Repository navigation
feat(cyberbattlesim): implement the conformant simulator backend target #27
Description
Activity
🛠️ Picked up by /implement - driver codex, branch
27-cyberbattlesim-backend, 2026-07-30T18:18:43.041Z.gc workflow phase recorded:
preflight(issue #27). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.Execution obligation OB-27-CYBERBATTLESIM-ADMISSION — Opened
Category: quality
Observed state: The selected CyberBattleSim profile is canonically not admissible, and the repository deliberately has no cyberbattlesim optional extra.
Impact: Implementing issue #27 now would require adding the optional extra, constructing a live target, and claiming evidence-backed capabilities in direct contradiction to the canonical qualification record and an enforced repository invariant. It would make the package claim installability and conformance that the selected source evidence does not support.
Current obligation: Complete a governed CyberBattleSim requalification that selects an admissible publishable artifact, binds every declared random stream through reset and evaluation, and resolves or explicitly patches and qualifies the material benchmark/evaluation defects before backend implementation resumes.Evidence
- src/raes_adapters/cyberbattlesim/qualification.json records admissibility.decision=not-admissible with blockers no-index-or-release-artifact, incomplete-random-stream-binding, and unresolved-upstream-benchmark-defects.
- tests/test_cyberbattlesim_qualification.py:117-129 structurally requires that no cyberbattlesim extra is published while the negative qualification remains in force; the focused invariant test passed on the current tree.
- docs/decisions/cyberbattlesim-backend-guardrails.md states implementation may begin only after governed requalification and forbids a backend manifest or live conformance claim before then.
- Issue build(cyberbattlesim): qualify and pin the public source and experiment profile #25 is closed with the explicit fail-closed qualification outcome; issue feat(cyberbattlesim): implement the conformant simulator backend target #27 depends only on feat(base): implement shared simulator-adapter plumbing over published RAES contracts #14 and contains no approved requalification or replacement artifact.
Execution obligation OB-27-CYBERBATTLESIM-ADMISSION — Escalated
Category: quality
Observed state: The selected CyberBattleSim profile is canonically not admissible, and the repository deliberately has no cyberbattlesim optional extra.
Impact: Implementing issue #27 now would require adding the optional extra, constructing a live target, and claiming evidence-backed capabilities in direct contradiction to the canonical qualification record and an enforced repository invariant. It would make the package claim installability and conformance that the selected source evidence does not support.
Current obligation: Complete a governed CyberBattleSim requalification that selects an admissible publishable artifact, binds every declared random stream through reset and evaluation, and resolves or explicitly patches and qualifies the material benchmark/evaluation defects before backend implementation resumes.Evidence
- src/raes_adapters/cyberbattlesim/qualification.json records admissibility.decision=not-admissible with blockers no-index-or-release-artifact, incomplete-random-stream-binding, and unresolved-upstream-benchmark-defects.
- tests/test_cyberbattlesim_qualification.py:117-129 structurally requires that no cyberbattlesim extra is published while the negative qualification remains in force; the focused invariant test passed on the current tree.
- docs/decisions/cyberbattlesim-backend-guardrails.md states implementation may begin only after governed requalification and forbids a backend manifest or live conformance claim before then.
- Issue build(cyberbattlesim): qualify and pin the public source and experiment profile #25 is closed with the explicit fail-closed qualification outcome; issue feat(cyberbattlesim): implement the conformant simulator backend target #27 depends only on feat(base): implement shared simulator-adapter plumbing over published RAES contracts #14 and contains no approved requalification or replacement artifact.
Pause class: hard_external_dependency
Decision request: Provide the issue or artifact revision where the three qualification blockers were resolved, or explicitly authorize expanding issue #27 to perform a governed requalification (including the approved publishable/repackaged artifact and patch disposition) before implementing the backend. Once one of those is available, ask me to resume issue #27.This obligation remains open while the decision is pending.
gc workflow phase recorded:
plan(issue #27). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.Implementation plan
- Correct qualification semantics before runtime work: treat maintainer-selected CyberBattleSim and CybORG profiles as admitted, convert packaging/randomness/upstream defects from vetoes into explicit limitations and claim-strength bounds, publish dependency-light extras, and reconcile qualification/protocol/ledger/guardrail tests and GitHub qualification issues.
