What problem does it solve? Server and workstation operators need ongoing visibility into security posture, crashes, capacity, and log anomalies without dashboards or alert fatigue, and they need remediation that never performs destructive actions without explicit confirmation. ## Core Features & Use Cases - Audit and inventory: Runs observe and analyze passes (hardening scan, services, security tooling, logs, capacity) and journals every finding in a SQLite database with stable fingerprints so re-runs never duplicate. - Report and status: Produces plain-language summaries of the journal state and the last run for technical and non-technical readers. - Monitor and fix: Watches a single concern live (e.g. CORS preflight 403s in Apache logs) announcing only new deltas, and remediates findings through risk-tiered fix flows where destructive actions always stop, warn, and ask. - Stats: Generates GDPR-friendly web traffic analytics from existing access logs with IPs correlated in memory only. - Use Case: An operator runs /watchman audit on a Debian web server, reviews the prioritized findings, then launches watchman fix from the shell to apply safe-tier remediations with per-change confirmation. ## Quick Start Ask the assistant to run /watchman audit to scan this machine and journal all security and capacity findings. ## Quick Start Run /watchman audit in a Claude Code session from the claude-watchman repo root to scan the machine and journal findings.
