[design gate] Architecture Stabilization — bridge current M.I.O. to the series-wide Active Cyber Defense program before implementation

[01rabbit]

Parent doctrine: #64
System program: #66
Final hostile gate: #67
Edge differentiation: 01rabbit/Azazel-Edge#391
Implementation baseline: 01rabbit/Azazel-Edge#400

Purpose

Insert the missing Architecture Stabilization / Detailed Design gate between the already-implemented M.I.O. Cognitive Plane and the much broader series-wide Active Cyber Defense research program.

The next-generation program is intentionally ambitious. It must not be implemented by directly coding #392–#399 in sequence while interfaces, state ownership, migration, and failure semantics are still only conceptual.

This gate answers one question first:

Can the current working Azazel/M.I.O. architecture be evolved into the target architecture through small reversible vertical slices without replacing the existing deterministic decision/execution path?

Terminology correction

For new design and implementation work, use Deception / Azazel-Deception as the component name. Do not use AZ-06 as the primary architecture term in new contracts/docs/issues. Historical issues/docs may retain the old designation as provenance until explicitly migrated.

Current implementation anchors

M.I.O. foundation

Current Edge code already has bounded contracts/runtime for:

• MioSituationFrame;
• MioHypothesis;
• MioEvidenceGap;
• typed Capability Broker;
• deterministic Grounding Validator;
• bounded ReasoningState / BoundedReasoningLoop;
• Reasoning Playbooks/context compiler;
• reasoning trace/replay/evaluation helpers.

Deterministic authority/runtime reality

Current repository contains both:

• py/azazel_edge/arbiter/action.py::ActionArbiter, a deterministic decision implementation; and
• executable Rust decide_defense() -> maybe_enforce() -> EnforcementOutcome logic in rust/azazel-edge-core/src/main.rs.

Therefore no design may call the Python ActionArbiter the sole live execution truth until wiring/unification is proven. #400 consumes existing Rust execution facts without introducing a second executor or authority.

Existing execution/evidence substrates

• current Rust throttle/redirect/isolate enforcement plans and EnforcementOutcome;
• redirect/OpenCanary/Deception integration work;
• Edge decision/audit/provenance;
• Edge -> Knowledge reaction/outcome export work;
• Knowledge Behavioral CTI/reaction history;
• Deception package/lifecycle/isolation/reset foundation.

Non-negotiable migration rule

Do not replace the existing hot decision loop. Wrap and observe it first.

Canonical observational chain is now locked by Edge #400:

ActionDecision / DefensiveDecision
        -> ActionExecutionReceipt
        -> AppliedMechanism
        -> OutcomeRecord
        -> TacticalEffectAssessment

These are different facts. Action != Mechanism != Outcome != Tactical Effect.

Target migration pattern:

CURRENT
Evidence -> current decision path -> concrete execution -> audit/log

STEP 1: shadow execution/mechanism evidence
same current path
 -> normalize provider execution facts into ActionExecutionReceipt
 -> independently represent AppliedMechanism
 -> no live authority change

STEP 2: outcome evidence
same current path
 -> bounded before/after observations
 -> OutcomeRecord with telemetry coverage/confounders/causal support
 -> optional Knowledge export outside hot path

STEP 3: tactical effect assessment
verified mechanism + policy-owned objective + outcome evidence
 -> deterministic TacticalEffectAssessment
 -> no `throttle=DELAY` or `redirect=DIVERSION` shortcut

STEP 4: shadow strategy
proven facts / deterministic eligible candidates
 -> M.I.O. comparison/counterfactual in shadow
 -> no live influence

STEP 5: bounded advisory influence only after gates
M.I.O. recommendation
 -> deterministic validation/policy
 -> existing authoritative decision path

At every step, feature-off behavior must remain decision-equivalent to the pre-migration baseline.

Detailed-design packages

DD0 — Current-to-target traceability

Owner: Edge #400

Produce an exact matrix:

• current module/type/API;
• current authority;
• target concept;
• reuse/extend/replace decision;
• migration adapter;
• compatibility lifetime;
• rollback behavior;
• owning repo.

No concept may proceed if its current implementation anchor is unknown.

