eBPF LSM runtime security agent for synchronous file/network denial — looking for technical feedback

I’m working on Aegis-BPF, an open-source Linux runtime security project built around eBPF LSM. The goal is narrow: explore enforcement-first runtime security, where selected file and network operations can be denied before syscall completion, rather than only emitting post-event telemetry. Current