docs(examples): add tripwire external project guide

examples/README.md

@@ -9,7 +9,8 @@ New to SIE? Start with the **[quickstart notebook](./quickstart.ipynb)** [![Open
 Use this table to pick the right starting point. "Runnable" means the
 example has code, sample data or data-fetch instructions, and a documented
 local path. "Advanced" examples may require a custom SIE image or third-party
-service keys.
+service keys. "External project guide" means docs-only onboarding that deep-links
+to a separately maintained repository (clone and run there).
 
 | Example | Best for | SIE primitives | Setup | Status |
 |---|---|---|---|---|
@@ -33,6 +34,7 @@ service keys.
 | [Reconstruct a bearing failure](./maintenance-triage-agent) | Turning the NTSB's three East Palestine detector readings into a cited temperature and alert sequence without adding a new causal claim | `extract`, `encode`, `score` | SIE endpoint; standalone `uv` project; exact NTSB illustrated report spread | Runnable agent example |
 | [Make a shelf gap auditable](./retail-shelf-audit) | Detecting one empty facing, deriving its notice and shelf-label crops by geometry, then preserving OCR evidence | `extract` | GPU SIE deployment; standalone `uv` project; CC0 supermarket shelf image and recorded direct-checkpoint evidence included | Runnable evaluation example |
 | [A behavioural gate that catches hijacked AI agents by their actions, not their credentials](./agent-action-monitor) | Judging a proposed AI agent action against that agent's own learned baseline in real time, before it reaches a downstream system | `encode`, `score`, `extract` | Docker Compose (gate + self-hosted SIE + n8n + mock downstream), no API key required | Runnable demo |
+| [Scan AI skills and MCP servers, then triage with SIE](./tripwire) | Discovering and scanning AI skills/MCP servers, then optionally routing findings with Superlinked SIE | `generate` | External repo; Mock demo local; Live needs Supabase + Modal; SIE keys optional | External project guide |
 
 For docs publishing, lead with the quickest runnable demos, then use the
 benchmark and evaluation examples for deeper technical users.

examples/tripwire/README.md

@@ -0,0 +1,49 @@
+# Scan AI skills and MCP servers, then triage with SIE
+
+> Tripwire is a metal detector for AI tools — discover, scan in isolation, review
+> findings in one dashboard. Optional Superlinked SIE routes findings after Live scans.
+
+This is an **external project guide**. The runnable app lives in
+[neomatrix369/tripwire](https://github.com/neomatrix369/tripwire).
+This folder is the SIE-facing onboarding surface: short pages here, full detail
+in that repo.
+
+**SIE primitives used:** `generate` (chat completions via OpenAI-compatible
+`/v1/chat/completions` for post-scan triage). SIE is **optional** — Mock demo and
+Live scans work without it; routing runs only when `SIE_*` keys are set.
+
+## Who this is for
+
+| You are… | Start here |
+|---|---|
+| New to SIE, found this in the gallery | [Getting started](./getting-started.md) → [SIE integration](./sie-integration.md) |
+| New to Tripwire, want SIE triage | Same path — then [What SIE does here](./what-sie-does.md) |
+
+Happy path for SIE: Mock demo first → Live scan (Supabase + Modal) → enable
+hosted SIE → `tripwire route` (or auto-route after scan).
+
+## Start here
+
+1. [Getting started](./getting-started.md) — clone, Mock demo, then Live prerequisites
+2. [SIE integration](./sie-integration.md) — `SIE_*` keys, verify, route a batch
+3. [What SIE does here](./what-sie-does.md) — tiered router, Model Studio escalation
+4. [Troubleshooting](./troubleshooting.md) — short FAQ + deep-links
+
+**Canonical docs in the project:**
+[QUICKSTART](https://github.com/neomatrix369/tripwire/blob/main/QUICKSTART.md) ·
+[SIE setup](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/sie-setup.md) ·
+[docs hub](https://github.com/neomatrix369/tripwire/blob/main/docs/README.md)
+
+## Ports cheat sheet
+
+| Service | Port | Notes |
+|---|---|---|
+| Dashboard | `8765` | `node scripts/serve-dashboard.mjs` |
+| SIE | Hosted | `https://api.superlinked.com` or EU endpoint — not self-hosted by default |
+
+## Attribution
+
+Built and maintained in
+[neomatrix369/tripwire](https://github.com/neomatrix369/tripwire)
+([license](https://github.com/neomatrix369/tripwire/blob/main/LICENSE)).
+Architecture and deeper guides live in that repository.

