[P2] feat(swarm): Implement Byzantine Swarm Protection

02_docs/architecture/23-sentinel_game_features.md

@@ -0,0 +1,143 @@
+# SentinelOS Game & Simulation Micro-Features
+
+This file catalogs micro-features for the game/simulation layer that sits between Physics and AI in the roadmap. These features form building blocks for the Security Simulation Engine, Multi-Agent Cyber World, Cyber Range, and Training systems.
+
+## Simulation primitives (GM-001..GM-015)
+- GM-001: World tick manager
+- GM-002: Simulation clock
+- GM-003: Pause simulation
+- GM-004: Replay speed control
+- GM-005: Time rewind marker
+- GM-006: Frame snapshot
+- GM-007: Checkpoint save
+- GM-008: Scenario reset
+- GM-009: Random seed control
+- GM-010: Deterministic mode
+- GM-011: Fast forward
+- GM-012: Event inject
+- GM-013: Simulation branch
+- GM-014: State rollback
+- GM-015: Experiment replay
+
+## Agent features (AG-001..AG-015)
+- AG-001: Attacker agent
+- AG-002: Defender agent
+- AG-003: Observer agent
+- AG-004: Scout behavior
+- AG-005: Exploit attempt
+- AG-006: Defense action
+- AG-007: Retreat action
+- AG-008: Risk memory
+- AG-009: Goal selection
+- AG-010: Strategy update
+- AG-011: Path planning
+- AG-012: Cooperation score
+- AG-013: Competition score
+- AG-014: Trust value
+- AG-015: Learning state
+
+## Environment templates (ENV-001..ENV-015)
+- ENV-001: Virtual host
+- ENV-002: Fake network
+- ENV-003: Honey service
+- ENV-004: Dummy user
+- ENV-005: Credential cache
+- ENV-006: Firewall node
+- ENV-007: Server template
+- ENV-008: Client template
+- ENV-009: Database node
+- ENV-010: IoT node
+- ENV-011: PLC node
+- ENV-012: Hospital model
+- ENV-013: Cloud node
+- ENV-014: Edge node
+- ENV-015: SOC station
+
+## Strategy primitives (STR-001..STR-015)
+- STR-001: Attack objective
+- STR-002: Defense objective
+- STR-003: Mission score
+- STR-004: Victory condition
+- STR-005: Loss condition
+- STR-006: Risk reward
+- STR-007: Budget limit
+- STR-008: Resource cap
+- STR-009: Adaptive strategy
+- STR-010: Node priority
+- STR-011: Escalation level
+- STR-012: Threat tier
+- STR-013: Mission timer
+- STR-014: Action utility
+- STR-015: Reward update
+
+## Training primitives (TRN-001..TRN-015)
+- TRN-001: Blue team mode
+- TRN-002: Red team mode
+- TRN-003: Purple team mode
+- TRN-004: Incident injection
+- TRN-005: Malware simulation
+- TRN-006: Phishing scenario
+- TRN-007: Lateral movement test
+- TRN-008: Ransomware drill
+- TRN-009: Recovery drill
+- TRN-010: SOC evaluation
+- TRN-011: Response timer
+- TRN-012: Detection score
+- TRN-013: False positive score
+- TRN-014: Replay grading
+- TRN-015: Team leaderboard
+
+## Economy primitives (ECO-001..ECO-015)
+- ECO-001: Defense budget
+- ECO-002: Attack budget
+- ECO-003: Node cost
+- ECO-004: Resource auction
+- ECO-005: Trust credits
+- ECO-006: Security tokens
+- ECO-007: Honeypot value
+- ECO-008: AI cost
+- ECO-009: Logging cost
+- ECO-010: Isolation cost
+- ECO-011: Recovery reward
+- ECO-012: Risk tax
+- ECO-013: Penalty score
+- ECO-014: Investment weight
+- ECO-015: Utility matrix
+
+## World evolution (WRD-001..WRD-015)
+- WRD-001: Threat weather
+- WRD-002: Attack season
+- WRD-003: Node mutation
+- WRD-004: Malware evolution
+- WRD-005: Defense adaptation
+- WRD-006: Entropy drift
+- WRD-007: Trust decay
+- WRD-008: Population growth
+- WRD-009: Cluster instability
+- WRD-010: Node aging
+- WRD-011: Recovery growth
+- WRD-012: Failure propagation
+- WRD-013: Pressure field
+- WRD-014: Chaos event
+- WRD-015: Equilibrium detection
+
+## Visualization (VIS-001..VIS-015)
+- VIS-001: Attack map
+- VIS-002: Heat zones
+- VIS-003: Node animation
+- VIS-004: Timeline player
+- VIS-005: Replay camera
+- VIS-006: Risk overlay
+- VIS-007: Trust graph
+- VIS-008: Threat wave
+- VIS-009: Evidence explorer
+- VIS-010: Cluster map
+- VIS-011: Agent tracker
+- VIS-012: Mission view
+- VIS-013: Physics display
+- VIS-014: Entropy field
+- VIS-015: Strategy board
+
+## Integration notes
+- These primitives are intentionally small and composable. Each micro-feature should map to an issue and a test harness. Combined, they form larger systems like the Security Simulation Engine, Cyber Range, and Training Platform.
+- Suggested immediate work: implement deterministic replay, world clock, checkpointing, and a minimal attacker/defender agent for early validation.

