Correct related-work framing

[jonathanjasare]

Summary

• Correct the related-work framing so Tripwire does not imply that cross-event agent detection is novel.
• Add the closest verified neighbours: AgentShield sigma-ai, Netzilo AIDR Sigma, and Timescale RSigma.
• Define Tripwire's narrower contribution as reproducible labelled measurement, frozen-holdout discipline, and the provenance-granularity finding.
• Record RSigma as a candidate substrate to evaluate before implementing a future streaming correlation backend.
• Keep the generated README and its reporting source aligned, with acceptance coverage for the published framing.

Why

The previous wording contrasted ATR's event rules with Tripwire's ordered matching and therefore understated existing sequence-detection work. Several agent-security projects already implement temporal or graph-based multi-event correlation. The report should position Tripwire on what this repository actually demonstrates rather than on mechanism novelty.

Source verification

• agentshield-ai/sigma-ai documents temporal correlation fields and sequence rules such as web-browse then execute.
• netzilo/aidr-sigma describes a persistent per-session behaviour graph for multi-step attack patterns.
• timescale/rsigma documents in-process stateful correlation, corpus backtesting, persistent state, and OTLP ingestion.
• cveye/agentsigma remains correctly linked and characterised as Sigma-compatible runtime detection for the agent tool-call layer.

Impact and scope

Documentation and generated-report assertions only. This does not change TW-001, the corpus, labels, taxonomy, split, dependencies, or measured counts. It does not select RSigma as a dependency or begin M3 backend work. Repository visibility remains private.

Verification

• uv run tripwire verify: TP 6, FP 1, TN 36, FN 11
• 30 tests passed
• mypy passed for src and tests
• Ruff passed
• source distribution and wheel built successfully
• git diff --check passed

[jonathanjasare]

Verification and review complete.

• uv run tripwire verify: TP 6, FP 1, TN 36, FN 11; fixtures 1 TP / 2 TN
• Test suite: 30 passed
• mypy: passed
• Ruff: passed
• Package build: source distribution and wheel succeeded
• git diff --check: passed
• Scope audit: no changes to TW-001, corpus, labels, taxonomy, split, dependencies, or measured counts

Primary-source review confirmed the three added neighbours:

• AgentShield sigma-ai: temporal correlation for sequential agent events
• AIDR Sigma: persistent per-session behaviour graph for multi-step patterns
• RSigma: in-process stateful correlation and OTLP ingest

The final wording explicitly treats cross-event detection as established prior art. Tripwire's contribution is limited to its reproducible labelled measurement, frozen holdout, and provenance-granularity finding. RSigma is identified only as a future evaluation candidate, not adopted as a dependency.

Repository visibility remains private.