fix: land TechVault on env-packs 6.2.1 (compat, detection, CVE gates, docs)

changelog.d/+install-scenario-packs-doc.added.md

@@ -0,0 +1 @@
+A getting-started guide, "Install a scenario pack and its adapter," documents how LilRAE consumes an external pack (content from `raes-env-packs` by identity) plus its adapter (the `aptl.*` entry points for that pack id), how to select the pack in `aptl.json`, and how to verify and troubleshoot it.

changelog.d/+proxy-addr-cve-2026-90711.fixed.md

@@ -0,0 +1 @@
+Bump the transitive `proxy-addr` dependency from 2.0.7 to 2.0.8 in every MCP package lockfile. Version 2.0.7 carries CVE-2026-90711 (CRITICAL): `proxy-addr` is vulnerable to IP spoofing through an IPv4-mapped IPv6 trust subnet. This cleared the critical finding reported by the dependency-audit and Trivy scans.

changelog.d/+techvault-env-packs-621-compat.fixed.md

@@ -0,0 +1 @@
+TechVault now realizes against `raes-env-packs` 6.2.1, and its Suricata web-attack detection fires. The 6.2.1 pack content changed the pack set-digest, so the `aptl_techvault` capture, serving, startup, planning, and verification providers now pin the 6.2.1 digests (`techvault` `sha256:1229f94f…`, `techvault-participant-study` `sha256:03baae36…`); the `raes-env-packs` requirement and the hash-locked requirement exports move to 6.2.1. The Wazuh manager config no longer excludes the built-in Suricata ruleset (`0475-suricata_rules.xml`): the authored rule `303020` chains off the built-in rule `86601` through `<if_sid>` (env-packs #418), so the built-in base must load for a network web attack to surface as rule `303020` ("Web attack (network)") instead of the generic built-in alert.

config/wazuh_cluster/wazuh_manager.conf

@@ -345,10 +345,11 @@
     <rule_dir>ruleset/rules</rule_dir>
     <rule_dir>etc/rules</rule_dir>
     <rule_exclude>0215-policy_rules.xml</rule_exclude>
-    <!-- The scenario supplies its own exact Suricata base/child rule family.
-         Exclude Wazuh's competing built-in family so the authored child rule
-         (303020) receives the decoded event instead of built-in rule 86601. -->
-    <rule_exclude>0475-suricata_rules.xml</rule_exclude>
+    <!-- Keep Wazuh's built-in Suricata family (0475: rules 86600/86601)
+         loaded. The authored web-attack rule 303020 chains off built-in rule
+         86601 via <if_sid> (env-packs #418), so the built-in base must be
+         present for 303020 to fire. -->
+
     <list>etc/lists/audit-keys</list>
     <list>etc/lists/amazon/aws-eventnames</list>
     <list>etc/lists/security-eventchannel</list>