- Add failing contract-level tests for
raes_adapters.cyberbattlesimcovering target construction, manifest/component agreement, unsupported capability rejection/disclosure, participant lifecycle, action translation, observation sealing, evaluator separation, stochastic-control reporting, termination, and idempotent cleanup. Use an injected deterministic fake native driver so the adapter contract is testable without publishing or pretending to install the upstream simulator. - Implement a module-private CyberBattleSim driver boundary. Lazy-load the separately installed pinned simulator only when a real target is constructed; keep native observations, masks, tuples, reward vectors, identifiers,
info, object representations, exceptions, and tracebacks inside the driver. Bind/reset each available random stream and report partial/unbound controls without claiming deterministic replay. - Implement the published RAES protocol surfaces: a Provisioner that realizes validated plans, an Orchestrator that owns workflow state without replaying simulator actions, a
BaseParticipantRuntimesubclass whose_model_actionperforms exactly one admitted driver operation and returns one typed terminal result joined to participant/episode/action identities, and an Evaluator that projects only evaluator-owned facts without advancing the simulator. - Build an evidence-backed
backend-manifest-v2andRuntimeTargetusing RAES-owned models andraes_adapters.baseplumbing. Claim only executable capabilities, reject unsupported requests, disclose the authored-to-native topology and stochastic/packaging/outcome limitations, and keep CyberBattleSim semantics entirely insideraes_adapters.cyberbattlesim. - Add positive and negative tests proving participant observations cannot expose evaluator-only or hidden native state; action results cannot contain native ids/reward/info; every admitted action joins one driver receipt and one terminal RAES result; reset/seed/termination/cleanup ordering is explicit; cleanup is deterministic, idempotent, partial-construction-safe, and failure-preserving.
- Update package exports, docs, optional-extra verification, and requirement-to-test mapping. Run focused tests during TDD, then the canonical
uv tool run --from 'nox[uv]==2026.4.10' nox -s verifygraph using the issue branch's requirement UID (or the repository's genuine requirement-free skip mechanism for this issue). - Run the mandatory pre-push code and test-quality review cycles, fix all actionable findings within the configured caps, publish the branch and draft PR through Ground Control, monitor CI/Sonar to terminal success, and post the final readiness evidence. No merge into the protected default branch is included.
Execution obligation OB-27-CYBERBATTLESIM-ADMISSION — Resolved
Category: workflow
Observed state: Qualification records and surrounding repository/GitHub text previously used not-admissible/blocker language as a hard implementation gate.
Impact: The earlier interpretation incorrectly treated simulator limitations as authority to stop issue #27 and would have prevented the adapter demonstration the issue requires.
Current obligation: Correct the CyberBattleSim admission misunderstanding and prevent the same qualification-veto semantics elsewhere in adapter evidence.Evidence
- src/raes_adapters/cyberbattlesim/qualification.json now records admission.decision=admitted and bounded claim_strength
- src/raes_adapters/cyborg/qualification.json now records admission.decision=admitted and bounded claim_strength
- pyproject.toml publishes dependency-light cyberbattlesim and cyborg extras
- GitHub issues build(cyborg): qualify and pin the supported CAGE-2 runtime profile #12, build(cyberbattlesim): qualify and pin the public source and experiment profile #25, build(nasim): qualify and pin the public source and experiment profile #32, build(primaite): qualify and pin the public source and experiment profile #39, and build(yawning-titan): qualify and pin the public source and experiment profile #46 now state maintainer selection is authoritative and qualification limitations only bound claims
Disposition: fix
Corrective action: Replaced the veto-style qualification model in both CyberBattleSim and CybORG with maintainer-authorized admission plus explicit claim-strength limitations; added the CyberBattleSim dependency-light extra; reconciled qualification tests, source pointers, protocol/ledger prose, and architecture guardrails; audited and corrected the related GitHub qualification issues.Verification
- uv run pytest -q tests/test_cyberbattlesim_qualification.py tests/test_cyborg_qualification.py tests/test_cyborg_source_ledger.py tests/test_cyberbattlesim_scenario_ledger.py: 65 passed
- Repository search finds no remaining not-admissible, qualification-blocker, or feasibility-gate wording in README.md, docs, src, tests, or pyproject.toml
1 remaining item
gc_codex_review pre-push cycle 1 of 1 complete for issue #27 on branch '27-cyberbattlesim-backend'. Posted by the MCP server to enforce the pre-push hard-cap-1 contract (issues #796, #804, #906). Do not edit or delete — used by the next
gc_codex_review(uncommitted) invocation to count cycles.Review decision record — codex cycle 1 (issue #27)
Reviewer: codex
Cycle: 1Architectural read:
Core reviewer: The change is directionally organized around the right backend-local seam: one serialized native driver, the canonical runtime-target builder, BaseParticipantRuntime, and typed evidence and cleanup contracts. Three load-bearing boundaries remain misshaped, however: participant admission loses its targets and arguments before native execution, the backend recreates RAES-owned protocol catalogs and result envelopes, and incremental UNCHANGED operations mutate state without reporting a change. These are structural contract issues rather than polish; the action seam forecloses correct multi-target behavior, while the duplicated protocol structures establish a second semantic boundary. I would not ship this shape yet.
