Roll out active defense

The end state is a named cohort serving automatic response for one effect class, promoted under a signed release record that binds its policy, manifests, rules, classifier, runtime build, and authority deployment to the window that measured them.

Finding quality, detector health, authority readiness, and recovery behavior answer separate questions, so each has its own gate, and a percentage threshold never stands in for a missing restart or rollback result. Each effect class stays in dry-run until its own evidence is complete.

1. Open a complete shadow window for the cohort

Name the population that will receive automatic response and observe it for at least 14 consecutive days and 100,000 mediated invocations. A low-volume cohort that cannot reach the invocation minimum observes 30 consecutive days instead, and an authority reset restarts the window. The window covers the workload itself, failures and detector-health events included, because routine indexing can resemble suspicious access and one noisy tenant can dominate a stream.

chio_active_defense_shadow_unknown_labels_total
chio_active_defense_shadow_store_errors_total
chio_active_defense_shadow_late_events_total
chio_active_defense_shadow_state_evictions_total
chio_active_defense_shadow_decoy_touches_total
chio_active_defense_shadow_lineage_truncation_total
chio_active_defense_shadow_proposed_effects_total
chio_active_defense_shadow_rollback_simulation_total
chio_active_defense_shadow_false_positive_review_total

Each counter points to the observations behind it, so an aggregate zero never stands as the explanation. A late event fails promotion only when it enters a match outside the allowed bound, and an eviction needs its health evidence; detector health covers the store and capacity failures that produce that evidence. An outage missing from telemetry is a measurement failure, and incomplete measurement keeps the cohort in dry-run.

For each reviewed finding, retain the rule version, ordered evidence, reviewer disposition, and reason, false positives and unreviewed findings included. Record unavailable intervals and exclusions instead of deleting them to improve a rate.

2. Calculate each rate from its own population

Use integer counts from the same cohort and window. The unknown-label rate is 10,000 × unknown labels / mediated invocations, precision is correct findings / reviewed findings, and injected-attack recall counts the registered attack cases executed. An empty population stays undefined.

def review_rates(invocations, unknown_labels, reviewed_findings, correct_findings):
    if min(invocations, unknown_labels, reviewed_findings, correct_findings) < 0:
        raise ValueError("counts must be nonnegative")
    if unknown_labels > invocations or correct_findings > reviewed_findings:
        raise ValueError("numerator exceeds its population")
    unknown_per_10000 = None if invocations == 0 else 10000 * unknown_labels / invocations
    precision = None if reviewed_findings == 0 else correct_findings / reviewed_findings
    return {
        "unknown_per_10000": unknown_per_10000,
        "precision": precision,
        "unknown_rate_within_ceiling": invocations > 0 and 10000 * unknown_labels <= invocations,
        "precision_and_sample_met": reviewed_findings >= 1000 and 100 * correct_findings >= 99 * reviewed_findings,
    }

assert review_rates(40000, 3, 1000, 995)["precision_and_sample_met"]
assert not review_rates(40000, 3, 200, 199)["precision_and_sample_met"]
assert review_rates(0, 0, 0, 0)["precision"] is None

Precision and recall describe the detector under the measured conditions. In the illustrative counts, three unknown labels in 40,000 invocations give 0.75 per 10,000, under the ceiling, and all three still need review. Both 995 of 1,000 and 199 of 200 give 99.5 percent precision; only the first meets the 1,000-reviewed-finding minimum. Retain the integers so rounding a displayed percentage cannot move a boundary decision.

3. Review the cohort against every gate

Every signal below holds for the window before any automatic-response stage promotes.

