DOC-foundry launches an adversarial multi-agent pipeline that writes Sigma detection rules and proves them

DOC-foundry is an open-source detection-engineering workflow built on LangGraph, Pydantic, FastMCP and Claude that turns a threat such as a CVE or ATT&CK technique into a Sigma rule plus a proof bundle. Four LLM agents (Threat Analyst, Blue Detection Engineer, Telemetry, Red-Team Adversary) propose, while a deterministic referee handles FP/FN evaluation, adversarial mutation, coverage verdicts and the deployment gate, producing a real-coverage, brittle or broken label with a reproducibility hash. A second Review Chain pipeline runs draft, Red Team, SOC Lead and final rule stages and explicitly issues no coverage verdict.