Security reviewer: The change correctly isolates native simulator state behind a serialized driver and projects typed RAES outputs, but it also replaces fail-closed qualification with execution of a separately installed package. Runtime source attestation is therefore the critical security seam. That seam is incomplete because the files verified through distribution metadata are not bound to the modules subsequently resolved and executed by Python's global import machinery. The driver/factory shape supports future profiles, but this trust boundary must be fixed first.
Blocking findings: 4
Finding 1 —
class(4 instances)- ID:
F1 - Title: [core] Action execution discards the admitted target and then reports it as affected
- Location:
src/raes_adapters/cyberbattlesim/backend/participant_runtime.py:211 - Decision: fix
- Rationale: After admission,
_model_actionpasses onlyaction_kindto the driver._resolve_native_actionconsequently selects the first available mask coordinate, so neitherrequest.validated_selection.normalized_argumentsnor `request.target_… - Instances:
src/raes_adapters/cyberbattlesim/backend/driver.py:86src/raes_adapters/cyberbattlesim/backend/driver.py:293src/raes_adapters/cyberbattlesim/backend/participant_runtime.py:211src/raes_adapters/cyberbattlesim/backend/participant_runtime.py:264
Finding 2 —
class(5 instances)- ID:
F2 - Title: [core] Backend recreates RAES-owned protocol catalogs and result envelopes
- Location:
src/raes_adapters/cyberbattlesim/backend/manifest.py:39 - Decision: fix
- Rationale: The architecture record identifies the published supported-contract catalog and the workflow/evaluation lifecycle and history models as the canonical semantic owners, but the implementation copies the contract catalog into `_SUPPORTED_CONT…
- Instances:
src/raes_adapters/cyberbattlesim/backend/manifest.py:39src/raes_adapters/cyberbattlesim/backend/orchestrator.py:112src/raes_adapters/cyberbattlesim/backend/orchestrator.py:153src/raes_adapters/cyberbattlesim/backend/evaluator.py:228src/raes_adapters/cyberbattlesim/backend/evaluator.py:261
Finding 3 —
class(4 instances)- ID:
F3 - Title: [core] UNCHANGED operations still mutate component state
- Location:
src/raes_adapters/cyberbattlesim/backend/evaluator.py:86 - Decision: fix
- Rationale: The evaluator treats every non-delete operation, including
UNCHANGED, as requiring a fresh driver projection, timestamps, evidence, result, and history. The orchestrator likewise replaces entries and workflow results, while the provision… - Instances:
src/raes_adapters/cyberbattlesim/backend/evaluator.py:86src/raes_adapters/cyberbattlesim/backend/evaluator.py:149src/raes_adapters/cyberbattlesim/backend/orchestrator.py:79src/raes_adapters/cyberbattlesim/backend/provisioner.py:98
Finding 4 —
class(5 instances)- ID:
F4 - Title: [security] Partial source hashing does not authenticate the modules that are executed
- Location:
src/raes_adapters/cyberbattlesim/backend/driver.py:138 - Decision: fix
- Rationale: Attacker model: a supply-chain adversary supplies the separately installed simulator package, or a local attacker places a shadow module earlier on sys.path before provisioning triggers the lazy import. The integrity gate hashes four files…
- Instances:
src/raes_adapters/cyberbattlesim/backend/driver.py:138src/raes_adapters/cyberbattlesim/backend/driver.py:139src/raes_adapters/cyberbattlesim/backend/driver.py:140src/raes_adapters/cyberbattlesim/backend/driver.py:141src/raes_adapters/cyberbattlesim/backend/driver.py:142
- ID:
gc_codex_review — cycle 2 of 1 (pre-push) on issue #27 (branch
27-cyberbattlesim-backend)
Diff mode: inline — the complete diff was supplied in one promptCore review
Verdict:
ship-with-fixesThe change is shaped correctly in its main dependency direction: CyberBattleSim semantics remain backend-local, the private driver owns native state, and the implementation composes RAES-owned manifest, runtime-target, participant, evaluation, and cleanup contracts rather than extending
