RFC: Runtime security telemetry below the agent process

## Primary area

** CDK / infrastructure

## Related issue or feature request

_Complements roadmap **Behavioral circuit breaker**, **Workload-anchored credential binding**, and **Immutable audit export**._

## Summary

Explore integrating **host-level runtime telemetry** (syscall/file/network events from outside the agent process) into ABCA's audit trail, so operators can corroborate or contradict agent-reported actions during incidents. Cedar and application hooks remain; this adds a physics-layer signal.

## Use case and motivation

Application-level guardrails can be reasoned around when instructions and tools coexist in the same trust domain. Editable JSON allowlists are trivially tampered with; **kernel-visible truth** (syscall/file/network) corroborates agent-reported progress and supports adaptive containment (e.g. credential exfiltration patterns). Security teams want tamper-evident records of what the sandbox actually did—especially for unattended background tasks—without relying solely on LLM narrated progress events.

## Proposal

### Architecture sketch

1. **Collector** in MicroVM guest or sidecar streams normalized events (file open, exec, connect) to CloudWatch Logs / S3 with `task_id` dimension.
2. **Correlator** Lambda joins runtime events with `TaskEvents` on `task_id` + time window for operator UI / `bgagent trace`.
3. **Policy feedback (optional later):** high-risk syscall patterns trip **Behavioral circuit breaker** even if Cedar allowed the tool call.

### Deployment stance

- Phase 0: design doc + spike on AgentCore Runtime observability hooks available today.
- Phase 1: opt-in Blueprint `runtime_telemetry: true` for pilots.
- No default-on until performance and PII review complete.

## Out of scope

- Shipping a specific third-party agent product integration in core repo.
- Replacing Cedar decisions with kernel rules in v1.
- Windows/macOS dev environments (compute target is Linux MicroVM only).

## Potential challenges

- AgentCore abstraction may limit BPF/eBPF access; may require alternative compute strategy for full fidelity.
- Volume and cost of raw syscall logs.
- PII redaction in paths and env vars.

## Dependencies and integrations

- `COMPUTE.md`, `SECURITY.md`, `OBSERVABILITY.md`
- Operator dashboard / `bgagent trace download`

## Alternative solutions

- **Stronger Cedar only** — necessary but insufficient when bash and subprocess paths can bypass declared tool calls.
- **Post-task filesystem diff only** — lighter weight; misses network exfiltration.

---

**Note:** Non-triaged RFCs may not get timely review. PRs on non-triaged issues might not be accepted.

* RFC PR:
* Approved by:
* Reviewed by:

Start by reading COMPUTE.md, SECURITY.md, and OBSERVABILITY.md, then inspect the AgentCore Runtime observability hooks referenced in the proposal. Determine whether a design document and feasibility spike can capture host-level telemetry, correlation, deployment, cost, and PII constraints. Done means a reviewed Phase 0 design and spike, not a production integration.

Written by the indexing model from the issue text.