Forensic Semantics of Intent · Protocol P2

VIGÍA

A forensic engine that does not ask what happened.
It asks why — and who benefits.

0lines of pure analysis
22canonical vectors, end-to-end
0opaque models · fully deterministic
Scroll to interrogate
01 — THE PARADIGM SHIFT

Most forensics reconstructs events. VIGÍA reconstructs motive.

A timeline tells you a file was deleted at 03:14. It cannot tell you whether that was routine hygiene, panic, or a planted alibi. VIGÍA treats every artifact as a sign — and reads the intent it points to.

Conventional DFIR

What happened

› Which bytes changed?
› When did the process spawn?
› What is the chain of custody?
› Reconstruct the timeline.
VIGÍA · Indicator of Intent

Why, and who benefits

› What does this artifact mean to assert?
› Which Gricean maxim is being flouted?
› Does effect precede its own cause?
Cui bono — who profits from this reading?
“cui bono?”The oldest question in forensics, now formalized
02 — EPISTEMOLOGICAL FOUNDATIONS

Not heuristics. A theory of meaning.

VIGÍA is built on four centuries of work on how signs carry intention — and on the disciplines that keep interpretation honest. Every scoring rule traces back to a published epistemics, not a hunch.

Charles Sanders Peirce

Triadic semiosis & abduction

Semiotics · c. 1903

A sign is never just a thing — it is a relation between a representamen, its object, and the interpretant it produces. Inference to the best explanation (abduction) is how we leap from trace to cause.

VIGÍA treats each artifact as a representamen and runs abductive closure to the most parsimonious intent.
Umberto Eco

The limits of interpretation

Overinterpretation · 1990

A text constrains its readings. The “paranoid reader” finds conspiracy in everything; Eco insists the object pushes back. Reading malice into mere noise is itself an error.

The NOISE verdict and the Causal-Closure veto are Eco's brake — VIGÍA refuses to over-read.
H. P. Grice

The cooperative maxims

Logic & Conversation · 1975

Communication assumes Quantity, Quality, Relation, Manner. A covert violation of Quality is the precise structure of a lie; an overt flout is irony. The pattern of violation is signal.

Maxim-violation profiles feed VIGÍA's Indicator-of-Intent features directly.
ENFSI · Daubert

Admissible by construction

Forensic standards · 2015 / 1993

Evidence must be testable, have a known error rate, and report strength as a likelihood ratio — not a verdict dressed as certainty. Courts reject black boxes.

Every score lands on the ENFSI verbal scale; every decision passes the Daubert checklist.
SIGN the artifact OBJECT the intent INTERPRETANT VIGÍA's reading

The unit of evidence is a sign

Hover a vertex. Peirce's insight: meaning is irreducibly three-part. A deleted log (sign) points to an act of concealment (object) only through a disciplined interpretation (interpretant). VIGÍA makes that third term explicit, auditable, and falsifiable — so the reading itself can be cross-examined.

03 — THE MATHEMATICS · LIVE

Don't read the equations. Operate them.

Every formula below is the real decision rule from Protocol P2, running in your browser. Move the controls and watch the engine reason. This is what “auditable” feels like.

Evidence Fusion — Noisy-OR (CAIE)

§2 · independent evidence
composite over independent sources

Toggle independent sources. Noisy-OR never lets weak evidence cancel strong evidence — it accumulates. But fewer than three independent sources triggers a 20% confidence penalty: corroboration is not optional.

