[architecture] Standardize Azazel defensive-state doctrine and deterministic/AI responsibility model

[01rabbit]

Purpose

Establish a single, system-wide operating vocabulary and responsibility model for the Azazel System after the M.I.O. cognitive-plane design matured the Edge decision flow.

Two decisions are standardized by this issue:

1. Azazel-Edge outward defensive state is expressed only as:
   • OBSERVE
   • NOTIFY
   • THROTTLE
   • REDIRECT
   • ISOLATE
2. Azazel-Gadget adopts the deterministic Edge decision principle without requiring the on-prem/local LLM cognitive plane.

The intent is to remove ambiguous uses of the word "mode" across products and make system behavior explainable from one common model.

Canonical system flow

Evidence
  -> deterministic scoring / policy evaluation
  -> optional M.I.O. reasoning (Edge only, when available)
  -> deterministic Arbiter
  -> Defensive State
     OBSERVE | NOTIFY | THROTTLE | REDIRECT | ISOLATE
  -> enforcement / bounded deception / notification
  -> outcome evidence

Terminology rule

The word Mode must no longer be used as a generic synonym for threat severity, defensive action, AI capability, or UI state.

Use these terms instead:

• Defensive State — what the product is currently doing: OBSERVE / NOTIFY / THROTTLE / REDIRECT / ISOLATE.
• Threat Level — how severe/risky the observed situation is.
• Policy Profile — deterministic threshold/tuning set such as conservative/balanced/demo or future equivalents.
• AI Runtime Tier — M.I.O. inference capability such as deterministic-only/tiny-local/primary-local/local-accelerated.
• Engagement/Deception State — lifecycle of an approved bounded deception environment; never a synonym for Edge/Gadget Defensive State.
• Presentation State — UI-only condition such as WARNING/UNKNOWN; never an authority or action state.

Legacy names such as portal, shield, and scapegoat may remain temporarily for migration/backward compatibility or concept branding, but must not remain the primary cross-product state vocabulary.

Product responsibility model

Azazel-Edge (AZ-01)

• Evidence Plane + deterministic scoring/evaluation.
• M.I.O. optional cognitive reasoning plane.
• Action Arbiter remains sole decision authority.
• Exposes canonical Defensive State.
• M.I.O. failure must not stop deterministic operation.

Azazel-Gadget (AZ-02)

• Reuse the deterministic decision principle from Edge, adapted to constrained hardware.
• No mandatory local/on-prem LLM.
• Core flow:

Evidence -> Scoring/Policy -> Arbiter/FSM-equivalent -> Defensive State

• May later consume advisory reasoning from an upstream Edge/M.I.O. only through typed, bounded, non-authoritative contracts.
• Must remain fully useful while disconnected from Edge/M.I.O.

Azazel-Knowledge (AZ-04)

• Memory/advisory plane only.
• May enrich evidence/reasoning but never set Defensive State.
• Stores facts/outcomes separately from inference.

Azazel-Fabric (AZ-05)

• Own shared vocabulary/contracts where cross-product representation is needed.
• DefensiveState semantics must not imply execution authority.
• Preserve product-specific fields without reintroducing ambiguous generic mode semantics.

Azazel-Deception (AZ-06)

• Materializes only Edge/Gadget-approved bounded deception decisions.
• REDIRECT may lead to a deception environment, but Deception lifecycle state is separate from Defensive State.
• Must not switch Edge/Gadget state by itself.

Architectural interpretation

A useful shorthand for the mature Azazel System is:

• Gadget = Reflex — lightweight deterministic local response.
• Edge = Authority — deterministic decision and enforcement authority.
• M.I.O. = Cognition — hypothesis/falsification/evidence-gap reasoning, advisory only.
• Knowledge = Memory — long-term tactical memory/advisory context.
• Fabric = Language — shared contracts and semantics.
• Deception = Environment — bounded observation/engagement materialization.

This shorthand is explanatory only; repository contracts remain authoritative.