examples/tripwire/getting-started.md

@@ -0,0 +1,60 @@
+# Getting started (Mock first, then Live)
+
+Goal: install the Tripwire CLI and see the Mock dashboard before adding cloud
+accounts or SIE.
+
+**Source of truth:**
+[QUICKSTART.md](https://github.com/neomatrix369/tripwire/blob/main/QUICKSTART.md).
+
+## Prerequisites
+
+- Node.js **22**
+- Python **3.12** (scanners / tooling)
+- Git and npm
+- For **Live** only: Modal CLI (`pip install modal`) before `./scripts/setup-modal.sh` —
+  see [modal-setup.md](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/modal-setup.md)
+
+Details: [prerequisites.md](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/prerequisites.md).
+
+## Mock demo (no cloud accounts)
+
+```bash
+git clone https://github.com/neomatrix369/tripwire.git
+cd tripwire
+cd cli && npm install && npm link && cd ..
+
+tripwire scan --dry-discover ./fixtures/skills/safe-csv-cleaner
+node scripts/serve-dashboard.mjs
+```
+
+Open **http://127.0.0.1:8765/** → choose **Mock (demo data)** in Guard.
+
+More commands:
+[setup-commands.md](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/setup-commands.md).
+
+## Live path (before SIE)
+
+SIE routing expects a completed **Live** scan batch. Minimum Viable Live:
+**Supabase + Modal** (scanner vendor keys are optional and soft-skip if missing).
+
+1. Accounts: [supabase-setup](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/supabase-setup.md) →
+   [modal-setup](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/modal-setup.md)
+2. Keys: [env-vars.md](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/env-vars.md)
+3. Bootstrap:
+
+```bash
+cp .env.example .env
+# fill SUPABASE_* and MODAL_TOKEN_* (and scanners you want)
+tripwire setup
+./scripts/setup-modal.sh
+tripwire scan ./fixtures/skills/safe-csv-cleaner
+node scripts/serve-dashboard.mjs
+# Open Live (Supabase) in the dashboard
+```
+
+Full Live checklist:
+[QUICKSTART — Live](https://github.com/neomatrix369/tripwire/blob/main/QUICKSTART.md#live-advanced).
+
+## Next
+
+Enable Superlinked routing: [SIE integration](./sie-integration.md).

examples/tripwire/sie-integration.md

@@ -0,0 +1,79 @@
+# SIE integration (tiered router)
+
+Routing is **optional**. Without the keys below, auto-route warns and skips; the
+scan itself still succeeds.
+
+**Source of truth:**
+[docs/user-guide/sie-setup.md](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/sie-setup.md).
+
+Finish a Live scan path from [Getting started](./getting-started.md) before
+relying on routing in the product UI.
+
+## Happy path — hosted Superlinked gateway
+
+1. Sign in at [console.superlinked.com](https://console.superlinked.com) → **Keys**.
+2. Put values in the **repo-root** `.env` (product CLI does **not** load
+   `prototypes/.env`):
+
+```bash
+SIE_ENDPOINT=https://api.superlinked.com
+# EU: https://eu.api.superlinked.com
+SIE_API_KEY=sk-sie-…
+# optional
+SIE_MODEL=gen-4b
+```
+
+3. For `tripwire route` / auto-route, also set Model Studio credentials in the
+   **same** repo-root `.env`. Today `resolveRouteConfig()` validates
+   `ALIBABA_OPENAI_BASE_URL` and `DASHSCOPE_API_KEY` up front (escalation still
+   runs only when SIE signals conflict / unusual status / low confidence):
+
+```bash
+ALIBABA_OPENAI_BASE_URL=https://…/compatible-mode/v1
+DASHSCOPE_API_KEY=sk-…
+```
+
+Key map:
+[env-vars — tiered router](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/env-vars.md#optional--tiered-router-sie--model-studio).
+
+## Verify SIE alone
+
+The sample CLI does **not** read the repo-root `.env`. Put the same `SIE_*`
+values in `prototypes/.env` or `prototypes/sie-studio/.env`, or export
+`SIE_API_KEY` / `SIE_ENDPOINT` in the shell:
+
+```bash
+cd prototypes/sie-studio
+python3 sie_studio.py list
+python3 sie_studio.py generate "Reply with one word: ok" --model gen-4b
+```
+
+Sample CLI notes:
+[prototypes/sie-studio](https://github.com/neomatrix369/tripwire/blob/main/prototypes/sie-studio/README.md).
+
+## Route after a Live scan
+
+```bash
+tripwire scan ./fixtures/skills/safe-csv-cleaner   # auto-routes when router keys set
+# or
+tripwire route --batch-id <batch_id>
+node scripts/serve-dashboard.mjs
+```
+
+Look for pathway strips (Scan → SIE → …) and filters (**Escalated** / **SIE-only**):
+[reading-router-results.md](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/reading-router-results.md).
+
+**First success:** a batch shows SIE routing strips in the Live dashboard (or
+`tripwire route` completes without skipping for missing keys).
+
+## Model Studio (required for route config; used on escalate)
+
+Configure Part B in
+[model-studio-setup.md](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/model-studio-setup.md)
+before expecting pathway strips. Review billing/quotas first. Alibaba calls run
+only when SIE escalates; missing MS keys still cause auto-route to skip today.
+
+## Next
+
+Understand the router design: [What SIE does here](./what-sie-does.md).
+Stuck? [Troubleshooting](./troubleshooting.md).

