of rules (bad bundle path, parse regression) fails loudly.
-        XCTAssertEqual(Self.allRules.count, 85, "rule count changed — update this if the change was deliberate")
+        XCTAssertEqual(Self.allRules.count, 86, "rule count changed — update this if the change was deliberate")
     }
 
     func testEveryRuleHasNonEmptyConditionAndDetection() {
diff --git a/Tests/ArgusTests/ChainCorrelatorTests.swift b/Tests/ArgusTests/ChainCorrelatorTests.swift
new file mode 100644
index 0000000..ffe7425
--- /dev/null
+++ b/Tests/ArgusTests/ChainCorrelatorTests.swift
@@ -0,0 +1,116 @@
+import XCTest
+@testable import Argus
+
+final class ChainCorrelatorTests: XCTestCase {
+    private let t0 = Date(timeIntervalSince1970: 1_000_000)
+
+    private func member(_ correlator: ChainCorrelator, pid: Int32, executable: String,
+                         rule: String, technique: String, severity: Severity,
+                         at offset: TimeInterval, ancestry: [Int32]) -> ChainDetection? {
+        correlator.register(eventID: UUID(), pid: pid, executable: executable,
+                             ruleNames: [rule], techniques: [technique], severity: severity,
+                             timestamp: t0.addingTimeInterval(offset), ancestry: ancestry)
+    }
+
+    func testParentChildAcrossDistinctTechniquesFires() {
+        let c = ChainCorrelator()
+        let first = member(c, pid: 100, executable: "cmd.exe", rule: "RuleA", technique: "T1059",
+                            severity: .watch, at: 0, ancestry: [])
+        XCTAssertNil(first)
+
+        let second = member(c, pid: 200, executable: "certutil.exe", rule: "RuleB", technique: "T1218",
+                             severity: .elevated, at: 10, ancestry: [100])
+        guard let detection = second else { return XCTFail("expected a chain detection") }
+        XCTAssertEqual(Set(detection.members.map(\.pid)), [100, 200])
+        XCTAssertEqual(detection.techniques, ["T1059", "T1218"])
+        XCTAssertEqual(detection.members.map(\.pid), [100, 200], "members are ordered oldest-first")
+    }
+
+    func testSameRuleOnTwoProcessesDoesNotFire() {
+        let c = ChainCorrelator()
+        _ = member(c, pid: 100, executable: "sh", rule: "RuleA", technique: "T1059",
+                   severity: .watch, at: 0, ancestry: [])
+        let second = member(c, pid: 200, executable: "sh", rule: "RuleA", technique: "T1059",
+                             severity: .watch, at: 10, ancestry: [100])
+        XCTAssertNil(second, "same rule refiring on a retried command must not self-chain")
+    }
+
+    func testSamePidMultiRuleDoesNotFire() {
+        let c = ChainCorrelator()
+        _ = member(c, pid: 100, executable: "curl", rule: "RuleA", technique: "T1059",
+                   severity: .watch, at: 0, ancestry: [])
+        let second = member(c, pid: 100, executable: "curl", rule: "RuleB", technique: "T1218",
+                             severity: .elevated, at: 1, ancestry: [])
+        XCTAssertNil(second, "a single process matching multiple rules is one multi-rule event, not a chain")
+    }
+
+    func testUnrelatedTreesDoNotFire() {
+        let c = ChainCorrelator()
+        _ = member(c, pid: 100, executable: "curl", rule: "RuleA", technique: "T1059",
+                   severity: .watch, at: 0, ancestry: [50])
+        let second = member(c, pid: 200, executable: "xattr", rule: "RuleB", technique: "T1218",
+                             severity: .elevated, at: 10, ancestry: [60])
+        XCTAssertNil(second, "disjoint process trees must not chain")
+    }
+
+    func testLineageViaCommonNonLaunchdAncestorFires() {
+        let c = ChainCorrelator()
+        _ = member(c, pid: 100, executable: "curl", rule: "RuleA", technique: "T1059",
+                   severity: .watch, at: 0, ancestry: [50])
+        let second = member(c, pid: 200, executable: "xattr", rule: "RuleB", technique: "T1218",
+                             severity: .elevated, at: 10, ancestry: [50])
+        XCTAssertNotNil(second, "a shared non-launchd ancestor further up the tree still counts as related")
+    }
+
+    func testPidLessThanOrEqualOneCommonAncestorDoesNotFire() {
+        let c = ChainCorrelator()
+        _ = member(c, pid: 100, executable: "curl", rule: "RuleA", technique: "T1059",
+                   severity: .watch, at: 0, ancestry: [1])
+        let second = member(c, pid: 200, executable: "xattr", rule: "RuleB", technique: "T1218",
+                             severity: .elevated, at: 10, ancestry: [1])
+        XCTAssertNil(second, "launchd (pid 1) is shared by every process and must not create a chain by itself")
+    }
+
+    func testWindowExpiryPreventsChaining() {
+        let c = ChainCorrelator(window: 600)
+        _ = member(c, pid: 100, executable: "curl", rule: "RuleA", technique: "T1059",
+                   severity: .watch, at: 0, ancestry: [])
+        let second = member(c, pid: 200, executable: "xattr", rule: "RuleB", technique: "T1218",
+                             severity: .elevated, at: 700, ancestry: [100])
+        XCTAssertNil(second, "the first member has aged out of the rolling window")
+    }
+
+    func testThirdTechniqueJoiningRefiresWithAllThreeMembers() {
+        let c = ChainCorrelator()
+        _ = member(c, pid: 100, executable: "sh", rule: "RuleA", technique: "T1059",
+                   severity: .watch, at: 0, ancestry: [])
+        let second = member(c, pid: 200, executable: "curl", rule: "RuleB", technique: "T1105",
+                             severity: .watch, at: 10, ancestry: [100])
+        XCTAssertNotNil(second)
+
+        let third = member(c, pid: 300, executable: "launchctl", rule: "RuleC", technique: "T1543",
+                            severity: .elevated, at: 20, ancestry: [200, 100])
+        guard let detection = third else { return XCTFail("expected a chain detection extending the prior one") }
+        XCTAssertEqual(Set(detection.members.map(\.pid)), [100, 200, 300])
+        XCTAssertEqual(detection.techniques, ["T1059", "T1105", "T1543"])
+        XCTAssertEqual(detection.members.map(\.pid), [100, 200, 300], "oldest-first ordering")
+    }
+
+    func testSeverityEscalatesOneLevelAboveMax() {
+        let c = ChainCorrelator()
+        _ = member(c, pid: 100, executable: "sh", rule: "RuleA", technique: "T1059",
+                   severity: .info, at: 0, ancestry: [])
+        let second = member(c, pid: 200, executable: "curl", rule: "RuleB", technique: "T1105",
+                             severity: .watch, at: 10, ancestry: [100])
+        XCTAssertEqual(second?.escalatedSeverity, .elevated)
+    }
+
+    func testSeverityEscalationCapsAtCritical() {
+        let c = ChainCorrelator()
+        _ = member(c, pid: 100, executable: "sh", rule: "RuleA", technique: "T1059",
+                   severity: .critical, at: 0, ancestry: [])
+        let second = member(c, pid: 200, executable: "curl", rule: "RuleB", technique: "T1105",
+                             severity: .elevated, at: 10, ancestry: [100])
+        XCTAssertEqual(second?.escalatedSeverity, .critical, "escalation must not overflow past .critical")
+    }
+}
diff --git a/Tests/ArgusTests/EventExportTests.swift b/Tests/ArgusTests/EventExportTests.swift
new file mode 100644
index 0000000..40c8a57
--- /dev/null
+++ b/Tests/ArgusTests/EventExportTests.swift
@@ -0,0 +1,127 @@
+import XCTest
+@testable import Argus
+
+final class EventExportTests: XCTestCase {
+    private func sampleEvent(
+        pid: Int32 = 1,
+        ppid: Int32 = 99,
+        executable: String = "osascript",
+        command: String = "osascript -e 'do shell script \"id\" with administrator privileges'",
+        rules: [MatchedRule]? = nil,
+        timestamp: Date = Date(timeIntervalSince1970: 1_700_000_000)
+    ) -> ProcessEvent {
+        ProcessEvent(
+            pid: pid,
+            ppid: ppid,
+            executable: executable,
+            command: command,
+            rules: rules ?? [MatchedRule(name: "AppleScript privilege escalation", severity: .critical,
+                                          technique: "T1548 – Elevated Execution", explanation: "e")],
+            timestamp: timestamp
+        )
+    }
+
+    // MARK: - JSON
+
+    func testJSONRoundTripsSingleEvent() throws {
+        let event = sampleEvent()
+        guard let json = EventExport.json(for: event) else {
+            return XCTFail("expected JSON string")
+        }
+
+        let decoder = JSONDecoder()
+        decoder.dateDecodingStrategy = .iso8601
+        let decoded = try decoder.decode(ProcessEvent.self, from: Data(json.utf8))
+
+        XCTAssertEqual(decoded.id, event.id)
+        XCTAssertEqual(decoded.pid, event.pid)
+        XCTAssertEqual(decoded.ppid, event.ppid)
+        XCTAssertEqual(decoded.executable, event.executable)
+        XCTAssertEqual(decoded.command, event.command)
+        XCTAssertEqual(decoded.rules.map(\.name), event.rules.map(\.name))
+        XCTAssertEqual(decoded.rules.map(\.severity), event.rules.map(\.severity))
+        XCTAssertEqual(decoded.timestamp.timeIntervalSince1970, event.timestamp.timeIntervalSince1970, accuracy: 0.001)
+    }
+
