Goodman: package-level runtime drift

The description states that Goodman is an eBPF sensor that:

• Watches Node/Python processes using CO-RE eBPF (specifically open, openat, connect, execve syscalls, with optional LSM block)
• Resolves user stack traces through V8 or CPython perf maps and /proc/<pid>/maps
• Maps the deepest node_modules/ or site-packages/ frame to a real version from package.json or dist-info
• Fingerprints behavior per (service, package, version)
• Compares live behavior against learned baselines
• Alerts via REST + SSE, Prometheus metrics, and an embedded dashboard

It also includes:

• A Go-based user-space component for loading/attaching eBPF programs, attribution logic, fingerprinting/diffing, API serving, and Helm/Docker deployment
• Support for integration with OpenClaw (Node skills) via package-level attribution
• Use of Codex (GPT-5.6) during development to assist in struct layout, rule behavior, and demo scripting

Inference The product is a kernel-level runtime monitoring tool that focuses on supply-chain security, particularly for environments with many dependencies.

The author states:

• The goal is to answer the question: “Which package@version did this syscall?” — not just “a Node process read your secrets.”
• It’s positioned as a kernel-level alternative to SCA scanners that only inspect lockfiles.
• The product is described as a “package-level runtime drift” detector, with an emphasis on baseline learning and alerting on drift.
• There is a stated OpenClaw integration angle, where the tool could attribute syscalls to specific skills in that system.

Inference The positioning has evolved from a hackathon prototype into a security product concept focused on supply-chain attack visibility, with potential for broader adoption in agent-based systems like OpenClaw.

The description does not state:

• Who the target customer is
• What industry or vertical they operate in
• Whether there are any existing customers or pilot programs

Inference Based on the architecture and use case, it seems likely that the target customer would be security teams, DevOps engineers, or platform teams managing environments with high dependency counts (e.g., Node.js/Python microservices in Kubernetes), especially those concerned with supply-chain attacks.

The description does not state:

• Any pricing model
• Revenue streams
• Monetization strategy
• Whether the tool is open-source or commercial

Inference There is no evidence of a business model or pricing structure. The project appears to be a prototype, possibly with an intent to commercialize, but no indication of how it would be monetized.

The description states:

• Built using CO-RE eBPF in C
• Go-based user-space components
• Uses V8/CPython perf maps for stack resolution
• Integrates with Kubernetes via Helm and Docker
• Supports Prometheus metrics, REST API, SSE, embedded React dashboard
• Uses SQLite and PostgreSQL for storage
• Employs strict struct layout contracts to avoid misattribution
• Uses Codex (GPT-5.6) for scaffolding and code consistency

Inference The technical stack is well-defined, with a focus on low-level kernel interaction, performance, and accuracy in attribution. The use of eBPF, perf maps, and structured layout tests suggests a highly technical and performance-sensitive architecture.

The description does not state:

• Any revenue
• Customer base or adoption metrics
• Product usage data
• Any production deployments or pilots

It does mention:

• A demo path (make demo, make smoke, make replay)
• Replay corpus of real incidents (e.g., event-stream, eslint-scope)
• End-to-end path that attributes to package@version
• API designed for SIEMs / agents without UI

Inference The product is in a pre-production or prototype stage, with no evidence of traction or customer adoption. It has been tested in demo environments and includes replayable attack scenarios, but lacks real-world usage data.

The description does not state:

• Any direct competitors
• Market positioning relative to existing tools
• Competitive advantages or differentiators

But no specific competitor names or market positioning are mentioned.

• No evidence of real-world usage or adoption — the project is described as a hackathon submission with no customer or revenue data.
• High technical complexity and reliance on eBPF, perf maps, and stack resolution — may be difficult to deploy or maintain in production environments.
• Use of GPT-5.6 during development — while helpful for scaffolding, it raises questions about whether the core logic is fully vetted or maintained by humans.
• No mention of scalability or performance benchmarks — especially in high-throughput environments.
• OpenClaw integration is described as a future demo, not a current feature.

1. What is the actual deployment experience like for users beyond the demo?
2. How does the tool handle edge cases in containerized or complex environments (e.g., mount namespaces, relative paths)?
3. Are there any known performance impacts on systems running Goodman?
4. Is there a plan to support more runtime environments beyond Node.js and Python?
5. What is the current roadmap for monetization or product development?
6. How is the attribution accuracy validated in practice?
7. Has the tool been tested against real-world supply-chain attacks, or only simulated ones?