OBSERVE
Read the health signals, events, and changes macOS already exposes.
HOW WARDEN WORKS / METHOD
03 / METHOD / HOW WARDEN WORKS
Once installed, Warden records the health signals macOS already exposes and learns how this Mac normally behaves. It does not assume that one fixed threshold fits every machine.

01 / 06 / FROM SIGNAL TO RESULT
Read the health signals, events, and changes macOS already exposes.
Measure the condition against what Warden has learned is normal for this Mac.
Gather enough evidence to explain the likely cause instead of reacting to one noisy reading.
Apply the hard guardrails and decide whether Warden may act, must ask, or must refuse.
Use a known repair tied to the diagnosed condition, ask first, or leave the machine unchanged.
Measure the same signal again, record the result, and retain recovery information when anything moved.
01 / 08 / INSIDE WARDEN
Each stage has one job. Warden cannot skip evidence, permission, or verification.
Reads health, state, events, and change over time.
LOCAL / BOUNDEDBuilds a picture of what is normal for this Mac and recognises recurrence against it.
LOCAL / BOUNDEDTurns collected evidence into a plain-language diagnosis.
LOCAL / BOUNDEDKeeps a defined set of repairs for known kinds of work.
LOCAL / BOUNDEDChecks evidence, scope, reversibility, and permission before action.
LOCAL / BOUNDEDApplies a permitted repair, asks first, or refuses to make a change.
LOCAL / BOUNDEDOptional read-only web research is switchable and every query is recorded with its reason.
LOCAL / BOUNDEDChecks the machine again, records the outcome, and retains recovery information.
LOCAL / BOUNDEDRECENT RECORDS FROM A REAL MAC