+    func testJSONArrayRoundTripsMultipleEvents() throws {
+        let events = [sampleEvent(pid: 1), sampleEvent(pid: 2), sampleEvent(pid: 3)]
+        guard let data = EventExport.json(events: events) else {
+            return XCTFail("expected JSON data")
+        }
+
+        let decoder = JSONDecoder()
+        decoder.dateDecodingStrategy = .iso8601
+        let decoded = try decoder.decode([ProcessEvent].self, from: data)
+
+        XCTAssertEqual(decoded.count, 3)
+        XCTAssertEqual(decoded.map(\.pid), [1, 2, 3])
+        XCTAssertEqual(decoded.map(\.id), events.map(\.id))
+    }
+
+    func testJSONForEventsIsEmptyArrayForEmptyInput() throws {
+        guard let data = EventExport.json(events: []) else {
+            return XCTFail("expected JSON data")
+        }
+        let decoder = JSONDecoder()
+        let decoded = try decoder.decode([ProcessEvent].self, from: data)
+        XCTAssertTrue(decoded.isEmpty)
+    }
+
+    // MARK: - CSV
+
+    func testCSVHeaderAndRowCount() {
+        let events = [sampleEvent(pid: 1), sampleEvent(pid: 2), sampleEvent(pid: 3)]
+        let csv = EventExport.csv(events: events)
+
+        let lines = csv.split(separator: "\n", omittingEmptySubsequences: false)
+        XCTAssertEqual(lines.first, "timestamp,pid,ppid,executable,severity,techniques,rules,command")
+        // header + 3 data rows, trailing newline leaves one empty trailing element
+        XCTAssertEqual(lines.count, 5)
+        XCTAssertEqual(lines.last, "")
+    }
+
+    func testCSVEmptyEventListProducesHeaderOnly() {
+        let csv = EventExport.csv(events: [])
+        XCTAssertEqual(csv, "timestamp,pid,ppid,executable,severity,techniques,rules,command\n")
+    }
+
+    func testCSVMultiRuleEventJoinsRulesAndTechniquesWithSemicolons() {
+        let rules = [
+            MatchedRule(name: "Rule A", severity: .watch, technique: "T1059", explanation: "e1"),
+            MatchedRule(name: "Rule B", severity: .critical, technique: "T1548", explanation: "e2")
+        ]
+        let event = sampleEvent(command: "echo hi", rules: rules)
+        let csv = EventExport.csv(events: [event])
+        let isoTimestamp = ISO8601DateFormatter().string(from: event.timestamp)
+
+        let expected = "timestamp,pid,ppid,executable,severity,techniques,rules,command\n"
+            + "\(isoTimestamp),1,99,osascript,CRITICAL,T1059;T1548,Rule A;Rule B,echo hi\n"
+        XCTAssertEqual(csv, expected)
+    }
+
+    /// The load-bearing quoting test: a command containing a comma, embedded
+    /// double quotes, and a literal newline must survive RFC 4180 quoting
+    /// exactly — comma/newline alone would misalign columns, unescaped
+    /// quotes would prematurely close the field. Also exercises quoting on a
+    /// non-command field (a rule name containing a comma).
+    func testCSVQuotesFieldsContainingCommasQuotesAndNewlines() {
+        let command = "echo \"hello, world\"\nsecond line"
+        let event = sampleEvent(
+            pid: 42,
+            ppid: 7,
+            executable: "bash",
+            command: command,
+            rules: [MatchedRule(name: "Rule, A", severity: .critical, technique: "T1059", explanation: "e")]
+        )
+
+        let csv = EventExport.csv(events: [event])
+        let isoTimestamp = ISO8601DateFormatter().string(from: event.timestamp)
+
+        let expectedCommandField = "\"echo \"\"hello, world\"\"\nsecond line\""
+        let expectedRuleField = "\"Rule, A\""
+        let expected = "timestamp,pid,ppid,executable,severity,techniques,rules,command\n"
+            + "\(isoTimestamp),42,7,bash,CRITICAL,T1059,\(expectedRuleField),\(expectedCommandField)\n"
+
+        XCTAssertEqual(csv, expected)
+    }
+}
diff --git a/Tests/ArgusTests/EventFilterTests.swift b/Tests/ArgusTests/EventFilterTests.swift
index 3847868..97c8ddf 100644
--- a/Tests/ArgusTests/EventFilterTests.swift
+++ b/Tests/ArgusTests/EventFilterTests.swift
@@ -2,12 +2,13 @@ import XCTest
 @testable import Argus
 
 final class EventFilterTests: XCTestCase {
-    private func event(pid: Int32, ppid: Int32, executable: String, severity: Severity, technique: String, command: String? = nil) -> ProcessEvent {
+    private func event(pid: Int32, ppid: Int32, executable: String, severity: Severity, technique: String, command: String? = nil, provenance: [String] = []) -> ProcessEvent {
         ProcessEvent(
             pid: pid, ppid: ppid, executable: executable,
             command: command ?? "\(executable) some args",
             rules: [MatchedRule(name: "rule-\(technique)", severity: severity, technique: technique, explanation: "e")],
-            timestamp: Date()
+            timestamp: Date(),
+            provenance: provenance
         )
     }
 
@@ -48,6 +49,17 @@ final class EventFilterTests: XCTestCase {
         XCTAssertEqual(Set(filtered.map(\.pid)), [1, 2])
     }
 
+    func testSearchMatchesProvenanceLabel() {
+        let events = [
+            event(pid: 1, ppid: 10, executable: "python3", severity: .critical, technique: "T1", provenance: ["claude"]),
+            event(pid: 2, ppid: 10, executable: "curl", severity: .critical, technique: "T2", provenance: ["docker"]),
+            event(pid: 3, ppid: 10, executable: "nc", severity: .critical, technique: "T3"),
+        ]
+        XCTAssertEqual(EventFilter.apply(events, searchText: "claude", severities: Set(Severity.allCases), sessionPPID: nil).map(\.pid), [1])
+        XCTAssertEqual(EventFilter.apply(events, searchText: "CLAU", severities: Set(Severity.allCases), sessionPPID: nil).map(\.pid), [1], "search should be case-insensitive")
+        XCTAssertEqual(EventFilter.apply(events, searchText: "docker", severities: Set(Severity.allCases), sessionPPID: nil).map(\.pid), [2])
+    }
+
     func testFiltersCombine() {
         let events = [
             event(pid: 1, ppid: 100, executable: "curl", severity: .watch, technique: "T1"),
diff --git a/Tests/ArgusTests/IntegrityGuardTests.swift b/Tests/ArgusTests/IntegrityGuardTests.swift
new file mode 100644
index 0000000..e99dabb
--- /dev/null
+++ b/Tests/ArgusTests/IntegrityGuardTests.swift
@@ -0,0 +1,110 @@
+import XCTest
+@testable import Argus
+
+/// Fixed, in-memory key so these tests never touch the real Keychain (the
+/// production `KeychainIntegrityKeyProvider` is exercised only via
+/// `IntegrityGuard.shared`, which these tests deliberately avoid).
+private struct FixedKeyProvider: IntegrityKeyProvider {
+    let data: Data?
+    func key() -> Data? { data }
+}
+
+final class IntegrityGuardTests: XCTestCase {
+    private func makeTempDir() -> URL {
+        let dir = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+        try? FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
+        return dir
+    }
+
+    private func makeGuard(dir: URL, key: Data? = Data(repeating: 0x42, count: 32)) -> IntegrityGuard {
+        IntegrityGuard(keyProvider: FixedKeyProvider(data: key), sidecarURL: dir.appendingPathComponent("integrity.json"))
+    }
+
+    func testVerifiedRoundTrip() throws {
+        let dir = makeTempDir()
+        let file = dir.appendingPathComponent("rules-state.json")
+        try "[\"a\"]".write(to: file, atomically: true, encoding: .utf8)
+
+        let guardInstance = makeGuard(dir: dir)
+        guardInstance.recordAuthenticatedWrite(of: file)
+
+        XCTAssertEqual(guardInstance.verify(file), .verified)
+    }
+
+    func testBaselineEstablishedOnFirstSight() throws {
+        let dir = makeTempDir()
+        let file = dir.appendingPathComponent("allowlist.json")
+        try "[]".write(to: file, atomically: true, encoding: .utf8)
+
+        let guardInstance = makeGuard(dir: dir)
+        XCTAssertEqual(guardInstance.verify(file), .baselineEstablished)
+        // The baseline just adopted should verify cleanly next time, with no
+        // further authenticated write in between.
+        XCTAssertEqual(guardInstance.verify(file), .verified)
+    }
+
+    func testTamperDetection() throws {
+        let dir = makeTempDir()
+        let file = dir.appendingPathComponent("rules-state.json")
+        try "[\"a\"]".write(to: file, atomically: true, encoding: .utf8)
+
+        let guardInstance = makeGuard(dir: dir)
+        guardInstance.recordAuthenticatedWrite(of: file)
+
+        // Simulate a local attacker rewriting the file directly, bypassing
+        // RuleStore's authenticated save path entirely.
+        try "[\"a\", \"b\"]".write(to: file, atomically: true, encoding: .utf8)
+
+        XCTAssertEqual(guardInstance.verify(file), .tampered)
+    }
+
+    func testRebaselinesAfterTamperSoItDoesNotRefire() throws {
+        let dir = makeTempDir()
+        let file = dir.appendingPathComponent("rules-state.json")
+        try "[\"a\"]".write(to: file, atomically: true, encoding: .utf8)
+
+        let guardInstance = makeGuard(dir: dir)
+        guardInstance.recordAuthenticatedWrite(of: file)
+        try "[\"a\", \"b\"]".write(to: file, atomically: true, encoding: .utf8)
+
+        XCTAssertEqual(guardInstance.verify(file), .tampered)
+        // Same file, unchanged since the tamper was reported: should now
+        // verify cleanly rather than reporting .tampered again forever.
