Aethelos Privacy Guard — local engine
=====================================

This is the wire. The command board (Guard) reads traffic here and sends
Approve / Kick here. Nothing leaves this machine.

Run (Python 3, no extra packages):

    python3 guard-engine.py

Optional live packet headers (this device only — Termux or a Linux box):

    python3 guard-engine.py --tcpdump

Optional PostgreSQL (same machine):

    DATABASE_URL=postgres://... python3 guard-engine.py

If DATABASE_URL is unset, state is a JSON file beside this script.

Android VpnService (packet capture without an outside server):
compile VpnCaptureService.java into the Aethelos package. It opens the
system VPN dialog, reads headers on-device, and posts them to this engine.
Kicked destinations are dropped in the TUN. Payloads never leave the phone.

The engine binds only the loopback interface. The board already knows where
to send Approve and Kick. Do not expose it on a public address.

Legal: local sockets and local capture only. No Tor crawl, no remote wipe,
no payload to a third host.