zeekayandHanzo Dev 5736ea8168 anomaly: record the measured per-tenant cost and the design in LLM.md ...

The memory bound in Config was an arithmetic estimate; it is now the figure a
test measures (336 KB per tenant at the defaults, 84 MB at MaxOrgs=256), so the
number an operator sizes against and the number the code enforces are the same
one.

LLM.md gains the reasoning a later reader needs and cannot recover from the
code: why half-space trees rather than isolation forest or robust random cut
forest, the two places this implementation departs from the paper and what each
departure buys, why attributability rather than accuracy decided the choice, and
what the appetite governs. The departures matter most — averaging clamped
per-tree votes instead of summing raw masses is the difference between a score
that ranks and a score a quantile can be cut from, and a reader who assumes the
paper's aggregation would reintroduce the fault.

Co-authored-by: Hanzo Dev <[email protected]>

2026-07-29 11:17:01 -07:00

..

anomaly_test.go

token: compare the mac, not the label, when checking domain separation

2026-07-29 11:14:53 -07:00

anomaly.go

anomaly: record the measured per-tenant cost and the design in LLM.md

2026-07-29 11:17:01 -07:00

feature.go

token: compare the mac, not the label, when checking domain separation

2026-07-29 11:14:53 -07:00

forest.go

aml: anomaly scoring, retention, tokenisation, replay, reference data

2026-07-29 11:04:33 -07:00