+        XCTAssertEqual(guardInstance.verify(file), .verified)
+    }
+
+    func testNilKeyIsUnverifiable() throws {
+        let dir = makeTempDir()
+        let file = dir.appendingPathComponent("rules-state.json")
+        try "[\"a\"]".write(to: file, atomically: true, encoding: .utf8)
+
+        let guardInstance = makeGuard(dir: dir, key: nil)
+        // Should not crash, and should decline to write a MAC with no key.
+        guardInstance.recordAuthenticatedWrite(of: file)
+        XCTAssertEqual(guardInstance.verify(file), .unverifiable)
+    }
+
+    func testUnreadableFileIsUnverifiable() {
+        let dir = makeTempDir()
+        let missing = dir.appendingPathComponent("does-not-exist.json")
+
+        let guardInstance = makeGuard(dir: dir)
+        XCTAssertEqual(guardInstance.verify(missing), .unverifiable)
+    }
+
+    func testTamperEventConstruction() throws {
+        let fileURL = URL(fileURLWithPath: "/Users/test/Library/Application Support/Argus/rules-state.json")
+        let event = IntegrityGuard.tamperEvent(for: fileURL)
+
+        XCTAssertEqual(event.pid, 0)
+        XCTAssertEqual(event.ppid, 0)
+        XCTAssertEqual(event.executable, "rules-state.json")
+        XCTAssertEqual(event.command, fileURL.path)
+        XCTAssertEqual(event.rules.count, 1)
+        let rule = try XCTUnwrap(event.rules.first)
+        XCTAssertEqual(rule.name, "Detection state modified outside Argus")
+        XCTAssertEqual(rule.technique, "T1562.001")
+        XCTAssertEqual(rule.severity, .critical)
+        XCTAssertTrue(rule.explanation.contains("rules-state.json"))
+    }
+}
diff --git a/Tests/ArgusTests/ModelsTests.swift b/Tests/ArgusTests/ModelsTests.swift
new file mode 100644
index 0000000..38b1ba2
--- /dev/null
+++ b/Tests/ArgusTests/ModelsTests.swift
@@ -0,0 +1,49 @@
+import XCTest
+@testable import Argus
+
+final class ProcessEventCodableTests: XCTestCase {
+    /// A hand-written JSON line shaped exactly like something written by a
+    /// build of Argus before `provenance` existed — no `provenance` key at
+    /// all. Real events.jsonl history on disk looks like this; decoding it
+    /// must not fail or the user's persisted history silently disappears.
+    private let legacyJSON = """
+    {
+      "id": "9B1DE1B1-6E23-4B47-9C1B-1F6A0B9E2B10",
+      "pid": 412,
+      "ppid": 99,
+      "executable": "osascript",
+      "command": "osascript -e 'do shell script \\"id\\" with administrator privileges'",
+      "rules": [
+        {
+          "id": "3C1D2E3F-4A5B-6C7D-8E9F-0A1B2C3D4E5F",
+          "name": "AppleScript privilege escalation",
+          "severity": 3,
+          "technique": "T1548 \\u2013 Elevated Execution",
+          "explanation": "e"
+        }
+      ],
+      "timestamp": 700000000.0
+    }
+    """
+
+    func testDecodesLegacyEventWithoutProvenanceKey() throws {
+        let data = try XCTUnwrap(legacyJSON.data(using: .utf8))
+        let event = try JSONDecoder().decode(ProcessEvent.self, from: data)
+        XCTAssertEqual(event.pid, 412)
+        XCTAssertEqual(event.executable, "osascript")
+        XCTAssertEqual(event.rules.first?.name, "AppleScript privilege escalation")
+        XCTAssertEqual(event.provenance, [], "missing key must default to empty, not fail decoding")
+    }
+
+    func testRoundTripsProvenanceThroughEncodeAndDecode() throws {
+        let event = ProcessEvent(pid: 1, ppid: 2, executable: "claude", command: "claude", rules: [], timestamp: Date(), provenance: ["claude", "tmux"])
+        let data = try JSONEncoder().encode(event)
+        let decoded = try JSONDecoder().decode(ProcessEvent.self, from: data)
+        XCTAssertEqual(decoded.provenance, ["claude", "tmux"])
+    }
+
+    func testProvenanceDefaultsToEmptyWhenOmittedFromInitializer() {
+        let event = ProcessEvent(pid: 1, ppid: 2, executable: "chain", command: "a -> b", rules: [], timestamp: Date())
+        XCTAssertEqual(event.provenance, [], "synthetic events (chain/persistence/tamper) keep an empty provenance")
+    }
+}
diff --git a/Tests/ArgusTests/PersistenceWatcherTests.swift b/Tests/ArgusTests/PersistenceWatcherTests.swift
new file mode 100644
index 0000000..28db573
--- /dev/null
+++ b/Tests/ArgusTests/PersistenceWatcherTests.swift
@@ -0,0 +1,197 @@
+import XCTest
+@testable import Argus
+
+final class SnapshotDiffTests: XCTestCase {
+    func testAddedFileIsReported() {
+        let previous: DirectorySnapshot = [:]
+        let current: DirectorySnapshot = ["com.evil.agent.plist": Date()]
+        let changes = SnapshotDiff.diff(previous: previous, current: current)
+        XCTAssertEqual(changes, [ArtifactChange(filename: "com.evil.agent.plist", kind: .added)])
+    }
+
+    func testModifiedFileIsReportedWhenModDateChanges() {
+        let older = Date(timeIntervalSince1970: 1000)
+        let newer = Date(timeIntervalSince1970: 2000)
+        let previous: DirectorySnapshot = ["com.example.agent.plist": older]
+        let current: DirectorySnapshot = ["com.example.agent.plist": newer]
+        let changes = SnapshotDiff.diff(previous: previous, current: current)
+        XCTAssertEqual(changes, [ArtifactChange(filename: "com.example.agent.plist", kind: .modified)])
+    }
+
+    func testRemovedFileIsReported() {
+        let previous: DirectorySnapshot = ["com.example.agent.plist": Date()]
+        let current: DirectorySnapshot = [:]
+        let changes = SnapshotDiff.diff(previous: previous, current: current)
+        XCTAssertEqual(changes, [ArtifactChange(filename: "com.example.agent.plist", kind: .removed)])
+    }
+
+    func testUnchangedFileYieldsNoChange() {
+        let same = Date(timeIntervalSince1970: 5000)
+        let previous: DirectorySnapshot = ["com.example.agent.plist": same]
+        let current: DirectorySnapshot = ["com.example.agent.plist": same]
+        XCTAssertEqual(SnapshotDiff.diff(previous: previous, current: current), [])
+    }
+
+    func testFirstBaselineProducesNoChangesAgainstItself() {
+        // Simulates DirectoryWatch's silent-baseline behavior: diffing a
+        // snapshot against itself (as happens when the first rescan runs
+        // before anything on disk has actually changed) must report nothing,
+        // so pre-existing files never alert at startup.