containers/generic-systemd-node22-base/Dockerfile

@@ -17,6 +17,8 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \
 # Node 22 ships npm 10, whose bundled dependencies carry fixed advisories.
 # Replace it with npm 11 (which supports Node >=22.9) from the registry
 # tarball, verified against its published sha512 integrity (issue #1193).
+# Also drop the unused yarn and corepack tooling (this substrate uses npm only)
+# so their bundled dependencies cannot fail the image vulnerability scan.
 ARG NPM_VERSION=11.21.0
 ARG NPM_SHA512=668bfc2a16a63677a22dd10bb63e5800bb4d9895b82f87c22d3ce37e9cd71b6c3a3121dc7f453181d94ae6e9680ae92c593fbb986514ef08bbf5c3ba46a8af3e
 RUN set -eu; \
@@ -26,7 +28,24 @@ RUN set -eu; \
     mkdir /usr/local/lib/node_modules/npm; \
     tar -xzf /tmp/npm.tgz -C /usr/local/lib/node_modules/npm --strip-components=1; \
     rm /tmp/npm.tgz; \
+    rm -rf /opt/yarn-* /usr/local/bin/yarn /usr/local/bin/yarnpkg \
+        /usr/local/lib/node_modules/corepack /usr/local/bin/corepack; \
     test "$(npm --version)" = "${NPM_VERSION}"
+# npm (through 12.x) bundles postcss-selector-parser 7.1.4, which carries a
+# fixed advisory (CVE-2026-104844, fixed in 7.1.6) that no npm release has
+# adopted. npm's ci path requires the module, so upgrade the bundled copy in
+# place to 7.1.6 (identical runtime deps cssesc/util-deprecate, already present)
+# and verify its published sha512 integrity.
+ARG PCSS_VERSION=7.1.6
+ARG PCSS_SHA512=eea0123f384a17697628b6e8459bb1f0209344c746895d3cbd69b22b33f3db6a99ed98d004e798eeb37336808b49489fb49ec752ad061111e6c70fedd1d09d33
+RUN set -eu; \
+    curl -fsSL "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-${PCSS_VERSION}.tgz" -o /tmp/pcss.tgz; \
+    echo "${PCSS_SHA512}  /tmp/pcss.tgz" | sha512sum -c -; \
+    pcss=/usr/local/lib/node_modules/npm/node_modules/postcss-selector-parser; \
+    rm -rf "$pcss"; mkdir -p "$pcss"; \
+    tar -xzf /tmp/pcss.tgz -C "$pcss" --strip-components=1; \
+    rm /tmp/pcss.tgz; \
+    test "$(node -p "require('$pcss/package.json').version")" = "${PCSS_VERSION}"
 # This image's offline cache is an APTL-owned build integration. Resolve the
 # exact compatible pack through the normal acquisition/artifact validators;
 # retain dependency cache + identity evidence, never a second runtime source.

docs/architecture/issue-592-scenario-pack-terminology-preflight.md

@@ -54,6 +54,7 @@ prose must not accidentally rename them.
 | Extension documentation | `src/aptl_techvault/README.md` | A plugin may be compatible with an exact pack binding; it is neither the pack, RAES, an APTL startup-catalog entry, nor a new catalog authority. |
 | Historical requirements and review evidence | `docs/requirements/SCN-010/requirement.md`, `docs/reviews/962-lilrae-readiness/` | Preserve historical names and exact recorded links. The review's backlog and identity dispositions provide current interpretation without changing the underlying evidence. |
 | Terminology record and navigation labels | `docs/architecture/issue-592-scenario-pack-terminology-preflight.md`, `docs/architecture/index.md`, `mkdocs.yml` | Titles may preserve an issue's or file's historical locator. Descriptive labels for current contracts use the terminology above. |
+| Scenario pack installation guide | `docs/getting-started/installing-packs.md` | Keep the content-pack and adapter distinction and the env-pack identity and source selection; do not rename the pack, RAES, or backend contracts. |
 
 The inventory identified three current-prose hazards for issue #592 to resolve:
 the tautological rename sentence at the start of the issue #589 preflight, the

