Bootstrap and evolve AZ-06 Azazel-Deception Host as the Engagement Environment Plane

[01rabbit]

Parent: #60
Repository: https://github.com/01rabbit/Azazel-Deception

Status

01rabbit/Azazel-Deception now exists and the designation is ratified:

• Formal name: Azazel-Deception Host
• Series number: AZ-06
• Codename: THEATRE
• Plane: Engagement Environment Plane
• Runtime model: portable, capability-aware, container-first

Naming was ratified in docs/specs/naming.md on 2026-08-13. The container-first architecture is documented in docs/concepts/azazel-deception-host-container-first.md.

Core responsibility rule

Engage expresses intent. Knowledge advises. Fabric describes. Edge decides and enforces. Deception Host materializes, transitions, records, and resets.

AZ-06 is not a second decision authority.

Current bootstrap implementation

The new repository contains:

• host capability discovery
• fail-closed bootstrap package validation
• deterministic, non-executing placement planning
• ARM64/AMD64 portability baseline
• Docker Compose reference adapter assets
• one static synthetic Linux reference package
• no host port publication or external network in the reference Compose profile
• CI and deterministic bootstrap tests
• safety, contract-integration, architecture, and roadmap documentation

Live activation remains disabled by design until Fabric and Edge integration gates are complete.

Product boundary

AZ-06 owns:

• validation/materialization of already-approved packages
• local capability matching and package-authored tier selection inside Edge-approved constraints
• isolated decoy service/artifact/credential/persona runtime
• approved finite-state transitions
• evidence export
• deterministic termination/reset and credential invalidation

AZ-06 does not own:

• engagement selection, routing, budgets, downgrade, or termination authority
• shared wire-contract authority
• Knowledge scoring/advisory authority
• hack-back, attacker-system access, autonomous retaliation, unrestricted egress, or production access
• runtime LLM action selection or free-form live mutation

Container-first invariant

• OCI is the initial standard execution unit.
• Phase 1 portability baseline is linux/arm64 + linux/amd64.
• Docker Compose is the first runtime adapter.
• Raspberry Pi 5 is the minimum lite reference host, not a product constraint.
• N100/N305-class x86 is the expected standard tier.
• KVM/libvirt and cluster adapters remain later work.
• Required narrative components may never be silently removed to fit weaker hardware.
• LLM capability is optional and preparation-oriented; approved packages execute without an LLM.

Cross-repository dependencies

• Define canonical deception-environment contracts for AZ-06 Azazel-Deception Host Azazel-Fabric#9 — canonical deception-environment, capability, image, tier, lifecycle, evidence, and outcome contracts
• Integrate AZ-06 Azazel-Deception Host under deterministic Edge authority Azazel-Edge#325 — deterministic activation, routing, capability validation, budgets, downgrade, termination, reset acknowledgement
• 01rabbit/Azazel-Knowledge#58 — narrative/runtime/tier-aware effectiveness analysis and advisory-only output
• Define Engage-lite compatibility boundary with AZ-06 Azazel-Deception Host Azazel-Gadget#17 — fixed Engage-lite compatibility boundary
• Keep system-level Engage work synchronized with Fabric#8, Edge#319, Knowledge#52, and Gadget#16

Delivery sequence

Phase 0 — bootstrap and canonical contracts

• create the repository
• ratify naming and AZ-06 accession
• establish container-first architecture
• add dry-run control-plane bootstrap and static reference package
• land Fabric canonical contracts/golden fixtures
• add digest/signature/SBOM provenance validation
• complete threat-model and abuse-case test set

Phase 1 — static coherent live environment

• promote Docker Compose adapter to feature-disabled live runtime
• run the same signed Linux reference package on ARM64 and AMD64
• prove resource/network isolation
• prove evidence export, termination, reset, and credential invalidation
• integrate Edge in shadow/replay mode before live activation

Phase 2 — deterministic narrative runtime

• narrative consistency compiler
• honey files and synthetic metadata
• decoy-only credential lures
• deterministic persona/activity replay
• Edge-approved finite-state transitions

Phase 3 — effectiveness loop

• Knowledge analyzes measured outcomes and returns advisory-only context
• Edge independently accepts/modifies/rejects future posture suggestions

Phase 4 — additional environment classes

• additional Linux profiles
• Windows/KVM profiles only after single-node isolation/reset are proven
• OT/IoT profiles
• multi-node/cluster support only after authority and failure semantics stabilize

Acceptance criteria

• Edge remains the only activation and transition authority.
• One signed reference package behaves equivalently on supported ARM64 and AMD64 hosts.
• Unsupported packages and capability mismatches fail closed with explicit reasons.
• No decoy route or credential reaches protected production resources.
• Package identity survives movement between hardware classes.
• Runtime state and evidence do not rely on attacker-modifiable container-local authoritative state.
• Knowledge remains optional/advisory-only.
• LLM absence does not affect approved package execution.
• Existing Azazel products retain zero behavior change unless AZ-06 integration is explicitly enabled.
• Public wording uses Engage-aligned or Engage-informed, never unsupported certification claims.

[01rabbit]

Cross-repository implementation status

The AZ-06 design is now decomposed into focused repository work, and 01rabbit/Azazel-Deception has been created and bootstrapped as AZ-06 Azazel-Deception Host (THEATRE).

