{
  "schema_version": 1,
  "pack_id": "coderssecret-malware-defense-course-pack-2026-08-25",
  "title": "Sanitized Defensive Evidence Pack",
  "classification": "inert-and-synthetic-training-data",
  "created_at": "2026-08-25T00:00:00Z",
  "authorization": {
    "owner": "CodersSecret course project",
    "permitted_use": "Offline defensive learning with course-owned fixtures",
    "prohibited_use": [
      "Substituting real suspicious artifacts or employer data",
      "Testing a third-party system, account, package, network, or security product",
      "Importing toy indicators into a production blocking system",
      "Creating persistence, credential access, propagation, command and control, evasion, or destructive behavior"
    ]
  },
  "evidence_handling": {
    "case_id": "CASE-NORTHSTAR-TOY-001",
    "timezone": "UTC",
    "original_evidence": false,
    "sanitized_derivative": true,
    "chain_of_custody": [
      {
        "event_id": "custody-001",
        "time": "2026-08-25T08:00:00Z",
        "actor": "course-author",
        "action": "created synthetic fixture set",
        "location": "course-repository"
      },
      {
        "event_id": "custody-002",
        "time": "2026-08-25T08:10:00Z",
        "actor": "course-validator",
        "action": "validated manifest, safety boundaries, and reserved identifiers",
        "location": "course-repository"
      }
    ]
  },
  "artifact_summaries": [
    {
      "evidence_id": "artifact-native-001",
      "artifact_type": "benign-native-metadata-summary",
      "format": "PE metadata summary without a binary",
      "declared_purpose": "Print a fixed course greeting and exit",
      "observed_capabilities": ["console-output", "read-process-identifier", "normal-exit"],
      "signature_state": "fictional-course-signer",
      "conclusion": "Capabilities match the declared toy purpose; no executable is distributed"
    },
    {
      "evidence_id": "artifact-native-002",
      "artifact_type": "benign-native-metadata-summary",
      "format": "ELF metadata summary without a binary",
      "declared_purpose": "Read a fixed course metadata record and print its identifier",
      "observed_capabilities": ["read-fixed-course-record", "console-output", "normal-exit"],
      "signature_state": "not-applicable-to-toy-summary",
      "conclusion": "No runtime artifact is present; use the record for format comparison only"
    },
    {
      "evidence_id": "artifact-managed-001",
      "artifact_type": "managed-package-summary",
      "package_name": "northstar-format-helper",
      "version": "4.2.1-course",
      "publisher": "Northstar Training Team",
      "lifecycle_scripts": [],
      "declared_permissions": ["read-course-manifest"],
      "baseline_difference": "Publisher matches baseline; provenance subject digest does not match the candidate release record",
      "conclusion": "Quarantine for release-integrity review; do not install"
    },
    {
      "evidence_id": "artifact-container-001",
      "artifact_type": "container-metadata-summary",
      "image_name": "northstar-helper-course",
      "tag": "4.2.1-course",
      "runtime_user": "65532",
      "declared_network_policy": "none",
      "entry_point_category": "fixed-course-helper",
      "conclusion": "Metadata only; no image layers or runnable image are distributed"
    },
    {
      "evidence_id": "artifact-wasm-001",
      "artifact_type": "webassembly-metadata-summary",
      "imports": ["course-console-output"],
      "exports": ["format-course-title"],
      "host_capabilities": ["write-course-console"],
      "conclusion": "Capability list is intentionally harmless; no WebAssembly module is distributed"
    }
  ],
  "compiler_reasoning_fixture": {
    "evidence_id": "control-flow-001",
    "source_visible": true,
    "blocks": [
      { "id": "entry", "action": "load fixed course title", "next": "validate" },
      { "id": "validate", "action": "check constant title length", "next": "print" },
      { "id": "print", "action": "write title to course console", "next": "exit" },
      { "id": "exit", "action": "return success", "next": null }
    ],
    "analyst_note": "A capability inferred from structure is not proof that a branch executed"
  },
  "offline_framework_reference": {
    "path": "frameworks/attack-d3fend-v19.2-1.5.0.json",
    "attck_version": "19.2",
    "d3fend_version": "1.5.0",
    "reviewed_at": "2026-08-25",
    "usage": "Read only during the network-disabled mapping lab; verify current official definitions outside the lab."
  },
  "asset_index": [
    { "path": "static/static-triage-fixtures.json", "role": "inert-static-triage-pairs" },
    { "path": "benign/harmless-control-flow.c", "role": "source-visible-harmless-utility" },
    { "path": "benign/course-input.txt", "role": "fixed-harmless-utility-input" },
    { "path": "benign/build-contract.md", "role": "benign-source-behavior-and-build-contract" },
    { "path": "yara/toy-positive-alpha.txt", "role": "inert-positive-fixture" },
    { "path": "yara/toy-positive-beta.txt", "role": "inert-positive-fixture" },
    { "path": "yara/toy-negative-clean.txt", "role": "inert-negative-fixture" },
    { "path": "yara/toy-negative-near-match.txt", "role": "inert-near-match-fixture" },
    { "path": "endpoint/synthetic-endpoint-events.jsonl", "role": "synthetic-endpoint-telemetry" },
    { "path": "sigma/positive-events.jsonl", "role": "synthetic-positive-log-corpus" },
    { "path": "sigma/negative-events.jsonl", "role": "synthetic-negative-log-corpus" },
    { "path": "network/sanitized-network-events.jsonl", "role": "sanitized-network-metadata" },
    { "path": "memory/sanitized-memory-observations.json", "role": "sanitized-volatile-observations" },
    { "path": "frameworks/attack-d3fend-v19.2-1.5.0.json", "role": "offline-version-pinned-framework-reference" },
    { "path": "tabletop/incident-cards.json", "role": "synthetic-response-tabletop" },
    { "path": "tabletop/service-map.json", "role": "fictional-service-and-owner-map" },
    { "path": "intelligence/northstar-toy-stix-2.1.json", "role": "toy-intelligence-exchange" },
    { "path": "intelligence/tlp-handling.json", "role": "external-first-tlp-2.0-handling-record" },
    { "path": "architecture/developer-tool-architecture.json", "role": "secure-design-review" },
    { "path": "capstone/capstone-bundle.json", "role": "capstone-evidence-index" },
    { "path": "capstone/capstone-timeline.jsonl", "role": "capstone-timeline" }
  ],
  "stop_conditions": [
    "A file hash differs from fixture-manifest.json",
    "A network identifier is not reserved for examples or documentation",
    "A fixture contains a real identity, credential, customer record, or employer record",
    "An exercise requests execution of anything other than the reviewed benign telemetry demo",
    "Any runtime behavior differs from behavior-contract.md"
  ]
}