raes_adapters.base. The unresolved seam is trial lifecycle: component latches and evaluator artifact identities have process lifetime even though the target advertises reusable state. That breaks the obvious next variation—multiple trials on one target—and must be corrected before production use.Blocking findings (2):
- [one-off] Provisioner lifetime latch survives driver cleanup —
src/raes_adapters/cyberbattlesim/backend/provisioner.py:79
_constructedrecords that construction happened once, not that the shared driver is currently live. Cleanup can destroy and close that driver, but the flag is never cleared; the next CREATE or UPDATE skipsdriver.construct()and returns an applied portable snapshot with no native environment. This breaks multi-trial reuse and conflicts with the manifest's reusable-state claim. The driver'sconstruct()is already idempotent, so invoke it whenever a mutating plan requires a live source, or query an authoritative driver lifecycle state. Add a create → destroy cleanup → create test. - [class] Evaluator reuses immutable artifact identities across runs —
src/raes_adapters/cyberbattlesim/backend/evaluator.py:406
The evaluator emits current timestamps, scores, and checksums under process-global run, evidence-record, content, capture-spec, capture-window, and derived-measure identifiers with constant versions. A second evaluation changes the data while preserving every identity, so evidence references can alias artifacts from another trial. Scope instance identifiers to the authoritative run or execution identity, keeping only genuine definition identifiers static, and test that two evaluations with different rewards produce distinct, internally consistent references.
Security review
Verdict:
don't-shipThe change correctly concentrates native simulator state and transitions behind a backend-local driver, with sanitized participant, evaluator, and cleanup projections. That driver is also the new supply-chain trust boundary: it imports separately installed executable code while claiming source-identity verification. The verification does not cover every executable artifact or establish dependency authenticity, so compiled-module and same-version package substitutions bypass the intended fail-closed seam. This shape cannot safely support the obvious next variation—packages containing native modules—without artifact-level attestation.
Blocking findings (1):
- [class] Partial package attestation permits arbitrary code execution —
src/raes_adapters/cyberbattlesim/backend/driver.py:153
Attacker model: an adversary who can supply a tampered separately installed simulator or dependency, such as through a compromised package index or prebuilt runtime image. The simulator check hashes only.pyentries undercyberbattle/. A package can therefore contain the exact expected 48 source files plus a malicious compiled extension with the same module name as a verified source file; CPython prefers extension modules over source modules. Importingcyberbattlecan execute that extension transitively before the later submodule-origin checks reject anything. Gymnasium and NumPy are even weaker: matching the selected version and resolving their module to a file owned by that same distribution provides no authenticity, so forged same-version packages pass and execute during construction. This defeats the advertised fail-closed identity control and gives code execution with the hosting process's privileges. Bind the simulator and dependencies to governed immutable artifact hashes or verified signatures, attest all executable artifacts rather than only.pyfiles, reject editable or otherwise unqualified installations, and ensure no package code executes before its complete artifact identity is established.
- [one-off] Provisioner lifetime latch survives driver cleanup —
gc_codex_review pre-push cycle 2 (USER-AUTHORIZED OVERRIDE past cap 1) complete for issue #27 on branch '27-cyberbattlesim-backend'. Posted by the MCP server to enforce the pre-push hard-cap-1 contract (issues #796, #804, #906). Do not edit or delete — used by the next
gc_codex_review(uncommitted) invocation to count cycles.
