Defence Factory · compliance import Local synthetic CSV/JSON · no AWS connection
Bounded findings intake
Use aliases mock-a/mock-b and resource-* only. Never upload real/private findings, account IDs, credentials or secrets. Maximum 256 KiB, 500 rows, UTF-8. No data is sent anywhere.
Official fixture mode. Imported assertions cannot authorize AWS actions.
Review before loading
24 candidate controls · live coverage UNKNOWN
| Account alias | Resource alias | Control | Reported result | Freshness |
|---|
Defence Factory · backend receipt review Reported assertions · no authenticated backend connection
Read-only canonical evidence
Load a sanitized JSON array containing exactly one Batch, Decision, Run and Evidence envelope from defence-factory/1. Use controlled aliases only; never upload private records or credentials. Maximum 256 KiB / 500 targets. No network calls, approval or execution from this viewer.
No reported receipt loaded. Origin/live acceptance NOT_VERIFIED.
File contents remain IMPORTED_ASSERTION even if they claim TRUSTED_PROVIDER_READ or VERIFIED. Every outcome and count below is reported, not independently authenticated REAL evidence. Existing MOCK approvals and runs stay separate.
Exact canonical frozen batch
Reported per-resource outcomes
Provider readback, compliance and freshness are independent claims. MOCK provider matches and compliance are explicitly SIMULATED; they never prove a live remediation.
| Finding | Target | Frozen control/revision | Execution | Provider readback | Compliance | Freshness | Reported real / simulated mutation attempts | Receipt |
|---|
Defence Factory · compare two observations Scoped synthetic change review · no scan or remediation
Compare immutable observations
Load the bounded synthetic pair or your own sanitized pair using mock-a/mock-b and resource-* aliases only. Maximum 256 KiB. Both snapshots must share exact scope, have increasing UTC times and valid content fingerprints. Files remain IMPORTED_ASSERTION; freshness and origin are NOT_VERIFIED. No AWS connection, execution or change to existing MOCK decisions/runs.
No observation pair loaded. Hosted version NOT_TESTED.
A reopened delta remains an imported assertion, not a signature or verification.
Exact immutable snapshots and scope
What changed in scope
RESOLVED means only that this later observation explicitly reports COMPLIANT. Missing later rows stay UNKNOWN even when the scan says COMPLETE. Neither result proves remediation, provider state or live verification.
| Account / resource / control | Earlier | Later | Delta |
|---|
NEXT SHIFT / LOCAL SYNTHETIC EVIDENCE
Shift Review Desk
Import recorded evidence. Triage exceptions. Leave operator notes for the next shift.
No imported authority · zero review writes
1 · Import an original campaign packet
Maximum 2 MiB, 12 complete runs and 2,000 evaluations. Use an original agentcore2.synthetic-shift-handoff.v1 JSON export. No remote loading or execution. Reload clears this desk.
No packet imported. The in-page campaign and its decisions are separate.
Continue only the notes this file carries
Prior review overlays: maximum 4 MiB; embedded original packet retains the limits above. Clear before replacing a loaded desk. Continuation restores available notes only, never execution authority or missing annotations.
2 · Evidence-derived exceptions inbox
Original unresolved evaluations remain unresolved even after operator review.
| Select | Exact source identity | Control / severity | Original outcome | Operator review | Inspect |
|---|
3 · Operator notes only
4 · Compare another operator's notes
Same original evidence, different operator notes. Choose individually; no automatic winner or evidence resolution.
Load or continue a desk, then choose a second overlay for the identical original packet.
5 · Next-shift overlay
Exports preserve original outcomes and separate provider/compliance assertions. Notes are not compliance decisions. The JSON includes the untouched original packet; neither format replaces it.
DAILY TRIAGE / SYNTHETIC OPERATIONS
Operations Campaign
Prioritize findings, make bounded decisions, hand off recorded evidence.
No campaign-wide approval · zero real writes
Priorities by control
Counts derive from current synthetic records. Reviewed is an overlapping count of findings with a recorded decision.
| Control / severity | Actionable | Blocked / manual | Compliant | Unknown / not applicable | Reviewed | Inspect |
|---|
Recommended queues
Up to 25 exact actionable targets per control, sorted by synthetic ID. Each preview needs its own decision.
