Compiled Twin & SIF¶
The digital twin stores raw data — facts, exercise results, connector syncs, events. The compiled twin transforms this into a dense, token-efficient representation that AI agents can consume in a single context load.
What Is Compilation?¶
Compilation takes all twin data and produces a structured output in the Salient Intelligence Format (SIF). This process:
- Aggregates facts by category and confidence level
- Computes current maturity scores per NIST CSF function
- Identifies active gaps and their recurrence patterns
- Detects contradictions between declared and observed posture
- Calculates trajectory (improving, stable, declining)
- Compresses everything using SIF's schema-header notation
The result is your organization's security posture in a format optimized for AI consumption.
Three Tiers¶
The compiled twin is available at three detail levels:
Tier 1 — Executive (~150 tokens)¶
Everything a CISO or AI agent needs for quick context. Organization identity, NIST CSF scores with trends, critical gaps, and trajectory.
@ORG AcmeCorp ind:MFG emp:250 it:3/MSP risk:moderate
@CTRL ID:65↑ PR:48→ DE:35↑ RS:55↑ RC:42→ | Σ:52↑8/mo
@GAPS.H no-escalation-afterhours(3x,RS.CO) mfa-vpn(2x,PR.AC)
Tier 2 — Standard (~800 tokens)¶
Adds identity posture from connectors, full tool inventory, all facts by confidence, exercise history, compliance scores, coverage analysis, and prioritized recommendations.
Tier 3 — Full (~3K tokens)¶
Deep dive with evidence chains for every fact, source quotes from exercises, full gap descriptions with remediation steps, event details, and connector raw data summaries.
Serving via MCP¶
The compiled twin is served as MCP resources with URI-based selection:
salient://twin/executive SIF Tier 1
salient://twin/standard SIF Tier 2
salient://twin/full SIF Tier 3
salient://twin/executive.md Markdown rendering
salient://twin/schema Schema header only
Using the compiled twin
An AI agent working on an incident response can load salient://twin/standard into its context — 800 tokens gives it full organizational awareness: what tools are deployed, what the team has practiced, where gaps exist, and what the current maturity trajectory looks like.
Auto-Recompilation¶
The intelligence loop triggers recompilation whenever twin data changes:
- After an exercise is scored and facts are mined
- After a connector sync completes
- After an artifact is uploaded and processed
- After a sibling MCP ingestion
Compiled output is cached and invalidated on change. The MCP server always returns the latest compilation.
Output Formats¶
The same compiler produces multiple formats from the same data:
| Format | Use Case |
|---|---|
| SIF | AI agent context (token-optimized) |
| Markdown | Human reading, documentation |
| JSON | Programmatic API access |
| Board reports (via posture report endpoint) |