An estate organ · SENTINEL · v3 behavioral entropy

You are how you behave

The grown stream detector learned where attacks sit and overfit its clean margin — under a distribution shift it did not transfer (flag3, reported honestly). The answer is one-class: model the operator's OWN behavioral entropy across three domains and flag deviation from the operator's own baseline, so an attack family the gate never saw is caught by construction.

Re-deriving the held-out generalization from the kernel…

The held-out generalization

…

window set	n	flagged	rate

The GEP decision — move the deviation, watch the gate

The unified entropy deviation from the operator baseline is the instability field E(t). The gate's bands are calibrated from the operator alone. Credential validity never enters — only the entropy state.

deviation from baseline

verdict: —

band	verdict	meaning

Re-run · own your signature

The operator baseline and the held-out evaluation are pure and seeded — they re-run here from the same kernel and must match the committed record.

Why this generalizes (Gary W. Floyd's GEP-BES)

Identity is insufficient. Behavior is authoritative. "Are you behaving like yourself?" — the gate models the operator, not the attacks, so it never learns an attack boundary to overfit. Attackers fail by being overly regular (scripted — a narrow repeated pattern, the wrong distribution) or randomly variant (uncorrelated — flat, no operator peaks). Both read as high deviation from the operator's structured baseline. Credential validity does not override entropy violation.

Honest scope (Gary §8): this performs stability regulation — whether behavior matches the operator — not morality, intent, or malware classification. The three domains (network / behavioral / authorization) and the ALLOW/THROTTLE/STEP-UP/BLOCK/ISOLATE decision are measured here on a seeded synthetic operator; a production baseline forms online over roughly two weeks.