HawkinsOperationsGoverned AI Security System

Evidence vault · claim authority hub

Proof is what survives validation, boundaries, and human review.

The website routes reviewers to proof. It does not authorize claims. Claims either survive the vault — validators, evidence boundaries, and human review — or they stop at the gate.

Public ceiling · CONTROLLED_TEST_VALIDATED72 public-facing governance savesRuntime claims boundedPrivate-only records excluded
Governance SavesProof Pack 001Runtime Boundary

Evidence Bay / Proof Terminal

Proof records are where public claims hit a ceiling.

The website routes reviewers to proof; it does not become proof. This bay shows the receipt path and which authority owns each ceiling.

  1. 01artifact
  2. 02source
  3. 03validation
  4. 04platform contract
  5. 05proof record
  6. 06Hoxline claim gate
  7. 07website render
hawkinsoperations-proofProof Pack 001

bounded reviewer ZIP, checksum, manifest, proof card, proof record, and verifier route

Ceiling: CONTROLLED_TEST_VALIDATED reviewer packagehawkinsoperations-proofHO-DET-001 proof route

source, Splunk source, controlled validation, proof-loop checks, and blocked claims

Ceiling: CONTROLLED_TEST_VALIDATEDhawkinsoperations-proof / hawkinsoperations-platformReviewer Metrics Pipeline v1

49 activity fires, 106 validation cases, 8 proof records, 31 blocked claims, 0 public-safe (fresh from hawkinsoperations-proof 70c6792)

Ceiling: proof-bounded metrics snapshothawkinsoperations-proof / hawkinsoperations-platformRuntime Route Proof v1 private candidate

reviewer-safe private route-proof packet reference and verifier result

Ceiling: PRIVATE_RUNTIME_ROUTE_PROOF_V1_CANDIDATE_PRESERVEDhawkinsoperations-websiteWebsite render

public routing to proof, artifacts, governance saves, and reviewer paths

Ceiling: RENDERING_ONLY

Evidence Bay

Receipts live here. Claims do not get to float free.

Artifact cards route reviewers from public rendering back to source, validation, proof, and authority surfaces. The wall is searchable by family and keeps proof ceilings attached.

proof-recordHO-DET-001 Proof Record

Public Proof

CONTROLLED_TEST_VALIDATEDgovernanceWebsite Rendering Is Not Proof

Public rendering

rendering/reference boundarycase-studyHO-DET-001 Case File

Public Proof

CONTROLLED_TEST_VALIDATEDproof-recordAWS-DET-001 Proof Record

Public Proof

CONTROLLED_TEST_VALIDATEDproof-recordHO-DET-001 Private Runtime Boundary

Runtime Truth

CONTROLLED_TEST_VALIDATEDproof-recordPrivate Marker Delivery Boundary

Evidence Truth

CONTROLLED_TEST_VALIDATEDvalidationValidation Report — Controlled-Test Scope

Validation Truth

CONTROLLED_TEST_VALIDATEDvalidationHO-DET-012 Controlled Validation / Runtime Boundary

Validation Truth

CONTROLLED_TEST_VALIDATEDarchitectureHO-PIPE-001 Telemetry Route Boundary

Telemetry route boundary

SOURCE_EXISTS_VALIDATION_PLANNEDarchitectureHO-NDR-001 Security Onion Visibility Contract

NDR visibility contract

BOUNDARY_CONTRACT_ONLYpublic-packetProof Loop Reviewer Brief / Review ZIP Standard

Reviewer packet

REVIEWER_PACKET_STANDARDarchitectureDetection Factory / Validation Factory Controller

Governed control plane

CONTROL_PLANE_STRUCTUREgovernanceHO-LAB-AUTO / Support-only AI Triage Boundary

AI support boundary

SUPPORT_ONLY_AIgovernanceClaim Firewall

Public claim boundary

rendering/reference boundaryci-verifierBlocked-Claim CI Scanner

Public claim boundary

rendering/reference boundaryarchitectureTruth Surface Model

System architecture

rendering/reference boundaryarchitectureRepository Authority Map

System architecture

rendering/reference boundarygovernanceControl Status Matrix

Governance routing

rendering/reference boundary
artifactsourcevalidationproofwebsite render

Sealed reviewer package

Proof Pack 001 — a bounded reviewer package.

The receipt states what the package supports and what it does not prove. Raw / private runtime evidence is excluded and public runtime proof stays blocked.

