audit(cyberbattlesim): compare the example pack with RAE contracts and upstream source

[Brad-Edwards]

Objective

Audit the CyberBattleSim chain environment pack delivered by #29 and PR #80 against both authoritative boundaries:

1. the published RAE/RAES contracts consumed by this adapter; and
2. the pinned Microsoft CyberBattleSim source protocol at commit 854d6966607fb68645651f55b0f97221bd293e0d.

The audit must distinguish exact source facts, adapter-derived mappings, intentionally lossy projections, and claims for which no canonical upstream original exists.

Audit inputs

• environments/cyberbattlesim-chain/ and its released immutable archive.
• The exact installed RAE/RAES contract versions and digests used by the pack validators and adapter.
• src/raes_adapters/cyberbattlesim/qualification.json, the scenario/source ledger, and native-readiness evidence.
• The pinned microsoft/CyberBattleSim repository, including ChainPattern construction, environment behavior, baseline policy/evaluator code, and any canonical notebooks or example protocols relevant to this pack.

Work

• Build a clause-by-clause crosswalk from every pack SDL, participant, experiment, compatibility, provenance, and evidence claim to its published RAE/RAES contract owner.
• Confirm that the pack defines no new RAE semantics and that backend-native concepts remain scoped to the CyberBattleSim adapter boundary.
• Compare topology, node and vulnerability roles, action affordances, observation boundaries, objective/reward facts, termination behavior, defender behavior, stochastic controls, evaluator projections, and exclusions with the pinned upstream source.
• Locate the closest canonical upstream scenario, notebook, or protocol. If upstream has no single original artifact equivalent to this pack, record which source files jointly define the comparison basis and explicitly bound any equivalence claim.
• Produce a divergence register classifying each item as exact, normalized, derived, lossy, unsupported, or absent upstream.
• Correct any pack, documentation, qualification, provenance, or test discrepancy found by the audit and add regression checks for every stable machine-checkable fact.
• Re-run pack validation, release checks, native-readiness verification, and the canonical repository graph on the corrected artifact.

Deliverables

• A version-pinned, digest-bearing audit crosswalk.
• A source-fidelity and contract-conformance report with cited file and clause locations.
• A divergence/loss register with explicit claim boundaries.
• Automated drift checks for stable facts on both audit axes.
• An updated immutable pack asset and evidence record if any bytes change.

Acceptance criteria

• Every semantic claim maps to a published RAE/RAES contract or is removed.
• Every source-fidelity claim cites pinned CyberBattleSim source evidence.
• The comparison basis identifies a canonical upstream original or documents that no single equivalent artifact exists.
• Topology, actions, observations, objectives, rewards, termination, defender behavior, randomness, evaluator facts, and exclusions each have an exact/normalized/derived/lossy/unsupported/absent disposition.
• All confirmed discrepancies are corrected with regression coverage.
• raes-pack-validate, raes-pack-release check, native-readiness verification, and the canonical repository verification graph pass.
• Portable artifacts remain free of native state, hidden truth, raw logs, credentials, tokens, and full tracebacks.

Context

• Implements an independent audit of the artifact delivered by feat(cyberbattlesim): add the example environment pack and researcher workflow #29.
• Upstream source: https://github.com/microsoft/CyberBattleSim
• Merged implementation: PR feat(cyberbattlesim): add example pack and researcher workflow #80