The shield is the framework's detective: a passive, streaming observer that reads multi-shadow telemetry and emits structural-anomaly events when the joint-admissibility score \(\mathfrak{A}\) exceeds the Theorem 3 precision floor \(\tau_{T3}\).
Reusable, domain-agnostic library
Source: shield/ · README · CHANGELOG (v1 → v2)
Three diagnostic capabilities
- Coordinated-attack detection (Theorem 10). Pair-difference brake test catches coordinated activity across M channels even when each individual channel passes per-shadow admissibility — botnets, meaconed GPS satellites, jamming.
- Drift / calibration-failure detection (Theorems 7 + 11). Time-windowed \(\mathfrak{A}\) with \(d\mathfrak{A}/dt > 0\) flags channels whose calibration is drifting against the consensus.
- Resonance / beacon detection (Theorem 13). The \(\mathcal{P}\) spectral primitive separates trend, resonance, and residual content — robust to jitter via harmonic-summed autocorrelation.
What the shield is and is not
- It is a top-level framework component that imports primitives but does not modify them.
- It does not replace your existing intrusion-detection / signal-processing infrastructure — it composes alongside it via an event stream and the \(\mathcal{A}\) scope reporter (T12).
- Every event carries a
ScopeReporter\(\mathcal{A}\) record (T12): tested shadows, excluded shadows, the \(\tau_{T3}\) floor, and the gauge group G under which the finding is invariant.
v2 — what changed from v1
v2 supersedes v1 in-place. Six application-layer lessons from the radar v1→v4 evolution and the cybersecurity scaffold are now baked in: continuous weights replace binary mask (L1); per-band \(\mathcal{P}\) decomposition before \(\mathfrak{A}\) (L2); \(\mathfrak{A}\) is a JOINT-basket test (L3); harmonic-summed autocorrelation, not raw FFT (L4); elapsed-time cascade for inter-arrival sources (L5); compose-aware weighted fusion (L6).
Headline benchmark deltas (v1 → v2)
| benchmark | v1 | v2 |
|---|---|---|
| synthetic_radar | +0.11 dB vs Wiener+median | +4.5 dB vs Wiener+median |
| ctu13_botnet | 1/3 caught + 3 FP | 2/3 caught + 2 FP |
| texbat_gps ds4/ds7 | 0/2 caught + 2 FP | 1/2 caught + 0 FP |
See the per-section pages for the full scope, benchmarks, and adapter library.