Override reason: user said: overcap authorized.Review decision record — codex cycle 2 (issue #27)
Reviewer: codex
Cycle: 2Architectural read:
Core reviewer: The change is shaped correctly in its main dependency direction: CyberBattleSim semantics remain backend-local, the private driver owns native state, and the implementation composes RAES-owned manifest, runtime-target, participant, evaluation, and cleanup contracts rather than extending
raes_adapters.base. The unresolved seam is trial lifecycle: component latches and evaluator artifact identities have process lifetime even though the target advertises reusable state. That breaks the obvious next variation—multiple trials on one target—and must be corrected before production use.Security reviewer: The change correctly concentrates native simulator state and transitions behind a backend-local driver, with sanitized participant, evaluator, and cleanup projections. That driver is also the new supply-chain trust boundary: it imports separately installed executable code while claiming source-identity verification. The verification does not cover every executable artifact or establish dependency authenticity, so compiled-module and same-version package substitutions bypass the intended fail-closed seam. This shape cannot safely support the obvious next variation—packages containing native modules—without artifact-level attestation.
Blocking findings: 3
Finding 1 —
one-off- ID:
F1 - Title: [core] Provisioner lifetime latch survives driver cleanup
- Location:
src/raes_adapters/cyberbattlesim/backend/provisioner.py:79 - Decision: fix
- Rationale:
_constructedrecords that construction happened once, not that the shared driver is currently live. Cleanup can destroy and close that driver, but the flag is never cleared; the next CREATE or UPDATE skipsdriver.construct()and return…
Finding 2 —
class(8 instances)- ID:
F2 - Title: [core] Evaluator reuses immutable artifact identities across runs
- Location:
src/raes_adapters/cyberbattlesim/backend/evaluator.py:406 - Decision: fix
- Rationale: The evaluator emits current timestamps, scores, and checksums under process-global run, evidence-record, content, capture-spec, capture-window, and derived-measure identifiers with constant versions. A second evaluation changes the data wh…
- Instances:
src/raes_adapters/cyberbattlesim/backend/evaluator.py:274src/raes_adapters/cyberbattlesim/backend/evaluator.py:406src/raes_adapters/cyberbattlesim/backend/evaluator.py:416src/raes_adapters/cyberbattlesim/backend/evaluator.py:435src/raes_adapters/cyberbattlesim/backend/evaluator.py:460src/raes_adapters/cyberbattlesim/backend/evaluator.py:512src/raes_adapters/cyberbattlesim/backend/evaluator.py:522src/raes_adapters/cyberbattlesim/backend/evaluator.py:533
Finding 3 —
class(5 instances)- ID:
F3 - Title: [security] Partial package attestation permits arbitrary code execution
- Location:
src/raes_adapters/cyberbattlesim/backend/driver.py:153 - Decision: fix
- Rationale: Attacker model: an adversary who can supply a tampered separately installed simulator or dependency, such as through a compromised package index or prebuilt runtime image. The simulator check hashes only
.pyentries undercyberbattle/.… - Instances:
src/raes_adapters/cyberbattlesim/backend/driver.py:153src/raes_adapters/cyberbattlesim/backend/driver.py:154src/raes_adapters/cyberbattlesim/backend/driver.py:155src/raes_adapters/cyberbattlesim/backend/driver.py:432src/raes_adapters/cyberbattlesim/backend/driver.py:487
- ID:
gc_test_quality_review cycle 1 of 1 — issue #27
Reviewer: test-quality (claude-sonnet-5 via gc_test_quality_review)
Branch:27-cyberbattlesim-backend
Cycle: 1 / 1
Findings: 0 (clean run)gc_test_quality_review cycle 1 of 1 complete for issue #27 on branch '27-cyberbattlesim-backend'. Posted by the MCP server to enforce the gc_test_quality_review hard-cap-1 contract (issue #884 follow-up, default lowered in #906). Do not edit or delete — used by the next
gc_test_quality_reviewinvocation to count cycles.Review decision record — test-quality cycle 1 (issue #27)
Reviewer: test-quality
Cycle: 1Architectural read:
This diff adds a complete new CyberBattleSim backend (driver, provisioner, orchestrator, evaluator, participant_runtime, cleanup, manifest, target) plus corresponding qualification/source-ledger evidence, with a single private driver instance shared across the RAES-facing components and a hard boundary that redacts native state (masks, credentials, reward vectors, exception text) before anything crosses into a RAES contract. The test suite matches that shape well: a FakeDriver is used for the portable-contract tests (provisioner/orchestrator/evaluator/participant_runtime/cleanup), while a separate, heavily monkeypatched test exercises the concrete CyberBattleSimDriver's actual supply-chain artifact verification (tampered source tree, injected native extension, editable install, mismatched module origin) and proves fail-closed behavior with zero native imports on each failure path. Leakage boundaries are tested by asserting forbidden substrings (credential_cache, action_mask, reward_vector, exception secret text) are absent from the full serialized portable payload rather than by mocking the redaction step itself, which is the right way to prove a boundary rather than assume it. This lines up almost 1:1 with the acceptance-evidence table in the accompanying guardrails ADR. I would ship this.
