Limits
SIR's public claim is bounded by its published rules, coverage data, and falsification conditions. The gaps are named, not hidden.
Runtime coverage
This table is rendered from coverage.json. It lists each included pack's full-gate covered count and every row ID not covered by the full gate.
Includes active registry packs with public or encoded visibility; draft and internal packs are excluded.
Snapshot as at 1 November 2026.
Showing the last published snapshot; live index unavailable.
| Pack | Version | Visibility | Rows | Covered | Uncovered row IDs |
|---|---|---|---|---|---|
| generic_safety | 1.0.0 | public | 100 | 100 | None named |
| mental_health_clinical | 1.0.0 | encoded | 15 | 5 | mh-block-003, mh-block-006, mh-block-007, mh-block-008, mh-block-009, mh-block-010, mh-block-012, mh-block-013, mh-block-014, mh-block-015 |
| account_recovery_fraud | 1.0.0 | public | 5 | 0 | arf-002, arf-003, arf-005, arf-006, arf-008 |
| support_operator_override | 1.0.0 | public | 26 | 26 | None named |
| data_exfiltration_pressure | 1.0.0 | public | 27 | 27 | None named |
| eu_ai_act_compliance_pressure | 1.0.0 | public | 100 | 74 | eua-116, eua-126, eua-127, eua-128, eua-129, eua-130, eua-131, eua-132, eua-133, eua-134, eua-135, eua-136, eua-137, eua-138, eua-139, eua-140, eua-141, eua-142, eua-143, eua-144, eua-145, eua-146, eua-147, eua-148, eua-149, eua-150 |
| scenario_injection_chain | 1.1.0 | public | 10 | 6 | t007_fictional_wrapper, t010_softened_bypass_language, t011_paraphrased_safety_removal, t012_punctuation_split_intent |
| scenario_tool_injection | 1.0.0 | public | 2 | 1 | t005_function_jailbreak |
Unpatched demonstration gap
The published coverage JSON names 26 uncovered rows in the EU AI Act pack. SDL does not patch those rows in this demonstration, because patching them would erase the demonstrated boundary between covered and uncovered behavior.
Integration constraints
Measured gate latency is published in the repository. Per-template input ceilings are an integration constraint; this static page does not embed numeric ceiling values because they are not exposed in the runtime JSON consumed here.
Supporting limits
Adversary model
Design constraints and adversary assumptions.
Failure behavior
What happens when SIR itself fails.
Negative tests
Deliberately invalid certificates for verifier testing.
Correction
A defect SDL found in its own published evidence, measured across published artefacts, and documented.
The limit that matters most
SIR's rules are published under MIT, which is deliberate: a rule set nobody can read is a claim nobody can check. The cost is that an attacker reads them too, and a request rephrased to miss a pattern is not covered by the pattern it missed. The worked example on the SIR page shows a verb and a target matching. It shows nothing about a request that avoids both.
SDL has measured this against an adversary given the published rules, and the result is not favourable: the gate was evaded on its own declared rule targets, at a low number of attempts, by rephrasings a person would recognise as the same request. The figures are deliberately not quoted here yet. They are a claim about this product, they have not been through the claims-register pass that every other figure on this site has been through, and putting them on a public page ahead of that pass is the thing this project exists to not do. The shape of the finding is stated here because omitting it from a page titled “what SIR does not cover” would be worse.
Read this as the reason the determinism is there. A gate that can be rephrased around is a weak control and a recomputable one, and only the second property survives an attacker. What SIR is for is a decision somebody can replay, not a decision nobody can get past.
Falsification condition
A leak of a covered row, or a block of an uncovered one, would falsify the bounded SIR claim for that run context.
Bring a bounded workflow and test that claim against your own operating conditions.