Vouch Request: [chipsolverzetra]

[chipsolverzetra]

What do you want to work on?

Ex-Googler, founder of Zetra — I'm building a behavioral security layer that sits on top of OpenShell. Saw PR #489 go up yesterday and it's exactly the event surface I need. My plan is to consume the OCSF stream, run DFS-based graph traversal across action sequences, and emit DetectionFindingEvent [2004] when patterns match known attack sequences.
I want to add a zetra-behavioral-scan skill to .agents/skills/ so OpenShell users can invoke behavioral analysis natively. Left a comment on #489 today about the evidence field — whether it supports arrays of contributing events for sequence-triggered findings.
Background in ML and cybersecurity — UofT, NYU Tandon MSc in Cybersecurity. The core graph methodology is patent-pending. I can explain every line I submit. 11 years of data center infrastructure experience across Deloitte, Accenture and Google. https://www.linkedin.com/in/tasneemararea-19101/

Why this change?

OpenShell handles infrastructure-level enforcement really well — filesystem, network, process boundaries. But there's nothing that looks at what an agent is deciding across a session. CrowdStrike called this out as "intent-aware controls" at GTC this week and said they're working on it. TrendAI flagged agent decision logic as unaddressed in their OpenShell blog. I already built the methodology for this — it's what Zetra does. Adding it as a skill means OpenShell users get behavioral analysis without needing to stand up a separate tool. Zetra came from my master's thesis research on agentic AI behavior and I'm developing the tech through my masters thesis at NYU Tandon and NYU Entrepreneurship Institute.

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md

[johntmyers]

Are you planning to incorporate this directly into OpenShell? What you describe sounds interesting but my initial reaction is that this should be a separate piece of technology that can consume logs and do the analysis.

[chipsolverzetra]

Completely agree — Zetra should be a separate piece of technology, not incorporated into OpenShell. That's exactly the architecture I described on PR #489: OpenShell is the enforcement plane, Zetra is the detection plane, the OCSF stream is the interface between them.
The skill I want to add to .agents/skills/ is just a thin wrapper — it teaches agents how to invoke Zetra for a behavioral scan, the same way generate-sandbox-policy teaches agents how to generate policies. Zetra itself lives in its own repo (github.com/chipsolverzetra/zetra-openshell) and runs as a separate process.
So to be concrete: the PR I want to submit is just a markdown skill file, not any Zetra code inside OpenShell.