+        let baseline: DirectorySnapshot = [
+            "com.apple.something.plist": Date(timeIntervalSince1970: 100),
+            "com.example.other.plist": Date(timeIntervalSince1970: 200),
+        ]
+        XCTAssertEqual(SnapshotDiff.diff(previous: baseline, current: baseline), [])
+    }
+
+    func testMixedAddModifyRemoveInSingleDiff() {
+        let previous: DirectorySnapshot = [
+            "kept.plist": Date(timeIntervalSince1970: 100),
+            "changed.plist": Date(timeIntervalSince1970: 100),
+            "gone.plist": Date(timeIntervalSince1970: 100),
+        ]
+        let current: DirectorySnapshot = [
+            "kept.plist": Date(timeIntervalSince1970: 100),
+            "changed.plist": Date(timeIntervalSince1970: 200),
+            "new.plist": Date(timeIntervalSince1970: 300),
+        ]
+        let changes = SnapshotDiff.diff(previous: previous, current: current)
+        XCTAssertEqual(changes, [
+            ArtifactChange(filename: "changed.plist", kind: .modified),
+            ArtifactChange(filename: "gone.plist", kind: .removed),
+            ArtifactChange(filename: "new.plist", kind: .added),
+        ], "results are sorted by filename for determinism")
+    }
+}
+
+final class PersistenceEventBuilderTests: XCTestCase {
+    func testLaunchAgentsAddedIsElevatedWithLaunchAgentTechnique() {
+        let event = PersistenceEventBuilder.makeEvent(
+            filename: "com.evil.agent.plist", changeKind: .added,
+            locationKind: .launchAgents, directoryPath: "/Users/mark/Library/LaunchAgents"
+        )
+        XCTAssertEqual(event.pid, 0)
+        XCTAssertEqual(event.ppid, 0)
+        XCTAssertEqual(event.executable, "com.evil.agent.plist")
+        XCTAssertEqual(event.command, "/Users/mark/Library/LaunchAgents/com.evil.agent.plist")
+        XCTAssertEqual(event.rules.count, 1)
+        let rule = event.rules[0]
+        XCTAssertEqual(rule.severity, .elevated)
+        XCTAssertEqual(rule.technique, "T1547.011")
+        XCTAssertEqual(rule.name, "Persistence artifact added: LaunchAgents")
+        XCTAssertTrue(rule.explanation.contains("LaunchAgents"))
+    }
+
+    func testLaunchAgentsModifiedIsElevated() {
+        let event = PersistenceEventBuilder.makeEvent(
+            filename: "com.evil.agent.plist", changeKind: .modified,
+            locationKind: .launchAgents, directoryPath: "/Library/LaunchAgents"
+        )
+        XCTAssertEqual(event.rules[0].severity, .elevated)
+        XCTAssertEqual(event.rules[0].name, "Persistence artifact modified: LaunchAgents")
+    }
+
+    func testLaunchAgentsRemovedIsWatch() {
+        let event = PersistenceEventBuilder.makeEvent(
+            filename: "com.evil.agent.plist", changeKind: .removed,
+            locationKind: .launchAgents, directoryPath: "/Library/LaunchAgents"
+        )
+        XCTAssertEqual(event.rules[0].severity, .watch)
+        XCTAssertEqual(event.rules[0].name, "Persistence artifact removed: LaunchAgents")
+    }
+
+    func testLaunchDaemonsUsesDaemonTechnique() {
+        let event = PersistenceEventBuilder.makeEvent(
+            filename: "com.evil.daemon.plist", changeKind: .added,
+            locationKind: .launchDaemons, directoryPath: "/Library/LaunchDaemons"
+        )
+        XCTAssertEqual(event.rules[0].technique, "T1543.001")
+        XCTAssertEqual(event.rules[0].severity, .elevated)
+        XCTAssertEqual(event.rules[0].name, "Persistence artifact added: LaunchDaemons")
+        XCTAssertTrue(event.rules[0].explanation.contains("root"))
+    }
+
+    func testPeriodicCronUsesCronTechnique() {
+        let event = PersistenceEventBuilder.makeEvent(
+            filename: "daily-evil", changeKind: .added,
+            locationKind: .periodicCron, directoryPath: "/etc/periodic/daily"
+        )
+        XCTAssertEqual(event.rules[0].technique, "T1053.003")
+        XCTAssertEqual(event.rules[0].severity, .elevated)
+    }
+
+    func testFullPathIsJoinedFromDirectoryAndFilename() {
+        let event = PersistenceEventBuilder.makeEvent(
+            filename: "foo.plist", changeKind: .added,
+            locationKind: .launchAgents, directoryPath: "/Library/LaunchAgents"
+        )
+        XCTAssertEqual(event.command, "/Library/LaunchAgents/foo.plist")
+    }
+}
+
+final class PersistenceLocationKindTests: XCTestCase {
+    func testDisplayNames() {
+        XCTAssertEqual(PersistenceLocationKind.launchAgents.displayName, "LaunchAgents")
+        XCTAssertEqual(PersistenceLocationKind.launchDaemons.displayName, "LaunchDaemons")
+        XCTAssertEqual(PersistenceLocationKind.periodicCron.displayName, "periodic")
+    }
+}
+
+/// Drives a real `DirectoryWatch` against a temp directory to exercise the
+/// end-to-end event → debounce → rescan → diff → callback path. Kept
+/// deterministic with a short debounce and a generous, bounded wait via
+/// `XCTestExpectation` rather than a fixed sleep.
+final class DirectoryWatchIntegrationTests: XCTestCase {
+    private var tempDir: URL!
+
+    override func setUpWithError() throws {
+        tempDir = FileManager.default.temporaryDirectory.appendingPathComponent("ArgusPersistenceWatcherTests-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: tempDir, withIntermediateDirectories: true)
+    }
+
+    override func tearDownWithError() throws {
+        try? FileManager.default.removeItem(at: tempDir)
+    }
+
+    func testExistingFileDoesNotAlertAtStartup() throws {
+        let existing = tempDir.appendingPathComponent("preexisting.plist")
+        try Data("preexisting".utf8).write(to: existing)
+
+        let notified = XCTestExpectation(description: "onChange should not fire for pre-existing file")
+        notified.isInverted = true
+
+        let watch = DirectoryWatch(path: tempDir.path, kind: .launchAgents, debounceInterval: 0.2) { _ in
+            notified.fulfill()
+        }
+        XCTAssertNotNil(watch)
+
+        wait(for: [notified], timeout: 0.8)
+        watch?.cancel()
+    }
+
+    func testNewFileTriggersAddedEvent() throws {
+        let received = XCTestExpectation(description: "onChange fires for a new file")
+        var observedEvent: ProcessEvent?
+
+        let watch = DirectoryWatch(path: tempDir.path, kind: .launchAgents, debounceInterval: 0.2) { event in
+            observedEvent = event
+            received.fulfill()
+        }
+        XCTAssertNotNil(watch)
+
+        let newFile = tempDir.appendingPathComponent("com.new.agent.plist")
+        try Data("new".utf8).write(to: newFile)
+
+        wait(for: [received], timeout: 5.0)
+        watch?.cancel()
+
+        XCTAssertEqual(observedEvent?.executable, "com.new.agent.plist")
+        XCTAssertEqual(observedEvent?.rules.first?.severity, .elevated)
+    }
+
+    func testUnreadableDirectoryReturnsNil() {
+        let missing = tempDir.appendingPathComponent("does-not-exist")
+        let watch = DirectoryWatch(path: missing.path, kind: .launchAgents) { _ in }
+        XCTAssertNil(watch)
+    }
+}
diff --git a/Tests/ArgusTests/ProcessMonitorTests.swift b/Tests/ArgusTests/ProcessMonitorTests.swift
new file mode 100644
index 0000000..f28723d
--- /dev/null
+++ b/Tests/ArgusTests/ProcessMonitorTests.swift
@@ -0,0 +1,285 @@
+import XCTest
+@testable import Argus
+
+final class ProcessMonitorParsingTests: XCTestCase {
+    func testParsesNormalLines() {
+        let output = """
+          PID  PPID USER             COMMAND
+            1     0 root             /sbin/launchd
+          412     1 mark             /usr/bin/curl -s https://example.com
+        """
+        let procs = ProcessMonitor.parsePSOutput(output)
+        XCTAssertEqual(procs.count, 2)
+        XCTAssertEqual(procs[0].id, 1)
+        XCTAssertEqual(procs[0].ppid, 0)
+        XCTAssertEqual(procs[0].user, "root")
+        XCTAssertEqual(procs[0].command, "/sbin/launchd")
+        XCTAssertEqual(procs[1].id, 412)
+        XCTAssertEqual(procs[1].ppid, 1)
+        XCTAssertEqual(procs[1].user, "mark")
+        XCTAssertEqual(procs[1].command, "/usr/bin/curl -s https://example.com")
+    }
+
+    func testHeaderLineIsSkipped() {
+        let output = """
+          PID  PPID USER             COMMAND
+            1     0 root             /sbin/launchd
+        """
+        let procs = ProcessMonitor.parsePSOutput(output)
+        XCTAssertEqual(procs.count, 1)
+        XCTAssertFalse(procs.contains { $0.command.contains("COMMAND") })
+    }
+
+    func testMalformedLinesAreSkipped() {
+        let output = """
+          PID  PPID USER             COMMAND
+            1     0 root             /sbin/launchd
+          not-a-pid   1 mark bash
+            5             root
+            7     2 mark             /bin/echo hi
+        """
+        let procs = ProcessMonitor.parsePSOutput(output)
+        // Only the two well-formed rows (pid 1, pid 7) should survive; the
+        // non-numeric pid row and the too-short row are dropped.
+        XCTAssertEqual(procs.map(\.id), [1, 7])
+    }
+
+    func testAbsolutePathImageIsPreservedAsIs() {
+        let output = """
+          PID  PPID USER             COMMAND
+          200     1 mark             /usr/bin/curl -s https://example.com
+        """
+        let procs = ProcessMonitor.parsePSOutput(output)
+        XCTAssertEqual(procs.first?.image, "/usr/bin/curl")
+        XCTAssertEqual(procs.first?.executable, "curl")
+    }
+
+    func testBareCommandArgv0IsNormalizedToLeadingSlashImage() {
+        let output = """
+          PID  PPID USER             COMMAND
+          201     1 mark             curl -s https://example.com
+        """
+        let procs = ProcessMonitor.parsePSOutput(output)
+        XCTAssertEqual(procs.first?.image, "/curl")
+        XCTAssertEqual(procs.first?.executable, "curl")
+    }
+
+    func testUserColumnIsParsed() {
+        let output = """
+          PID  PPID USER             COMMAND
+          300     1 _spotlight       /usr/bin/mdworker
+        """
+        let procs = ProcessMonitor.parsePSOutput(output)
+        XCTAssertEqual(procs.first?.user, "_spotlight")
+    }
+
+    func testEmptyOutputYieldsNoProcesses() {
+        XCTAssertEqual(ProcessMonitor.parsePSOutput(""), [])
+        XCTAssertEqual(ProcessMonitor.parsePSOutput("  PID  PPID USER             COMMAND"), [])
+    }
+}
+
+final class ParentContextCacheTests: XCTestCase {
+    private func raw(_ id: Int32, ppid: Int32, image: String, user: String = "mark") -> RawProcess {
+        RawProcess(id: id, ppid: ppid, command: image, executable: (image as NSString).lastPathComponent, image: image, user: user)
+    }
+
+    func testCurrentSampleIsResolvable() {
+        var cache = ParentContextCache(retentionTicks: 3)
+        cache.update(with: [raw(10, ppid: 1, image: "/bin/bash", user: "mark")], tick: 0)
+        XCTAssertEqual(cache.image(for: 10), "/bin/bash")
+        XCTAssertEqual(cache.user(for: 10), "mark")
+    }
+
+    func testRetainsExitedParentWithinGraceWindow() {
+        var cache = ParentContextCache(retentionTicks: 3)
+        // Parent pid 10 present at tick 0, then gone from every later sample.
