Adopt an Engage-aligned adversary engagement model across the Azazel System

[01rabbit]

Summary

Define and adopt a MITRE Engage-aligned adversary engagement model across the Azazel System without weakening deterministic, local-first, advisory-only, bounded-action, and fail-closed guarantees.

This is the system-level doctrine and coordination issue. Product-specific implementation remains in each repository.

Current series responsibility model

• Azazel defines doctrine, terminology, safety boundaries, naming, and cross-product responsibility.
• Azazel-Fabric Contract (AZ-05) defines shared engagement and deception-environment contracts and event vocabulary, but no decision logic.
• Azazel-Edge Gateway (AZ-01) builds engagement candidates, makes the final deterministic decision, controls routing/exposure/budgets, and owns activation, downgrade, and termination authority.
• Azazel-Deception Host (AZ-06, THEATRE) materializes Edge-approved coherent deception environments, executes only approved finite-state transitions, records outcomes, and resets. Repository: https://github.com/01rabbit/Azazel-Deception
• Azazel-Gadget Shield (AZ-02) supports only constrained, mode-bound Engage-lite profiles suitable for personal tactical defense.
• Azazel-Knowledge Advisor (AZ-04) correlates ATT&CK/CTI and attacker reactions, evaluates prior effectiveness, and returns advisory-only posture suggestions.
• Azazel-Boot Probe (AZ-03) remains observation-first until its repository and safety model exist.

Core rule

Engage expresses intent. Knowledge advises. Fabric describes. Edge decides and enforces. Deception Host materializes, transitions, records, and resets. Gadget executes only bounded local profiles.

Why AZ-06 exists

Delay/throttle/redirect can influence attacker tempo and action, but coherent deception requires an attacker-facing environment whose services, host history, synthetic artifacts, credentials, personas, and staged exposure remain internally consistent. That runtime responsibility does not belong in Edge's deterministic control plane.

AZ-06 therefore provides a separate Engagement Environment Plane while preserving Edge authority and production-path availability.

Required doctrine

• Define adversary engagement, cyber denial, deception, channeling, collection, materialization, termination, and reset in Azazel terminology.
• Explain the relationship among ATT&CK, MITRE Engage, Behavioral CTI, delaying action, Edge routing, and AZ-06 deception environments.
• Preserve the rule that AI may explain or assist preparation but never select or execute core live actions.
• Explicitly prohibit hack-back, attacker-system compromise, uncontrolled decoy egress, autonomous retaliation, production access from decoys, and unbounded engagement.
• Require maximum duration, scope, resource limits, production isolation, operator visibility, termination conditions, reset proof, and audit evidence for every engagement-capable profile.
• Distinguish observed interaction/reaction/outcome from unsupported claims that an attacker believed the deception.
• Public wording uses Engage-aligned or Engage-informed, not certification/compliance claims.

Cross-repository implementation

• Define shared adversary-engagement contracts and safety invariants Azazel-Fabric#8 — shared Engage contracts and safety invariants
• Define canonical deception-environment contracts for AZ-06 Azazel-Deception Host Azazel-Fabric#9 — AZ-06 deception-environment/capability/runtime contracts and golden fixtures
• Add Engage-aligned engagement candidates to the deterministic decision loop Azazel-Edge#319 — engagement candidates in the deterministic Action Arbiter
• Integrate AZ-06 Azazel-Deception Host under deterministic Edge authority Azazel-Edge#325 — AZ-06 activation, routing, capability validation, lifecycle, downgrade, and termination
• Implement mode-bound Engage-lite profiles for portable tactical defense Azazel-Gadget#16 — mode-bound Engage-lite profiles
• Define Engage-lite compatibility boundary with AZ-06 Azazel-Deception Host Azazel-Gadget#17 — AZ-06-compatible fixed-profile boundary
• 01rabbit/Azazel-Knowledge#52 — engagement-effectiveness advisory
• 01rabbit/Azazel-Knowledge#58 — AZ-06 narrative/runtime/tier-aware effectiveness analysis
• Create and bootstrap 01rabbit/Azazel-Deception
• Add cross-repository replay, failure, compatibility, provenance, isolation, reset, and safety test orchestration after contracts stabilize

Recommended implementation order

1. Ratify doctrine, naming, AZ-06 boundary, and non-goals — done for AZ-06 bootstrap.
2. Reconcile Fabric consumer status and release additive Engage/deception contracts.
3. Adapt AZ-06 bootstrap schemas to canonical Fabric contracts and add signed OCI provenance/golden fixtures.
4. Implement Edge + AZ-06 shadow/replay integration with live execution disabled.
5. Prove isolation, resource limits, evidence export, termination, and deterministic reset on ARM64 and AMD64.
6. Enable one static live reference environment behind an explicit feature flag.
7. Implement Knowledge outcome ingest/advisory.
8. Add Gadget's constrained compatible static subset.
9. Run cross-repository adversarial/failure review before broader live profiles.