Blocking findings: 0 (clean run)
Pre-PR base synchronization
- Source:
refs/remotes/origin/devat7ebf4b9a3fe37d720143cc1baa77203212309a80 - Outcome:
merged_conflicts_resolved - Published feature head:
7fffcb51a6ff74f6f6835f0f9f73a0dca71e20ee - Verified tree:
7e69cafc38b0f74a4d6fe7eae8bcc5f78fc55f85
- Source:
Pre-PR base synchronization
- Source:
refs/remotes/origin/devat7ebf4b9a3fe37d720143cc1baa77203212309a80 - Outcome:
already_current - Published feature head:
414b3a2d3b7620cd884628eaa9b5fc2634166cc9 - Verified tree:
b04aaa9df5211abfd2528f86caaa5565bb347c4f
- Source:
Pre-PR base synchronization
- Source:
refs/remotes/origin/devat7ebf4b9a3fe37d720143cc1baa77203212309a80 - Outcome:
already_current - Published feature head:
96f59f08674f8a03f05e82ac8b4fbbd68753389f - Verified tree:
ec80fd95c9793a6f14a0c073818d62f2f2eac68d
- Source:
Ready for review — issue #27
PR: #60
Outcome
CyberBattleSim now runs through a RAES backend with selected-source and runtime-artifact attestation, bounded stochastic controls, portable participant/evaluator evidence, reusable cleanup, and qualification limitations that bound claims without blocking maintainer-directed simulator admission.
All CI checks passed. Sonar quality gate passed with 81.5% new-code coverage, zero new violations, and zero security hotspots.
Files changed
Added:
docs/decisions/cyberbattlesim-backend-guardrails.mdsrc/raes_adapters/cyberbattlesim/backend/__init__.pysrc/raes_adapters/cyberbattlesim/backend/cleanup.pysrc/raes_adapters/cyberbattlesim/backend/driver.pysrc/raes_adapters/cyberbattlesim/backend/evaluator.pysrc/raes_adapters/cyberbattlesim/backend/manifest.pysrc/raes_adapters/cyberbattlesim/backend/orchestrator.pysrc/raes_adapters/cyberbattlesim/backend/participant_runtime.pysrc/raes_adapters/cyberbattlesim/backend/provisioner.pysrc/raes_adapters/cyberbattlesim/backend/target.pytests/test_cyberbattlesim_backend.py
Modified:
README.mddocs/decisions/cyberbattlesim-qualification-guardrails.mddocs/decisions/cyberbattlesim-scenario-ledger-guardrails.mddocs/decisions/cyborg-cage2-runtime-qualification-guardrails.mddocs/decisions/cyborg-cage2-source-ledger-guardrails.mddocs/index.mdmkdocs.ymlpyproject.tomlsrc/raes_adapters/__init__.pysrc/raes_adapters/cyberbattlesim/experiment/cyberbattle-chain.task.exp.yamlsrc/raes_adapters/cyberbattlesim/mapping/README.mdsrc/raes_adapters/cyberbattlesim/mapping/loss-disclosures.mdsrc/raes_adapters/cyberbattlesim/mapping/source-ledger.jsonlsrc/raes_adapters/cyberbattlesim/public-protocol.mdsrc/raes_adapters/cyberbattlesim/qualification.jsonsrc/raes_adapters/cyborg/__init__.pysrc/raes_adapters/cyborg/mapping/README.mdsrc/raes_adapters/cyborg/mapping/cage2-loss-disclosures.mdsrc/raes_adapters/cyborg/qualification.jsontests/test_cyberbattlesim_qualification.pytests/test_cyborg_provisioner.pytests/test_cyborg_qualification.pytests/test_cyborg_source_ledger.pyuv.lock
Reviews
- codex: Two full implementation review cycles completed and all reported findings were fixed; an additional confirmation cycle was skipped at explicit maintainer direction.
