INT-CoT

INT-CoT scores a model’s reasoning trace for divergence from the stated task. It is a chain-of-thought integrity classifier, not a harmful-content classifier. Content safety stays with INT-Input and INT-Output. The gateway runs INT-CoT after a buffered response is available. It is also available as an experimental SDK check.

What it detects#

Divergence between what a model says it is doing and the task it was given. The classifier chunks the supplied trace and computes a running score across those chunks. The gateway runs it for non-streaming and buffered responses. Chat requests served incrementally do not run INT-CoT; an Enforce request that falls back to buffered handling can run it there. The classes it is trained on:

• Instruction hijack. The reasoning adopts an objective injected through content.
• Goal substitution. The trace drifts to a different objective than the user’s.
• Deceptive alignment. The stated reasoning misrepresents the intended action.
• CoT and output mismatch. The reasoning and the final output disagree.
• Unsupported action. An action the reasoning does not justify.

Conjunction-only by design#

A reasoning trace is observed, never trusted as ground truth. Chain-of-thought can be unfaithful to what a model is actually doing, so INT-CoT never blocks a request on its own. The gateway can use it only to raise the severity of an independently flagged tool call or output. The runtime behavior is fixed:

• Default-off. Inert until a project explicitly opts in.
• No independent block. A CoT result by itself cannot become unsafe or block.
• Conjunction gate. The score must cross its calibrated threshold, still be rising, and coincide with a flagged INT-Tooling or INT-Output result. The gateway then treats that action result as unsafe and sends it through the existing informed-retry and block policy.
• Verdict ceiling. It returns at most flagged, never unsafe or block.
• Fail-open. Any error is a benign skip, so the layer can never break a request.
• Threshold provenance. The classifier exact-matches the supplied source_model against measured per-model calibration first. A current model may use an explicitly declared family_proxy inherited from a related, calibrated model; this remains non-exact and does not certify production enforcement. Unknown models use the global fallback. See Thresholds and calibration.

Result fields#

REST response fields. SDK results expose score, label, threshold, rising, verdict, reason_codes, and latency_ms directly. Access decision_chunk and chunk_count through the SDK result’s raw payload.

The SDKs also expose is_divergent (Python) and isDivergent (TypeScript), computed as score >= threshold. They are not aliases for verdict: a weak-divergence score below the threshold can still return the advisory flagged verdict. Threshold provenance is available as threshold_source / thresholdSource and threshold_source_model / thresholdSourceModel.

Gateway span fields. On buffered paths, each successful provider response emits one guard.cot_integrity span with status, verdict, and reason_codes. When scoring runs, the span also carries score, threshold, threshold_source, threshold_source_model, rising, decision_chunk, transport, service_elapsed_ms, and model_latency_ms. The gateway wrapper does not currently copy label or chunk_count into that span. An activated conjunction also emits a guardrail.cot_integrity_conjunction span and adds the conjunction reason to the escalated action result.

Reason codes#

Enabling INT-CoT#

INT-CoT is off by default. Turn it on per project under runtime policy:

{
  "detector_config": {
    "proxy_runtime": {
      "classifiers": {
        "cot_integrity": { "enabled": true }
      }
    }
  }
}

SDK usage#

INT-CoT is available as an experimental SDK check. It returns a score and advisory verdict. Treat the standalone result as an advisory signal, not as an independent action gate. Pass the exact model identifier that generated the trace so the classifier can select a known source-model threshold.

cot = triage_sdk.cot.check(
    reasoning_text=reasoning_trace,
    final_output=model_response,
    source_model="gpt-5.6-sol",
    session_id="sess_abc123",
)

if cot.verdict == "flagged":
    print(cot.score, cot.reason_codes)

gpt-5.6-sol currently uses a family_proxy inherited from the exactly calibrated gpt-5.5 threshold. claude-opus-4-8 similarly inherits from claude-fable-5. These are operational defaults, not measured target-model calibration, so exact enforcement certification remains blocked. Model aliases such as gpt-5.6 do not match gpt-5.6-sol and use the global fallback. See the current calibrated source-model list.

Gate your own allow and block decisions on INT-Input, INT-Tooling, and INT-Output.