MOAR Stack · Trustworthy
Data quality & verification.
A rule can compile clean and silently never fire because a value was wrong three layers down, and the same silent-failure mode shows up one layer below the detection logic, in the engines themselves. Reading one byte-identical Parquet file through twelve query engines, eleven matched the generator's ground truth and one returned a confidently wrong row count with no error raised, which is the case for treating answer-equality across engines as something you verify with a standing check, not something an open format hands you for free.
Trustworthy component · 6 essays
Listed from the front door down to the measured evidence. Start here marks the entry essay. The reading-level tag says whether you are reading the frame (Orientation), the argument (Depth), or a first-party finding (Evidence). The durability tag flags durable architecture versus an Evidence-pinned result tied to a version or price.
- Start here OrientationDurable
The ground you're already standing on.
Detection engineers are doing data modeling every day without naming it, and a rule can compile clean and quietly never fire because one of those mappings was wrong with nothing set to catch it. The vocabulary, the silent-failure mode, and a deductive check that caught 100% of injected type-crossings on a 925-row corpus.
Read →
- DepthDurable
Catching the mistake that kills a detection.
The wrong field mapping that silently kills a detection is catchable with a reasoner and a few disjointness assertions D3FEND never shipped. How to run that check yourself against your own mappings, and the honest limits of what it catches.
Read →
- DepthDurable
What your data means vs what shape it is.
Schema conformance checks the shape of a field, not its meaning, so a mapping can fit OCSF exactly and still mean the wrong thing. Eight real meaning-crossings from a six-schema crosswalk corpus, made visible by a deductive check the syntax pass waves through.
Read →
- EvidenceEvidence-pinned
The query engine returned the wrong answer and didn't tell you.
Over an open format the engine is supposed to be interchangeable. In my lab one returned a filtered count tens of rows short of the others on the identical Parquet, no error raised, and a timing-only benchmark would have published it as a win. Why a cross-engine answer-equality gate is the only thing that caught it.
Read →
- EvidenceEvidence-pinned
Parquet doesn't hash the way your security tools assume.
Chain-of-custody, WORM, and dedup workflows key on a file hash, but Parquet isn't byte-reproducible by default: parallel row-group order makes the same logical data produce a different SHA-256 every write. A faithful re-export breaks the hash and looks like tampering. Force determinism (threads=1 or ORDER BY, ~20% smaller too), and hash the logical content, not the bytes.
Read →
- EvidenceEvidence-pinned
The better the model, the quieter the wrong answer.
I answered one OCSF question battery six ways across three model tiers. On compute-over-population questions no LLM-authored arm was ever correct, and the more capable model made the wrong answer quieter rather than rarer; an execution loop and self-consistency both failed the same way. Safety lived in the layer that refuses a query it can't answer, not in the model.
Read →
Capability Matrix
Verification rigor is the evidence-tier discipline behind every Matrix score.
See the Capability Matrix →