Cross-repository trackers:

• Define canonical deception-environment contracts for AZ-06 Azazel-Deception Host Azazel-Fabric#9 — canonical deception-environment, capability, runtime, provenance, lifecycle, and golden-fixture contracts
• Integrate AZ-06 Azazel-Deception Host under deterministic Edge authority Azazel-Edge#325 — deterministic approval, routing, budgets, host trust, state reconciliation, downgrade, and termination
• 01rabbit/Azazel-Knowledge#58 — evidence-backed narrative/runtime/tier effectiveness analysis and advisory-only output
• Define Engage-lite compatibility boundary with AZ-06 Azazel-Deception Host Azazel-Gadget#17 — fixed Engage-lite compatibility and explicit prohibition on full dynamic environment orchestration

AZ-06 local implementation trackers:

• Replace bootstrap schemas with canonical Azazel-Fabric deception contracts Azazel-Deception#1 — migrate bootstrap schemas to canonical Fabric contracts
• Implement feature-disabled Docker Compose lifecycle adapter Azazel-Deception#2 — feature-disabled Docker Compose lifecycle adapter
• Prove one signed reference package on ARM64 and AMD64 Azazel-Deception#3 — prove one signed package on ARM64 and AMD64
• Build isolation, evidence, termination, and deterministic reset test harness Azazel-Deception#4 — isolation/evidence/termination/reset test harness
• Implement AZ-01 Edge shadow/replay integration before live activation Azazel-Deception#5 — Edge shadow/replay integration before live activation
• Phase 2: coherent narrative, honey artifacts, credentials, personas, and finite-state transitions Azazel-Deception#6 — Phase 2 coherent narrative/artifact/credential/persona/finite-state runtime

The governing rule remains:

Engage expresses intent. Knowledge advises. Fabric describes. Edge decides and enforces. Deception Host materializes, transitions, records, and resets.

Repository creation is complete. The remaining gates now apply to live activation, not repository creation: canonical Fabric contracts, signed provenance, Edge authorization, production isolation, deterministic reset, cross-architecture validation, and adversarial review must pass before broader live profiles are enabled.

[01rabbit]

Container-first architecture amendment

The design baseline is now documented in docs/concepts/azazel-deception-host-container-first.md and reflected in the product map.

AZ-06 is a software/runtime class rather than a Raspberry Pi-specific appliance:

• OCI container is the standard execution unit.
• Phase 1 portability baseline is linux/arm64 and linux/amd64 with Docker Compose.
• Raspberry Pi 5 is the minimum lite reference host, not a product constraint.
• N100/N305-class x86 hosts provide the expected standard tier; KVM-capable x86 and multi-node profiles are later extensions.
• Every node publishes capabilities; every package declares requirements and authored deployment tiers.
• Missing required capabilities fail closed. A tier may omit only components explicitly marked optional by the package author.
• Edge approves profile, target capability class, budgets, routing, transitions, and termination. AZ-06 performs placement inside that approved boundary.
• LLM use is optional and preparation-oriented. Approved packages remain fully executable when no LLM is available.
• Co-location with Edge is limited to static development/demo profiles; separated field deployment remains the recommendation.

Additional bootstrap gates:

• Ratify OCI/multi-architecture portability as a product invariant.
• Define HostCapabilities, RuntimeRequirements, DeploymentTier, and RuntimeAdapter contracts in Fabric.
• Require one signed reference package to pass on both ARM64 and AMD64.
• Define Docker Compose as the initial adapter and postpone KVM/K3s until single-node isolation and reset are proven.
• Prove that migration between hardware classes does not alter package identity or Edge authority.

[01rabbit]

Phase 0 / Phase 1 implementation checkpoint

The planned implementation sequence has now moved from design into code:

Landed

• Azazel-Fabric main now implements the canonical AZ-06 deception contract baseline as unreleased 0.5.0.dev0; stable remains v0.4.0.
• Fabric provides shared ARM64/AMD64 golden fixtures and deterministic authority/safety invariants.
• AZ-06 consumes the canonical Fabric models through an exact reviewed development commit pin; bootstrap package input is compatibility-only.
• AZ-06 has a bounded Docker Compose lifecycle adapter with live execution default-off.
• Package maximum budgets, explicit live bandwidth bounds, expiring Edge decisions, atomic one-shot decision anti-replay, static Compose isolation checks, evidence-preserving reset, and failure evidence are implemented.
• Live preflight requires exact Package↔Compose service/image binding and a configured trusted package-verification hook; verified: true metadata alone is insufficient.
• The current reference package deliberately remains unsigned/unverified and therefore cannot be activated live.
• Azazel-Edge has a canonical Fabric-backed shadow/replay evaluator with enforcement_applied=false; Edge CI is green.

Still deliberately open

• stable Fabric v0.5.x release
• real signed/provenanced/SBOM-backed multi-arch OCI reference package
• real ARM64 + AMD64 execution proof
• HIL production isolation / denied egress / failure injection
• authenticated Edge↔AZ-06 transport, heartbeat and state reconciliation
• full live activation→evidence→termination→reset lab path

Azazel-Deception/docs/implementation-status.md and docs/live-gate-checklist.md now distinguish implemented software properties from unproven field/HIL claims.

Phase 2 (Azazel-Deception#6) remains intentionally unstarted until these Phase-1 authority, provenance, isolation, portability, evidence, and reset gates are proven.