Policy-scoped behavioural decision layer.
Sigma reads what code is able to do — statically, pre-runtime — and resolves it to one auditable decision on a five-step escalation ladder: observe → shield → contain → quarantine → terminate. Calibrated for low false-positives: benign trees rest at observe, and only corroborated, high-confidence critical chains escalate to a hard fail.
Decision profile from the 2026-05-17 low-false-positive calibration on a mixed developer workspace. Determinism verified by hermetic repeat-replay.
Benign developer trees rest at observe. Escalation requires corroborated, high-confidence evidence — raw signal counts never escalate on their own. Terminate stays reachable only for confirmed critical chains, and every decision carries an auditable trace of why it escalated.
Gate names, the trusted-source set, capability resolution and invariant mechanics, and formula identifiers stay sealed. Sensor coverage has known boundaries — characterised honestly and disclosed to evaluation partners under NDA, never advertised.