examples/tripwire/troubleshooting.md

@@ -0,0 +1,43 @@
+# Troubleshooting (SIE / router-focused)
+
+Short FAQ for gallery readers. Full guides:
+[sie-setup.md](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/sie-setup.md),
+[model-studio-setup.md](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/model-studio-setup.md),
+[setup-commands — when it fails](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/setup-commands.md#when-it-fails),
+[env-vars.md](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/env-vars.md).
+
+## Route warns and skips
+
+Missing `SIE_ENDPOINT` / `SIE_API_KEY` **or** `ALIBABA_OPENAI_BASE_URL` /
+`DASHSCOPE_API_KEY` from **repo-root** `.env`. The product CLI does not load
+`prototypes/.env`. Scan can still succeed; no `routing_review` rows are written.
+
+## `sie_studio.py` fails but `.env` looks fine
+
+Confirm keys are in `prototypes/.env` or `prototypes/sie-studio/.env` (or
+exported in the shell). The sample CLI does not load repo-root `.env`. Product
+routing still needs root `.env`.
+
+## No pathway strips in the dashboard
+
+- You are on **Mock** — switch to **Live (Supabase)** after a real scan
+- Batch was never routed — run `tripwire route --batch-id …` or re-scan with
+  router keys set (`SIE_*` and Model Studio)
+- Read filters: [reading-router-results.md](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/reading-router-results.md)
+
+## Live scan “all clear” but a scanner was missing
+
+Missing scanner keys **soft-skip** that engine — not a clean bill of health.
+MVP Live only needs Supabase + Modal.
+
+## Model Studio never runs (no Alibaba calls)
+
+Expected unless SIE escalates. Keys must still be present for route config; check
+`DASHSCOPE_*` / region endpoint in [model-studio-setup](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/model-studio-setup.md).
+
+## Still stuck?
+
+1. [QUICKSTART](https://github.com/neomatrix369/tripwire/blob/main/QUICKSTART.md)  
+2. [docs hub](https://github.com/neomatrix369/tripwire/blob/main/docs/README.md)  
+3. Open an issue on
+   [neomatrix369/tripwire](https://github.com/neomatrix369/tripwire/issues)

examples/tripwire/what-sie-does.md

@@ -0,0 +1,56 @@
+# What SIE does in Tripwire
+
+Tripwire discovers AI skills and MCP servers, runs isolated safety scanners
+(Modal + Cisco / Snyk / Tessl, etc.), stores findings in Supabase, and shows them
+in one dashboard. **SIE is a post-scan tiered router**, not part of the core
+scan path.
+
+**Source of truth:**
+[sie-setup.md](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/sie-setup.md) ·
+[model-studio-setup.md](https://github.com/neomatrix369/tripwire/blob/main/docs/user-guide/model-studio-setup.md) ·
+[ADR-0016](https://github.com/neomatrix369/tripwire/blob/main/docs/adr/0016-tiered-router-sie-model-studio.md).
+
+## SIE primitives
+
+| Primitive | Role in this project |
+|---|---|
+| `generate` | Triage scanner findings via OpenAI-compatible chat (`/v1/chat/completions`) |
+
+Default model override: `SIE_MODEL` (default `gen-4b`). Endpoint + API key from
+`SIE_ENDPOINT` / `SIE_API_KEY`.
+
+## Flow
+
+```text
+Discover → Scan (Modal / scanners) → Store (Supabase)
+                                      │
+                                      ▼
+                         SIE triage (optional)
+                                      │
+                    escalate? ──yes──► Model Studio
+                         │
+                         ▼
+                    Dashboard pathway strips
+```
+
+Router findings use `scanner_source=tiered_router` and are excluded from severity
+rollups — triage is separate from scanner severity.
+
+## vs Mock and Live without SIE
+
+| Mode | Needs SIE? |
+|---|---|
+| Mock demo | No |
+| Live scan + dashboard | No |
+| Auto-route / `tripwire route` | Yes — `SIE_*` plus Model Studio keys (validated up front) |
+| Model Studio second hop | Same keys; Alibaba called only when SIE escalates |
+
+## Sample prototypes
+
+- [prototypes/sie-studio](https://github.com/neomatrix369/tripwire/tree/main/prototypes/sie-studio) — list / generate against SIE
+- [prototypes/model-studio](https://github.com/neomatrix369/tripwire/tree/main/prototypes/model-studio) — escalation sample
+
+## Next
+
+Wire keys and route: [SIE integration](./sie-integration.md). Problems:
+[Troubleshooting](./troubleshooting.md).