02_docs/architecture/24-cloud-distributed_features.md

@@ -0,0 +1,126 @@
+# AI / Cloud / Distributed Micro-Features Catalog
+
+This document catalogs AI/ML, Cyber, Cloud, and Distributed micro-features mapped to the extended roadmap. These features support building the Cloud Distributed OS and Sentinel Cloud capabilities.
+
+## AI / ML features (AI-ML-001..AI-ML-025)
+- AI-ML-001: Anomaly detector
+- AI-ML-002: Risk classifier
+- AI-ML-003: Threat labeler
+- AI-ML-004: Log embedding
+- AI-ML-005: Graph embedding
+- AI-ML-006: Sequence predictor
+- AI-ML-007: Time series model
+- AI-ML-008: False positive scorer
+- AI-ML-009: Confidence estimator
+- AI-ML-010: Policy recommender
+- AI-ML-011: Node ranking
+- AI-ML-012: Attack prediction
+- AI-ML-013: Model registry
+- AI-ML-014: Model version tracker
+- AI-ML-015: Model rollback
+- AI-ML-016: Online learning
+- AI-ML-017: Federated update
+- AI-ML-018: Drift detector
+- AI-ML-019: Feature store
+- AI-ML-020: Training queue
+- AI-ML-021: Inference cache
+- AI-ML-022: Prompt memory
+- AI-ML-023: RAG index
+- AI-ML-024: Replay explanation
+- AI-ML-025: SOC copilot
+
+## Cybersecurity features (CYB-001..CYB-025)
+- CYB-001: Process trust score
+- CYB-002: Binary reputation
+- CYB-003: Command anomaly
+- CYB-004: Privilege jump detector
+- CYB-005: Credential tracker
+- CYB-006: Token misuse detector
+- CYB-007: Persistence scanner
+- CYB-008: Registry watcher
+- CYB-009: Kernel event monitor
+- CYB-010: File entropy monitor
+- CYB-011: Ransom burst detector
+- CYB-012: Lateral movement graph
+- CYB-013: Beacon detector
+- CYB-014: C2 suspicion score
+- CYB-015: DNS anomaly
+- CYB-016: Threat timeline
+- CYB-017: MITRE mapper
+- CYB-018: Evidence signer
+- CYB-019: Incident builder
+- CYB-020: Attack replay
+- CYB-021: Sandbox launcher
+- CYB-022: Honey token
+- CYB-023: Decoy node
+- CYB-024: Auto isolate
+- CYB-025: Recovery planner
+
+## Cloud features (CLD-001..CLD-025)
+- CLD-001: VM launcher
+- CLD-002: Container launcher
+- CLD-003: Image registry
+- CLD-004: Snapshot manager
+- CLD-005: Volume attach
+- CLD-006: Volume replicate
+- CLD-007: Cloud scheduler
+- CLD-008: Workload placement
+- CLD-009: Policy push
+- CLD-010: Global config
+- CLD-011: Secrets manager
+- CLD-012: Identity provider
+- CLD-013: API gateway
+- CLD-014: Load balancer
+- CLD-015: Service discovery
+- CLD-016: Autoscaling
+- CLD-017: Cold migration
+- CLD-018: Hot migration
+- CLD-019: Cloud replay
+- CLD-020: Telemetry aggregation
+- CLD-021: Cluster dashboard
+- CLD-022: Remote evidence
+- CLD-023: Cloud SOC
+- CLD-024: Distributed storage
+- CLD-025: Cloud shell
+
+## Distributed system features (DST-001..DST-025)
+- DST-001: Node heartbeat
+- DST-002: Leader election
+- DST-003: Consensus vote
+- DST-004: Node trust
+- DST-005: Node join
+- DST-006: Node leave
+- DST-007: Replica tracker
+- DST-008: Event replication
+- DST-009: Distributed replay
+- DST-010: Global process ID
+- DST-011: Cross host lineage
+- DST-012: Remote execution
+- DST-013: Task migration
+- DST-014: Failure detector
+- DST-015: Clock sync
+- DST-016: State sync
+- DST-017: Shard manager
+- DST-018: Partition detector
+- DST-019: Recovery node
+- DST-020: Distributed cache
+- DST-021: Distributed graph
+- DST-022: Evidence federation
+- DST-023: Cluster entropy
+- DST-024: Topology mapper
+- DST-025: Global namespace
+
+## Mapping to phases & priorities
+- Phase 5 (Distributed Telemetry Layer): DST-008, DST-009, DST-011, DST-021, DST-022, DST-023
+- Phase 6 (Cloud Control Plane): CLD-007, CLD-008, CLD-009, CLD-020, CLD-022, CLD-024
+- Phase 11 (AI Runtime): AI-ML-001..AI-ML-025 (start with anomaly, drift, model registry)
+- Cross-cutting Cyber basics (P0): CYB-001..CYB-010
+
+## Implementation guidance
+- Start with minimal, well-tested primitives: `DST-001` (heartbeat), `DST-015` (clock sync), `DST-016` (state sync), `CLD-020` (telemetry aggregation), `AI-ML-001` (anomaly detector), and `CYB-010` (file entropy monitor).
+- Gate distributed/Cloud rollout behind replay determinism and evidence federation tests.
+- Treat AI models as replaceable components with a model registry and versioning; enable model rollback and federated update for safety.
+
+## Notes
+- Each micro-feature should be tracked as an individual issue with an owner, tests, and benchmark targets.
+- These lists are intentionally exhaustive; prioritize and stage implementation using the recommended P0–P3 buckets in the roadmap.