Phase 4.5 — Intelligence Layer

What Phase 4.5 Delivers

This phase makes IBEX observably trustworthy over time. It does not change what an agent sees on any single request (no hot-path injection changes) — it only watches, measures, and alerts. Nothing here can change agent behavior automatically in this phase; auto-remediation is an explicit non-goal until the statistical methodology has a track record.

What changed from the original design

The original design had five statistical problems this redesign fixes:

Z-score assumes Gaussian distributions — token counts and response lengths are right-skewed. Replaced with Kolmogorov-Smirnov tests on t-digest quantile sketches.
Static baseline cannot distinguish gradual drift from sudden regression — replaced with river's ADWIN (Adaptive Windowing) detector.
Single embedding centroid smears multi-modal behavior — replaced with k-means sub-clusters per window.
KL divergence is undefined on zero-probability events — replaced with Jensen-Shannon divergence with Laplace smoothing.
Auto-suspend on uncalibrated thresholds — replaced with a staged rollout (shadow → notify-only → auto-suspend opt-in).

Phase 4.5 Tracks

Track	Theme	Key Milestones
A	Behavioral Fingerprint Computation	4.5.A.1 (feature extraction with t-digest/clustering), 4.5.A.2 (schema migration), 4.5.A.3 (trigger scheduling)
B	Drift Detection Engine	4.5.B.1 (distribution-aware drift tests), 4.5.B.2 (threshold calibration), 4.5.B.3 (severity aggregation + staged action ladder)
C	Directive Regression Testing	4.5.C.1 (scenario management), 4.5.C.2 (regression runner with LLM judge), 4.5.C.3 (promotion gate + gradual rollout), 4.5.C.4 (dashboard integration)
D	Exit Gate	4.5.D.1 (cross-track integration tests INT-4.5.*), 4.5.D.2 (e2e + Playwright), 4.5.D.3 (benchmark sign-off), 4.5.D.4 (gap register)

Key Design Decisions

Quantile sketches (t-digest): Store distribution shape, not just mean/std. Enables KS-test comparison instead of z-score.
Jensen-Shannon divergence: Symmetric, bounded, no infinite-blowup on new tool types. Laplace smoothing eliminates zero-probability edge cases.
Multi-centroid clusters: k-means with k=3–5 per window (silhouette-selected). Detects "new behavior mode appeared" directly.
ADWIN (Adaptive Windowing): From the river library. Automatically maintains variable-size window and flags drift with proven false-positive rate bound.
Calibrated thresholds: Not arbitrary constants. Calibration procedure targets <=2% false-positive rate per week per agent, documented in ADR.
Staged action ladder: Shadow (mandatory 30 days) → Notify-only (opt-in) → Auto-suspend (opt-in, off by default). Auto-remediation never a global default.
Regression runner routes through real proxy: Tests the exact injection/formatting/token-budget code path, not a bespoke harness.
LLM judge majority vote (3 runs): Non-deterministic judges need repeated evaluation. Judge disagreement rate tracked as its own metric.

Exit Criteria

Gap register published, zero open P0 gaps
All 10 INT-4.5 integration cases pass with real containers
intelligence-integration CI check required on main
Cross-tenant isolation independently verified for fingerprint/drift tables
Fingerprint/drift computation stays fully off the proxy hot path (benchmarked)
All Phase 1–4 regression suites still green
Dashboard Playwright flow (drift alert → regression → promotion) green
current-state.mdx and roadmap snapshot updated