[PurpleCHOIms]

Phase 2b-i of the AutoBot migration (Decepticon design doc §0.3): AutoBot takes ownership of its sensor stack and detection package.

What moves

• examples/local-sensor — the complete local blue sensor stack: receiver (SQLite event store + ingest API), monitor (rule/decision detection adapters, incident batching, standing watch, autonomous analysis loop, notifications API), caddy ingress proxy, fluent-bit collector, capture wrapper, compose files + all overlays (runtime/logs/rules/engagement). Image prefixes renamed decepticon-blue-* → autobot-blue-*.
• packages/autobot/autobot/bluecell — the Sigma-flavored rule engine, target tap, and the blue.json engagement configuration module (fail-closed, Blue-owned workspace root), plus the shipped sample rules.
• Tests — resident-watch behavior, rules-file loader, engagement config, detector adapters: 73 unit tests green in this repo's CI.

What this changes (and doesn't)

• The monitor's BLUE_AGENT_URL contract is unchanged — it speaks the LangGraph Platform HTTP API and works with any server hosting the blue_cell graph. AutoBot's own blue-only agent runtime is stage 2b-ii (the middleware/LLM stack deserves its own security-reviewed design, not a transplant); until then the stack runs against any compatible server.
• Decepticon keeps its in-tree blue code until stage 2c; this copy is the canonical home for sensor development going forward (noted in the README).
• The caddy proxy leg could not bind on the verification host (unrelated local process holding 18080); the receiver→monitor detection path was verified live: image built under the new name, event ingested, path_traversal detected.

Verification

• make ci-lint clean; make ci-test 73 passed; ruff format --check clean.
• Live smoke: autobot-blue-receiver:3.14.8 built, receiver healthy, synthetic traversal event ingested (202 accepted), monitor emitted detected/path_traversal from the built-in rules.