01 / 04
The Regulatory Heatmap
Real-time triggers aligned to FedRAMP, STIG, and HIPAA controls: accreditation signals your counsel and authorizing official can cite without re-parsing raw telemetry.
BOARDROOM ARTIFACT · CLASS V[REQUEST_LIVE_LEDGER_ACCESS]
The Truth, Exported on Demand.
One command. One unforgeable PDF. Stop digging through logs and start handing auditors the proof they need.
GATED EXPORT · MAILJET RELAYAUTH REQUIRED
[STATUS]: READY TO EXPORT TRANSPARENCY_REPORT_SAMPLE.PDF
KERNEL LEDGERarca-sentry reportCLASS V ARTIFACT
Mission
Enforce your policy at the NVIDIA driver boundary. Seal every outcome with a signed receipt the regulator or accrediting official can read. One operator persona governs the whole loop — host-native, air-gapped, no third party in the trust path.
Evidence is the ultimate security.
ANATOMY · arca-sentry report
From raw telemetry to boardroom artifact.
Four pillars ship inside every Executive Artifact: regulation, safety economics, waste, and forensic depth, in one signed export.
02 / 04
Governance Effectiveness
A Sovereign Safety Score indexed to policy decisions made at the ioctl boundary — allow, alert, and block outcomes drawn from kernel-grade evidence, not self-attested application logs.
03 / 04
The Waste Audit
A financial ledger that converts reclaimed VRAM hours and reclaimed zombie GPU-hours into capital your CFO can defend line-by-line.
04 / 04
Forensic Intelligence
Kernel-level breadcrumbs showing exactly where leaks were stopped: thread, syscall path, and gate verdict in one chain.
TECHNICAL PROVENANCE
Unforgeable by design.
Because Arca sits below userspace at the kernel boundary, the transparency ledger cannot be rewritten by the applications it observes. Tamper the workload; you still cannot tamper the observer path that sealed the record.
Hardware telemetry, ioctl and CUDA hooks, and gate decisions are committed to a host-local chain your auditors can replay. The certificate is a projection of that chain, not a prettified log file.
SOVEREIGN STACK · OBSERVER ISOLATION
SCOPE & LIMITS · WHAT WE OBSERVE, WHAT WE DON’T
Host-observable, not omniscient.
Arca builds a high-resolution model of GPU behavior from four host signals. We do not claim to see the silicon. The honest scope is what makes the ledger credible.
// THE FOUR SIGNALS · OBSERVED
- ioctl(2) tracepoint against
/dev/nvidia*— the driver-bound request stream, FD-filtered in the kernel. - libcuda uprobes on
cudaLaunchKernelandcudaMalloc— host-side call sites with kernel symbol resolution. - NVML device state— what the driver reports about VRAM allocation and per-PID GPU attachment.
- /proc process metadata— cmdline, comm, starttime; the correlation and PID-recycle guard anchor.
// PUBLISHED LIMITS · NOT OBSERVED
- SM-level execution traces — requires CUPTI / Nsight Systems; orthogonal to this product.
- Hardware command-queue state — the driver batches and reorders below the syscall layer.
- L1 / L2 / memory-controller telemetry — requires GPU-vendor instrumentation (DCGM).
- Cross-host correlation beyond Nexus ingest — we do not pull NVLink fabric telemetry.
- GPU-side firmware visibility.
The moat is the correlation, not the omniscience. No observability tool today fuses these four signals into one continuously-attributed record, with persona policy on top, and persists it to an audit ledger. We publish the limits because the technical reviewer who asks “can you actually see what’s running on the GPU?” is asking the right question — and the answer is sharper than a vague yes.
SCOPE STATEMENTPRINCIPLES.md · published in arca-sentryversioned
USE CASE · REGULATOR DEMAND
The 2 a.m. auditor call.
When a regulator demands proof of PII protection, don't panic. Run the binary. Export the truth. Arca provides the sovereign ledger that stands up to the highest scrutiny: kernel hashes, gate verdicts, and blocked egress in one artifact your general counsel can hand across the table.
FLEET-LEVEL TRANSPARENCY · ARCA NEXUS
One ledger per host. One signed roll-up per fleet.
The Sentry seals its append-only ledger on every host. Arca Nexus aggregates every Sentry's ledger into a single, byte-stable artifact your auditor can replay for the whole fleet, instead of stitching per-box logs.
The roll-up is sovereign by design: durable, de-duplicated storage inside your perimeter, license verified offline, no outbound calls after install. The fleet-wide PDF uses the same byte-for-byte format you already trust on a single host, just summed over every node.
FLEET ROLL-UPsecured streamidentity verifiedair-gap deployable
LIVE// NEXUS FLEET · 12 SENTRIES · SECURED STREAMidentity verified · per entry
// INGEST TAIL · last 6
node-07+143 lines 12ms
node-03+ 91 lines 9ms
node-11+207 lines 14ms
node-02+ 64 lines 7ms
node-09+118 lines 11ms
node-05+ 82 lines 8ms
DELIVERYnever lost
RETRIESde-duped
TEASER · AUTONOMOUS FLEETS
The same reporting engine is the Universal Driver for fleet trust.
Robotics and edge autonomy inherit the same exfil and policy surface as data-center inference. The Transparency Engine generalizes: one ledger discipline, many machine footprints.
Discovery: AI Governance PDF · Unforgeable Audit Log · HIPAA AI Compliance · FedRAMP & CMMC Evidence · Kernel-level Infrastructure Ledger.