+        cache.update(with: [raw(10, ppid: 1, image: "/bin/bash")], tick: 0)
+
+        cache.update(with: [raw(11, ppid: 10, image: "/usr/bin/curl")], tick: 1)
+        XCTAssertEqual(cache.image(for: 10), "/bin/bash", "still within the grace window")
+
+        cache.update(with: [raw(12, ppid: 10, image: "/usr/bin/curl")], tick: 2)
+        XCTAssertEqual(cache.image(for: 10), "/bin/bash")
+
+        cache.update(with: [raw(13, ppid: 10, image: "/usr/bin/curl")], tick: 3)
+        XCTAssertEqual(cache.image(for: 10), "/bin/bash", "last tick of the retention window")
+    }
+
+    func testPrunesAfterGraceWindowExpires() {
+        var cache = ParentContextCache(retentionTicks: 3)
+        cache.update(with: [raw(10, ppid: 1, image: "/bin/bash")], tick: 0)
+
+        cache.update(with: [], tick: 4)
+        XCTAssertNil(cache.image(for: 10), "pid should be pruned once past the retention window")
+        XCTAssertNil(cache.command(for: 10))
+        XCTAssertNil(cache.user(for: 10))
+    }
+
+    func testCurrentSampleAlwaysWinsOverCachedEntry() {
+        var cache = ParentContextCache(retentionTicks: 3)
+        cache.update(with: [raw(10, ppid: 1, image: "/bin/bash")], tick: 0)
+        cache.update(with: [raw(10, ppid: 1, image: "/bin/zsh")], tick: 1)
+        XCTAssertEqual(cache.image(for: 10), "/bin/zsh")
+    }
+
+    func testPpidIsResolvable() {
+        var cache = ParentContextCache(retentionTicks: 3)
+        cache.update(with: [raw(10, ppid: 1, image: "/bin/bash")], tick: 0)
+        XCTAssertEqual(cache.ppid(for: 10), 1)
+        XCTAssertNil(cache.ppid(for: 999))
+    }
+
+    func testAncestryWalksThroughKnownAncestors() {
+        var cache = ParentContextCache(retentionTicks: 3)
+        cache.update(with: [
+            raw(10, ppid: 1, image: "/sbin/launchd"),
+            raw(20, ppid: 10, image: "/bin/bash"),
+            raw(30, ppid: 20, image: "/usr/bin/curl"),
+        ], tick: 0)
+        XCTAssertEqual(cache.ancestry(of: 30), [20, 10])
+    }
+
+    func testAncestryExcludesPidOneAndBelow() {
+        var cache = ParentContextCache(retentionTicks: 3)
+        cache.update(with: [raw(10, ppid: 1, image: "/bin/bash")], tick: 0)
+        XCTAssertEqual(cache.ancestry(of: 10), [], "pid 1 (launchd) carries no chain-correlation signal and must be excluded")
+    }
+
+    func testAncestryStopsAtUnknownParent() {
+        var cache = ParentContextCache(retentionTicks: 3)
+        // pid 40's own ppid (99) is known, but 99 has no entry of its own —
+        // the walk must include the known link and stop there rather than
+        // fabricate anything further up.
+        cache.update(with: [raw(40, ppid: 99, image: "/bin/bash")], tick: 0)
+        XCTAssertEqual(cache.ancestry(of: 40), [99])
+    }
+
+    func testAncestryOfUnknownPidIsEmpty() {
+        var cache = ParentContextCache(retentionTicks: 3)
+        cache.update(with: [raw(10, ppid: 1, image: "/bin/bash")], tick: 0)
+        XCTAssertEqual(cache.ancestry(of: 999), [])
+    }
+
+    func testAncestryIsCycleSafe() {
+        var cache = ParentContextCache(retentionTicks: 3)
+        // Corrupted/adversarial data: 50 and 60 point at each other. Must
+        // terminate rather than loop forever.
+        cache.update(with: [
+            raw(50, ppid: 60, image: "/bin/a"),
+            raw(60, ppid: 50, image: "/bin/b"),
+        ], tick: 0)
+        XCTAssertEqual(cache.ancestry(of: 50), [60])
+    }
+
+    func testAncestryRespectsMaxDepth() {
+        var cache = ParentContextCache(retentionTicks: 3)
+        var sample: [RawProcess] = []
+        for pid in Int32(2)...30 {
+            sample.append(raw(pid, ppid: pid - 1, image: "/bin/p\(pid)"))
+        }
+        cache.update(with: sample, tick: 0)
+        XCTAssertEqual(cache.ancestry(of: 30, maxDepth: 5), [29, 28, 27, 26, 25])
+    }
+
+    // MARK: - ancestorRecords
+
+    func testAncestorRecordsWalksThroughKnownAncestorsWithImageAndCommand() {
+        var cache = ParentContextCache(retentionTicks: 3)
+        cache.update(with: [
+            raw(10, ppid: 1, image: "/sbin/launchd"),
+            raw(20, ppid: 10, image: "/bin/bash"),
+            raw(30, ppid: 20, image: "/usr/bin/curl"),
+        ], tick: 0)
+        let records = cache.ancestorRecords(of: 30)
+        XCTAssertEqual(records.map(\.pid), [20, 10])
+        XCTAssertEqual(records.map(\.image), ["/bin/bash", "/sbin/launchd"])
+        XCTAssertEqual(records.map(\.command), ["/bin/bash", "/sbin/launchd"])
+    }
+
+    func testAncestorRecordsAndAncestryShareIdenticalPidOrdering() {
+        // ancestry(of:) is now a pid-only projection of ancestorRecords —
+        // they must always agree on which pids are walked and in what order.
+        var cache = ParentContextCache(retentionTicks: 3)
+        cache.update(with: [
+            raw(40, ppid: 99, image: "/bin/bash"), // 99 has no entry of its own
+        ], tick: 0)
+        XCTAssertEqual(cache.ancestorRecords(of: 40).map(\.pid), cache.ancestry(of: 40))
+        XCTAssertEqual(cache.ancestry(of: 40), [99])
+    }
+
+    func testAncestorRecordsReportsEmptyImageAndCommandForUncachedPid() {
+        // pid 99 is known only as pid 40's ppid link — it was never itself
+        // sampled/cached, so its record carries the pid but empty
+        // image/command rather than being dropped from the chain.
+        var cache = ParentContextCache(retentionTicks: 3)
+        cache.update(with: [raw(40, ppid: 99, image: "/bin/bash")], tick: 0)
+        let records = cache.ancestorRecords(of: 40)
+        XCTAssertEqual(records.map(\.pid), [99])
+        XCTAssertEqual(records.first?.image, "")
+        XCTAssertEqual(records.first?.command, "")
+    }
+
+    func testAncestorRecordsOfUnknownPidIsEmpty() {
+        var cache = ParentContextCache(retentionTicks: 3)
+        cache.update(with: [raw(10, ppid: 1, image: "/bin/bash")], tick: 0)
+        XCTAssertEqual(cache.ancestorRecords(of: 999).count, 0)
+    }
+
+    func testAncestorRecordsRespectsMaxDepth() {
+        var cache = ParentContextCache(retentionTicks: 3)
+        var sample: [RawProcess] = []
+        for pid in Int32(2)...30 {
+            sample.append(raw(pid, ppid: pid - 1, image: "/bin/p\(pid)"))
+        }
+        cache.update(with: sample, tick: 0)
+        let records = cache.ancestorRecords(of: 30, maxDepth: 5)
+        XCTAssertEqual(records.map(\.pid), [29, 28, 27, 26, 25])
+        XCTAssertEqual(records.map(\.image), ["/bin/p29", "/bin/p28", "/bin/p27", "/bin/p26", "/bin/p25"])
+    }
+}
+
+final class SamplingHealthTrackerTests: XCTestCase {
+    func testStaysHealthyBelowThreshold() {
+        var tracker = SamplingHealthTracker(threshold: 3)
+        XCTAssertEqual(tracker.recordFailure(), .none)
+        XCTAssertFalse(tracker.isDegraded)
+        XCTAssertEqual(tracker.recordFailure(), .none)
+        XCTAssertFalse(tracker.isDegraded)
+    }
+
+    func testBecomesDegradedExactlyAtThreshold() {
+        var tracker = SamplingHealthTracker(threshold: 3)
+        _ = tracker.recordFailure()
+        _ = tracker.recordFailure()
+        XCTAssertEqual(tracker.recordFailure(), .becameDegraded)
+        XCTAssertTrue(tracker.isDegraded)
+    }
+
+    func testDoesNotReReportDegradedOnFurtherFailures() {
+        var tracker = SamplingHealthTracker(threshold: 3)
+        _ = tracker.recordFailure()
+        _ = tracker.recordFailure()
+        _ = tracker.recordFailure()
+        XCTAssertEqual(tracker.recordFailure(), .none, "already degraded — no repeat transition")
+        XCTAssertTrue(tracker.isDegraded)
+    }
+
+    func testRecoversAfterSuccess() {
+        var tracker = SamplingHealthTracker(threshold: 3)
+        _ = tracker.recordFailure()
+        _ = tracker.recordFailure()
+        _ = tracker.recordFailure()
+        XCTAssertTrue(tracker.isDegraded)
+        XCTAssertEqual(tracker.recordSuccess(), .recovered)
+        XCTAssertFalse(tracker.isDegraded)
+        XCTAssertEqual(tracker.consecutiveFailures, 0)
+    }
+
+    func testSuccessWithoutPriorDegradationReportsNone() {
+        var tracker = SamplingHealthTracker(threshold: 3)
+        _ = tracker.recordFailure()
+        XCTAssertEqual(tracker.recordSuccess(), .none)
+        XCTAssertFalse(tracker.isDegraded)
+    }
+}
diff --git a/Tests/ArgusTests/ProvenanceClassifierTests.swift b/Tests/ArgusTests/ProvenanceClassifierTests.swift
new file mode 100644
index 0000000..9131b72
--- /dev/null
+++ b/Tests/ArgusTests/ProvenanceClassifierTests.swift
@@ -0,0 +1,114 @@
+import XCTest
+@testable import Argus
+
+final class ProvenanceClassifierTests: XCTestCase {
+    func testUnrelatedAncestryYieldsNoTags() {
+        let tags = ProvenanceClassifier.classify(
+            ancestorImages: ["/bin/bash", "/sbin/launchd"],
+            ancestorCommandLines: ["/bin/bash -l", "/sbin/launchd"]