DD1 — Identity, authority, and lifecycle model

Define canonical non-confusable identities/relationships for:

• incident/trace;
• M.I.O. reasoning cycle/frame/hypothesis;
• authoritative/local decision;
• action/execution receipt;
• applied mechanism;
• policy-owned effect objective;
• reaction/outcome observation;
• tactical effect assessment;
• Deception presentation/lifecycle;
• Knowledge trajectory;
• replay/experiment run.

For each type define:

• who creates it;
• who may mutate it;
• whether it is fact/advisory/authority;
• freshness/expiry;
• persistence/retention;
• invalid/stale behavior.

DD2 — Vertical Slice A: prove DELAY without AI

First executable proof. Do not require Belief, Council, Terrain adaptation, or multi-model reasoning.

recorded/live test evidence
 -> current deterministic Edge decision (`throttle` where current policy selects it)
 -> existing execution provider
 -> ActionExecutionReceipt
 -> independently verified TRAFFIC_SHAPING AppliedMechanism
 -> bounded pre/post OutcomeRecord
 -> TacticalEffectAssessment(DELAY) only if objective, mechanism, correlation, causal evidence and guardrails support it
 -> optional Knowledge fact export
 -> replay identical evidence bundle

throttle itself is not DELAY evidence. Current Rust throttle is an interface-root qdisc and must be represented truthfully as TRAFFIC_SHAPING with interface scope. If an independently verified postcondition and outcome do not support DELAY, the result remains inconclusive/unsupported.

Success criteria:

• same existing action behavior;
• no new authority;
• complete provenance chain;
• measurable outcome/confounders;
• uncalibrated confidence remains null rather than invented;
• M.I.O. completely removable;
• Knowledge completely removable from hot path.

If this cannot be made robust, stop the larger architecture.

DD3 — Vertical Slice B: REDIRECTION + Deception Presented Terrain

Only after Slice A works.

existing deterministic redirect decision
 -> current execution provider
 -> REDIRECTION AppliedMechanism only when postcondition is independently verified
 -> valid Deception materialization / PresentedTerrainRef
 -> interaction/reaction facts
 -> termination/reset proof
 -> OutcomeRecord
 -> tactical DIVERSION assessment only when effect-specific evidence rules exist
 -> Knowledge fact export
 -> replay

No adaptive terrain transition in the first slice. Static coherent Deception is the baseline. A redirect command or decoy interaction alone is not proof that the adversary believed the deception or that diversion succeeded.

DD4 — M.I.O. strategic overlay

Only after DD2/DD3 data contracts are proven.

M.I.O. consumes:

• SituationFrame;
• current deterministic eligible effect candidates;
• Tempo/Outcome history;
• Real/Presented Terrain facts;
• Belief hypotheses.

M.I.O. outputs only:

• comparative assessment;
• assumptions/uncertainty;
• expected observations;
• preferred eligible effect ref(s);
• dissent/limitations.

It does not create target scope, provider commands, Deception transitions, canonical execution/outcome facts, or authority tokens.

DD5 — Council/co-adaptation

Council and Asurada-style team memory are deliberately last. They cannot be required to prove the core Active Defense loop.

Required sequence diagrams

Detailed design must include at least:

1. current deterministic action/execution path;
2. Slice A execution/mechanism/outcome/DELAY assessment path;
3. Slice B REDIRECTION/Deception outcome path;
4. M.I.O. shadow comparison path;
5. Knowledge unavailable path;
6. Deception unavailable path;
7. M.I.O./model unavailable path;
8. stale/superseded trace path;
9. rollback/release/termination path;
10. replay/evaluation path.

Failure semantics

Every cross-series call must define:

• timeout;
• retry/no-retry;
• idempotency key;
• queue bound;
• stale cutoff;
• cancellation/supersession;
• partial-write behavior;
• reboot recovery;
• clock uncertainty;
• duplicate/replay handling;
• feature-disabled behavior.

Unknown/missing optional data is never a reason to strengthen a live action or promote an outcome/effect claim.

Data ownership rules

• Edge/Gadget: authoritative local decisions and actual local execution observations.
• Deception: actual materialization/lifecycle/reset/isolation facts.
• Knowledge: durable fact/derived/advisory storage and retrieval, never live authority.
• Fabric: shared type language only where at least two products exchange the type.
• M.I.O.: advisory cognition state; no authoritative environment/execution/outcome truth.

