feat(cyberbattlesim): add baseline reproduction evidence

[Brad-Edwards]

Summary

Publish a predeclared, content-addressed CyberBattleSim source-native/RAES-mediated baseline reproduction and preserve every negative result. Revision 3 corrects two adapter evidence defects and the mediated epsilon schedule. Availability and terminal-cause comparisons are now complete and bounded; reward and step intervals still fail because one retained mediated episode reached the 600-step cutoff. The result remains a negative outcome-evaluation record, not an outcome-equivalence claim.

The apparatus/readiness evidence contributes to OpenRAE/research#14. The immutable failed revision-2 bundle and corrected revision-3 negative bundle are also preserved byte-for-byte in OpenRAE/research#20's data path through OpenRAE/research#74.

Requirement UIDs

• None; this issue is requirement-free maintenance and experiment evidence.

Related Issues

Closes #30

ADR Impact

• ADR-021
• ADR-069
• ADR-003

Changes

• Retain bounded per-step network availability and a source-backed terminal cause at the private CyberBattleSim boundary.
• Write one sanitized episode-outcome.json per mediated episode and bind it through exactly one RAES evidence record.
• Carry the upstream evaluator's cumulative epsilon-step schedule across the ten process-isolated mediated episodes and record each offset in provenance.
• Add strict aggregation, validation, leak scanning, inventory sealing, and pure offline recomputation for the corrected revision while preserving predecessor bytes.
• Publish revision 3 under declaration c588a174ab97ef1e4d863b743a02213e9527b7731cfbdc897d6602d72362bebf: 20/20 valid scheduled attempts, 39 timestamped notes, 138 regular files, inventory SHA-256 20eec98ff44f09e3b3466e0c57af2a960cf9886cdfcd9d5add5f5392172fa8dd.
• Document the exact negative result, root-cause limits, hardware envelope, and bounded contributions to research feat(base): implement shared simulator-adapter plumbing over published RAES contracts #14 and feat(cli): add a researcher-facing run and evidence command with CybORG support #20.

Result

Tier or metric	Result
Authored source / contract / disclosure	passed / passed / passed
Execution control / state-observation	weakened / weakened
Outcome-evaluation	failed
Cumulative reward	mean difference -488.6; 95% interval [-1558.015, 90.6] exceeds ±500
Steps to termination	mean difference 51.4; 95% interval [-48.5, 153.8025] exceeds ±60
Mean availability	bounded; difference -0.0008853231676272388, interval [-0.010524172216097161, 0.00887836373877486]
Terminal cause	bounded; source defender-sla=1.0, mediated defender-sla=0.9 plus evaluator-cutoff=0.1

The single cutoff row is retained with reward 512; it was not excluded, retried, or used to change tolerances. The exact path is not deterministically attributable because the lane random-stream bindings are explicitly different and partly unbound.

Test Plan

• Focused backend/reproduction/researcher suite after the final analyzer repair: 58 passed.
• Offline final-bundle verification: 20 scheduled rows, 39 notes, six tiers, matching inventory hash on AWS, local workspace, package snapshot, and research repository copy.
• Canonical make verify plus make policy on final commit c8e801b804e4e55d13df317894aa1ea782c304f4: base 443 passed/21 skipped; CyberBattleSim 470 passed; CybORG 470 passed; NASim 470 passed; PrimAITE 443 passed/21 skipped; combined coverage 87%; clean wheels, installed probes, pack/release gates, identity policy, and strict docs passed.
• Remote CI run 31468812255: every job passed, including 16m16s Tests, SonarCloud, CodeQL, distributions, security, and the aggregate PR Gate. Sonar reports 82.9% new-code coverage, 0% duplication, all ratings A, 100% hotspot review, and zero open PR issues.

The first final monitor had all non-Sonar jobs pass but exposed five new Sonar findings. The first repair reduced that to two analyzer type findings; the typed config-factory repair cleared both. Ground Control then misclassified the already-running final workflow as queued_too_long, while GitHub's authoritative run subsequently completed green; both the check failures and monitor mismatch are recorded on issue #30.

Ground Control Checks

• Architecture preflight completed and guardrails updated.
• Configured repository policy and canonical verification passed.
• Additional over-cap code review was waived by explicit user direction.
• Test-quality review was waived by explicit user direction.

The earlier recorded pre-push code-review cycle inspected an empty uncommitted diff, so it is not represented as an effective review of the final changes.

Traceability

• IMPLEMENTS: Issue test(cyberbattlesim): reproduce the selected public baseline through RAES #30 ← src/raes_adapters/cyberbattlesim/reproduction.py, src/raes_adapters/cyberbattlesim/backend/driver.py, src/raes_adapters/cyberbattlesim/backend/evaluator.py, src/raes_adapters/cyberbattlesim/termination.py, src/raes_adapters/cyberbattlesim/researcher.py, src/raes_adapters/cli.py.
• TESTS: Issue test(cyberbattlesim): reproduce the selected public baseline through RAES #30 ← tests/test_cyberbattlesim_reproduction.py, tests/test_cyberbattlesim_researcher_cli.py, shared CLI/backend tests.
• RESEARCH: OpenRAE/research#14 and feat(cli): add a researcher-facing run and evidence command with CybORG support #20 ← docs/cyberbattlesim-baseline-reproduction.md, readiness record, content-addressed bundles, OpenRAE/research#74.

Checklist

• Code follows the project's coding standards.
• Changelog is owned by Release Please.
• Architectural and researcher documentation is updated.
• Negative outcomes and operational issues remain disclosed.