⚠ < 3 independent sources — composite penalized ×0.80
COMPOSITE INTENT EVIDENCE
0.000

Likelihood Ratio → ENFSI Strength

§3 · forensic weight of evidence
correlation-discounted log-likelihood
2.5
1.8
3.2
0.20
LIKELIHOOD RATIO (FABRICATION)

ENFSI VERBAL SCALE
Weak
<10
Moderate
10–100
Strong
10²–10³
Very str.
10³–10⁴
Extreme
≥10⁴

★ Risk-Bounded Decision Layer

§7 · the heart of the engine
risk functional · all arithmetic in decimal, ROUND_HALF_EVEN
0.50
0.10
0.90
0.70
1.0
1.0
1.0
RISK r
0.000
accept abstain reject

ABSTAIN is a first-class outcome. Where drift, instability, or inconsistency dominates, the engine declines to convict — and names why (ABSTAIN_DRIFT, ABSTAIN_INSTABILITY, ABSTAIN_INTENTION, ABSTAIN_ZONE). Thresholds ε are read from a sealed PolicySpec — never hardcoded into the decision path.

Quadripartite Verdict — 8-State Cascade

§6 + §10 · ordered resolution
0.42
0.85
EFFECT_BEFORE_CAUSEhard gate — causality violated
DEGRADED_MODEengine integrity compromised
dissent · escalation_requiredreview collective split
§6 base verdict · §9 effective confidence
RESOLUTION TRACE — first match wins
ABSTAIN_DEGRADEDdegraded_mode
ESCALATEdissent required
MALICE_HIGHmalice · eff≥0.8
MALICE_MEDIUMmalice · 0.6–0.8
ABSTAIN_INSUFFICIENTconfidence<0.6
BENIGN_HIGHbenign · eff≥0.8
BENIGN_MEDIUMbenign · 0.6–0.8
ABSTAIN_ZONEhonest uncertainty
BASE · §6
RESOLVED STATE
04 — DETERMINISM & ADMISSIBILITY

The same input yields the same byte, on every machine, forever.

A forensic instrument that gives different answers on x86 and ARM is not evidence — it's an opinion. VIGÍA refuses the floating-point unit entirely. Reproducibility is not a feature; it's the whole point.

Decimal, not float

No FPU. No drift.

All arithmetic runs in decimal.Decimal at precision 28 with banker's rounding. Native round() delegates to libc and can disagree across platforms — so it is banned from the decision path.

round(2.675,2)
→ 2.67 / 2.68 ⚠
Decimal quantize
→ 2.68 ✓ everywhere
Sealed & hashed

Every verdict is signed.

State, raw verdict, confidence, stability, integrity, adversarial flags and dissent are folded into one canonical hash with sorted keys. Change any input and the fingerprint changes. Tamper-evident by design.

audit_hash = SHA-256(
  state ‖ verdict ‖ confidence ‖
  stability ‖ integrity ‖
  adversarial ‖ dissent )
Canonical vectors

22 vectors. One truth.

The full canonical suite is pinned to a single SHA-256. The agent runs all 22 end-to-end against both a pure-Python and a NumPy backend — and they must agree, bit for bit.

P2 canonical set:
f7276a524a46149a2811d52f
9e5072d2a281df227f9d46d0
84a651d6420cf4ce
05 — END TO END

One autonomous pass, trace to verdict.

The planner ingests raw artifacts and emits a signed, STIX 2.1-conformant verdict with MITRE ATT&CK mappings — without a human in the loop, and without a single hardcoded threshold.

01

Normalize

z-scores over robust MAD baselines; pre-normalized signals pass through untouched.

02

Fuse

Noisy-OR within and across sources; corroboration penalty applied.

03

Weigh

Correlation-discounted likelihood ratio on the ENFSI scale.

04

Close

Causal Closure Score in exact fractions; CCS ≤ ½ vetoes to ABSTAIN.

05

Bound

Risk functional resolves ACCEPT / ABSTAIN / REJECT against sealed ε.

06

Sign

8-state verdict, effective-confidence adjusted, SHA-256 sealed → STIX 2.1.

Self-calibrating across runs — λ, γ, ε adapt to observed false-positive/negative rates, clamped to Daubert-defensible ranges. No opaque ML anywhere in the chain.

why VIGÍA is different

It can be
cross-examined.

Black-box detectors give you a score and ask for trust. VIGÍA gives you a verdict, the theory behind it, the arithmetic that produced it, and a hash that proves no one touched it on the way out.

0lines of pure code — every one of them auditable