/cyber-exercise

Cyber Exercise

Run a bounded cybersecurity exercise workflow with authorization, runtime, control, evidence, and independent adjudication gates; supports safe offline planning when live controls are unavailable.

**Input:** $ARGUMENTS

Optional args: slug=<feature>, ticket=<id/url>, mode=interactive|autonomous|channel, channel=<id>, auto_continue=true|false, profile=business|hybrid|technical.

Instructions

Execute the following steps for **$ARGUMENTS**.

Cyber Exercise

Goal: coordinate an authorized, evidence-led exercise without treating white-team control as compliance certification or host enforcement.

Steps

1. **Plan**: Load `cyber-engagement-planning`; define objective, scope, exclusions, roles, synthetic-data boundary, evidence owner, expiry, stop, and restart terms. 2. **Authorize**: Load `cyber-authorization`; bind `engagement_scope_ref`, approved actions, exclusions, window, approver, and runtime support. 3. **Preflight**: Check tool, credential, filesystem, network, logging, and cancellation controls. If unsupported, mark live lane `BLOCKED` and continue offline plan/evidence review only. 4. **Control**: Load `cyber-exercise-control`; release injects, log decisions, stop on expiry/drift/unsafe impact, and require fresh gates before restart. 5. **Validate**: Load `cyber-scoped-validation`; validate one bounded claim using synthetic or explicitly authorized observations. Never use offensive scripts, real targets, credentials, malware, or exfiltration. 6. **Adjudicate**: Load `cyber-exercise-adjudication`; compare redacted evidence with independently held ground truth. Preserve `confirmed`, `suspected`, `blocked`, `not-tested`, and `false-positive` statuses. 7. **Report**: Load `cyber-evidence`; update `artifacts/security-review.md` when a continuous security-review chain exists. Add sparse framework edges only with primary sources and review status.

Runtime Contract

Host runtime enforces tools, credentials, filesystem/network scope, logging, and cancellation. Markdown records intent and evidence; it cannot enforce permissions. Missing runtime support blocks live action, not safe offline planning.

Handoff Payload

• `engagement_scope_ref`, objective, scope/exclusions, authorization window, runtime support
• control log, evidence records, independent ground-truth reference, finding statuses
• `artifacts/security-review.md` when in scope, mapping edges, limitations, accountable owner
• `feature_status`, `completed_evidence`, `missing_evidence`, `decision_needed`, `recommended_next_workflow`

Blocking Questions

• Is authorization current, explicit, and bounded to this action?
• Which runtime controls are host-enforced, and which are unsupported?
• Who independently holds ground truth and adjudicates outcomes?

Output Template

# Cyber Exercise Report: [name]
## Scope and Authorization
## Runtime Contract
## Control Log
## Evidence and Findings
## Independent Adjudication
## Framework Edges
## Limitations and Decisions
## Outcome Report
feature_status: implemented | partially_implemented | blocked
completed_evidence: []; missing_evidence: []; decision_needed: []; recommended_next_workflow: verify-work
## Next Workflow
verify-work