A hash with a hole in it
Our change detector digests inode metadata to decide whether to look. Leave one field out of that digest and an agent can edit a file without any checkpoint ever noticing.
Tagged
You cannot authenticate a process that shares your uid
We wanted checkpoints that only the harness could request, not the agent. Under a shared uid and a shared process tree that check cannot be built — so we changed the property instead of trying.