Update network adapter

network/README.md

@@ -0,0 +1,124 @@
+---
+license: apache-2.0
+library_name: gliner2
+pipeline_tag: text-classification
+language:
+  - en
+tags:
+  - decision-model
+  - calibration
+  - selective-prediction
+  - conformal-prediction
+  - abstention
+  - risk-aware
+  - security
+  - cybersecurity
+  - security-operations
+  - soc
+  - pentest
+  - red-team
+  - blue-team
+  - gliner2
+base_model: fastino/GLiNER2.5-Decide
+metrics:
+  - accuracy
+model-index:
+  - name: haruspex
+    results:
+      - task:
+          type: text-classification
+          name: Security decision (boolean / choice / score)
+        dataset:
+          type: custom
+          name: network pack test split (71 rows)
+        metrics:
+          - type: accuracy
+            value: 0.9437
+            name: accuracy
+          - type: ece
+            value: 0.0224
+            name: ece
+          - type: brier
+            value: 0.0191
+            name: brier
+---
+
+# TyrusRC/haruspex (network)
+
+**Haruspex** is a small, local **decision layer** for security operations. It reads a
+situation and returns a *calibrated* typed verdict — **boolean** (yes/no + probability),
+**choice** (pick one option), **score** (rate on a rubric) — and **abstains** when it is
+not confident enough for your risk budget.
+
+Haruspex **reuses** the published decision encoder
+[`fastino/GLiNER2.5-Decide`](https://huggingface.co/fastino/GLiNER2.5-Decide) (Apache-2.0, non-autoregressive, CPU/GPU) and
+specializes it on security decisions. It does not train a decision model from scratch.
+
+- Base: `fastino/GLiNER2.5-Decide`.
+- Added: a typed decision contract, security specialization data, a certified
+  **selective-calibration** layer (accept/abstain against a risk budget), conformal
+  **prediction sets**, and a **novelty gate** that abstains on unfamiliar input.
+- Serves the TypeSafe `POST /v1/systemone` and native `/v1/evaluate` contracts.
+
+## Intended use (security, both sides)
+
+- **Offensive (pentest / red-team):** is this template/probe relevant to the target?
+  is this scanner hit a real finding? finding severity; verdict discipline
+  (vulnerable / not-vulnerable / inconclusive); attack-path next step.
+- **Defensive (SOC / blue-team):** alert and incident triage (true / benign / false
+  positive), alert severity/priority, detection-rule applicability, incident routing, CVE
+  applicability, ATT&CK tactic of Windows/Sysmon events. Raw Defender, Sentinel, Elastic
+  ECS and Windows event JSON is normalised before the model reads it.
+
+It is a classifier for bounded decisions — not a chatbot, not an exploit generator.
+
+## Use
+
+```python
+from haruspex import Haruspex
+m = Haruspex.load("TyrusRC/haruspex", subfolder="network", device="cuda")   # or "mps" / "cpu"
+print(m.decide({"type":"boolean","state":"Target: WordPress 6.2, PHP 8.1",
+                 "question":"Is a WordPress xmlrpc.php template relevant?",
+                 "criteria":{"true":"WordPress target","false":"not WordPress"}}))
+```
+
+Or serve the decision API (keyless, self-hosted):
+
+```sh
+pip install "haruspex[serve] @ git+https://github.com/TyrusRC/haruspex"
+haruspex-serve --adapters network=TyrusRC/haruspex#network --port 3000      # POST /v1/systemone  ·  /v1/evaluate
+```
+
+## Calibration
+
+Fitted calibrator: accept threshold `0.0`, target risk `0.2` at delta `0.1`, coverage on the calibration split `1.0` (n=44), temperature `1.0`.
+
+Each verdict carries the full probability distribution over its options (temperature-
+scaled). A Learn-then-Test selective layer accepts a verdict only when its confidence
+clears a threshold certified on a held-out calibration split, so that with probability
+1 - delta the error among accepted verdicts stays within the target risk; otherwise it
+abstains with `"route": "escalate"`. A conformal prediction set lists the options the
+true answer is among, and a novelty gate abstains on inputs unlike the training data.
+Fit with `python -m haruspex.calibrate` and `python -m haruspex.ood`; evaluate with
+`python -m haruspex.eval`.
+
+## Evaluation
+
+Held-out test sets, never used for training, model selection or calibration:
+
+- **network pack test split (71 rows)**: accuracy 0.9437, ECE 0.0224, Brier 0.0191; with the calibrator it answers 1.0 of rows at accuracy 0.971 and abstains on the rest.
+
+Comparisons against general LLMs are in the repo's `docs/benchmark.md`.
+
+## Limitations
+
+- A specialist for the decision types above; novel free-form judgments belong to a
+  general LLM.
+- Calibrated on this domain's held-out split; recalibrate before relying on the
+  guarantee on your own data.
+- Prediction-set coverage is marginal over the calibration mix, not per input.
+- A calibrator fitted on a mix of domains holds its risk target on average over that
+  mix, not on each domain: check each test set's accepted accuracy under Evaluation,
+  and route a domain with its own adapter to that adapter.
+
+Apache-2.0. Repo + recipe: https://github.com/TyrusRC/haruspex