docs/getting-started/installing-packs.md

@@ -0,0 +1,115 @@
+# Install a scenario pack and its adapter
+
+LilRAE does not contain the scenarios it runs. A scenario has two parts, and you
+install each one:
+
+1. **The pack.** A RAES environment pack holds the scenario content: the SDL
+   document, assets, detection content, and seed data. TechVault is a pack.
+2. **The adapter.** A Python package that provides the scenario-specific
+   behavior for the pack's identity: serving, capture, startup, runtime
+   parameters, verification, and participant smoke plans. The generic
+   materializer in `src/aptl` does not branch on scenario names. The adapter
+   supplies all scenario-specific behavior through entry points.
+
+You must install both. The pack without its adapter realizes generically, but
+its scenario-specific startup, verification, and capture do not run.
+
+## Install the pack
+
+The default scenario source is `env-pack`. LilRAE resolves the pack from the
+installed `raes-env-packs` distribution by identity. It reads
+`resources/packs/<identity>/sdl/<identity>.sdl.yaml`, stages the pack into
+private project state, and validates it with the env-packs gates before use.
+
+Install the distribution that carries the pack:
+
+```shell
+pip install "raes-env-packs==6.2.0"
+```
+
+TechVault ships in `raes-env-packs` as two packs: `techvault` (the environment)
+and `techvault-participant-study` (the environment plus authored red and blue
+participants).
+
+A third-party pack that is not in `raes-env-packs` ships in its own
+distribution. Install that distribution the same way. The pack directory name
+must equal the pack's declared identity.
+
+## Install the adapter
+
+The adapter registers entry points in these groups, keyed by the pack identity:
+
+| Entry-point group | Purpose |
+| --- | --- |
+| `aptl.pack_backend_interactions` | Serving provider |
+| `aptl.scenario_capture` | Capture provider |
+| `aptl.scenario_startup` | Startup provider |
+| `aptl.scenario_runtime_parameters` | Runtime parameters |
+| `aptl.scenario_planning_compatibility` | Planning compatibility |
+| `aptl.scenario_verifiers` | Verifier |
+| `aptl.evidence_payload` | Evidence collectors |
+| `aptl.participant_mcp_smoke_plans` | Participant MCP smoke plans |
+
+The TechVault adapter is `aptl_techvault`. It ships inside the `aptl-labs`
+(LilRAE) distribution, so a LilRAE install already has it. You do not install it
+separately.
+
+A third-party pack supplies its own adapter distribution. Install it with pip.
+Its entry points must name the pack's identity (for example `mypack.aptl`).
+After install, confirm the entry points resolve:
+
+```shell
+python -c "from importlib.metadata import entry_points as e; print([ep.name for ep in e(group='aptl.scenario_startup')])"
+```
+
+## Select the pack
+
+The active scenario is an operator decision. It lives in `aptl.json`:
+
+```json
+{
+  "scenario": {
+    "source": "env-pack",
+    "identity": "techvault"
+  }
+}
+```
+
+- `source: env-pack` resolves the pack from the installed distribution by
+  identity. This is the default.
+- `identity` names the pack. The default identity is `techvault`.
+
+The backend never switches the scenario at runtime. You select it before
+`aptl lab start`.
+
+## Verify and run
+
+List the configured pack. The catalog projects the pack named in `aptl.json`:
+
+```shell
+aptl lab scenarios
+```
+
+The command prints the identity, version, status, digest, and description. Start
+the lab:
+
+```shell
+aptl lab start
+```
+
+`aptl lab start` uses the configured identity. The `--scenario` option selects
+another identity, but only one that the catalog already lists. The catalog lists
+the configured pack, so `--scenario` cannot select a pack that `aptl.json` does
+not configure. To run a different pack, set `scenario.identity` in `aptl.json`.
+
+## Troubleshooting
+
+- **`Unknown scenario id '<x>'. Available scenarios: <y>`**. The identity is
+  not the configured pack. Set `scenario.identity` to `<x>` in `aptl.json`, then
+  run `aptl lab scenarios` to confirm the catalog lists it.
+- **`env-pack source not found for '<x>'`**. The pack distribution is not
+  installed, or the pack directory name does not match the identity. Install the
+  distribution that carries `resources/packs/<x>/`.
+- **The lab realizes, but scenario-specific startup or verification does not
+  run**. The adapter is missing. Install the adapter distribution and confirm
+  its entry points name the pack identity.

docs/reviews/962-lilrae-readiness/tracked-file-inventory.tsv

@@ -1889,3 +1889,7 @@ containers/_host-identity/aptl-host-identity.service	split-pack-delivery	Invento
 containers/_host-identity/install.sh	split-pack-delivery	Inventory exact content owner; retain reusable delivery/evidence tools, retire static duplication after parity
 docs/adrs/adr-062-lilrae-name-and-naming-convention.md	architecture-history	Preserve LilRAE name change and new-code naming decision
 docs/architecture/issue-1232-lilrae-naming-preflight.md	architecture-history	Preserve LilRAE public naming boundary and compatibility guardrails
+changelog.d/+install-scenario-packs-doc.added.md	repository-metadata	Inspect identity/content owner during #934; no runtime capability implied
+changelog.d/+proxy-addr-cve-2026-90711.fixed.md	repository-metadata	Inspect identity/content owner during #934; no runtime capability implied
+changelog.d/+techvault-env-packs-621-compat.fixed.md	repository-metadata	Inspect identity/content owner during #934; no runtime capability implied
+docs/getting-started/installing-packs.md	docs-follow-owner	Separate current user guidance from historical evidence and scenario-pack-specific docs