fix: update TechVault study for RAES 6.0.1

docs/development/techvault-participant-affiliations-preflight.md

@@ -0,0 +1,69 @@
+# TechVault participant affiliations preflight
+
+Issue #401 is a compatibility correction to first-party RAES content. RAES owns
+the agent affiliation shape and the parse, compile, and admission rules. This
+repository owns the two TechVault pack copies, their byte-bound associated
+artifacts, and the release that makes the corrected study pack consumable. No
+pack-owned participant schema, migration alias, or admission policy is needed.
+
+## Contract and scope
+
+Use one compatible **published** RAES release as the exactly pinned dependency
+and as the authority in the regression. The study pack's three agent
+declarations must use its `affiliations` contract. The base TechVault pack also
+declares `entity` on its two agents; a pin change that rejects that field must
+bring those declarations forward as well, because hosted-pack and package tests
+validate both packs. Compare the final parsed agent affiliations with the
+intended `study-control`, `red-team`, and `blue-team` entities. Do not treat a
+syntactic rename as proof that authority or audience is unchanged.
+
+Affiliation identifies an agent's relation to an entity. It does not grant the
+controller authority or participant access. Preserve the separate
+`authority_anchors`, `operating_scope`, `interactive_access`,
+`observation_boundaries`, inject source and recipients, delivery policies,
+mixed-control transitions, evidence requirements, and the authored red-start,
+red-stop, blue-start, blue-stop order. The existing study regression checks the
+compiled addresses and ticks; it needs a RAES-owned admission check of the
+participant delivery bindings and their authority and exposure boundaries.
+That admission test should use a deterministic, non-secret compatible fixture,
+not backend credentials or a live provider session. A passing `validate_pack`
+or successful compile alone does not establish admission.
+
+## Cross-cutting guardrails
+
+| Layer | Existing authority and constraint |
+| --- | --- |
+| SDL shape and semantics | `raes.parse_sdl_file`, `instantiate_scenario`, `raes_processor.compiler.compile_runtime_model`, and the published RAES admission contract. Use their public models and diagnostics; add no local SDL DTO, validator, exception hierarchy, or fallback for `entity`. |
+| Pack validation | `validation.validate_pack` is the silent consumer result. `content_ci` adds trusted author checks. Keep their bounded, payload-free diagnostic and logging behavior; do not route foreign packs through pack-local executable tests. |
+| Filesystem and content identity | `_pack_fs`, `digest.validate_pack_content_manifest`, and `digest.pack_content_digest` guard contained reads and exact inventory. `tools/refresh_pack_sdl_binding.py` is the SDL-only authoring path that retargets surviving external-concept subjects and rebinds their manifest members. Use `derive_pack_content_manifest` when another member's bytes or inventory change. Verify the resulting digest from the final tree; never hand-edit hashes or claim a digest from unvalidated bytes. |
+| Concepts and schemes | ADR 0038 and RAES `admit_external_concept_bindings` own concept admission. The scheme snapshot is an independently pinned source, not a digest of agent affiliations. Preserve its bytes when its source and concepts are unchanged; revalidate it and its manifest member after rebinding. |
+| Exposure and secrets | Keep `pack.compatibility.yaml` artifact boundaries, release participant-view and leak gates, RAES observation boundaries, and existing generated-secret references. The SDL has no provider credential, host path, environment binding, or executable launch command. Test fixtures, CLI argv, logs, and errors must contain no secret values or instruction payload dumps. |
+| Publication | `pyproject.toml` includes both packs in wheel and sdist. Use the hosted-pack validation and release checks plus packaged-content tests. Release Please owns the project version and `CHANGELOG.md`; the `dev` to `main` promotion and release workflow own publication. |
+
+The extensibility seam is the pinned RAES public contract and its admission
+fixture: a later participant profile or affiliation variation should change
+authored RAES data and the fixture, not introduce a TechVault-specific parser or
+hard-code Claude Code into a generic pack validator. Preserve the
+`participant-implementation-manifest:claude-code` reference as authored study
+data. Backend mapping of that reference and provider session lifecycle remain
+outside this repository.
+
+## Published RAES 6.0.1 compatibility
+
+RAES 6.0.1 admits participant delivery addresses as temporal subjects and
+requires agent affiliations. It also accepts required evidence media types only
+when a registered output contract can validate their content. The two TechVault
+packs previously required `text/plain` or `application/x-ndjson` for three
+evidence needs without a matching RAES output contract. Leave their encodings
+unspecified while preserving each requirement's source, scope, channel,
+redaction, integrity, retention, and loss-disclosure intent. Do not relabel a
+plain-text transcript as JSON merely to satisfy the parser.
+
+## Boundaries
+
+No changes to the four-inject study design, evidence meaning, scoring, telemetry,
+backend admission policy, runtime controller, credential delivery, or live
+qualification are implied. Do not conflate affiliation with authorization,
+observation with instruction delivery, the pack set digest with an SDL or scheme
+digest, or a validated local checkout with a published package. Do not encode
+APTL-specific catalog paths or backend commands into canonical pack metadata.