Architecture review / hostile review

Before code for new adaptive features:

Normal review

• current modules really support the proposed adapter points;
• no duplicate state machine;
• no unnecessary shared contract;
• bounded hardware/resource behavior;
• schema/version migration plan exists.

Hostile review

Try to prove:

• this is unnecessary complexity around the current decision path;
• raw Outcome Memory/RAG is enough;
• static Deception is enough;
• DELAY metric can be gamed;
• IDs can be confused across advisory/authority;
• optional dependency outage changes the hot path;
• command success is mistaken for mechanism postcondition;
• old action and tactical effect semantics diverge;
• M.I.O. recommendation accidentally becomes authority;
• Deception presentation state is mistaken for attacker belief;
• policy guardrails can be bypassed by missing evidence;
• uncalibrated numeric confidence creates false precision;
• a better external model makes the new layer irrelevant.

Correct all high/medium findings before progressing to the next vertical slice.

Current locked implementation status

Edge #400 / PR #401 implement the first shadow layer on feat/outcome-as-evidence-v1:

• canonical execution/mechanism/outcome/effect contracts;
• Rust EnforcementOutcome adapter;
• truthful current throttle scope;
• passive bounded observer;
• fail-closed replay execution boundary;
• conservative DELAY rule requiring explicit evidence;
• strict correlation joins;
• fail-closed policy guardrails;
• no invented numeric tactical confidence.

The PR must pass current CI/review before merge. Automatic release lifecycle observation, independently verified live mechanism postconditions, real pre/post metric collectors, end-to-end replay golden, and Pi/HIL remain gates.

Exit criteria

• Exact current runtime execution source for v1 is identified.
• Action/Execution/Mechanism/Outcome/Tactical Effect semantics are non-confusable.
• Slice A implementation baseline reaches module/schema/test-file granularity in Edge #400.
• Slice A passes repository CI and PR review.
• Independently verify disruptive mechanism postconditions.
• Bind policy-owned EffectObjective to real pre/post telemetry collectors.
• Add end-to-end golden replay.
• Pi/HIL proves no deterministic-path regression.
• Slice B reaches equivalent grounded implementation detail without adaptive Deception.
• Feature-off path remains decision-equivalent baseline by design.
• M.I.O. is layered after proven execution/outcome facts, not woven into authority.
• Deception is the new architecture term; historical AZ-06 naming is not propagated into new contracts.
• [program] Post-BHUSA Azazel Series research program — system-wide co-adaptive Active Cyber Defense #66 does not start adaptive Terrain/Belief/Council field work until the G1-G6 gates from Edge #400 are complete or explicitly reviewed as waived.

[01rabbit]

2026-08-26 re-review / hostile review — execution readiness and issue-control decision

Verdict

GO for Architecture Stabilization / exact detailed-design tracing. CONDITIONAL NO-GO for Slice A implementation until the current execution semantics are proven.

The program is not blocked by lack of M.I.O. foundations: Edge already has bounded SituationFrame/Hypothesis/EvidenceGap/Broker/Grounding/Reasoning/Replay code and a deterministic ActionArbiter. The blocker is narrower and more important: the new research vocabulary must be proven against the actual current execution path before code is allowed to treat it as fact.

HR-001 — throttle -> DELAY is currently a hypothesis, not an accepted semantic mapping

The current ActionArbiter describes throttle as traffic_shaping with control_mode=route_preference. That is insufficient evidence that the existing executor creates a measurable temporal delaying effect consistent with the Cyber Scapegoat / delaying-action doctrine.

Before Slice A code is allowed to emit effect_class=DELAY, #400 must identify and review the actual current:

1. throttle executor symbol/file;
2. concrete enforcement semantics and parameters;
3. authoritative decision/audit ID creation point;
4. release/reset path;
5. normalized actor/session observation source;
6. NOC/resource/telemetry-health source used for confounders;
7. existing reaction/export queue/client and replay-fixture conventions.

Disposition after tracing:

• if the actual mechanism creates bounded measurable temporal friction, retain DELAY;
• if it is merely rate/path shaping without a defensible temporal claim, use a narrower neutral effect semantic (FRICTION/provider-specific observation) or select a different real vertical slice;
• do not rename implementation behavior to fit the doctrine.

