build(cyberbattlesim): qualify public source profile

[Brad-Edwards]

Summary

Qualify an immutable official CyberBattleSim source revision and publish the exact reproducible experiment protocol while keeping research admission closed until upstream distribution, seed-control, and benchmark-defect blockers are resolved.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #25

ADR Impact

• ADR-021
• ADR-069
• ADR-003

Changes

• Record the immutable official CyberBattleSim source, dependency, license, archive, and clean-install qualification evidence.
• Define the exact public experiment protocol, including scenario, attacker, defender, evaluator, metrics, termination rules, and independent seed bindings.
• Expose packaged read-only qualification resources without importing CyberBattleSim, and fail closed by withholding an install extra until upstream admission blockers are resolved.
• Document the backend-local architecture guardrails and add regression tests for identity, smoke evidence, legal disposition, protocol completeness, and negative admissibility.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Configured completion command passes
• No coverage regression

The canonical make verify and make policy gates passed. Focused qualification tests, related package tests, static analysis, distribution-content checks, and clean-wheel resource loading also passed.

Ground Control Checks

• Configured repository policy command passes
• gc_evaluate_quality_gates passes or is unchanged by this repo-only change
• gc_run_sweep reviewed; findings fixed or recorded with rationale

Traceability

• IMPLEMENTS: Issue build(cyberbattlesim): qualify and pin the public source and experiment profile #25 ← src/raes_adapters/cyberbattlesim/qualification.json, Issue build(cyberbattlesim): qualify and pin the public source and experiment profile #25 ← src/raes_adapters/cyberbattlesim/public-protocol.md, Issue build(cyberbattlesim): qualify and pin the public source and experiment profile #25 ← src/raes_adapters/cyberbattlesim/init.py
• TESTS: Issue build(cyberbattlesim): qualify and pin the public source and experiment profile #25 ← tests/test_cyberbattlesim_qualification.py

Checklist

• Code follows project coding standards (docs/CODING_STANDARDS.md)
• No business logic in API layer
• Domain layer has no framework imports
• Envers @Audited on new entities if applicable
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.