packs/techvault-participant-study/associated-artifacts.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "associated-artifact-manifest/v1",
   "manifest_id": "techvault-participant-study-associated-artifacts",
-  "manifest_version": "0.1.0",
+  "manifest_version": "0.1.1",
   "canonicalization_profile": "associated-artifact-set/v1",
   "scope": "scenario",
   "parent_ref": {
@@ -547,7 +547,7 @@
       "uri": "raes-environment-pack:/pack.compatibility.yaml",
       "checksum": {
         "algorithm": "sha256",
-        "value": "11592e4c23fe22092c9c7aeb06c18c0d4bf27992c8ac8cf868a5a23f52156735"
+        "value": "079837132da23c786ecfa8991a810e50dc3c7d79fbe0b89b22f7aec2fc5c1f87"
       },
       "size_bytes": 1607,
       "created_at": "2026-08-02T00:00:00Z",
@@ -563,7 +563,7 @@
       "uri": "raes-environment-pack:/pack.yaml",
       "checksum": {
         "algorithm": "sha256",
-        "value": "ad659b564b3bfc38206a61f94d8b2422a941666740529939ba63ec24da671171"
+        "value": "e2f0a8063d8770e37a68f98bb139f5aa3ae1729f35d0b20319508672559467cc"
       },
       "size_bytes": 552,
       "created_at": "2026-08-02T00:00:00Z",
@@ -595,7 +595,7 @@
       "uri": "raes-environment-pack:/sdl/techvault-participant-study.bindings.json",
       "checksum": {
         "algorithm": "sha256",
-        "value": "08d6197a94bceb75325d63bb5e469c188534a93cc99a1f14d967964af4b1ab06"
+        "value": "7c4c678ebe41cedfb06d9cf879bc8db7886229a54e8f699f0310045b2bddd854"
       },
       "size_bytes": 44611,
       "created_at": "2026-09-13T00:00:00Z",
@@ -627,9 +627,9 @@
       "uri": "raes-environment-pack:/sdl/techvault-participant-study.sdl.yaml",
       "checksum": {
         "algorithm": "sha256",
-        "value": "1fec5130185eadea28157af10fb76c3394ad21c349d2849628d0f4e5c3fc1e24"
+        "value": "bacbfb918bff2fab5bc730bce2ac1668fbc409e007dd84f17d47496d23cb73e0"
       },
-      "size_bytes": 167003,
+      "size_bytes": 166927,
       "created_at": "2026-08-02T00:00:00Z",
       "source": "environment-pack-author",
       "satisfies_refs": [],
@@ -733,5 +733,5 @@
       "description": "Exact defensive stdio MCP source packages for the SOC workstation."
     }
   },
-  "set_digest": "sha256:94dc0236f3e2d4c62db782040acd73b1739ba0bf12adec580289a916fbfcce5a"
+  "set_digest": "sha256:fdde7b1a8b9377f7ddd473417de1f3fd3e24549e4560d8d6392f1727b3af5357"
 }

packs/techvault-participant-study/pack.compatibility.yaml

@@ -2,7 +2,7 @@ schema_version: "environment-pack-compatibility/v2"
 pack:
   name: techvault-participant-study
   title: TechVault
-  version: 0.1.0
+  version: 0.1.1
   status: built
   provenance_ledger: docs/provenance-ledger.yaml
   source:

packs/techvault-participant-study/pack.yaml

@@ -1,6 +1,6 @@
 name: techvault-participant-study
 title: TechVault Participant Study
-version: 0.1.0
+version: 0.1.1
 status: built
 description: >-
   The TechVault enterprise intrusion environment plus an SDL-authored,

