[Unit]
Description=AIOS Semantic Governance Drift Monitor
After=aios-governance-executor.service

[Service]
Type=oneshot
User=root
Group=gitops
ExecStart=/usr/bin/python3 /usr/local/libexec/aios-governance-drift-monitor
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
LockPersonality=true
RestrictSUIDSGID=true
RestrictRealtime=true
MemoryDenyWriteExecute=true
RestrictAddressFamilies=AF_UNIX
IPAddressDeny=any
ReadOnlyPaths=/usr/local/libexec/aios-governance-drift-monitor
ReadOnlyPaths=/var/lib/aios-gitops/runtime/tasks/AIOS-PROTECTION-SNAPSHOT-DRIFT-FORENSICS-V1/protection-drift/semantic-analysis.json
ReadWritePaths=/var/lib/aios-gitops/governance-executor