Issue/WIP control rule

Issue count is now an engineering risk. Until this gate exits:

• Do not create another roadmap/epic for this program. [design gate] Architecture Stabilization — bridge current M.I.O. to the series-wide Active Cyber Defense program before implementation #68 is the stabilization source of truth.
• New implementation work should be attached to an existing owning issue whenever possible.
• Per repository, target at most one active implementation issue + one closure/validation issue at a time. Parent research epics may remain open as specifications but are PARKED, not active WIP.
• Close an old specification/tracker in the same cycle that its final residual acceptance/child issue closes.
• Do not begin adaptive Terrain/Belief/Council/co-adaptation coding merely because their design issues exist.

Current execution queue

NOW

1. Azazel#68 — stabilization / cross-series source of truth.
2. Azazel-Edge#400 — exact current-symbol trace and implementation-ready Slice A/B design.
3. Edge #383–#389 — close foundation residuals one at a time; when a residual issue satisfies the remaining acceptance of its #361–#377 parent, close that parent in the same closure wave.

NEXT (only after #400 proves semantics)
4. Azazel-Fabric#16 — minimal v0 shared Effect/Outcome fixtures.
5. Azazel-Knowledge#67 — minimal fact ingest/replay for the proven first slice.
6. Azazel-Deception#31 — static Presented Terrain slice after the first Effect/Outcome evidence chain is stable.

PARKED / NOT ACTIVE WIP

• Edge #392–#398 implementation;
• Edge #399 until evidence exists for the hostile gate;
• Fabric Vector による Mattermost 通知機能（初期導入） #15 broader contract family;
• Knowledge [program] Post-BHUSA Azazel Series research program — system-wide co-adaptive Active Cyber Defense #66 full Outcome Memory expansion;
• Deception #30 adaptive Presented Terrain work;
• Gadget Mattermost 通知機能の完成と最終調整 #19 extension work.

Closure work completed during this review

Knowledge issue cleanup was started immediately rather than only documented:

• Azazel-Knowledge#12 closed: software implementation complete; remaining Pi 4 hardware validation is already consolidated in Feature/suricata python alert #21.
• Azazel-Knowledge#30 closed: Behavioral CTI implementation tracker completed through children Azazelシステムの稼働状況を確認するスクリプトの作成 #31–Feature/suricata autodefense #37.
• Azazel-Knowledge#29 closed after recording that Behavioral CTI is now a completed foundation feeding Outcome Memory [program] Post-BHUSA Azazel Series research program — system-wide co-adaptive Active Cyber Defense #66/[review] Series-wide adversarial differentiation gate — prove the integrated Azazel System beats strong simpler baselines #67; remaining hardware validation remains Feature/suricata python alert #21.

Exit condition for implementation GO

#68 may move from design-only to first vertical-slice implementation only when #400 can name the actual current symbols/contracts and demonstrate that the chosen Effect semantic is an observation of real behavior, not an aspirational relabeling. Feature-off behavior must remain decision/action equivalent to the current baseline.

[01rabbit]

Foundation closure wave for Edge — reduce Open issues instead of parallelizing them

Review of #383–#389 shows a practical close-first sequence:

1. #388 + #383 → when their residual acceptance is satisfied, close parent architecture/frame issues #361 and #362 in the same wave.
2. #384 → close parent #364 when its remaining broker acceptance is demonstrably satisfied.
3. #385 → close parents #363 and #365 when hypothesis/reasoning lifecycle residuals are satisfied.
4. #386 → close parents #366 and #376 when grounding/playbook provenance/docs residuals are satisfied.
5. #389 → close parent #377 when trace/retention residuals are satisfied.
6. #387 → close parents #370 and #372 only after the required Pi-class/evaluation evidence exists.

Do not work all six waves concurrently. Complete a wave, close the residual issue and its satisfied parent(s), then start the next. This converts the current two-layer spec issue + closure-gap issue structure back into a shrinking queue.

After these waves, re-review #367–#375 individually against #68 rather than automatically implementing them. Items that are still valid but not required for the first vertical slice remain PARKED; items made redundant by the Effect/Outcome path should be closed/superseded rather than carried forever.