{ "schemaVersion": "1.0.0", "source": "claims/claims.json", "summary": { "total": 24, "verified": 22, "partial": 1, "planned": 1 }, "claims": [ { "id": "synthetic-soc-lab", "claim": "The public SOC lab uses four synthetic scenarios and deterministic triage with a human approval gate.", "status": "verified", "scope": "Browser-local /labs/soc-triage experience", "surfaces": [ "/labs/soc-triage", "/soc" ], "evidenceTests": [ "src/labs/labs.test.ts", "src/governance/investigation.test.ts" ], "ciJobs": [ ".github/workflows/ci.yml#build" ], "limitations": [ "The lab does not connect to a model, SIEM, EDR, identity provider, ticketing system or network control." ] }, { "id": "role-and-workflow-contracts", "claim": "The public catalog contains 46 specialist roles and eight versioned workflow packs whose steps reference valid roles.", "status": "verified", "scope": "Generated role catalog and canonical workflow-pack contract", "surfaces": [ "/agents", "/personas" ], "evidenceTests": [ "src/agents/agents.test.ts" ], "ciJobs": [ ".github/workflows/ci.yml#build", ".github/workflows/integrated-platforms.yml#persona-catalog" ], "limitations": [ "A role or workflow definition does not grant runtime authority, credentials or production access." ] }, { "id": "tamper-evident-investigations", "claim": "The self-hosted platform records replayable per-thread investigation events and detects changed or unreadable history.", "status": "verified", "scope": "Agentic Cyber investigation ledger", "surfaces": [ "/cyber", "/soc", "/ciso" ], "evidenceTests": [ "platforms/agenticcyber/tests/test_investigation.py" ], "ciJobs": [ ".github/workflows/integrated-platforms.yml#agentic-platform" ], "limitations": [ "Hash chaining detects mutation; HMAC authenticity requires a non-default signing secret and protected key handling." ] }, { "id": "governed-operations-api", "claim": "The operational API exposes investigation replay, workflows, run containment, tool policy, business context, knowledge review, connector conformance, case metrics and detection change control.", "status": "verified", "scope": "Self-hosted /platform/operations API contract", "surfaces": [ "/cyber", "/soc", "/ciso" ], "evidenceTests": [ "platforms/agenticcyber/tests/test_operations_api.py" ], "ciJobs": [ ".github/workflows/integrated-platforms.yml#agentic-platform", ".github/workflows/integrated-platforms.yml#agentic-smoke" ], "limitations": [ "Contract tests use synthetic fixtures and do not certify a customer connector or production deployment." ] }, { "id": "bounded-tool-egress", "claim": "Tool authorization enforces registered runs, role allowlists, data scopes, autonomy and risk ceilings, exact destinations, run and case budgets, egress mode, approval and argument redaction.", "status": "verified", "scope": "Self-hosted Agentic Cyber tool-control plane", "surfaces": [ "/trust", "/cyber", "/soc" ], "evidenceTests": [ "platforms/agenticcyber/tests/test_operational_controls.py" ], "ciJobs": [ ".github/workflows/integrated-platforms.yml#agentic-platform" ], "limitations": [ "Authorization does not validate a third-party provider's independent retention, security or contractual terms." ] }, { "id": "independent-agent-run-containment", "claim": "The self-hosted runtime binds governed tool use to unique workload identities, short-lived secret references, exact egress destinations, immutable prohibited capabilities and independently enforced runtime, action, token and denial budgets; high-risk behavioral signals suspend the run outside the model.", "status": "verified", "scope": "Agentic Cyber run-safety controller and operations API", "surfaces": [ "/trust", "/cyber", "/soc", "/proof" ], "evidenceTests": [ "platforms/agenticcyber/tests/test_runtime_safety.py", "platforms/agenticcyber/tests/test_operations_api.py", "docs/AGENT_RUNTIME_CONTAINMENT.md" ], "ciJobs": [ ".github/workflows/integrated-platforms.yml#agentic-platform", ".github/workflows/integrated-platforms.yml#agentic-smoke" ], "limitations": [ "Repository tests verify the application boundary. Production proof still requires external workload-identity issuance, network and DNS enforcement, sensor coverage, connector controls and kill-switch integration in the customer environment." ] }, { "id": "governed-knowledge", "claim": "Reusable knowledge requires curated source references, sanitization, expiry and human approval before retrieval.", "status": "verified", "scope": "Tenant-scoped