+        )
+        XCTAssertEqual(tags, [])
+    }
+
+    func testEmptyAncestryYieldsNoTags() {
+        XCTAssertEqual(ProvenanceClassifier.classify(ancestorImages: [], ancestorCommandLines: []), [])
+    }
+
+    func testClaudeMatchesByCommandLinePath() {
+        let tags = ProvenanceClassifier.classify(
+            ancestorImages: ["/usr/bin/node"],
+            ancestorCommandLines: ["node /Users/mark/.claude/local/claude.js"]
+        )
+        XCTAssertEqual(tags.map(\.label), ["claude"])
+        XCTAssertEqual(tags.first?.category, "AI agent")
+    }
+
+    func testClaudeMatchesByImageBasename() {
+        let tags = ProvenanceClassifier.classify(
+            ancestorImages: ["/usr/local/bin/claude"],
+            ancestorCommandLines: ["claude --resume"]
+        )
+        XCTAssertEqual(tags.map(\.label), ["claude"])
+    }
+
+    func testDockerMatchesCLIImage() {
+        let tags = ProvenanceClassifier.classify(
+            ancestorImages: ["/usr/local/bin/docker"],
+            ancestorCommandLines: ["docker run -it alpine sh"]
+        )
+        XCTAssertEqual(tags.map(\.label), ["docker"])
+        XCTAssertEqual(tags.first?.category, "Container tooling")
+    }
+
+    func testDockerMatchesComDockerImage() {
+        let tags = ProvenanceClassifier.classify(
+            ancestorImages: ["/Applications/Docker.app/Contents/MacOS/com.docker.backend"],
+            ancestorCommandLines: ["com.docker.backend"]
+        )
+        XCTAssertEqual(tags.map(\.label), ["docker"])
+    }
+
+    func testBrewMatchesByCommandLinePath() {
+        let tags = ProvenanceClassifier.classify(
+            ancestorImages: ["/usr/bin/ruby"],
+            ancestorCommandLines: ["/opt/Homebrew/bin/brew install curl"]
+        )
+        XCTAssertEqual(tags.map(\.label), ["brew"])
+        XCTAssertEqual(tags.first?.category, "Package manager")
+    }
+
+    func testBrewMatchesByImageBasename() {
+        let tags = ProvenanceClassifier.classify(
+            ancestorImages: ["/opt/homebrew/bin/brew"],
+            ancestorCommandLines: ["brew upgrade"]
+        )
+        XCTAssertEqual(tags.map(\.label), ["brew"])
+    }
+
+    func testTerminalSupervisorsMatch() {
+        XCTAssertEqual(
+            ProvenanceClassifier.classify(ancestorImages: ["/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal"], ancestorCommandLines: ["Terminal"]).map(\.label),
+            ["Terminal"]
+        )
+        XCTAssertEqual(
+            ProvenanceClassifier.classify(ancestorImages: ["/Applications/iTerm.app/Contents/MacOS/iTerm2"], ancestorCommandLines: ["iTerm2"]).map(\.label),
+            ["iTerm2"]
+        )
+        XCTAssertEqual(
+            ProvenanceClassifier.classify(ancestorImages: ["/opt/homebrew/bin/tmux"], ancestorCommandLines: ["tmux new-session"]).map(\.label),
+            ["tmux"]
+        )
+    }
+
+    func testIDESupervisorsMatch() {
+        XCTAssertEqual(
+            ProvenanceClassifier.classify(
+                ancestorImages: ["/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper (Plugin).app/Contents/MacOS/Code Helper (Plugin)"],
+                ancestorCommandLines: ["Code Helper (Plugin)"]
+            ).map(\.label),
+            ["Code"]
+        )
+        XCTAssertEqual(
+            ProvenanceClassifier.classify(ancestorImages: ["/Applications/Cursor.app/Contents/MacOS/Cursor"], ancestorCommandLines: ["Cursor"]).map(\.label),
+            ["Cursor"]
+        )
+    }
+
+    func testDeduplicatesRepeatedSupervisorByLabel() {
+        let tags = ProvenanceClassifier.classify(
+            ancestorImages: ["/usr/local/bin/claude", "/usr/local/bin/claude"],
+            ancestorCommandLines: ["claude --resume", "claude --resume"]
+        )
+        XCTAssertEqual(tags.map(\.label), ["claude"], "repeated ancestry match must not duplicate the tag")
+    }
+
+    func testNearestSupervisorReportedFirst() {
+        // Nearest ancestor (index 0) is tmux; further up is claude. Tag
+        // order must follow ancestry order, nearest first — not table order.
+        let tags = ProvenanceClassifier.classify(
+            ancestorImages: ["/opt/homebrew/bin/tmux", "/usr/local/bin/claude"],
+            ancestorCommandLines: ["tmux new-session", "claude --resume"]
+        )
+        XCTAssertEqual(tags.map(\.label), ["tmux", "claude"])
+    }
+}
diff --git a/Tests/ArgusTests/RuleStoreTests.swift b/Tests/ArgusTests/RuleStoreTests.swift
index 6d69195..7c46e5f 100644
--- a/Tests/ArgusTests/RuleStoreTests.swift
+++ b/Tests/ArgusTests/RuleStoreTests.swift
@@ -93,4 +93,213 @@ final class RuleStoreTests: XCTestCase {
         let mine = store.rules.first { $0.title == "My Custom Watch" }
         XCTAssertEqual(mine?.origin, .user)
     }
+
+    func testIncompatibleLogsourceRuleIsSkippedAndCounted() {
+        let (store, _, user, _) = makeStore()
+        XCTAssertEqual(store.skippedIncompatibleCount, 0, "the one bundled rule is macos/process_creation and should load cleanly")
+
+        let windowsRule = """
+        title: Windows Only Rule
+        id: 33333333-3333-3333-3333-333333333333
+        status: stable
+        author: Me
+        date: 2026-08-21
+        tags:
+            - attack.execution
+        logsource:
+            category: process_creation
+            product: windows
+        detection:
+            selection:
+                CommandLine|contains: 'powershell'
+            condition: selection
+        level: high
+        """
+        try? windowsRule.write(to: user.appendingPathComponent("windows.yml"), atomically: true, encoding: .utf8)
+        store.reload()
+
+        XCTAssertEqual(store.rules.count, 1, "the windows/process_creation rule should be skipped, not loaded")
+        XCTAssertFalse(store.rules.contains { $0.title == "Windows Only Rule" })
+        XCTAssertEqual(store.skippedIncompatibleCount, 1)
+    }
+
+    func testIncompatibleCategoryRuleIsSkippedAndCounted() {
+        let (store, _, user, _) = makeStore()
+
+        let networkRule = """
+        title: Network Connection Rule
+        id: 44444444-4444-4444-4444-444444444444
+        status: stable
+        author: Me
+        date: 2026-08-21
+        tags:
+            - attack.command-and-control
+        logsource:
+            category: network_connection
+            product: macos
+        detection:
+            selection:
+                DestinationPort: 4444
+            condition: selection
+        level: high
+        """
+        try? networkRule.write(to: user.appendingPathComponent("network.yml"), atomically: true, encoding: .utf8)
+        store.reload()
+
+        XCTAssertEqual(store.rules.count, 1, "a non-process_creation category should be skipped")
+        XCTAssertEqual(store.skippedIncompatibleCount, 1)
+    }
+
+    func testStoreWiredWithIntegrityGuardRecordsMACOnSave() {
+        let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+        let bundled = root.appendingPathComponent("bundled")
+        let user = root.appendingPathComponent("user")
+        let state = root.appendingPathComponent("rules-state.json")
+        try? FileManager.default.createDirectory(at: bundled.appendingPathComponent("custom"), withIntermediateDirectories: true)
+        try? FileManager.default.createDirectory(at: bundled.appendingPathComponent("imported"), withIntermediateDirectories: true)
+        try? FileManager.default.createDirectory(at: bundled.appendingPathComponent("imported-portable"), withIntermediateDirectories: true)
+
+        let fixedKeyGuard = IntegrityGuard(
+            keyProvider: FixedKeyProviderForTests(data: Data(repeating: 0x11, count: 32)),
+            sidecarURL: root.appendingPathComponent("integrity.json")
+        )
+
+        let sampleRule = """
+        title: Test Rule
+        id: 55555555-5555-5555-5555-555555555555
+        status: stable
+        description: A rule for testing.
+        author: Test
+        date: 2026-08-21
+        tags:
+            - attack.execution
+            - attack.t1059
+        logsource:
+            category: process_creation
+            product: macos
+        detection:
+            selection:
+                CommandLine|contains: 'dangerous-thing'
+            condition: selection
+        level: high
+        """
+        try? sampleRule.write(to: bundled.appendingPathComponent("custom/test.yml"), atomically: true, encoding: .utf8)
+
+        let store = RuleStore(bundledRulesDirectory: bundled, userRulesDirectory: user, stateFileURL: state, integrityGuard: fixedKeyGuard)
+        // Verification is async-on-request now (a Keychain prompt must never
+        // block init), so init leaves the verdict unset. No rules-state.json
+        // exists yet — nothing has been authenticated, nothing to verify.