packs/techvault-participant-study/sdl/techvault-participant-study.bindings.json

@@ -10,7 +10,7 @@
         "owning_contract_id": "sdl-authoring-input-v1",
         "lifecycle_phase": "normalized-authoring",
         "canonical_ref": "nodes.webapp.runtime.applications.techvault-portal.routes.ping-tool",
-        "artifact_digest": "sha256:631d3ca119b18647d2f32a7fbe229c9bad5a224f51ffc1c61831741f1d9d9b74"
+        "artifact_digest": "sha256:4fbffb486f2c9500c4ebe8b3f82da334a52d493f6a147dc43a1c6f12febbfb7e"
       },
       "scheme": {
         "scheme_id": "mitre-cwe",
@@ -87,7 +87,7 @@
         "owning_contract_id": "sdl-authoring-input-v1",
         "lifecycle_phase": "normalized-authoring",
         "canonical_ref": "nodes.webapp.runtime.applications.techvault-portal.routes.debug",
-        "artifact_digest": "sha256:631d3ca119b18647d2f32a7fbe229c9bad5a224f51ffc1c61831741f1d9d9b74"
+        "artifact_digest": "sha256:4fbffb486f2c9500c4ebe8b3f82da334a52d493f6a147dc43a1c6f12febbfb7e"
       },
       "scheme": {
         "scheme_id": "mitre-cwe",
@@ -164,7 +164,7 @@
         "owning_contract_id": "sdl-authoring-input-v1",
         "lifecycle_phase": "normalized-authoring",
         "canonical_ref": "nodes.webapp.runtime.applications.techvault-portal.routes.debug",
-        "artifact_digest": "sha256:631d3ca119b18647d2f32a7fbe229c9bad5a224f51ffc1c61831741f1d9d9b74"
+        "artifact_digest": "sha256:4fbffb486f2c9500c4ebe8b3f82da334a52d493f6a147dc43a1c6f12febbfb7e"
       },
       "scheme": {
         "scheme_id": "mitre-cwe",
@@ -241,7 +241,7 @@
         "owning_contract_id": "sdl-authoring-input-v1",
         "lifecycle_phase": "normalized-authoring",
         "canonical_ref": "nodes.webapp.runtime.applications.techvault-portal.routes.api-token",
-        "artifact_digest": "sha256:631d3ca119b18647d2f32a7fbe229c9bad5a224f51ffc1c61831741f1d9d9b74"
+        "artifact_digest": "sha256:4fbffb486f2c9500c4ebe8b3f82da334a52d493f6a147dc43a1c6f12febbfb7e"
       },
       "scheme": {
         "scheme_id": "mitre-cwe",
@@ -318,7 +318,7 @@
         "owning_contract_id": "sdl-authoring-input-v1",
         "lifecycle_phase": "normalized-authoring",
         "canonical_ref": "nodes.webapp.runtime.applications.techvault-portal.routes.api-file",
-        "artifact_digest": "sha256:631d3ca119b18647d2f32a7fbe229c9bad5a224f51ffc1c61831741f1d9d9b74"
+        "artifact_digest": "sha256:4fbffb486f2c9500c4ebe8b3f82da334a52d493f6a147dc43a1c6f12febbfb7e"
       },
       "scheme": {
         "scheme_id": "mitre-cwe",
@@ -395,7 +395,7 @@
         "owning_contract_id": "sdl-authoring-input-v1",
         "lifecycle_phase": "normalized-authoring",
         "canonical_ref": "nodes.webapp.runtime.applications.techvault-portal.routes.api-user",
-        "artifact_digest": "sha256:631d3ca119b18647d2f32a7fbe229c9bad5a224f51ffc1c61831741f1d9d9b74"
+        "artifact_digest": "sha256:4fbffb486f2c9500c4ebe8b3f82da334a52d493f6a147dc43a1c6f12febbfb7e"
       },
       "scheme": {
         "scheme_id": "mitre-cwe",
@@ -472,7 +472,7 @@
         "owning_contract_id": "sdl-authoring-input-v1",
         "lifecycle_phase": "normalized-authoring",
         "canonical_ref": "nodes.webapp.runtime.applications.techvault-portal.routes.admin",
-        "artifact_digest": "sha256:631d3ca119b18647d2f32a7fbe229c9bad5a224f51ffc1c61831741f1d9d9b74"
+        "artifact_digest": "sha256:4fbffb486f2c9500c4ebe8b3f82da334a52d493f6a147dc43a1c6f12febbfb7e"
       },
       "scheme": {
