Cyber Detection Validation

Priority: P0 (CRITICAL)

No defensive outcome without linked action and observation evidence.

Input: control hypothesis, permitted action, scope/approval, mode (analysis, replay, isolated-lab-validation, defensive-verification), entity, window, expected observation, stop condition. Process: classify active effects (active: true for any interaction outside supplied-artifact reasoning; reading supplied events/files is non-active analysis); verify fresh host gate before active actions; capture ActionReceipt and ObservationRecord; enforce transitive binding chain: ObservationRecord.action_receipt_ref -> ActionReceipt.gate_ref -> GateDecision.request_ref -> ActionRequest. Output: purple outcome enum, finding status, evidence references, limitations, stage fidelity, owner.

Workflow

1. Declare step mode and effects: analysis, replay, isolated-lab-validation, or defensive-verification.
2. Preflight host gate for active effects: evaluate ActionRequest and GateDecision immediately before dispatch.
3. Execute bounded action; bind ActionReceipt to correlation key (run_id, attempt_id, test_id).
4. Capture ObservationRecord within defined time window; enforce unique observation_id and transitive binding chain.
5. Classify purple defensive outcome: blocked, prevented, detected, responded, or telemetry-gap.
6. Report stage fidelity: replay reports only exercised stages (e.g., parsing/correlation); lab reports observed sensor/control stages.
7. Run teardown plan; record CleanupResult (verified-clean, residual, unverified, not-applicable).