Agentic Cyber knowledge registry", "surfaces": [ "/cyber", "/soc", "/ciso" ], "evidenceTests": [ "platforms/agenticcyber/tests/test_operational_controls.py" ], "ciJobs": [ ".github/workflows/integrated-platforms.yml#agentic-platform" ], "limitations": [ "Approval establishes governance state; it does not prove that a source statement remains factually correct after review." ] }, { "id": "detection-change-control", "claim": "Detection publication requires positive, negative and telemetry-replay fixtures, independent approval, a versioned record and post-publish verification.", "status": "verified", "scope": "Agentic Cyber detection lifecycle", "surfaces": [ "/soc", "/proof" ], "evidenceTests": [ "platforms/agenticcyber/tests/test_operational_controls.py", "platforms/agenticcyber/tests/test_operations_api.py" ], "ciJobs": [ ".github/workflows/integrated-platforms.yml#agentic-platform" ], "limitations": [ "Synthetic fixture success does not establish production detection quality against a customer's telemetry distribution." ] }, { "id": "connector-contracts", "claim": "Connector definitions validate secret references, HTTPS boundaries, tenancy and fixtures; the runtime adds executable adapters, write approval, idempotency, rollback evidence and digest-only retention.", "status": "verified", "scope": "Agentic Cyber connector registry and conformance report", "surfaces": [ "/trust", "/cyber" ], "evidenceTests": [ "platforms/agenticcyber/tests/test_operational_controls.py", "platforms/agenticcyber/tests/test_human_command.py" ], "ciJobs": [ ".github/workflows/integrated-platforms.yml#agentic-platform" ], "limitations": [ "Conformance verifies the declared adapter contract, not the availability or security posture of an external service." ] }, { "id": "tenant-durable-orchestration", "claim": "Operational workflow state is tenant-keyed, idempotent, restart-safe and controllable through pause, resume, cancel and recovery transitions when persistence is configured.", "status": "verified", "scope": "Self-hosted Agentic Cyber workflow and persistence services", "surfaces": [ "/soc", "/trust" ], "evidenceTests": [ "platforms/agenticcyber/tests/test_human_command.py", "platforms/agenticcyber/tests/test_operations_api.py" ], "ciJobs": [ ".github/workflows/integrated-platforms.yml#agentic-platform" ], "limitations": [ "The bundled persistence profile is suitable for a single self-hosted control plane; clustered deployments require a customer-qualified transactional backend and recovery design." ] }, { "id": "continuous-agent-assurance", "claim": "Agent evaluation records can be baselined by a human reviewer, compared for quality, latency and override drift, and blocked from deployment when thresholds are exceeded.", "status": "verified", "scope": "Self-hosted Agentic Cyber evaluation registry", "surfaces": [ "/soc", "/proof" ], "evidenceTests": [ "platforms/agenticcyber/tests/test_human_command.py", "platforms/agenticcyber/tests/test_operations_api.py" ], "ciJobs": [ ".github/workflows/integrated-platforms.yml#agentic-platform" ], "limitations": [ "Evaluation quality depends on representative, reviewed datasets; synthetic acceptance suites do not establish production effectiveness." ] }, { "id": "human-command-plane", "claim": "The Human Command API centralises autonomy policy, agent disable controls, approval queues, expiring exceptions, connector status and agent scorecards per tenant.", "status": "verified", "scope": "Self-hosted /platform/operations/command API and public synthetic preview", "surfaces": [ "/soc", "/trust" ], "evidenceTests": [ "platforms/agenticcyber/tests/test_human_command.py", "platforms/agenticcyber/tests/test_operations_api.py", "src/products/command.test.ts" ], "ciJobs": [ ".github/workflows/integrated-platforms.yml#agentic-platform", ".github/workflows/ci.yml#build" ], "limitations": [ "The public view contains synthetic operating data; real approvals and policy state remain inside the authenticated customer deployment." ] }, { "id": "staged-soc-pilots", "claim": "Four bounded pilot packs cover business-aware prioritisation, alert triage, investigation and OSINT hunting with explicit inputs, quality gates and success measures.", "status": "verified", "scope": "Canonical workflow contract and public workflow catalog", "surfaces": [ "/soc", "/agents" ], "evidenceTests": [ "src/agents/agents.test.ts", "src/products/command.test.ts", "platforms/agenticcyber/tests/test_operational_controls.py" ], "ciJobs": [ ".github/workflows/ci.yml#build", ".github/workflows/integrated-platforms.yml#agentic-platform" ], "limitations": [ "Pilot definitions establish bounded workflow contracts; customer value must still be measured against an agreed baseline and acceptance criteria." ] }, { "id": "open-soc-portable-contracts", "claim": "The self-hosted platform carries a pinned, machine-validated OPEN-SOC contract bundle and assessed conformance record.", "status": "verified", "scope": "Portable schemas, operating profiles and repository-level conformance evidence", "surfaces": [ "/proof", "/trust", "/soc" ], "evidenceTests": [ "platforms/agenticcyber/tests/test_open_soc_assurance.py", "platforms/agenticcyber/open_soc/conformance.yaml" ], "ciJobs": [ ".github/workflows/integrated-platforms.yml#repository-contract" ], "limitations": [ "Repository conformance does not establish customer identity, connector, recovery, tenancy or production operating evidence." ] }, { "id": "least-agency-and-exact-approval", "claim": "Agent goals, context, delegation and targets are bounded by role, while material connector writes require an unexpired approval for the exact action digest.", "status": "verified", "scope": "Agentic Cyber agency registry, action intent and connector execution controls", "surfaces": [ "/agents", "/trust", "/soc" ], "evidenceTests": [ "platforms/agenticcyber/tests/test_open_soc_assurance.py", "platforms/agenticcyber/tests/test_human_command.py" ], "ciJobs": [ ".github/workflows/integrated-platforms.yml#agentic-platform" ], "limitations": [ "Deployment owners must still configure trustworthy identities, authoritative context sources and customer-specific risk ceilings." ] }, { "id": "assurance-circuit-breakers", "claim": "Context quality and service-objective breaches deterministically lower autonomy to read-only or manual operation, and R4 execution is refused.", "status": "verified", "scope": "Agentic Cyber assurance controls and service profiles", "surfaces": [ "/trust", "/proof", "/soc" ], "evidenceTests": [ "platforms/agenticcyber/tests/test_open_soc_assurance.py" ], "ciJobs": [ ".github/workflows/integrated-platforms.yml#agentic-platform" ], "limitations": [ "Production objectives, alerting ownership and recovery criteria require customer acceptance and live operational testing." ] }, { "id": "curated-defensive-skills", "claim": "Eight curated defensive skill packs bind activation, prerequisites, evidence, allowed tools, autonomy, approval, verification, output, framework references and source review to existing role and workflow contracts.", "status": "verified", "scope": "Canonical defensive-skill contract and progressive public catalog", "surfaces": [ "/agents", "/soc", "/proof" ], "evidenceTests": [ "src/agents/agents.test.ts", "platforms/agenticcyber/contracts/defensive-skills.json" ], "ciJobs": [ ".github/workflows/ci.yml#build", ".github/workflows/integrated-platforms.yml#agentic-platform" ], "limitations": [ "A reviewed procedure improves consistency but does not prove that every third-party command, platform API or framework reference remains current in a customer environment." ] }, { "id": "governed-capability-radar", "claim": "The public tool registry and capability radar record lifecycle, execution boundary, credentials, evidence maturity, commercial-use posture, review cadence and retirement guidance.", "status": "verified", "scope": "Browser tool registry and product-independent architecture radar", "surfaces": [ "/freetools", "/trust" ], "evidenceTests": [ "src/freetools/freetools.test.ts", "scripts/verify-tool-governance.mjs" ], "ciJobs": [ ".github/workflows/ci.yml#build" ], "limitations": [ "Lifecycle status describes Yefosec's stated operating boundary and is not an independent certification or vendor endorsement." ] }, { "id": "evidence-grounded-agent-release-gate", "claim": "Agent release comparison requires matched scenario coverage, deterministic objective evidence, trajectory digests, a resource-limited environment record with enforcement references, zero prohibited attempts and accountable human approval.", "status": "verified", "scope": "Public synthetic assurance lab and self-hosted evaluation registry", "surfaces": [ "/labs/agent-assurance", "/proof", "/soc" ], "evidenceTests": [ "src/assurance/assurance.test.ts", "src/labs/labs.test.ts", "platforms/agenticcyber/tests/test_human_command.py", "platforms/agenticcyber/tests/test_operations_api.py" ], "ciJobs": [ ".github/workflows/ci.yml#build", ".github/workflows/integrated-platforms.yml#agentic-platform" ], "limitations": [ "The registry validates environment declarations and evidence references; deployment owners must independently prove the referenced network and resource controls were enforced." ] }, { "id": "regulated-soc-portfolio", "claim": "The public agent catalog packages a focused 12-persona regulated-SOC workforce with portable source-role mappings, explicit permissions and exclusions, three governed team patterns, ten adversarial evaluation classes and ten decisions retained by humans.", "status": "verified", "scope": "Schema-validated reference product profile and public catalog rendering", "surfaces": [ "/agents", "/soc", "/labs/agent-assurance" ], "evidenceTests": [ "src/agents/agents.test.ts", "platforms/agenticcyber/tests/test_regulated_soc_portfolio.py", "platforms/agenticcyber/open_soc/catalog/portfolios/regulated-banking-soc.json" ], "ciJobs": [ ".github/workflows/ci.yml#build", ".github/workflows/integrated-platforms.yml#agentic-platform" ], "limitations": [ "The portfolio is a reference composition and evaluation floor, not evidence that every persona, vendor adapter or banking scenario has been deployed or accepted in a customer environment." ] }, { "id": "interchangeable-model-gateway", "claim": "Active model-backed runtimes isolate provider SDKs behind one normalized gateway and can use Anthropic or OpenAI-compatible hosted and local routes without changing agent authority, workflow, tool or evidence contracts.", "status": "verified", "scope": "Unified platform, standalone SOC, standalone CISO and CyberCheck model-call boundaries", "surfaces": [ "/trust", "/soc", "/proof" ], "evidenceTests": [ "platforms/agenticcyber/tests/test_model_gateway.py", "docs/MODEL_PORTABILITY.md" ], "ciJobs": [ ".github/workflows/integrated-platforms.yml#agentic-platform", ".github/workflows/integrated-platforms.yml#cybercheck-backend" ], "limitations": [ "A new provider or model remains a material change and must pass customer-specific quality, safety, privacy, residency, outage and rollback evaluation before promotion." ] }, { "id": "operational-domain-readiness", "claim": "The public coverage explorer and browser-local readiness lab use a pinned catalog of 13 operational security domains, 52 controls, 52 workflow steps and 21 provider-neutral connector contracts with evidence-aware deterministic scoring and existing-role mappings.", "status": "verified", "scope": "Pinned public-safe catalog, generated TypeScript, local assessment logic and public route rendering", "surfaces": [ "/coverage", "/labs/domain-readiness", "/agents", "/trust", "/proof" ], "evidenceTests": [ "src/domainops/domainops.test.ts", "scripts/sync-domain-ops.mjs", "catalogs/domain-ops/provenance.json" ], "ciJobs": [ ".github/workflows/ci.yml#build" ], "limitations": [ "Connector entries are contracts rather than live integrations; the lab is self-reported and browser-local, standards mappings are indicative, and neither catalog validation nor a score proves a customer control is effective." ] }, { "id": "customer-deployment-readiness", "claim": "The integrated platform is ready to be adapted to a specific customer environment and operating model.", "status": "partial", "scope": "Architecture, controls, APIs, container and synthetic validation", "surfaces": [ "/platforms", "/cyber", "/soc", "/ciso" ], "evidenceTests": [ "platforms/agenticcyber/tests/test_api_routes.py" ], "ciJobs": [ ".github/workflows/agentic-container.yml#build", ".github/workflows/integrated-platforms.yml#agentic-platform" ], "evidenceNeeded": [ "docs/PILOT_EVIDENCE.md", "public/proof/pilot-outcome-template.json" ], "limitations": [ "Readiness still depends on customer-specific threat modelling, identity, tenancy, connector qualification, runbooks, recovery testing and operational acceptance." ] }, { "id": "production-outcomes", "claim": "The platform improves customer detection, response or governance outcomes in production.", "status": "planned", "scope": "Customer outcome validation", "surfaces": [ "/proof" ], "evidenceTests": [], "ciJobs": [], "evidenceNeeded": [ "docs/PILOT_EVIDENCE.md", "public/proof/pilot-outcome-template.json" ], "limitations": [ "No named customer outcome, benchmark or production case study is published; the site provides synthetic examples and tested implementation evidence only." ] } ] }