# Calm footprint, SLA and scheduler Measured live today, under the full default engine set: roughly 2.6% of one core and 16 MB, settled. The kernel ceiling exists so the sensor can never run away with the machine, and the whole design exists to never come near it. Two things make a sensor calm. A hard floor the kernel enforces, so it cannot run away with the machine. And scheduling, which is the key to any telemetry system, and Whisper Endpoint has two schedulers: an on-host governor that reads the machine and does the heavy work only when nobody would feel it, and a fleet-plane planner that computes where the fleet's attention should go and hands the host an advisory hint. Behind both sits a calm personality you can set per fleet or per device: ten personas on one plane, eighteen levers underneath, and a safety floor no persona, drag, or override can cross. At a glance: 2.61% of one core (measured, settled) · 16 MB RSS (measured) · 2 schedulers · 10 calm personas · 18 levers, one floor. ## The measured footprint, before the ceiling The number that matters is the measured one. The sensor reads its own cgroup counters, cpu.stat and memory.current, and ships the result as a per-window heartbeat, so calm is a measured property, not a claim on a slide. This is a real line, captured today from a live sensor process run root-privileged inside a transient systemd scope carrying the exact production cgroup SLA (CPUQuota=25%, MemoryHigh=150M, MemoryMax=250M), every detection engine on its shipped default: ``` whisper: sensor: calm footprint: cpu 2.61% of the 25% quota, mem 17235968B of the 157286400B soft ceiling (262144000B hard), within SLA; deferrable submitted=5 completed=2 dropped=0 promoted=0 pending=3 ``` ``` CPU 2.61% |####......................................| 25% ceiling, never approached MEM 16 MB |##.................:150M soft..............| 250M hard cap ``` 25% of a core is the ceiling we promise never to need. This capture ran on a working host mid-session, not an idle one: the first window read 8.89% while the sensor seeded 338 already-running processes from /proc; two windows later it had settled to the 2.61% above, and memory held flat at 16-17 MB throughout, an order of magnitude under the 150 MB soft ceiling. Neither reading came within a third of the 25% CPU ceiling. This is the "measured calm" vector on the operator console: a live self-metered footprint per /128. See [Fleet, logs and console](/docs/fleet). ## The kernel floor: a published cgroup SLA Underneath the measurement sits the guardrail. The sensor installs under a bounded systemd unit, and the limits below are directives the kernel enforces, not averages we hope to hit. Read them off the unit yourself: ``` $ systemctl cat whisper-sensor | grep -E 'CPUQuota|MemoryHigh|MemoryMax|IOWeight' CPUQuota=25% MemoryHigh=150M MemoryMax=250M IOWeight=10 ``` | Directive | Value | What it means | |---|---|---| | CPUQuota=25% | a quarter of one core | The hard ceiling. The measured footprint above runs near a hundredth of it. | | MemoryHigh=150M | 150 MB, soft | The kernel throttles the sensor here first, so it slows down long before it is ever at risk. | | MemoryMax=250M | 250 MB, hard | Past this the kernel stops the sensor. It never reaches for the host's memory. | | IOWeight=10 | lowest-priority I/O | Disk traffic from the sensor yields to every other process on the box. | | event-driven | no polling | Collection rides kernel events, so there is no busy loop burning cycles at idle. | The ceiling is the promise; the measurement is the reality. The unit also self-lowers the sensor's scheduling and I/O priority and runs the deferrable work in its own child cgroup, so even inside its quota it gives way to your work first. ## Two tiers: the hot path never rides the scheduler The floor keeps the sensor small. The schedulers keep it polite. The design starts by splitting the work in two, and only one of the two is ever scheduled. ``` # tier one - the HOT path. Outside the governor by construction. the connection never scheduled, never gated taps + local verdict run immediately (urgency: now) # tier two - the DEFERRABLE tier. The only work the scheduler admits. inventory · FIM baseline · deep analysis · shipping | v admitted against a cheap read of host state host is calm -----> burst the worker pool up to 10x host is busy -----> collapse back to a single worker past deadline -----> run anyway, at the lowest priority the kernel offers ``` The hot path, the taps and the local verdict and the network connection itself, never touches a scheduler and never waits on one. Only the deferrable tier, the work that can wait a minute without any loss, is admitted against host state. That is why a busy machine never pays for the sensor's homework, and why nothing on this page can slow a detection down. ## Scheduler one: the on-host governor The first scheduler lives on the machine, autonomous and zero-config, and its only job is to be invisible. Before it admits a deferrable task it reads a snapshot of the host from cheap kernel signals: pressure-stall (PSI), /proc/stat and load average, power supply and thermal state, active login sessions, and /proc/net/dev. Every signal is fail-soft, so a signal it cannot read means "unconstrained", never an error. The tenfold burst is the one place that logic inverts, because the burst multiplies the sensor's own footprint. Admission fails open; the burst needs positive evidence: ``` # the 10x burst needs three green lights, all at once host calm measured off the sensor's own cgroup + PSI network quiet positive evidence; an unknown link is NOT quiet nobody at the keyboard | v all three green -----> up to 10 workers any one red -----> 1 worker fleet hint "hold" -----> back to 1, even at full idle ``` - Host idle, do the work. When the