A quiet workload establishes no correlation precision, so the reviewed-finding minimum holds for every automatic-response cohort, and seeded conformance cases measure the registered attack set alone. The review worksheet applies all of these conditions to the pricing project's agent cohort with 14 uninterrupted days, 120,000 mediated invocations, three reviewed unknown labels, and 995 correct findings out of 1,000, whose restart recovery observation is missing. Download review_shadow.py and run it with Python 3:

python3 review_shadow.py

HOLD worksheet: required_recovery_cases (restart observation missing)
REVIEW complete worksheet: no failing checks; signed operator promotion still required
HOLD worksheet: 99.5 percent across 200 reviews does not meet the sample minimum

You should see the cohort held on required_recovery_cases, then the full fixture printed for inspection. The repaired copy changes only the restart observation and passes every check, and it still needs a signed operator promotion; the copy with 200 reviews holds despite 99.5 percent. A missing authority or an incomplete window holds as well, because zero counters say nothing about missing observations, and an authority reset or a changed runtime or policy starts a new window.

"""Local review worksheet for the documented rollout contract, not a Chio CLI.

The example counts are synthetic. Passing this worksheet neither authenticates
the supplied measurements nor records a signed promotion in a runtime.
"""
from copy import deepcopy
import json


ZERO_SIGNALS = (
    "unsigned_or_stale_manifest_accepted", "adapter_declaration_loss",
    "hidden_store_error", "fail_closed_case_allowed", "late_event_entering_match",
    "state_eviction_without_health", "untrusted_executable_finding",
    "truncated_executable_plan", "production_decoy_false_positive",
    "canary_reaching_fake_server", "response_double_apply_or_remove",
    "lifted_with_reversible_contribution", "rollback_conflict_reported_clean",
    "receipt_state_contradiction",
)


def review(record, registered_attacks, required_recovery):
    integers = ("consecutive_days", "invocations", "authority_resets", "unknown_labels",
                "unknown_labels_reviewed", "reviewed_findings", "correct_findings")
    for name in integers:
        if type(record[name]) is not int or record[name] < 0:
            raise ValueError("invalid count: " + name)
    for name in ZERO_SIGNALS:
        if type(record["zero_signals"][name]) is not int or record["zero_signals"][name] < 0:
            raise ValueError("invalid signal: " + name)
    if record["unknown_labels"] > record["invocations"] or record["correct_findings"] > record["reviewed_findings"]:
        raise ValueError("numerator exceeds population")
    failed = []
    if record["complete_window"] is not True or record["authority_resets"]:
        failed.append("continuous window after the last authority reset")
    if not ((record["consecutive_days"] >= 14 and record["invocations"] >= 100_000)
            or record["consecutive_days"] >= 30):
        failed.append("shadow duration and invocation population")
    failed += [name for name in ZERO_SIGNALS if record["zero_signals"][name] != 0]
    if (record["invocations"] == 0 or 10_000 * record["unknown_labels"] > record["invocations"]
            or record["unknown_labels_reviewed"] != record["unknown_labels"]):
        failed.append("unknown-label rate and complete review")
    if record["reviewed_findings"] < 1_000 or 100 * record["correct_findings"] < 99 * record["reviewed_findings"]:
        failed.append("finding precision and minimum review population")
    for suite, expected in (("registered_attacks", registered_attacks),
                            ("required_recovery_cases", required_recovery)):
        cases = record[suite]
        if not expected or set(cases) != set(expected) or any(value is not True for value in cases.values()):
            failed.append(suite)
    if record["authority_ready"] is not True:
        failed.append("durable authority readiness")
    if not all(record["identity_bindings"].get(name) for name in (
            "cohort", "policy", "manifests", "rules", "classifier", "runtime_build", "evidence_window")):
        failed.append("complete release identity binding")
    return failed


