I'm a political scientist, not a security engineer. I can't judge the launchd, egress-allowlist or MCP design, and I'll say so where it matters. My concern is what the agent can see, in which languages, and how it decides what counts as evidence. The plan is careful in some places. The dogfood test (§2, Test 3), the "nothing today" rule, and the "two sources, one primary, or low-confidence" rule (§8) are the habits I'd want. But the plan's sources, test, and analytic fields all inherit one blind spot.
1. Test 1 (the replay test) is partly circular. The score is "incidents caught within 24h / incidents with a public trace," measured on a 37-incident corpus. That corpus was presumably assembled from the same kinds of sources the watch loop reads: English-language, Western-lab-centric, disclosed through Western channels. Section 3 says it yourself: "Wiz, Hugging Face, METR, Wikimedia, a journalist, a government bug inbox." An 80% score then measures how well Ria rediscovers what English-language sources already noticed. It says nothing about what she misses.
There is a second problem. "The earliest public source date is known" depends on who searched and in what language. If an incident had an earlier trace in Chinese, Korean, or a regulator's filing, the corpus date is wrong and the 24-hour window is too generous. P8 ("detection was almost always external") may partly be an artifact of this: you observe incidents that entered the English-language disclosure ecosystem.
2. The source set can't support the mandate's "watches every channel that matters." §4.2 builds on "the 15 feeds that returned valid XML today." That selects sources by technical convenience, not importance. The roster is Zvi, LessWrong, Alignment Forum, Import AI, Transformer, Palisade, and so on. Even the lab coverage runs through "the Anthropic news mirror," a secondhand copy, not the primary page. There is no Chinese-language source anywhere in the list: no CAC, TC260, MIIT, CAICT, Chinese lab technical reports, or Chinese-language media. "Geopolitics" appears as a screening category in step 3 with no sources feeding it. A screening bucket with no inputs will quietly fill with whatever English-language commentary says about geopolitics, which is exactly the secondhand channel I'd distrust.
3. The local-model screen will fail silently. Step 3 has Qwen and Gemma "discard the rest." No false-negative audit is described, and nothing says how non-English text is handled. Terminology also hurts here. 安全 covers both "safety" and "security," so a classifier keyed to English "AI safety" or "containment" misreads or misses Chinese-language material. "Responsible AI" has no clean counterpart in the Chinese policy vocabulary. Related terms include 可信 (trustworthy), 安全可控 (safe and controllable), and 治理 (governance), each with a different institutional history. Discarded items need a sampled audit, or "nothing today" will often mean "nothing in English that my screener liked."
Non-English and Chinese coverage. The plan doesn't address it, so currently the answer is no. A realistic version for one person on a home server: start with Chinese, where English-only analysis fails most visibly. Cover official primary sites (CAC notices, TC260 standards texts, the State Council policy library, MIIT, CAICT) and Chinese lab technical reports and model cards (Hugging Face, ModelScope, arXiv). WeChat official accounts are a real access problem with no clean feed. The honest design is to mark them "not covered," not to imply coverage. Then add a rotating pass on the EU AI Office, Korea, Japan, and India.
Avoiding the US-China race frame. The plan isn't framed as a race, which is to its credit, but that's omission, not design. The danger is that the frame returns through the sources: English commentary that arrives pre-framed. Nothing in §4.3 asks whether the framing came from the evidence or from the outlet. History offers a caution. The 1950s "missile gap" was built on partial, secondhand, filtered estimates that were persuasive and wrong. A related lesson from earlier industrial transitions: Germany's strength in the Second Industrial Revolution owed more to institutions that spread chemical and electrical know-how, such as technical universities and standards bodies, than to who invented first. Analogies are suggestive, not proof, but the question transfers. The corpus measures failures at the frontier. It doesn't ask whether the controls it recommends (P1–P8) reach the median deployer, or how fast.
Primary-document checking. The two-source rule is good, but "primary" is undefined. For a Chinese policy claim, primary should mean the original-language document on the issuing body's site, not an English summary or translation, even a good one. The plan needs a provenance record per claim: original language, original URL, retrieval date, translation method (machine or human-verified), and whether the English claim matches the original. Absent that, you can't tell a claim that was checked from one that was merely repeated.
One more point on the corpus. It consists of publicly disclosed failures. Absence of Chinese incidents in it is not evidence that none occurred, and it isn't evidence of the opposite. Ria should record "no data" separately from "none observed," and publish a coverage map alongside the index.
Take ten recent English-language claims about Chinese AI governance or Chinese lab behavior, drawn from reputable Western outlets and think tanks. Seed three that are known to be stale or mistranslated, without telling Ria which. For each claim, she must produce the original-language passage with its URL, a translation, and a verdict (supported, outdated, or mistranslated), with provenance logged. Have a Chinese-reading human grade the results blind.
Pass: all ten traced to original-language primary documents, at least two of the three seeded errors caught unprompted, and no verdict the grader finds unsupported by the source text. If Ria can do this, her "primary source" label means something. If she can't, the Containment Index will look rigorous while resting on translations and secondhand claims.