Acceptance criteria

• Responsibilities are explicit for every AZ class.
• Edge remains the only full engagement activation/transition authority.
• AZ-06 cannot infer authority from package content, Fabric data, Knowledge advice, or local capability.
• Safety/non-goal statements are testable.
• System remains functional when Knowledge or AZ-06 is absent, slow, malformed, unsupported, or wrong.
• No shared contract carries a directive that bypasses product-local authority.
• No decoy route or credential can reach protected production assets.
• Public claims distinguish denial/delay, deception, and measured effectiveness.

[01rabbit]

AZ-06 extension

The Engage-aligned system model has been extended with a proposed dedicated Engagement Environment Plane:

• Bootstrap and evolve AZ-06 Azazel-Deception Host as the Engagement Environment Plane #61 — establish provisional AZ-06 Azazel-Deception Host
• Define canonical deception-environment contracts for AZ-06 Azazel-Deception Host Azazel-Fabric#9 — shared deception-environment contracts
• Integrate AZ-06 Azazel-Deception Host under deterministic Edge authority Azazel-Edge#325 — external host integration under deterministic Edge authority
• 01rabbit/Azazel-Knowledge#58 — narrative and environment effectiveness analysis
• Define Engage-lite compatibility boundary with AZ-06 Azazel-Deception Host Azazel-Gadget#17 — fixed Engage-lite boundary and compatibility

The responsibility rule is refined as follows:

Engage expresses intent. Knowledge advises. Fabric describes. Edge decides and enforces. Deception Host materializes, transitions, records, and resets.

This does not replace the current work in #60 or its original children. It separates attacker-facing environment generation and runtime from the Edge decision plane while retaining the same bounded-action, offline-first, advisory-only, and fail-closed guarantees.

[01rabbit]

AZ-06 container-first execution-plane refinement

The Engage-aligned system model now includes a proposed, separate Azazel-Deception Host execution plane tracked in #61. Its architecture is documented at docs/concepts/azazel-deception-host-container-first.md.

Refined system rule:

Engage expresses intent. Knowledge advises. Fabric describes. Edge decides and enforces. Deception Host materializes, transitions, records, and resets.

Key implications for this parent issue:

• AZ-06 is container-first and capability-aware, not Raspberry Pi-specific.
• Phase 1 uses OCI images for linux/arm64 and linux/amd64 with Docker Compose.
• Pi 5 is the minimum lightweight reference host; x86 mini PCs and later KVM/cluster profiles scale capacity without changing package identity or Edge authority.
• Fabric describes capabilities, requirements, tiers, images, and lifecycle records.
• Edge approves the profile, capability class, budgets, routing, transitions, and termination, but does not become a general-purpose scheduler.
• LLM is optional and preparation-oriented; live approved packages must not depend on it.
• Edge co-location is limited to bounded development/demo profiles; separated field deployment remains preferred.

Related implementation tracking: Azazel-Fabric#9, Azazel-Edge#325, Azazel-Knowledge#58, and Azazel-Gadget#17.

[01rabbit]

Relationship to 2027–2028 research doctrine

Keep this issue open as the Engage / bounded adversary-engagement doctrine. It is not replaced by #64.

#64 adds the higher-level Active Cyber Defense research model:

• Real / Perceived Terrain;
• Adversary Tempo and measurable Defensive Initiative;
• evidence-bounded Adversary Belief State;
• tool-independent Defensive Effects;
• M.I.O. counterfactual planning / preserved dissent / operator co-adaptation.

Engage/AZ-06 therefore becomes one materialization/observation mechanism inside the broader #64 control-plane research, not the entire Azazel north star.

Status correction: Edge #319 is already completed; do not use the unchecked #319 box in this older body as current implementation status. Live AZ-06 authority/security work remains owned by Edge #325/#358 and AZ-06/Fabric dependencies.

[01rabbit]

Program status after BHUSA / Black Hat Europe CFP submission

This issue remains the Engage-aligned safety/responsibility foundation, but it is no longer the top-level research roadmap.

Current north star / execution ownership:

• [research doctrine] Azazel 2027–2028: Dual-Terrain Co-Adaptive Active Cyber Defense #64 — series-wide Co-Adaptive Active Cyber Defense doctrine
• [program] Post-BHUSA Azazel Series research program — system-wide co-adaptive Active Cyber Defense #66 — post-BHUSA system-wide research program and cross-product gates
• [review] Series-wide adversarial differentiation gate — prove the integrated Azazel System beats strong simpler baselines #67 — series-wide hostile differentiation gate

Engage terminology and safety boundaries remain valid inputs. However, future work must be judged by measurable Defensive Initiative, Presented Terrain honesty, Outcome Memory/replay, strong-baseline comparison, and cross-product authority discipline rather than by Engage feature coverage alone.