if __name__ == "__main__":
    fixture = {
        "consecutive_days": 14, "invocations": 120_000, "authority_resets": 0,
        "complete_window": True, "unknown_labels": 3, "unknown_labels_reviewed": 3,
        "reviewed_findings": 1_000, "correct_findings": 995,
        "zero_signals": {name: 0 for name in ZERO_SIGNALS},
        "registered_attacks": {"credential-egress": True, "wrong-producer": True},
        "required_recovery_cases": {"overlap": True, "stale-fence": True,
                                    "restart": False, "out-of-order-expiry": True, "store-outage": True},
        "authority_ready": True,
        "identity_bindings": {name: "fixture-" + name for name in (
            "cohort", "policy", "manifests", "rules", "classifier", "runtime_build", "evidence_window")},
    }
    # In production these sets come from the independent registered test suite,
    # not from whatever case names the measurement record happens to contain.
    attacks = {"credential-egress", "wrong-producer"}
    recovery = {"overlap", "stale-fence", "restart", "out-of-order-expiry", "store-outage"}
    assert review(fixture, attacks, recovery) == ["required_recovery_cases"]
    print("HOLD worksheet: required_recovery_cases (restart observation missing)")
    repaired = deepcopy(fixture)
    repaired["required_recovery_cases"]["restart"] = True
    assert review(repaired, attacks, recovery) == []
    print("REVIEW complete worksheet: no failing checks; signed operator promotion still required")
    small = deepcopy(repaired)
    small["reviewed_findings"], small["correct_findings"] = 200, 199
    assert "finding precision and minimum review population" in review(small, attacks, recovery)
    print("HOLD worksheet: 99.5 percent across 200 reviews does not meet the sample minimum")
    print(json.dumps(fixture, indent=2, sort_keys=True))

The fixture is synthetic and the record shape is a review worksheet, not a Chio wire schema. You verify the original measurements, the complete registered attack and recovery populations, and the signed release identities. Its five recovery cases represent the throttle and egress stage; suspension and freeze need their full crash, restore, orphan-fence, and operator-page suites.

4. Dry-run the response plans

A response plan carries an execution binding whose mode is dry-run or live. The binding is mirrored into the signed authorization, so one approval covers exactly one mode, and live dispatch refuses any plan whose binding is not live.

Run the cohort's plans in dry-run. You should see approval, capability, causal-scope, receipt, and rollback checks execute for each plan while every external effect stays unapplied.

5. Promote one effect class at a time

Each class promotes only after the classes before it, and only when its own evidence is complete:

1. Flow enforcement. For tools with explicit policy, re-signed v2 manifests, and the complete runtime. Newly registered tools with effective egress and no declarations are rejected, and tenant-specific decoys arm once development markers and keys are removed.
2. Signed dry-run response plans. Every check executes while external effects stay unapplied.
3. Throttling and egress restriction. After the overlap, stale-fence, restart, out-of-order expiry, and store-outage cases pass.
4. Session suspension, capability-set suspension, and issuance freeze. After the full crash, exact-restore, orphan-fence, and operator-recovery paths pass on production-equivalent durable stores.

Permanent revocation stays manual at every stage. A cohort arriving from shadow migration follows this same sequence.

6. Sign the release record and bind the authority

The signed release record binds the cohort, policy hash, manifest-set hash, rule-set hash, classifier hash, runtime build, evidence window, and exact gate results. Promotion also binds the cohort to one validated authority deployment digest, and the daemon refuses to start under any other (binding the deployment digest). Before you sign:

1. Name the cohort and effect class, and confirm the 14-day, 100,000-invocation window or the 30-day alternative, with any authority reset retained.
2. Match the current policy, manifests, rules, classifier, runtime, authority identities, and adapter configuration to the measured record, so a later configuration change cannot borrow these results.
3. Record every zero-ceiling check, the unknown-label review, the precision numerator over at least 1,000 reviewed findings, and every registered attack outcome.
4. Confirm the recovery cases for this effect class, exact restore included where the class requires it.
5. Bind the record to the authority deployment digest and one execution mode, and keep it with the deployment configuration and recovery logs.

Worksheet labels point at those originals and are never trusted hashes on their own. After promotion, watch the first live effects and their rollback receipts with the operator recovery path available, and diagnose incidents through investigation.

A missing measurement or a failed removal stops promotion

Stop promotion when a required measurement is missing, an authority is unavailable, an event loses its trusted binding, or rollback cannot remove every reversible contribution. Preserve the evidence, and narrow the cohort or effect class while you repair the cause.

During a stop, new planning stops while applied contributions keep their recovery under their original identities, and an unresolved rollback never counts as a clean lift. A deployment rollback still reads retained state and removes the controls already applied. For a tool already enforced, a failure stops service through that path; reopening a bypass changes the protection contract and needs an explicit authorized migration.

Next: run the authority the cohort is bound to