Open prepares selection. Preview freezes it. Neither grants approval or executes.
Session journal & shift handoff
Read-only recorded evidence. Select complete runs for a synthetic review packet.
TEACHING MODE · 2–3 MINUTES · READ ONLY
Reasoning selects. Governance decides what can run.
Walk the contract from finding to audit. These stages explain the same synthetic executor used by all three stories; clicking a stage never creates authority or runs a tool.
FIVE CHANNELS · ONE CONTRACT
Copilot · CLI-style · API-style · event/scheduled · ServiceNow-style ticket
Each presentation supplies the same exact scope and reads the same proposal/run. None can bypass validation, grant its own approval or invent another executor.
DEMO MODE · 3–5 MINUTES · SCRIPTED MOCK
Compliance: encrypted transport
ONE FINDING · ONE DECISION
Load a story to select an exact synthetic finding. No authority is granted.
FROZEN CHANGE · FIXED REGISTERED TOOL
PRESENTER CUES · THREE MINUTES
RECORDED EVIDENCE · NO INFERRED OUTCOME
PLATFORM OVERVIEW
Governed operations, from finding to evidence.
Choose a capability. Inspect its boundaries. Make one accountable decision.
Scripted reasoning · simulated tools
Capability registry
What it does. Who decides. How we know.
| Capability / finding | Domain | Readiness | Operator decision |
|---|
Enterprise SecOps · a three-minute synthetic story
Northstar archive · transport risk
Northstar Research is a fictional organization. An internal review flags an unencrypted transport path to one synthetic archive bucket. The operator must understand the risk, approve an exact remedy and report what the evidence actually proves.
Research archive transport risk
No automatic incident resolution. The update checks the exact linked target and separate compliance result. Rejection, interruption or mismatch stays open for review.
EXECUTIVE BRIEF · SYNTHETIC SERVICENOW-STYLE INTAKE
PRESENTER CUES · THREE MINUTES
- 0:00 · Intake. A ticket carries business context; it does not authorize a mutation.
- 0:45 · Triage. A scripted MOCK coordinator links the finding to the registered S3 specialist. Explain and Investigate keep the exact resource visible.
- 1:15 · Decision. Compare the fixed policy diff. Approve Once or Reject consumes this proposal only.
- 2:00 · Evidence. Compare the simulated operation, provider readback and independent compliance result. Try mismatch to show why they differ.
- 2:40 · Accountability. Return here and update the incident from the linked run. Export the local audit record.
Audit activity
Many entry points · one governed contract
One contract. Five entry points.
These are local MOCK presentations of the same selected finding, proposal and run. No shell, HTTP endpoint, scheduler or ticket service is connected.
A channel can request a proposal. It cannot grant approval. Review the frozen target and make a human decision in Copilot.
REQUEST / MOCK INPUT
Shared response · read-only projection
One record across channels
RECORD / SAME PROPOSAL & RUN
Registry → target / policy validation → proposal → human decision → deterministic executor → provider and compliance evidence.
Contract vocabulary comes from packages/contracts. This portable browser simulation reuses one in-memory executor; it is not a deployed API or durable service.
58 synthetic accounts. Presentation-safe simulation. No AWS connection, model invocation or real write.
Build v1.2.1Scenario lab Success, refusal, partial outcomes and same-run recovery
Governance, made observable
Same finding. Different failure boundary.
Choose a synthetic scenario, then use Explain / Investigate and Preview Fix. Approval never grants arbitrary tools or targets.
Findings
Synthetic inventory
| Select | Status | Fixability |
|---|
Learn / Demo Scenarios, architecture and reusable interface patterns
Scenario controls
Baseline: 58 synthetic accounts, 100–1,000 S3 buckets per account, 180 security groups and 120 EC2 instances per account.
All data and outcomes are invented. A blocked target remains NON_COMPLIANT. Scenario changes clear proposals and results.
How this MOCK contract works
Choose a stage. Every channel uses the same local governance and recorded evidence.
In-memory simulation; no external transport or provider runtime.
Reusable design patterns
- One filter state drives table, counts and selection.
- Only compatible controls share a bulk proposal.
- Freeze exact targets and parameters before approval.
- Keep current finding state separate from last-run evidence.
- Progressive disclosure keeps the table primary.
- Keyboard navigation, readable contrast and reduced motion.