Greyline: Warden

The Greyline suite covers five distinct threat surfaces: deployment configuration, endpoint monitoring, installation integrity, active counter-intelligence, and runtime defense. Each skill does its domain well. What they don't do is talk to each other. Greyline: Warden coordinates them, scheduling audits, tracking findings across sessions, integrating honeypot signal, and presenting a unified program status at the start of every security session.

The Warden is a security director persona. It does not investigate individual findings in real time, that is Greyline: Sentinel's role. The Warden runs the program: what is covered, what is open, what is overdue, what risk has been accepted and when it needs re-evaluation. Every finding logged by any Greyline skill lands in WARDEN_LOG.md and stays there until it is resolved or explicitly accepted as known risk. Nothing disappears.

Operators who have installed multiple Greyline skills will find that the Warden dramatically reduces the overhead of maintaining a security posture across sessions. Rather than manually remembering to run audits, track which findings were addressed, and maintain awareness of program gaps, the Warden does this work automatically. Program status is a two-sentence summary away.