Doc-foundry – AI writes Security detection rules, then proves they work

Doc-foundry is an adversarial multi-agent detection-engineering workflow (LangGraph, Pydantic, FastMCP, Claude) that turns a threat such as a CVE, CISA KEV entry, incident writeup or ATT&CK technique into a validated first-version Sigma detection rule, a threat report with round-by-round convergence history, and a proof bundle containing a positive corpus, benign baseline, adversarial mutation set and a computed coverage label (real-coverage/brittle/broken) with FP/FN numbers and a reproducibility hash. Four LLM agents (Threat Analyst, Blue Detection Engineer, Telemetry, Red-Team Adversary) propose, while a deterministic referee handles FP/FN evaluation, adversarial evasion, the coverage verdict, red-team verification and the deployment gate, so the same input yields the same verdict and hash. A second pipeline, the Review Chain, runs draft → Red Team → revision → SOC Lead → final rule and produces a reviewed but explicitly unvalidated rule with the full trail of findings that shaped it.