Phase 1: Generator and Validator end-to-end pipeline

[sehkone]

Goal

Build the Generator → Bundle → Validator pipeline end-to-end, starting from the smallest Linux-only vertical slice and expanding incrementally to cover AC-1 and AC-2 anchor cases.

This issue tracks the reduced Phase 1 scope agreed upon in design review. The full Phase 1 vision is documented in overview discussions, but implementation begins with a narrower slice to lock down contracts and avoid early rework.

Milestones

Milestone	Description
M0 Contract Freeze	Unify v1 contracts, initialize project scaffolding (Cargo workspace, CI, dependabot)
M1 PCAP Only	Smallest Linux-only E2E path: scenario parsing → container provisioning → activity execution → bundle generation → Validator L1-L3 + L4-lite + pipeline CI
M2 PCAP + Sysmon	Windows VM provisioning via libvirt + Sysmon JSONL collection alongside PCAP
M3 Falco, TLS, and Campaign	Falco collection, TLS termination topology (AC-2), mini campaign support
M4 Hardening and CI	Golden fixtures, regression checks, AC-1/AC-2 CI, pre-baked container images
P1 Docs Track	Write AI Agent traffic generation and QFlow replay contracts (parallel with implementation)

Sub-issues

M0 Contract Freeze

• Freeze v1 contracts across Scenario, Bundle, Ground Truth, and Validator #9 Freeze v1 contracts across Scenario, Bundle, Ground Truth, and Validator
• Add canonical AC-0 scenario and expected bundle layout #10 Add canonical AC-0 scenario and expected bundle layout
• Initialize project scaffolding #28 Initialize project scaffolding

M1 PCAP Only

• Parse Scenario YAML into typed Rust structs #11 Parse Scenario YAML into typed Rust structs
• Provision Linux containers and PCAP capture for AC-0 #12 Provision Linux containers and PCAP capture for AC-0
• Execute curl and nmap activities and record Ground Truth #13 Execute curl and nmap activities and record Ground Truth
• Assemble dataset bundle from collected artifacts #14 Assemble dataset bundle from collected artifacts
• Implement Validator L1-L3 and L4-lite #15 Implement Validator L1-L3 and L4-lite
• Add AC-0 pipeline CI #24 Add AC-0 pipeline CI

M2 PCAP + Sysmon

• Add Windows VM provisioning and Sysmon collection #19 Add Windows VM provisioning and Sysmon collection
• Extend bundle handling and validation for Windows artifacts #20 Extend bundle handling and validation for Windows artifacts

M3 Falco, TLS, and Campaign

• Add mini campaign support for two-step Linux attacks #16 Add mini campaign support for two-step Linux attacks
• Implement TLS termination topology and dual PCAP capture for AC-2 #17 Implement TLS termination topology and dual PCAP capture for AC-2
• Extend Validator L4 for dual-capture and campaign alignment #18 Extend Validator L4 for dual-capture and campaign alignment
• Add Falco collection to Linux containers #27 Add Falco collection to Linux containers

M4 Hardening and CI

• Prepare Windows VM E2E environment #49 Prepare Windows VM E2E environment
• Run AC-1 and AC-2 end-to-end and fix integration gaps #21 Run AC-1 and AC-2 end-to-end and fix integration gaps
• Build and publish pre-baked container images for generator environments #22 Build and publish pre-baked container images for generator environments
• Add golden fixtures and deterministic regression checks #23 Add golden fixtures and deterministic regression checks
• Add AC-1/AC-2 CI with golden fixture comparison #29 Add AC-1/AC-2 CI with golden fixture comparison

P1 Docs Track

• Write AI Agent traffic generation specification #25 Write AI Agent traffic generation specification
• Define QFlow replay contract and smoke-test interface #26 Define QFlow replay contract and smoke-test interface

Parallel work (enables M4 fixture determinism)

• Add scenario start time and time compression with timestamp rewriting #67 Add scenario start time and time compression with timestamp rewriting (umbrella; sub-issues Add scenario start_at and time-compression fields to schema and parser #62–Update fixtures and CI for fixed start_at and time-compression #66). Required precursor for Add golden fixtures and deterministic regression checks #23 and Add AC-1/AC-2 CI with golden fixture comparison #29: without fixed start_at and per-execution anchoring, PCAP/JSONL fixtures cannot be compared byte-for-byte across runs.

Scope

In scope

• Scenario Definition v1 schema and parser
• Generator: Linux container provisioning, activity execution (curl, nmap, Atomic Red Team), PCAP capture, bundle assembly
• Generator: Windows VM provisioning, Sysmon collection
• Generator: Falco collection, TLS termination topology, mini campaign support
• Ground Truth: session-scope recording with campaign support
• Validator: L1 (completeness), L2 (schema), L3 (GT integrity), L4 (cross-artifact alignment)
• AC-1 and AC-2 end-to-end integration
• CI pipeline with regression checks

Out of scope

• AC-3 (HTTPS proxy decryption)
• AC-4 and medium/large scale scenarios
• E2E encryption
• CALDERA full-chain automation
• Metasploit complex exploitation automation
• AI Actor (all modes: simulation, hybrid, autonomous)
• AI Agent deployment and control modes
• Cloud provider integration
• QFlow Replay full integration (contract only in P1 Docs)

Exit criteria

• AC-1 and AC-2 produce reproducible bundles that pass Validator L1-L4
• CI runs a minimum scenario and validates the resulting bundle on every change
• AI Agent traffic generation and QFlow replay contracts are documented and concrete enough to unblock Phase 2 planning

References

• Overview
• Generator Design
• Scenario Definition Schema
• Anchor Case Selection
• Ground Truth Definition
• Validator Design
• AI Actor Behavior Model