Added

  • Central warden mode: aggregates audit entries from multiple dockward agents via HTTP push

  • --mode agent|warden flag; agent mode is the default (backward compatible)

  • Agent push config block (push.warden_url, push.token, push.machine_id): when warden_url is set, every audit entry is forwarded to the warden asynchronously

  • internal/push package: HTTP client that POSTs audit entries to warden /ingest

  • audit.Pusher interface and Logger.WithPush to decouple push client from audit package

  • Warden HTTP server with four endpoints: POST /ingest, GET /events (SSE), GET / (dashboard), GET /health

  • SSE hub: fan-out broadcaster; replays last 50 events on new connection

  • In-memory ring buffer (200 events) with per-agent connectivity state

  • Heartbeat poller: polls each agent GET /health every 30s; emits agent_online / agent_offline synthetic entries on state transitions

  • Multi-machine dashboard: per-agent status cards, real-time SSE event feed, machine and level filters

  • warden.sample.json: sample warden config