Doc-foundry automates and validates Sigma security detection rules

Doc-foundry uses a multi-agent workflow to transform CVEs or ATT&CK techniques into Sigma rules. It distinguishes itself by producing a proof bundle containing a positive corpus, a benign baseline, and a coverage label with FP/FN numbers.