Adopt an Engage-aligned adversary engagement model across the Azazel System

[01rabbit]

Summary

Define and adopt a MITRE Engage-aligned adversary engagement model across the Azazel System without weakening the existing deterministic, local-first, advisory-only, and bounded-action guarantees.

This is a system-level doctrine and coordination issue. Product-specific implementation remains in each repository.

Why

Azazel already implements the core operational ideas behind adversary engagement: delaying action, controlled friction, selective redirection, deception, observation, and auditable local decisions. MITRE Engage provides a useful vocabulary and planning structure for expressing the intent behind those actions.

The objective is not to claim formal MITRE certification or to turn Azazel into an offensive or autonomous platform. The intended description is Engage-aligned or Engage-informed.

System responsibility model

• Azazel defines doctrine, terminology, safety boundaries, and cross-product responsibility.
• Azazel-Fabric (AZ-05) defines shared engagement contracts and event vocabulary, but no decision logic.
• Azazel-Edge (AZ-01) builds engagement candidates, makes the final deterministic decision, executes bounded actions, and records outcomes.
• Azazel-Gadget (AZ-02) supports only constrained, mode-bound engagement profiles suitable for a personal tactical gateway.
• Azazel-Knowledge (AZ-04) correlates ATT&CK/CTI and attacker reactions, evaluates prior effectiveness, and returns advisory-only posture suggestions.
• Azazel-Boot (AZ-03) remains observation-first until a repository and explicit safety model exist.

Core rule

Engage expresses intent. Knowledge advises. Fabric describes. Edge decides and executes. Gadget executes only bounded profiles.

Required doctrine additions

• Define adversary engagement, cyber denial, deception, channeling, collection, and termination in Azazel terminology.
• Explain the relationship among ATT&CK, MITRE Engage, Behavioral CTI, delaying action, and the Cyber Scapegoat Gateway.
• Preserve the existing rule that AI may explain or suggest but never select or execute core actions.
• Explicitly prohibit hack-back, attacker-system compromise, uncontrolled outbound traffic from decoys, autonomous retaliation, and unbounded engagement.
• Require maximum duration, scope, resource limits, production isolation, operator visibility, termination conditions, and audit evidence for every engagement-capable profile.
• Define external wording and claim boundaries for documentation, CFPs, papers, and demonstrations.

Cross-repository implementation issues

• Define shared adversary-engagement contracts and safety invariants Azazel-Fabric#8 — shared engagement contracts, safety invariants, compatibility fixtures, and consumer-status reconciliation
• Add Engage-aligned engagement candidates to the deterministic decision loop Azazel-Edge#319 — engagement candidate builder and deterministic Action Arbiter integration
• Implement mode-bound Engage-lite profiles for portable tactical defense Azazel-Gadget#16 — mode-bound Engage-lite profiles for portable tactical defense
• 01rabbit/Azazel-Knowledge#52 — engagement-effectiveness analysis and advisory-only posture suggestions
• Add cross-repository replay, failure, compatibility, and safety test orchestration after the individual contracts stabilize
• Define the observation-first boundary for future Azazel-Boot work; do not create an implementation issue until its repository and safety model exist

Recommended implementation order

1. Ratify doctrine and non-goals in this repository.
2. Reconcile current Fabric consumer versions and release the additive shared contract.
3. Implement Knowledge ingest/advisory and Edge shadow/replay consumers against golden fixtures.
4. Enable Edge candidate evaluation in feature-disabled/shadow mode.
5. Add Gadget mode-bound profiles after the Fabric contract is stable.
6. Run cross-repository adversarial, failure, replay, and isolation review before enabling live profiles by default.

Acceptance criteria

• A doctrine document clearly assigns responsibilities to every AZ class.
• Safety and non-goal statements are explicit and testable.
• All child issues link back to this issue.
• The design remains functional when Knowledge is absent, slow, malformed, or wrong.
• No shared contract can carry a directive that bypasses a product-local decision authority.
• Public descriptions use Engage-aligned or Engage-informed, not unsupported compliance or certification claims.

[01rabbit]

AZ-06 extension

The Engage-aligned system model has been extended with a proposed dedicated Engagement Environment Plane:

• Establish container-first AZ-06 Azazel-Deception Host as the Engagement Environment Plane #61 — establish provisional AZ-06 Azazel-Deception Host
• Define deception-environment contracts for AZ-06 Deception Host Azazel-Fabric#9 — shared deception-environment contracts
• Integrate external AZ-06 Deception Host under deterministic Edge authority Azazel-Edge#325 — external host integration under deterministic Edge authority
• 01rabbit/Azazel-Knowledge#58 — narrative and environment effectiveness analysis
• Define the Engage-lite boundary and fixed-profile compatibility with AZ-06 Azazel-Gadget#17 — fixed Engage-lite boundary and compatibility

The responsibility rule is refined as follows:

Engage expresses intent. Knowledge advises. Fabric describes. Edge decides and enforces. Deception Host materializes, transitions, records, and resets.

This does not replace the current work in #60 or its original children. It separates attacker-facing environment generation and runtime from the Edge decision plane while retaining the same bounded-action, offline-first, advisory-only, and fail-closed guarantees.

[01rabbit]

AZ-06 container-first execution-plane refinement

The Engage-aligned system model now includes a proposed, separate Azazel-Deception Host execution plane tracked in #61. Its architecture is documented at docs/concepts/azazel-deception-host-container-first.md.

Refined system rule:

Engage expresses intent. Knowledge advises. Fabric describes. Edge decides and enforces. Deception Host materializes, transitions, records, and resets.

Key implications for this parent issue:

• AZ-06 is container-first and capability-aware, not Raspberry Pi-specific.
• Phase 1 uses OCI images for linux/arm64 and linux/amd64 with Docker Compose.
• Pi 5 is the minimum lightweight reference host; x86 mini PCs and later KVM/cluster profiles scale capacity without changing package identity or Edge authority.
• Fabric describes capabilities, requirements, tiers, images, and lifecycle records.
• Edge approves the profile, capability class, budgets, routing, transitions, and termination, but does not become a general-purpose scheduler.
• LLM is optional and preparation-oriented; live approved packages must not depend on it.
• Edge co-location is limited to bounded development/demo profiles; separated field deployment remains preferred.

Related implementation tracking: Azazel-Fabric#9, Azazel-Edge#325, Azazel-Knowledge#58, and Azazel-Gadget#17.