machine is quiet the governor leans in and clears the deferrable backlog. - Host busy, urgent only. An active user or a loaded machine drops the sensor to the hot-path verdict and nothing else. Urgent work runs immediately on its own self-lowered thread; everything else waits for a calm host or its deadline. - Never starve. A task past its deadline is admitted even on a busy host, at the lowest scheduling priority the kernel offers. Keeping a machine loaded does not suppress a scan. - Self-lowered workers. Deferrable work runs at nice 19 with idle I/O priority inside its own child cgroup, and the lowering is locked to the worker thread, so it dies with it. - A coalescer for churn storms. A package manager touching thousands of files becomes one submission per quiet window, not thousands of tasks. The window clamps between 200 ms and 1 s. - A graded resource breaker. Three one-directional notches: reduce sampling, then pause the heavy scans, then trip the disarm latch. It ratchets up immediately and steps down only after minutes of sustained calm, and it only ever sheds the sensor's own discretionary work. - A panic firewall. Repeated panics in deferrable work trip the same latch, so a wounded sensor degrades to a counted no-op instead of thrashing. A warmup gate holds analysis at cold start, so a freshly booted host does not produce a burst of first-sight false positives while the baseline settles. ## Scheduler two: the fleet planner The second scheduler runs where compute is free: in the fleet plane, next to the security graph. For each /128 it folds the identity's own behavioural history against graph intelligence and computes a small hint: a vigilance band, a deferral window, a burst stance, a bounded SLA lift, and an ordering over named tasks. The host pulls the hint on its own cadence; an absent or expired hint means the pure local baseline, so a fleet-wide reconnect can never stampede anything. ``` ON THE HOST · the governor FLEET PLANE · the planner +--------------------------------+ +--------------------------------+ | hot path ---- never scheduled | | graph history, per /128 | | +----------------------------+ | | -> vigilance band · window | | | deferrable tier |<- - - -| -> burst stance · bounded lift| | | idle burst 10x · busy 1 | advise | -> task ordering | | | deadline floor · breaker | only | pulled by the host | | +----------------------------+ | | absent/expired -> baseline | +--------------------------------+ +--------------------------------+ ``` Strike the whole right-hand column and the host is still calm, smart and zero-config. The planner is pure upside, never a serve-time dependency, and the arrow between the two is advisory on purpose: it can only advise. What the hint actually says is a vigilance ladder, and every band carries an expiry, because a belief about a host should not outlive its evidence. Hotter bands are believed for less time: | Graph history | Vigilance | Deferral | Burst | Believed for | |---|---|---|---|---| | clean | low | defer deeply | allowed | 20 min | | (no signal, the baseline) | neutral | standard | standard | 5 min | | suspicious | elevated | soon | held | 3 min | | critical or known-exploited | high | now | now, with a bounded SLA lift | 45 s | By construction the hint can only dampen a burst, confirm one, deepen a deferral, re-order named tasks, or request a hard-capped lift. A busy host, an active user, the disarm latch, or the starvation floor always override it; it can never touch the hot path, never exceed the cgroup SLA, never starve a past-deadline task, and never outlive its TTL. If the hint is missing, expired, or you are on the keyless tier, the shipped local governor runs unmodified. Even the fleet-wide cadence is stampede-proof: with the backend dark, each host staggers itself deterministically off its own address. ## The calm personality: ten personas on one plane How assertive the sensor is and how much it tells you are two different questions, so the calm personality is a plane, not a slider: aggression across (how hard and deep it hunts, how readily it escalates) and loudness up (how much it tells you). Ten named personas are points on that plane. The center is Balanced, the identity: choose it, or touch nothing, and the sensor behaves exactly as shipped, byte for byte. ``` loud ^ | passive · loud aggressive · loud | Mandela(.48,.82) Nicholson(.90,.90) | Ali(.72,.70) | Attenborough(.20,.52) [Balanced .50,.50] Bruce Lee(.85,.50) | Curie(.30,.30) | Dalai Lama(.15,.15) Nightingale(.52,.16) Sentry(.90,.15) | calm · quiet aggressive · quiet (the SOC dream) +------------------------------------------------> aggression ``` | Persona | Aggr | Loud | The idea | |---|---|---|---| | Balanced | 0.50 | 0.50 | Sensible defaults. Nothing changes until you move. | | Dalai Lama | 0.15 | 0.15 | Barely there. A gentle daily whisper, never a tap on the shoulder. | | Curie | 0.30 | 0.30 | Meticulous, tireless, quiet investigation; lets the verified evidence speak. | | Nightingale | 0.52 | 0.16 | Steady, proactive protection through the night; speaks up only when critical. | | Attenborough | 0.20 | 0.52 | Watches everything up close, never intervenes; a patient commentary that keeps you aware. | | Mandela | 0.48 | 0.82 | Measured, deliberate action with radical transparency. | | Ali | 0.72 | 0.70 | Hits hard and precise, and tells the whole world it is coming. | | Bruce Lee | 0.85 | 0.50 | Be like water: fast, precise, adaptive; reports only what matters. | | Sentry | 0.90 | 0.15 | Hunts hard and deep, says almost nothing. The SOC dream. | | Nicholson | 0.90 | 0.90 | Maximum vigilance, maximum transparency. You will hear about everything. | Two personas would prefer an armed response mode. The floor keeps response at observe and stores the preference as stored, never