HAWKINSOPERATIONS_PROOF_PACK_001CONTROLLED_TEST_VALIDATED
Included · reviewer package (7)
REVIEWER_PACKET.md — Boundary packet for HO-DET-001.
SHA256SUMS.txt — Source-controlled checksums for packet files.
HO-DET-001 proof card — Bounded controlled-test proof card.
HO-DET-001 proof record — Public proof record with stated ceiling.
Validation record — 14 / 14 controlled fixtures.
Ledger / schema — Evidence ledger and schema.
Proof verifier — Structure / parity / boundary checks.
Excluded · blocked from public release (2)
Raw / private runtime evidence — NOT_PUBLIC_SAFE — excluded from the public proof basis.
Public-safe runtime proof — BLOCKED until evidence linkage and explicit promotion.
Does not prove
Runtime-active status is not claimed.
Signal-observed status is not claimed.
Evidence-linked public runtime proof is blocked.
Production-ready and SOCaaS availability are not claimed.
Live Splunk, Cribl/Wazuh, and live AWS are blocked.
Autonomous SOC and AI / analyst disposition are not claimed.
DIRECT_RELEASE_ROUTESOURCE_PACKET_CHECK_MODENO_SIGNED_ARTIFACT

An official direct GitHub Release route exists. Source packet manifest / check-mode language remains source-packet / release-candidate metadata — a route / status distinction, not a stronger proof claim.

Render-only ledger route

Lifetime Case Ledger v1

The website is render-only; the proof repo owns the summary and proof bundle. The badges are workflow-status indicators only. Boundary: no runtime, signal, public-safe runtime proof, SOCaaS, production, autonomous SOC, disposition, or case-closure claim is made.

LEDGER STATUSNOT_PUBLIC_SAFEProof ceiling: SCHEMA_CONTRACT_VERIFIER_EXISTS_ONLY
COUNT SNAPSHOTtotal_ledger_events=6total_cases=6 · public_safe_count=0 · closed_case_count=0
APPENDED DETECTIONSHO-DET-001, HO-DET-011, HO-DET-012Tracked by proof-owned summary references, not by website authority.
VERIFICATION STATUSWorkflow-status indicators onlyInspect lifetime-ledger-public-summary and lifetime-ledger-proof-bundle jobs in Governance Gate.
PROOF-OWNED PUBLIC SUMMARY ↗proof/records/lifetime-case-ledger-v1-public-summary.jsonbounded count and boundary summaryOpen ↗PROOF BUNDLE ↗proof/records/lifetime-case-ledger-v1-proof-bundle.jsonreviewer verification packet sourceOpen ↗BADGE VERIFICATION ↗.github/workflows/governance-gate.ymlworkflow-status routing for ledger verifier jobsOpen ↗
Boundarywebsite is render-only; proof repo owns the summary and proof bundle; badges are workflow-status indicators only; no runtime, signal, public-safe runtime proof, SOCaaS, production, autonomous SOC, disposition, or case-closure claim is made. Does not prove: live runtime activity; signal observation; public proof; public-safe runtime proof; SOCaaS deployment; production deployment; autonomous SOC authority; AI-approved final disposition; analyst-approved final disposition; case closure authority.

Runtime boundary

The runtime proof tower — what survives, what stays sealed.

Each level names a stronger runtime status. The public surface holds at controlled validation; higher rungs are sealed gates that require separate evidence and human approval.

View levels as text
Runtime proof boundary levels.
LevelStatusWhat it does not prove
01 · Controlled validationSUPPORTEDIt does not prove runtime activation or any signal observation.
02 · Runtime path initializedSOURCE-VISIBLESource presence is not runtime; nothing here is claimed as executed in production.
03 · Runtime-supported (private)PARTIALPublic runtime proof is blocked; the private marker is not a public claim.
04 · Runtime-observed (private)PARTIALPublic NDR, cross-source, and signal-observed proof are not claimed from this surface.
05 · Public runtime proofBLOCKEDRuntime-active, signal-observed, and public-safe runtime proof are blocked and not claimed until a separate promotion gate clears them.
06 · Production / customer / fleetBLOCKEDProduction-ready, customer-validated, partner-endorsed, fleet-wide, and autonomous SOC claims are blocked and not made anywhere on this surface.

Evidence bay

Proof records — receipts, not a ledger.

The flagship record leads; supporting records follow at lower weight. Each holds its bounded ceiling and a supports / does-not-prove split.

