Panopticon: Evidence-Bounded Cross-Platform Endpoint Detection and Response

Panopticon is an open, cross-platform endpoint detection and response (EDR/XDR) research prototype. This paper audits its nine repositories and traces how telemetry, versioned contracts, detection, authorization and endpoint execution fit together. Detection only recommends, a Manager service enforces identity and policy, and endpoints alone perform a closed set of seven typed actions. Locally reproduced tests pass for the contract, response, Manager and Console layers, while the detection suite exposes four schema-compatibility failures. Repository-documented virtual-machine evidence supports selected native scenarios, but not fleet scale or production readiness.