silently enacted and never silently discarded. Turning response on is a separate, explicit opt-in; see [Containment](/docs/kill-switch). ## Eighteen levers, one deterministic projection Underneath the plane are eighteen named levers, and this is the part worth trusting: a position on the plane is not a vibe, it is a deterministic projection. Ten levers are plane-active, each with a stated loading on the two axes, and one drag moves all of them at once through an exact least-squares projection, identically on every server. The other eight are off-plane sliders with zero loading on both axes, which is a structural guarantee: no drag on the plane, however wild, can ever reach the resource ceiling, the response mode, or the burst width. | Plane-active lever | What it controls | Leans with | |---|---|---| | Aggression | the escalation cut-points that decide when a score becomes a concern | aggression | | Signal weights | how threat evidence trades against courtesy in the fused score | aggression | | Scan cadence | how often inventory, deep scans and sweeps re-run | aggression | | Promptness | how soon admitted work must land even when the host is busy | mostly aggression | | Calm sensitivity | how idle the machine must be before the sensor leans in | aggression | | Detect sensitivity | how readily a detector decides bad; the one lever both axes share | both | | Deferral depth | how long non-urgent work may wait | mostly loudness | | Interaction ceiling | how far the sensor may go to get your attention | loudness | | Notify floor | the lowest severity allowed to interrupt you | loudness | | Attention budget | the most interruptions allowed per hour or day | loudness | | Off-plane slider | Lives on | Why it is off the plane | |---|---|---| | Resource ceiling | Footprint | CPU, memory and I/O weight are an explicit envelope choice, never a side effect of a drag. | | Burst parallelism | Footprint | How wide the idle burst may go. | | Worker priority | Footprint | Idle or low, and the floor forbids raising it. | | Scan depth | Footprint | Executables, scripts, or documents too. | | User reactivity | Reactivity | Yield to an active session; defer on battery; defer when hot. | | Response mode | Autonomy | Off, observe, or armed, behind its own explicit gate. | | Freshness | Cadence | How long a fleet hint is believed per vigilance band. | | Self-governance | Cadence | A tighten-only factor: it can make the sensor stricter with itself, never looser. | The projection has one invariant that makes the whole surface trustworthy: the center of the plane maps every lever to exactly today's shipped default. Balanced is not a preset that resembles the default, it is the default, byte for byte, and that equality is asserted at startup so a drifted loading table fails loudly instead of shipping quietly. ## The safety floor: what no setting can cross Whatever a persona, a quadrant position, an operator override or a device-level policy asks for, it passes through one final clamp, and the clamp is monotone: it only ever moves a value toward safety. The floor guarantees, in every configuration the product can express: - CPU never exceeds the 25% cgroup quota. The generous footprint envelope buys memory, depth and burst width, never more CPU. - Memory never exceeds the hard cap, with the soft watermark held below it. - Response stays at observe unless response is separately and explicitly opted in. A persona's armed preference is stored, tagged as stored, and never silently enacted. - Detector conviction stays neutral while its enforcer lands: the detect-sensitivity multiplier is pinned, and the read-back says so. - Laptop guards stay on. On battery-powered hardware, defer-on-battery and defer-when-hot are floored on and cannot be disabled from the plane. - Worker priority is never raised. Deferrable work stays at idle or low. - Self-governance only tightens. The self-tuning factor can make the sensor stricter with itself, never looser. Maturity: the governor, the ceiling, the self-meter, the fleet planner's hint plumbing and the safety floor on this page are live. The persona and lever surface is a real, deterministic policy plane that round-trips through the control plane today; its loudness and aggression enforcers land namespace by namespace, and the policy read-back tags each one live or stored so a stored token never renders as enforced policy. See the policy section of [Fleet, logs and console](/docs/fleet). ## Fail-open, never a self-inflicted outage Security that can take the host down is a liability. Whisper Endpoint fails open in every direction that matters. - No hot-path blocking. The collectors watch kernel events out of band. They do not gate the processes they observe, so the host keeps resolving names and keeps running even if the sensor is slow or down. - Graceful degradation. A slow or absent dependency reduces visibility, never availability. A dark fleet planner returns the host to its standalone baseline. - A resource breaker. The in-process breaker sheds only the sensor's own discretionary work, in graded notches, and only ever in the direction of doing less. It never touches the connection. - A disarm latch. A single latch can drop the whole deferrable tier to a counted no-op pass-through without the sensor exiting. The fail-safe direction is always toward pass-through, never toward blocking you. ## What calm means Calm is the composure of power held in reserve. The sensor is quiet at rest and cheap under load, the heavy work happens when you are not looking, and the lethal control, the [off-host kill-switch](/docs/kill-switch), lives outside the host entirely. So there is nothing to prove with noise: no alarm storm, no cycles stolen from the work you actually run. In a market of alarmist agents, restraint is the brand.