Migration requirements

• Audit all public/operator-facing uses of mode in Edge/Gadget and classify them as Defensive State, Policy Profile, AI Runtime Tier, Engagement State, Presentation State, or legacy compatibility.
• Remove/rename ambiguous UI labels.
• Preserve compatibility where required, but expose canonical normalized state alongside legacy fields during transition.
• Update docs and architecture diagrams.
• Add tests preventing cross-product semantic regression.
• Do not silently change live enforcement behavior during terminology migration.

Related implementation work

Child/cross-repo issues should be created in:

• 01rabbit/Azazel-Edge
• 01rabbit/Azazel-Gadget
• 01rabbit/Azazel-Fabric
• 01rabbit/Azazel-Knowledge
• 01rabbit/Azazel-Deception

Existing Gadget issues that currently make portal / shield / scapegoat authoritative must receive migration notes rather than being silently contradicted.

Acceptance criteria

• One canonical definition of Defensive State exists across Azazel docs/contracts.
• Edge exposes OBSERVE / NOTIFY / THROTTLE / REDIRECT / ISOLATE as its primary current-defense vocabulary.
• Gadget is specified as deterministic Edge-derived architecture without mandatory AI inference.
• Threat Level, Policy Profile, AI Runtime Tier, Engagement State, and Presentation State are clearly distinguished from Defensive State.
• Fabric contract semantics preserve the distinction without creating authority.
• Knowledge and Deception explicitly cannot set Defensive State.
• Legacy portal / shield / scapegoat terminology has an explicit migration/deprecation plan.
• Cross-repo docs and diagrams are aligned.

[01rabbit]

Cross-repo implementation index created from this doctrine:

• [architecture] Make Defensive State the canonical outward state vocabulary Azazel-Edge#379 — canonical Edge Defensive State vocabulary and terminology separation
• [architecture] Rebase Gadget on Edge deterministic decision doctrine without mandatory AI Azazel-Gadget#18 — deterministic Edge-derived Gadget architecture without mandatory AI
• [contracts] Define canonical DefensiveState vocabulary without conferring authority Azazel-Fabric#14 — shared DefensiveState contract semantics without authority
• 01rabbit/Azazel-Knowledge#65 — advisory/memory alignment; Knowledge cannot set state
• [integration] Separate Deception lifecycle state from Edge/Gadget Defensive State Azazel-Deception#28 — separate deception lifecycle from producer Defensive State

Existing Gadget issues updated with migration notes:

• [legacy/support roadmap] Common/Fabric migration, dev tooling, and advisory integration groundwork Azazel-Gadget#8
• Implement mode-bound Engage-lite profiles for portable tactical defense Azazel-Gadget#16
• Define Engage-lite compatibility boundary with AZ-06 Azazel-Deception Host Azazel-Gadget#17

M.I.O. epic 01rabbit/Azazel-Edge#360 also received the terminology/authority update.

Recommended implementation order:

1. Edge#379 + Gadget#18 architecture inventories
2. Fabric#14 shared contract decision
3. Edge/Gadget compatibility emission + tests
4. Knowledge#65 / Deception#28 integration alignment
5. operator docs/UI migration and legacy terminology deprecation

[01rabbit]

Defensive State vs next-generation Defensive Effect

#64 / Edge #391 introduces a new research abstraction named Defensive Effect. This does not replace or expand the canonical Defensive State vocabulary ratified here.

Keep the distinction:

• Defensive State = current outward posture: OBSERVE / NOTIFY / THROTTLE / REDIRECT / ISOLATE.
• Defensive Effect = a non-authoritative, tool-independent desired/assessed outcome such as bounded DELAY, DIVERT, INSTRUMENT, CONTAIN, or RESTORE, with target scope, objective, expected observations, duration, risk, reversibility, and capability constraints.

A candidate effect must be deterministically validated/mapped and pass the existing Edge authority path before any concrete action/state change. M.I.O. effect proposals remain non-executable.

This separation is deliberate so the 2027–2028 research can become tool/provider-independent without silently breaking the stable cross-product state doctrine defined by this issue.