AUTARCH v1.9 — remote monitoring, SSH manager, daemon, vault, cleanup

- Add Remote Monitoring Station with PIAP device profile system
- Add SSH/SSHD manager with fail2ban integration
- Add privileged daemon architecture for safe root operations
- Add encrypted vault, HAL memory, HAL auto-analyst
- Add network security suite, module creator, codex training
- Add start.sh launcher script and GTK3 desktop launcher
- Remove Output/ build artifacts, installer files, loose docs
- Update .gitignore for runtime data and build artifacts
- Update README for v1.9 with new launch method, screenshots, and features

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/templates/defense_monitor.html

@@ -776,6 +776,7 @@ function loadConnections() {
                 + '</td></tr>';
         });
         document.getElementById('conn-table').innerHTML = html || '<tr><td colspan="6">No connections found</td></tr>';
+        halAnalyze('Defense Monitor: Connections', JSON.stringify(data, null, 2), 'security audit', 'defense');
     }).catch(function() { setLoading(btn, false); });
 }
 
@@ -801,6 +802,7 @@ function niBandwidth() {
         });
         html += '</tbody></table>';
         document.getElementById('ni-bandwidth').innerHTML = html;
+        halAnalyze('Defense Monitor: Bandwidth', JSON.stringify(data, null, 2), 'security audit', 'defense');
     }).catch(function() { setLoading(btn, false); });
 }
 
@@ -823,6 +825,7 @@ function niArpCheck() {
         });
         html += '</tbody></table>';
         document.getElementById('ni-arp').innerHTML = html;
+        halAnalyze('Defense Monitor: ARP Check', JSON.stringify(data, null, 2), 'security audit', 'defense');
     }).catch(function() { setLoading(btn, false); });
 }
 
@@ -845,6 +848,7 @@ function niNewPorts() {
         });
         html += '</tbody></table>';
         document.getElementById('ni-ports').innerHTML = html;
+        halAnalyze('Defense Monitor: New Ports', JSON.stringify(data, null, 2), 'security audit', 'defense');
     }).catch(function() { setLoading(btn, false); });
 }
 
@@ -868,6 +872,7 @@ function niGeoip() {
             + '<tr><td>ASN</td><td>' + (data.asn || '—') + '</td></tr>'
             + '</tbody></table>';
         document.getElementById('ni-geoip-result').innerHTML = html;
+        halAnalyze('Defense Monitor: GeoIP Lookup', JSON.stringify(data, null, 2), 'security audit', 'defense');
     }).catch(function() { setLoading(btn, false); });
 }
 
@@ -896,6 +901,7 @@ function niConnsGeo() {
                 + '<td>' + escapeHtml(c.process || '') + '</td></tr>';
         });
         document.getElementById('ni-geo-tbody').innerHTML = html;
+        halAnalyze('Defense Monitor: Connections GeoIP', JSON.stringify(data, null, 2), 'security audit', 'defense');
     }).catch(function() { setLoading(btn, false); });
 }
 
@@ -911,6 +917,7 @@ function niConnRate() {
             + '<tr><td>Peak</td><td>' + (data.peak_rate || 0) + '</td></tr>'
             + '</tbody></table>';
         document.getElementById('ni-conn-rate').innerHTML = html;
+        halAnalyze('Defense Monitor: Connection Rate', JSON.stringify(data, null, 2), 'security audit', 'defense');
     }).catch(function() { setLoading(btn, false); });
 }
 
@@ -952,6 +959,7 @@ function loadThreatReport() {
             data.blocklist.forEach(function(ip) { lines.push('  ' + ip); });
         }
         renderOutput('threat-output', lines.join('\n'));
+        halAnalyze('Defense Monitor: Threat Report', JSON.stringify(data, null, 2), 'security audit', 'defense');
     }).catch(function() { setLoading(btn, false); });
 }
 
@@ -1025,6 +1033,11 @@ function capDone(stats) {
     document.getElementById('btn-cap-start').style.display = '';
     document.getElementById('btn-cap-stop').style.display = 'none';
     document.getElementById('cap-status').textContent = 'Capture complete' + (stats.packet_count ? ' — ' + stats.packet_count + ' packets' : '');
+    // Send captured packet output to HAL for analysis
+    var packetPanel = document.getElementById('cap-live-packets');
+    if (packetPanel && packetPanel.textContent.trim()) {
+        halAnalyze('Threat Monitor: Packet Capture', packetPanel.textContent, 'packet capture analysis', 'network');
+    }
 }
 
 function capProtocols() {
@@ -1043,6 +1056,7 @@ function capProtocols() {
             html += '<p class="empty-state">No packet data. Run a capture first.</p>';
         }
         document.getElementById('cap-analysis').innerHTML = html;
+        halAnalyze('Defense Monitor: Protocol Distribution', JSON.stringify(data, null, 2), 'security audit', 'defense');
     });
 }
 
@@ -1061,6 +1075,7 @@ function capConversations() {
             html += '<p class="empty-state">No conversation data. Run a capture first.</p>';
         }
         document.getElementById('cap-analysis').innerHTML = html;
+        halAnalyze('Defense Monitor: Top Conversations', JSON.stringify(data, null, 2), 'security audit', 'defense');
     });
 }
 
@@ -1087,6 +1102,7 @@ function ddosDetect() {
             html += '<pre class="output-panel" style="margin-top:8px;font-size:0.78rem">' + data.indicators.map(escapeHtml).join('\n') + '</pre>';
         }
         document.getElementById('ddos-status').innerHTML = html;
+        halAnalyze('Defense Monitor: DDoS Detection', JSON.stringify(data, null, 2), 'security audit', 'defense');
     }).catch(function() { setLoading(btn, false); });
 }
 
@@ -1116,6 +1132,7 @@ function ddosTopTalkers() {
                 + '</td></tr>';
         });
         document.getElementById('ddos-talkers-tbody').innerHTML = html;
+        halAnalyze('Defense Monitor: Top Talkers', JSON.stringify(data, null, 2), 'security audit', 'defense');
     }).catch(function() { setLoading(btn, false); });
 }
 
@@ -1213,6 +1230,7 @@ function ddosHistory() {
         });
         html += '</tbody></table>';
         document.getElementById('ddos-history').innerHTML = html;
+        halAnalyze('Defense Monitor: Mitigation History', JSON.stringify(data, null, 2), 'security audit', 'defense');
     });
 }