HO-DET-001

Controlled Validation Receipt · controlled-test validation

CONTROLLED_TEST_VALIDATEDPROOF RECORD PRESENT

Supports

  • The public ceiling is stated as CONTROLLED_TEST_VALIDATED.
  • Blocked promotions are visible instead of hidden.
  • Website rendering remains separated from evidence authority.
  • The platform verifier preserves NOT_PUBLIC_SAFE and BLOCKED runtime promotion fields.
  • The controlled validation receipt shows source, alert shape, validation, case packet, AI support, and human review as separate stages.

Does not prove

  • Runtime activation is not claimed.
  • Signal observation is not claimed.
  • Public-safe runtime proof is not claimed.
  • Live Splunk fired, Cribl-routed status, Wazuh-routed public proof, AWS-live status, production-ready status, fleet-wide coverage, autonomous SOC operation, AI-approved disposition, and analyst-approved disposition are not claimed.
  • External-use approval is not claimed.
  • Public-safe proof is not claimed.
  • Production/customer/SOCaaS deployment, SOCaaS-ready status, FortiSIEM integration proven status, and autonomous production alert resolution are not claimed.
Remaining gates & promotion requirements

Remaining blocked

  • Runtime evidence must be promoted separately.
  • Signal evidence must be promoted separately.
  • Public proof requires evidence linkage.
  • The platform runtime contract does not promote HO-DET-001 beyond CONTROLLED_TEST_VALIDATED.
  • Blocked-claim scanner must stay clean before wording changes ship.

Promotion requirements

  • Preserved validation output linked to the record.
  • Evidence bundle with current trust classification.
  • Runtime and signal claims reviewed independently.
  • Public wording reviewed against blocked promotions.
AWS-DET-001

CloudTrail-style IAM denial fixture proof card

CONTROLLED_TEST_VALIDATEDPROOF RECORD PRESENT

Supports

  • AWS-DET-001 passed fixture-only validation against controlled CloudTrail-style IAM denial fixtures.
  • The website renders the public ceiling as CONTROLLED_TEST_VALIDATED.

Does not prove

  • AWS-live status is not claimed.
  • AWS CloudTrail live evidence is not claimed.
Remaining gates & promotion requirements

Remaining blocked

  • AWS-live proof requires separate evidence and Raylee approval.
  • Cloud runtime-active proof requires separate deployment evidence.
  • Signal-observed public proof requires preserved cloud telemetry.
  • Public-safe runtime proof requires evidence linkage and promotion.

Promotion requirements

  • Real CloudTrail evidence with sanitization and stale review.
  • Cloud deployment evidence linking the rule to an enabled environment.
  • Public wording reviewed against the blocked-claim list.
  • Raylee approval after evidence and claim review.
HO-DET-011

Windows Service Creation / Binary Change · bounded summary

CONTROLLED_TEST_VALIDATEDPRIVATE RUNTIME BOUNDARY

Supports

  • 17 / 17 fixtures pass deterministically.
  • 0 missed positives and 0 false-positive negatives.

Does not prove

  • Public runtime proof and public signal-observed proof are not claimed.
  • Splunk remains NOT_VERIFIED.
Remaining gates & promotion requirements

Remaining blocked

  • Raw Wazuh lines, Windows event payloads, command output, host/user details, private paths, internal network details, service markers, correlation markers, and private hashes remain excluded.
  • Public runtime proof requires a separate approval beyond this bounded summary.

Promotion requirements

  • Separate proof/index vocabulary and approval before any stronger runtime or signal claim.
  • Fresh wording review before publishing any evidence anchor or private hash.
HO-DET-012

Suspicious Scheduled Task Creation · bounded summary

CONTROLLED_TEST_VALIDATEDPROOF RECORD PRESENT

Supports

  • 8 / 8 fixtures pass deterministically.
  • 0 missed positives and 0 false-positive negatives.

Does not prove

  • Public runtime proof and public signal-observed proof are not claimed.
  • Splunk remains NOT_VERIFIED.
Remaining gates & promotion requirements

Remaining blocked

  • Raw Wazuh lines, Windows event payloads, command output, host/user details, private paths, internal network details, task markers, correlation markers, and private hashes remain excluded.
  • Public runtime proof requires a separate approval beyond this bounded summary.

Promotion requirements

  • Separate proof/index vocabulary and approval before any stronger runtime or signal claim.
  • Fresh wording review before publishing any evidence anchor or private hash.
ID-DET-001

Suspicious identity session context · no proof record

CONTROLLED_TEST_VALIDATEDNO PROOF RECORD

Supports

  • 10 / 10 fixtures pass deterministically.
  • 0 missed positives and 0 false-positive negatives.