         "scheme_id": "mitre-cwe",
@@ -549,7 +549,7 @@
         "owning_contract_id": "sdl-authoring-input-v1",
         "lifecycle_phase": "normalized-authoring",
         "canonical_ref": "nodes.webapp.runtime.applications.techvault-portal.routes.login",
-        "artifact_digest": "sha256:631d3ca119b18647d2f32a7fbe229c9bad5a224f51ffc1c61831741f1d9d9b74"
+        "artifact_digest": "sha256:4fbffb486f2c9500c4ebe8b3f82da334a52d493f6a147dc43a1c6f12febbfb7e"
       },
       "scheme": {
         "scheme_id": "mitre-cwe",
@@ -626,7 +626,7 @@
         "owning_contract_id": "sdl-authoring-input-v1",
         "lifecycle_phase": "normalized-authoring",
         "canonical_ref": "nodes.webapp.runtime.applications.techvault-portal.routes.search",
-        "artifact_digest": "sha256:631d3ca119b18647d2f32a7fbe229c9bad5a224f51ffc1c61831741f1d9d9b74"
+        "artifact_digest": "sha256:4fbffb486f2c9500c4ebe8b3f82da334a52d493f6a147dc43a1c6f12febbfb7e"
       },
       "scheme": {
         "scheme_id": "mitre-cwe",
@@ -703,7 +703,7 @@
         "owning_contract_id": "sdl-authoring-input-v1",
         "lifecycle_phase": "normalized-authoring",
         "canonical_ref": "nodes.webapp.runtime.applications.techvault-portal.routes.upload",
-        "artifact_digest": "sha256:631d3ca119b18647d2f32a7fbe229c9bad5a224f51ffc1c61831741f1d9d9b74"
+        "artifact_digest": "sha256:4fbffb486f2c9500c4ebe8b3f82da334a52d493f6a147dc43a1c6f12febbfb7e"
       },
       "scheme": {
         "scheme_id": "mitre-cwe",
@@ -780,7 +780,7 @@
         "owning_contract_id": "sdl-authoring-input-v1",
         "lifecycle_phase": "normalized-authoring",
         "canonical_ref": "nodes.webapp.runtime.applications.techvault-portal.routes.login",
-        "artifact_digest": "sha256:631d3ca119b18647d2f32a7fbe229c9bad5a224f51ffc1c61831741f1d9d9b74"
+        "artifact_digest": "sha256:4fbffb486f2c9500c4ebe8b3f82da334a52d493f6a147dc43a1c6f12febbfb7e"
       },
       "scheme": {
         "scheme_id": "mitre-cwe",
@@ -857,7 +857,7 @@
         "owning_contract_id": "sdl-authoring-input-v1",
         "lifecycle_phase": "normalized-authoring",
         "canonical_ref": "nodes.webapp.runtime.applications.techvault-portal.routes.api-token",
-        "artifact_digest": "sha256:631d3ca119b18647d2f32a7fbe229c9bad5a224f51ffc1c61831741f1d9d9b74"
+        "artifact_digest": "sha256:4fbffb486f2c9500c4ebe8b3f82da334a52d493f6a147dc43a1c6f12febbfb7e"
       },
       "scheme": {
         "scheme_id": "mitre-cwe",
@@ -934,7 +934,7 @@
         "owning_contract_id": "sdl-authoring-input-v1",
         "lifecycle_phase": "normalized-authoring",
         "canonical_ref": "nodes.webapp.runtime.applications.techvault-portal.routes.search",
-        "artifact_digest": "sha256:631d3ca119b18647d2f32a7fbe229c9bad5a224f51ffc1c61831741f1d9d9b74"
+        "artifact_digest": "sha256:4fbffb486f2c9500c4ebe8b3f82da334a52d493f6a147dc43a1c6f12febbfb7e"
       },
       "scheme": {
         "scheme_id": "mitre-cwe",
@@ -1011,7 +1011,7 @@
         "owning_contract_id": "sdl-authoring-input-v1",
         "lifecycle_phase": "normalized-authoring",
         "canonical_ref": "nodes.webapp.runtime.applications.techvault-portal.routes.comment",
-        "artifact_digest": "sha256:631d3ca119b18647d2f32a7fbe229c9bad5a224f51ffc1c61831741f1d9d9b74"
+        "artifact_digest": "sha256:4fbffb486f2c9500c4ebe8b3f82da334a52d493f6a147dc43a1c6f12febbfb7e"
       },
       "scheme": {
         "scheme_id": "mitre-cwe",