A six-layer security observability platform for OpenShift/Kubernetes. It consumes cluster-native signals (OVN ACL drop logs, live NetworkPolicy objects, time-series flow statistics) and converts them into structured findings, ranked anomalies and plain-English explanations. Detection in three tiers: Z-score spikes over Welford baselines, deterministic rules, and Isolation Forest for multivariate outliers. Policy audit: live NetworkPolicy objects checked against an 8-rule catalogue, scored per namespace and graded A–F. On-cluster LLM: llama3.2:3b on a dedicated tainted node.