Does not prove

  • Live IdP / SIEM / NDR coverage is not claimed.
  • Production identity coverage and autonomous / AI disposition are not claimed.
Remaining gates & promotion requirements

Remaining blocked

  • A proof record must be created before public proof status.

Promotion requirements

  • Proof record authored and linked to validation output.
ID-DET-002

MFA fatigue / repeated MFA failure · no proof record

CONTROLLED_TEST_VALIDATEDNO PROOF RECORD

Supports

  • 10 / 10 fixtures pass deterministically.
  • 0 missed positives and 0 false-positive negatives.

Does not prove

  • Live IdP and live SIEM / NDR are not claimed.
  • Proof promotion and public-safe state are not claimed.
Remaining gates & promotion requirements

Remaining blocked

  • A proof record must be created before public proof status.

Promotion requirements

  • Proof record authored and linked to validation output.
ID-DET-003

Privileged role / admin group change · no proof record

CONTROLLED_TEST_VALIDATEDNO PROOF RECORD

Supports

  • 10 / 10 fixtures pass deterministically.
  • 0 missed positives and 0 false-positive negatives.

Does not prove

  • Live IdP / SIEM coverage is not claimed.
  • Production coverage and AI / analyst disposition are not claimed.
Remaining gates & promotion requirements

Remaining blocked

  • A proof record must be created before public proof status.

Promotion requirements

  • Proof record authored and linked to validation output.
ID-DET-004

Impossible travel / anomalous session · no proof record

CONTROLLED_TEST_VALIDATEDNO PROOF RECORD

Supports

  • 10 / 10 fixtures pass deterministically.
  • 0 missed positives and 0 false-positive negatives.

Does not prove

  • Impossible-travel and session-hijacking completeness are not claimed.
  • Live IdP and public-safe state are not claimed.
Remaining gates & promotion requirements

Remaining blocked

  • Completeness is blocked; a proof record must be created before public proof status.

Promotion requirements

  • Proof record authored and linked to validation output.
HO-NDR-001

Security Onion visibility contract · boundary scaffold

BOUNDARY_CONTRACT_ONLYBOUNDARY CONTRACT ONLY

Supports

  • A cross-source corroboration contract is defined.

Does not prove

  • Security Onion runtime, Splunk search, and Cribl / Wazuh routes are not claimed.
  • Zeek / Suricata quality and public-safe proof are not claimed.
Remaining gates & promotion requirements

Remaining blocked

  • Cross-source corroboration contract is defined, not promoted to proof.

Promotion requirements

  • Fixtures authored and validated before any proof record.

Each record holds its bounded ceiling and routes reviewers to source and validation. Website rendering is not proof.

Promotion gates

What must hold before stronger wording ships.

The ladder is sequential — no rung is skipped. Stronger runtime, signal, and public proof wording cannot ship until its gate clears.

  1. G·01Current source artifact remains reviewable in the owning repository.
  2. G·02Validation output is deterministic and linked to the proof record.
  3. G·03Runtime state is independently evidenced before runtime claims move forward.
  4. G·04Signal state is independently evidenced before signal claims move forward.
  5. G·05Evidence linkage is explicit before public proof status changes.
  6. G·06Public wording is scanned against the blocked-claim list before release.

Governed work · Snapshot as of 2026-05-18

Recent governed proof-repo work

Recent governed work on the proof repo. Reviewer-visible cards that do not change the public claim ceiling. Stronger wording requires a separate evidence-backed promotion gate.

SNAPSHOT · 2026-05-18
Snapshot scope: governed labor and reviewed merges. Hand-maintained. Not auto-updated. Does not claim runtime-active, signal-observed, or public-safe runtime proof — those wordings remain blocked by the claim firewall.Open the org ↗

Routes

Where to inspect next.

CLAIM FIREWALLClaim Firewall control surfaceReview the public wording gate that keeps website rendering below proof authority.Open Claim Firewall ->GOVERNANCE SAVESControls that prevented unsafe truthPublic-backed examples where review, verifiers, branch hygiene, and claim ceilings blocked drift.Open →ARCHITECTUREPlane separation mapWhere each surface lives and what its promotion gate looks like.Open →CONTROL MATRIX ↗Status routingRouting surface for HawkinsOperations control ownership and promotion state.Open ↗

Rendering is not proof.

Evidence, validators, and human review authorize claims. The website routes reviewers to proof; it does not author it.