- test-quality: Full changed-test review completed cleanly with 34/34 file coverage.
Traceability reconciliation
- Pending — requirement status transition and IMPLEMENTS/TESTS reconciliation run in Phase E once the PR merges.
Status
- CI: ✅ green
- SonarCloud: ✅ passed
- PR ready for user review and merge. Ground Control reconciliation (requirement status + traceability) runs on merge (Phase E).
gc workflow phase recorded:
traceability_reconciled(issue #27). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.no in-scope requirements; touched-files audit clean.
Final report — issue #27 complete
PR: #60
Outcome
CyberBattleSim now runs through a RAES backend with selected-source and runtime-artifact attestation, bounded stochastic controls, portable participant/evaluator evidence, reusable cleanup, and qualification limitations that bound claims without blocking maintainer-directed simulator admission.
Merged as c641cab. All CI checks passed. Sonar quality gate passed with 81.5% new-code coverage, zero new violations, and zero security hotspots.
Files changed
Added:
docs/decisions/cyberbattlesim-backend-guardrails.mdsrc/raes_adapters/cyberbattlesim/backend/__init__.pysrc/raes_adapters/cyberbattlesim/backend/cleanup.pysrc/raes_adapters/cyberbattlesim/backend/driver.pysrc/raes_adapters/cyberbattlesim/backend/evaluator.pysrc/raes_adapters/cyberbattlesim/backend/manifest.pysrc/raes_adapters/cyberbattlesim/backend/orchestrator.pysrc/raes_adapters/cyberbattlesim/backend/participant_runtime.pysrc/raes_adapters/cyberbattlesim/backend/provisioner.pysrc/raes_adapters/cyberbattlesim/backend/target.pytests/test_cyberbattlesim_backend.py
Modified:
README.mddocs/decisions/cyberbattlesim-qualification-guardrails.mddocs/decisions/cyberbattlesim-scenario-ledger-guardrails.mddocs/decisions/cyborg-cage2-runtime-qualification-guardrails.mddocs/decisions/cyborg-cage2-source-ledger-guardrails.mddocs/index.mdmkdocs.ymlpyproject.tomlsrc/raes_adapters/__init__.pysrc/raes_adapters/cyberbattlesim/experiment/cyberbattle-chain.task.exp.yamlsrc/raes_adapters/cyberbattlesim/mapping/README.mdsrc/raes_adapters/cyberbattlesim/mapping/loss-disclosures.mdsrc/raes_adapters/cyberbattlesim/mapping/source-ledger.jsonlsrc/raes_adapters/cyberbattlesim/public-protocol.mdsrc/raes_adapters/cyberbattlesim/qualification.jsonsrc/raes_adapters/cyborg/__init__.pysrc/raes_adapters/cyborg/mapping/README.mdsrc/raes_adapters/cyborg/mapping/cage2-loss-disclosures.mdsrc/raes_adapters/cyborg/qualification.jsontests/test_cyberbattlesim_qualification.pytests/test_cyborg_provisioner.pytests/test_cyborg_qualification.pytests/test_cyborg_source_ledger.pyuv.lock
Reviews
- codex: Two full implementation review cycles completed and all reported findings were fixed; an additional confirmation cycle was skipped at explicit maintainer direction.
- test-quality: Full changed-test review completed cleanly with 34/34 file coverage.
Traceability reconciliation
- IMPLEMENTS / TESTS / DOCUMENTS added: 11
- Links updated: 24
- Stale links removed: 0
Issue #27 has no requirement UIDs. Qualification records for CyberBattleSim and CybORG were aligned so limitations bound reproducibility claims and do not act as simulator-admission gates.
Status
- CI: ✅ green
- SonarCloud: ✅ passed
- PR ready for user review and merge.
Objective
Implement
raes_adapters.cyberbattlesimas a conformant simulator backend over the selected source profile.Scope
cyberbattlesimoptional extra and module without changing base-only installation.backend-manifest-v2.raes_adapters.baseand published RAES contracts directly.Acceptance criteria
Dependencies