network/calibrator.json

@@ -1,7 +1,12 @@
 {
-  "threshold": 1.0,
+  "threshold": 0.0,
   "target_risk": 0.2,
   "achieved_risk": 0.0,
   "coverage": 1.0,
-  "n": 44
+  "n": 44,
+  "delta": 0.1,
+  "temperature": 1.0,
+  "temperature_scope": "all",
+  "set_q": 0.0,
+  "set_alpha": 0.1
 }

network/eval.json

@@ -1,7 +1,29 @@
 {
-  "accuracy": 1.0,
-  "ece": 0.0,
-  "brier": 0.0,
-  "test_n": 74,
-  "dataset": "network held-out"
+ "n": 71,
+ "accuracy": 0.9437,
+ "accuracy_ci95": [
+  0.8639,
+  0.9779
+ ],
+ "brier": 0.0191,
+ "ece": 0.0224,
+ "ece_adaptive": 0.0224,
+ "p50_ms": 43.2,
+ "by_source": {
+  "model": {
+   "n": 69,
+   "accuracy": 0.971
+  },
+  "model_declined": {
+   "n": 2,
+   "accuracy": 0.0
+  }
+ },
+ "selective": {
+  "coverage": 1.0,
+  "accepted_accuracy": 0.971,
+  "accepted_risk": 0.029
+ },
+ "test_n": 71,
+ "dataset": "network pack test split"
 }

network/final/adapter_config.json

@@ -35,22 +35,22 @@
   "rank_pattern": {},
   "revision": null,
   "target_modules": [
+    "dense",
+    "count_pred.0",
     "project_end.0",
-    "out_project.0",
-    "key_proj",
+    "projector.2",
+    "classifier.2",
     "project_start.3",
+    "count_pred.2",
+    "project_end.3",
     "classifier.0",
-    "query_proj",
     "project_start.0",
-    "classifier.2",
-    "project_end.3",
-    "value_proj",
-    "projector.2",
-    "count_pred.2",
-    "count_pred.0",
     "out_project.3",
-    "projector.0",
-    "dense"
+    "out_project.0",
+    "value_proj",
+    "key_proj",
+    "query_proj",
+    "projector.0"
   ],
   "target_parameters": null,
   "task_type": null,

network/final/adapter_model.safetensors

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:e4ac86c03380139cb23a032cad12bc780aecf0051129131e8cd76632d03374ad
+oid sha256:16492ad29e1aa1b73c5cf86b439509c9c8297de41f791a0d71281a53c137f7dd
 size 31766440

network/ood.json

@@ -0,0 +1 @@
+{"alpha": 0.01, "dim": 2048, "cal_scores": [0.552101, 0.59451, 0.595525, 0.604385, 0.611636, 0.623373, 0.652501, 0.653637, 0.658146, 0.659068, 0.663924, 0.66851, 0.683587, 0.68777, 0.688723, 0.696749, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0]}

network/ood_train.npy

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f856616e0c5713e73b552902f8009aea7addc0b3e34bf6f7b09593120ed284e8
+size 1147008