soul-guardian

The code is intended as a local workspace integrity monitor and does not show indicators of malware. It has a fatal syntax error in the monitoring-instructions function and a meaningful path traversal risk because policy-controlled paths are not constrained to WORKSPACE_ROOT; this should be fixed before use with untrusted policy files. Parent-directory symlink handling should also be hardened.