History

Max Gorog 0390eb20b6 fix: revert speculative fleet picker change — was producing dishonest labels Empirical evidence from k-gamingcom (commit `4ab5477`, 2026-05-03 22:20Z vsftpd_234_backdoor episode): the picker selected vsftpd because BRIDGE was set on that host. The exploit fires against target_ip=127.0.0.1 (SLIRP loopback) but vsftpd's hardcoded port-6200 backdoor is reachable only at the guest's bridge IP. Result: session_open_timeout, AND a schedule-clock-driven `infected_running` label was still written for the failed exploit — exactly the §10 poisoned-training-example pattern. Until guest-IP discovery for bridge mode is wired (a separate piece of infrastructure), bridge-only modules can't actually reach their target even when the operator sets BRIDGE for Tier-2's pcap source. Revert the picker to its prior conservative form: drop requires_bridge modules unconditionally regardless of BRIDGE state. Same for the BRIDGE env strip in the Tier-3 launch path — it was correct as unconditional. Replaces the two aspirational tests (test_fleet_uses_all_modules_when_bridge_set, test_fleet_propagates_bridge_env_to_runner) with their honest negatives (test_tier3_drops_requires_bridge_modules_unconditionally, test_tier3_strips_bridge_env_even_when_set). The previous tests asserted behavior the rest of the pipeline can't deliver; they were false signals. 229 passed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-05-03 17:58:43 -05:00
..
__init__.py	Add v0 orchestrator + first oracle collector (host /proc)	2026-04-28 23:40:25 -06:00
__main__.py	Add v0 orchestrator + first oracle collector (host /proc)	2026-04-28 23:40:25 -06:00
episode.py	PIPELINE §5 step 1: fix four root-cause defects	2026-05-03 17:05:25 -05:00
fleet.py	fix: revert speculative fleet picker change — was producing dishonest labels	2026-05-03 17:58:43 -05:00
README.md	Scaffold project: docs, repo skeleton, transport + deploy design	2026-04-28 23:21:00 -06:00
ulid.py	Add v0 orchestrator + first oracle collector (host /proc)	2026-04-28 23:40:25 -06:00

README.md

orchestrator/

The state machine that drives a single episode:

snapshot_load → clean → armed → infecting → infected_running → dormant → reverting

Responsibilities:

Bring up the host-only bridge and verify isolation before the guest starts.
Boot the guest from a named snapshot.
Spawn the five telemetry collectors (collectors/) with a shared episode id and shared monotonic clock origin.
Drive the Metasploit Framework over RPC to fire the configured exploit module.
Upload + execute the configured malware sample once a session is open.
Emit phase transitions to labels.jsonl at the moment the action is taken.
Revert the snapshot at episode end.
Write meta.json with the result summary.

Implementation lives in this directory and is imported as orchestrator.*.