cyber-exercise-adjudication

Cyber Exercise Adjudication

Priority: P0 (CRITICAL)

Compare evidence to pre-held expectations without self-approved promotion or compliance claims.

Structure

cyber-exercise-adjudication/
├── SKILL.md
├── references/adjudication-record.md
└── evals/evals.json

Workflow

1. Confirm adjudicator independence from operator and evidence collector.
2. Load approved objective, scope, expected observation, and ground-truth version.
3. Compare redacted evidence by time, source, and limitation; record discrepancies.
4. Assign confirmed, suspected, blocked, not-tested, or false-positive only with rationale.
5. Preserve unresolved conflicts and route them to an accountable owner.
6. Emit sanitized findings to artifacts/security-review.md when that artifact is in scope.

Rules

• Independent ground truth is held before observation review; do not rewrite it to fit results.
• A blocked runtime or missing evidence remains blocked, not passed.
• Adjudication describes exercise evidence; it does not certify compliance or measure real-world efficacy.
• Production changes, credential use, and live target interaction remain separately gated. Adjudication records carry engagement_scope_ref, skill_version, source, observed_at, finding_status, evidence_refs, limitations, and accountable_owner.

Anti-Patterns

• No operator grading: Separate execution from adjudication.
• No pass by silence: Missing observation is not success.
• No certainty inflation: Keep suspected and not-tested statuses.
• No raw leakage: Redact before handoff.

References

• Adjudication record
• Evidence fields