+        XCTAssertNil(store.integrityVerdict)
+        XCTAssertEqual(fixedKeyGuard.verify(state), .unverifiable)
+        XCTAssertEqual(store.rules.count, 1)
+
+        store.toggle(store.rules[0])
+        XCTAssertEqual(fixedKeyGuard.verify(state), .verified, "saveDisabledState should have recorded a MAC via the injected guard")
+    }
+    // MARK: - Supersession
+
+    private static let supersededImportedID = "f5141b6d-9f42-41c6-a7bf-2a780678b29b"
+
+    /// Bundled/user directories, not yet turned into a `RuleStore`, whose
+    /// "imported" folder carries a stand-in for the real SigmaHQ xattr rule
+    /// (same `id` as the real one — content otherwise irrelevant) so
+    /// `RuleStore.applySupersessions()`'s loaded-rule-presence gate lets the
+    /// supersession fire, mirroring what the real bundle looks like.
+    private func makeDirsWithImportedGatekeeperRule() -> (bundled: URL, user: URL, state: URL) {
+        let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+        let bundled = root.appendingPathComponent("bundled")
+        let user = root.appendingPathComponent("user")
+        let state = root.appendingPathComponent("rules-state.json")
+        try? FileManager.default.createDirectory(at: bundled.appendingPathComponent("custom"), withIntermediateDirectories: true)
+        try? FileManager.default.createDirectory(at: bundled.appendingPathComponent("imported"), withIntermediateDirectories: true)
+        try? FileManager.default.createDirectory(at: bundled.appendingPathComponent("imported-portable"), withIntermediateDirectories: true)
+
+        let importedRule = """
+        title: Gatekeeper Bypass via Xattr
+        id: \(Self.supersededImportedID)
+        status: test
+        description: Detects macOS Gatekeeper bypass via xattr utility
+        author: Test
+        date: 2026-08-21
+        tags:
+            - attack.defense-impairment
+            - attack.t1553.001
+        logsource:
+            category: process_creation
+            product: macos
+        detection:
+            selection:
+                Image|endswith: '/xattr'
+                CommandLine|contains|all:
+                    - '-d'
+                    - 'com.apple.quarantine'
+            condition: selection
+        level: low
+        """
+        try? importedRule.write(to: bundled.appendingPathComponent("imported/xattr.yml"), atomically: true, encoding: .utf8)
+        return (bundled, user, state)
+    }
+
+    func testSupersessionDisablesImportedRuleOnFirstLoadAndRecordsApplied() {
+        let (bundled, user, state) = makeDirsWithImportedGatekeeperRule()
+        let store = RuleStore(bundledRulesDirectory: bundled, userRulesDirectory: user, stateFileURL: state)
+
+        XCTAssertTrue(store.disabledRuleIDs.contains(Self.supersededImportedID),
+                       "the superseded imported rule should be auto-disabled on first load")
+
+        guard let data = try? Data(contentsOf: state),
+              let decoded = try? JSONDecoder().decode(RuleDisabledStateForTests.self, from: data) else {
+            XCTFail("expected a persisted rules-state.json after supersession ran")
+            return
+        }
+        XCTAssertTrue(decoded.disabled.contains(Self.supersededImportedID))
+        XCTAssertTrue(decoded.supersessionsApplied.contains(Self.supersededImportedID),
+                       "the supersession should be recorded as applied so it isn't redone if the user re-enables the rule")
+    }
+
+    func testReenabledSupersededRuleStaysEnabledAcrossReload() {
+        let (bundled, user, state) = makeDirsWithImportedGatekeeperRule()
+        // Simulate a prior launch where supersession already ran, and the
+        // user then deliberately re-enabled the imported rule (removing it
+        // from `disabled` without clearing the `supersessionsApplied` marker).
+        let priorState = RuleDisabledStateForTests(disabled: [], supersessionsApplied: [Self.supersededImportedID])
+        if let encoded = try? JSONEncoder().encode(priorState) {
+            try? encoded.write(to: state)
+        }
+
+        let store = RuleStore(bundledRulesDirectory: bundled, userRulesDirectory: user, stateFileURL: state)
+
+        XCTAssertFalse(store.disabledRuleIDs.contains(Self.supersededImportedID),
+                        "a user-re-enabled superseded rule should not be disabled again on reload")
+    }
+
+    func testLegacyBareSetStateFileStillDecodesAndSupersessionAppliesOnTop() {
+        let (bundled, user, state) = makeDirsWithImportedGatekeeperRule()
+        // Pre-supersession on-disk format: a bare JSON array of disabled IDs.
+        let legacyDisabledID = "some-other-rule-id"
+        if let encoded = try? JSONEncoder().encode([legacyDisabledID]) {
+            try? encoded.write(to: state)
+        }
+
+        let store = RuleStore(bundledRulesDirectory: bundled, userRulesDirectory: user, stateFileURL: state)
+
+        XCTAssertTrue(store.disabledRuleIDs.contains(legacyDisabledID),
+                       "existing disabled ids from a legacy bare-Set state file should be preserved")
+        XCTAssertTrue(store.disabledRuleIDs.contains(Self.supersededImportedID),
+                       "supersession should still apply on top of a migrated legacy state file")
+    }
+}
+
+/// Local fixed-key provider so this test doesn't depend on
+/// `IntegrityGuardTests`'s private helper across files.
+private struct FixedKeyProviderForTests: IntegrityKeyProvider {
+    let data: Data?
+    func key() -> Data? { data }
+}
+
+/// Mirrors `RuleStore`'s private on-disk state shape so these tests can
+/// decode/encode `rules-state.json` without exposing that type.
+private struct RuleDisabledStateForTests: Codable {
+    var disabled: [String]
+    var supersessionsApplied: [String]
 }
diff --git a/Tests/ArgusTests/SigmaEngineTests.swift b/Tests/ArgusTests/SigmaEngineTests.swift
index 276e6b0..72aa2c6 100644
--- a/Tests/ArgusTests/SigmaEngineTests.swift
+++ b/Tests/ArgusTests/SigmaEngineTests.swift
@@ -109,6 +109,80 @@ final class SigmaEngineTests: XCTestCase {
     level: medium
     """
 
+    private let nOfSelections = """
+    title: Test N Of Quantifier
+    id: 55555555-5555-5555-5555-555555555555
+    status: test
+    logsource:
+        category: process_creation
+        product: macos
+    detection:
+        selection_a:
+            CommandLine|contains: 'marker-a'
+        selection_b:
+            CommandLine|contains: 'marker-b'
+        selection_c:
+            CommandLine|contains: 'marker-c'
+        condition: 2 of selection_*
+    level: medium
+    """
+
+    private let base64Marker = """
+    title: Test Base64 Modifier
+    id: 66666666-6666-6666-6666-666666666666
+    status: test
+    logsource:
+        category: process_creation
+        product: macos
+    detection:
+        selection:
+            CommandLine|base64|contains: 'malicious-payload'
+        condition: selection
+    level: medium
+    """
+
+    private let base64OffsetMarker = """
+    title: Test Base64Offset Modifier
+    id: 77777777-7777-7777-7777-777777777777
+    status: test
+    logsource:
+        category: process_creation
+        product: macos
+    detection:
+        selection:
+            CommandLine|base64offset|contains: 'malicious-payload'
+        condition: selection
+    level: medium
+    """
+
+    private let casedMarker = """
+    title: Test Cased Modifier
+    id: 88888888-8888-8888-8888-888888888888
+    status: test
+    logsource:
+        category: process_creation
+        product: macos
+    detection:
+        selection:
+            CommandLine|contains|cased: 'MaliciousCase'
+        condition: selection
+    level: medium
+    """
+
+    private let keywordMarker = """
+    title: Test Keyword All Fields
+    id: 99999999-9999-9999-9999-999999999999
+    status: test
+    logsource:
+        category: process_creation
+        product: macos
+    detection:
+        keywords:
+            - 'suspicious-marker'
+        condition: keywords
+    level: medium
+    """
+
     private func parseFirst(_ yaml: String, source: String = "test.yml") -> SigmaRule? {
         let docs = YAMLParser.parseDocuments(yaml)
         guard let first = docs.first else { return nil }
@@ -179,6 +253,106 @@ final class SigmaEngineTests: XCTestCase {
         XCTAssertFalse(SigmaMatcher.matches(rule, record: benign))
     }
 
+    // MARK: - `N of` quantifier
+
+    func testNOfQuantifierRequiresAtLeastNMatchingSelections() {
+        guard let rule = parseFirst(nOfSelections) else { return XCTFail("failed to parse") }
+
+        let onlyOne = ["CommandLine": "run marker-a only"]
+        XCTAssertFalse(SigmaMatcher.matches(rule, record: onlyOne), "1 of 3 selections true should not satisfy '2 of'")
+
+        let twoOfThree = ["CommandLine": "run marker-a and marker-b"]
+        XCTAssertTrue(SigmaMatcher.matches(rule, record: twoOfThree))
+
+        let allThree = ["CommandLine": "run marker-a marker-b marker-c"]
+        XCTAssertTrue(SigmaMatcher.matches(rule, record: allThree))
+    }
+
+    func testOneOfQuantifierStillBehavesLikeBefore() {
+        // "1 of x*" is the N=1 case of the same code path — verify it wasn't
+        // regressed by generalizing to N.
