A quiet first release of hood

Say hello to hood, a new Atomdrift project. You handle unfamiliar chemicals under a fume hood; hood does the same for unfamiliar software. It's a local enforcement layer that inspects public and private artifacts fetched by developers and AI agents before they reach a package manager, installer, or curl | sh — adding zero-day detection without changing your workflow and without shipping proprietary packages off to a third party.

Under the hood (sorry), it creates a fresh, child-only certificate authority for each intercepted command, never touching the host trust store. Known hashes are fast-pathed; anything unknown is decomposed by cleave and classified locally by Atomdrift Scan before it's released to the tool. Because it scores what an artifact can actually do against traits refined by our reinforcement-learning loop — rather than matching known-bad signatures — hood is built for the case feeds can't cover: a previously unseen 0-day supply-chain attack, caught on your machine at fetch time. Like isomer, it's an application of the same local detection stack. Fetches fail closed if scanning can't start, and local operations like go test and cargo build bypass it entirely. It installs user-level shims for the tools already on your PATH — curl, wget, the npm and pip families, go, cargo, brew, and more.

An early build is on GitHub at atomdrift-project/hood.