Sentry Mode

First conversation with a new owner. Sets up the exposure inventory, the app watch list, and the incident-watch and app-watch routines.

Use when the user asks "am I affected", "check my server / site / repo / project", pastes a CVE, advisory, or security headline, or a watch routine finds an Act-now item. Read-only check of the user's macOS or Linux machines, repos, servers and sites; gives a verdict, evidence, and the exact next step.

Use this to watch X and official sources for patches, active attacks, and expert advice about the week's biggest security story (incident part) and the user's top 20 apps (apps part), pinging only for items that affect the user's own projects or apps.

Every 3 hours while a security story is live, checks official sources and pings only when something hits the user's projects or apps; ends itself after 7 days or 2 quiet days.

Each morning around 9, checks the user's top apps for attacks and patches and pings only when one affects them.