+        guard let node = SigmaConditionParser.parse("1 of selection_*") else { return XCTFail("failed to parse") }
+        XCTAssertTrue(SigmaConditionParser.evaluate(node, results: ["selection_a": false, "selection_b": true], allNames: ["selection_a", "selection_b"]))
+        XCTAssertFalse(SigmaConditionParser.evaluate(node, results: ["selection_a": false, "selection_b": false], allNames: ["selection_a", "selection_b"]))
+    }
+
+    // MARK: - base64 / base64offset modifiers
+
+    func testBase64ModifierMatchesEncodedSubstringCaseSensitively() {
+        guard let rule = parseFirst(base64Marker) else { return XCTFail("failed to parse") }
+        let encoded = Data("malicious-payload".utf8).base64EncodedString()
+
+        let matching = ["CommandLine": "echo \(encoded) | base64 -d | sh"]
+        XCTAssertTrue(SigmaMatcher.matches(rule, record: matching))
+
+        let wrongCase = ["CommandLine": "echo \(encoded.uppercased()) | base64 -d | sh"]
+        XCTAssertFalse(SigmaMatcher.matches(rule, record: wrongCase), "base64 matching is case-sensitive — must not match on case difference alone")
+
+        let unrelated = ["CommandLine": "echo aGVsbG8gd29ybGQ= | base64 -d"]
+        XCTAssertFalse(SigmaMatcher.matches(rule, record: unrelated))
+    }
+
+    func testBase64OffsetModifierMatchesRegardlessOfByteAlignment() {
+        guard let rule = parseFirst(base64OffsetMarker) else { return XCTFail("failed to parse") }
+        let value = "malicious-payload"
+
+        // Embed the value at every possible byte alignment (mod 3) within a
+        // larger encoded stream and confirm one of the three precomputed
+        // offset encodings is found regardless of where it lands. The suffix
+        // matters: it forces the bytes after the value to differ from plain
+        // padding, which is exactly the case the trailing-character trim
+        // exists for — without it, an over-long encoding still matches.
+        for prefixLength in 0...5 {
+            let prefix = String(repeating: "X", count: prefixLength)
+            let fullyEncoded = Data((prefix + value + "; rm -rf /tmp/x").utf8).base64EncodedString()
+            let record = ["CommandLine": fullyEncoded]
+            XCTAssertTrue(SigmaMatcher.matches(rule, record: record), "prefix length \(prefixLength) (offset \(prefixLength % 3)) should still match")
+        }
+
+        let noPayload = ["CommandLine": Data("totally-unrelated-string".utf8).base64EncodedString()]
+        XCTAssertFalse(SigmaMatcher.matches(rule, record: noPayload))
+    }
+
+    func testBase64OffsetEncodingsMatchReferenceVectors() {
+        // Computed with the reference implementation
+        // (base64.b64encode(b' '*i + val)[start[i]:end[(len(val)+i)%3]]).
+        XCTAssertEqual(SigmaRule.base64OffsetEncodings(of: "/bin/bash"),
+                       ["L2Jpbi9iYXNo", "9iaW4vYmFza", "vYmluL2Jhc2"])
+        XCTAssertEqual(SigmaRule.base64OffsetEncodings(of: "bash -i"),
+                       ["YmFzaCAta", "Jhc2ggLW", "iYXNoIC1p"])
+        XCTAssertEqual(SigmaRule.base64OffsetEncodings(of: "A"), ["Q", "", "B"])
+    }
+
+    // MARK: - `cased` modifier
+
+    func testCasedModifierRequiresExactCase() {
+        guard let rule = parseFirst(casedMarker) else { return XCTFail("failed to parse") }
+
+        let exactCase = ["CommandLine": "run --flag MaliciousCase now"]
+        XCTAssertTrue(SigmaMatcher.matches(rule, record: exactCase))
+
+        let differentCase = ["CommandLine": "run --flag maliciouscase now"]
+        XCTAssertFalse(SigmaMatcher.matches(rule, record: differentCase), "cased modifier must not fall back to lowercased comparison")
+    }
+
+    // MARK: - keyword selections match all fields
+
+    func testKeywordSelectionMatchesAnyFieldNotJustCommandLine() {
+        guard let rule = parseFirst(keywordMarker) else { return XCTFail("failed to parse") }
+
+        let inCommandLine = ["CommandLine": "run suspicious-marker now", "Image": "/usr/bin/run"]
+        XCTAssertTrue(SigmaMatcher.matches(rule, record: inCommandLine))
+
+        let inImageOnly = ["CommandLine": "run now", "Image": "/usr/bin/suspicious-marker"]
+        XCTAssertTrue(SigmaMatcher.matches(rule, record: inImageOnly), "keyword selections must search every field, not just CommandLine")
+
+        let inParentImageOnly = ["CommandLine": "run now", "Image": "/usr/bin/run", "ParentImage": "/bin/suspicious-marker"]
+        XCTAssertTrue(SigmaMatcher.matches(rule, record: inParentImageOnly))
+
+        let nowhere = ["CommandLine": "run now", "Image": "/usr/bin/run"]
+        XCTAssertFalse(SigmaMatcher.matches(rule, record: nowhere))
+    }
+
     func testMultiDocumentFileParsesBothRules() {
         let combined = netcatReverseShell + "\n---\n" + jxaInMemory
         let docs = YAMLParser.parseDocuments(combined)
diff --git a/scripts/build_app.sh b/scripts/build_app.sh
index bae8f4c..0b3a115 100755
--- a/scripts/build_app.sh
+++ b/scripts/build_app.sh
@@ -36,8 +36,28 @@ sips -z 512 512   "$SRC" --out "$ICONSET/icon_512x512.png"    >/dev/null
 cp "$SRC" "$ICONSET/icon_512x512@2x.png"
 iconutil -c icns "$ICONSET" -o "$APP/Contents/Resources/AppIcon.icns"
 
-echo "==> ad-hoc code signing"
-codesign --force --deep -s - "$APP"
+# Sign with a stable identity when one is available. An ad-hoc signature
+# (-s -) changes on every rebuild, which resets the app's identity as far as
+# the Keychain is concerned — macOS then re-prompts for access to the
+# IntegrityGuard key after each rebuild. A real signing identity (an Apple
+# Development certificate, or any codesigning cert) keeps the designated
+# requirement stable across rebuilds, so the Keychain ACL keeps matching and
+# the prompt never comes back. Resolution order:
+#   1. $ARGUS_SIGN_IDENTITY, if set (name or SHA-1 of a keychain identity)
+#   2. the first valid codesigning identity in the keychain
+#   3. ad-hoc (-s -) — the CI runner has no identities and lands here
+IDENTITY="${ARGUS_SIGN_IDENTITY:-}"
+if [ -z "$IDENTITY" ]; then
+  IDENTITY=$(security find-identity -v -p codesigning 2>/dev/null \
+    | awk -F'"' '/^ *[0-9]+\)/ { print $2; exit }')
+fi
+if [ -n "$IDENTITY" ]; then
+  echo "==> code signing as: $IDENTITY"
+  codesign --force --deep -s "$IDENTITY" "$APP"
+else
+  echo "==> ad-hoc code signing (no signing identity found)"
+  codesign --force --deep -s - "$APP"
+fi
 
 echo "==> done: $APP"
 echo "    open $APP"
diff --git a/scripts/sync_sigma_rules.sh b/scripts/sync_sigma_rules.sh
new file mode 100755
index 0000000..096db38
--- /dev/null
+++ b/scripts/sync_sigma_rules.sh
@@ -0,0 +1,66 @@
+#!/bin/bash
+# Syncs bundled SigmaHQ rules from upstream. This script is manually invoked by
+# developers and is never called by the app or build process.
+set -euo pipefail
+
+# Check that we're in the repo root
+if [[ ! -d "Resources/Rules/imported" ]]; then
+    echo "Error: Resources/Rules/imported not found. Run this script from the repo root." >&2
+    exit 1
+fi
+
+# Create and trap cleanup of temp directory
+TMPDIR=$(mktemp -d)
+trap "rm -rf '$TMPDIR'" EXIT
+
+echo "==> Cloning SigmaHQ/sigma (shallow, depth 1)..."
+git clone --depth 1 https://github.com/SigmaHQ/sigma "$TMPDIR/sigma"
+
+updated=0
+unchanged=0
+missing_upstream=0
+
+echo "==> Syncing imported (macos/process_creation)..."
+for file in Resources/Rules/imported/*.yml; do
+    filename=$(basename "$file")
+    upstream_file="$TMPDIR/sigma/rules/macos/process_creation/$filename"
+
+    if [[ -f "$upstream_file" ]]; then
+        if ! cmp -s "$file" "$upstream_file"; then
+            cp "$upstream_file" "$file"
+            ((updated++))
+        else
+            ((unchanged++))
+        fi
+    else
+        echo "Warning: $filename no longer exists upstream (not removed locally)" >&2
+        ((missing_upstream++))
+    fi
+done
+
+echo "==> Syncing imported-portable (linux/process_creation)..."
+for file in Resources/Rules/imported-portable/*.yml; do
+    filename=$(basename "$file")
+    upstream_file="$TMPDIR/sigma/rules/linux/process_creation/$filename"
+
+    if [[ -f "$upstream_file" ]]; then
+        if ! cmp -s "$file" "$upstream_file"; then
+            cp "$upstream_file" "$file"
+            ((updated++))
+        else
+            ((unchanged++))
+        fi
+    else
+        echo "Warning: $filename no longer exists upstream (not removed locally)" >&2
+        ((missing_upstream++))
+    fi
+done
+
+echo ""
+echo "==> Summary"
+git diff --stat Resources/Rules
+echo ""
+echo "Updated: $updated, Unchanged: $unchanged, Missing upstream: $missing_upstream"
+echo ""
+echo "Note: BundledRulesTests asserts rule count and IDs."
+echo "Run 'swift test' to verify bundled rules."