How the parts connect
Target Management supplies the scoped people/assets and current rules. A vector invocation binds those rules to a specific tool, resource and expected output. Telecoms, account creation and red-team platforms are selected only where the approved assessment needs them.
| Component | Current finding | Connection required |
|---|---|---|
| Library | 11 scenario playbooks, 10 reusable vectors, 7 assessment guides and 30 resources are published here. The previous placeholder cards have been replaced. | Follow the scenario → vector → tool guide → selected resource → output links. Armory and Repository navigation link back to this Library. |
| Armory and tool guides | The catalogue supports direct search links. 22 relevant guide files were inspected by title/structure; sample contents are basic autogenerated notes. | Link the selected tool plus version-appropriate official guidance. Do not treat a launcher/installed badge as workflow proof. |
| Repository | 142 source documents and 293 artifacts were observed in the 13 October audit. The Repository now also links to this Library’s curated assessment resources; its upstream catalogue is preserved. | Bind the exact reviewed resource/version/hash to the selected step. Candidate reference material is not an execution permit. |
| Target Management and agents | CRM, Mission Control and native services exist; a universal target/permission gate is not demonstrated. | Preserve engagement, target, policy and step identity; check current permission before every external action. |
| Evidence and report | Completion semantics differ; some Agent001 manual/log-only work is recorded as completed. | Require actual receipts/results and review. Retain blocked, not-authorised and untested states and their assurance limits. |
| Mitigation offering | Outside current scope. | Part 1 stops at evidence-backed recommendations. Implementation allocation, scheduling and commercial pricing are Part 2. |
What is and is not ready
The scenario and vector content, resource mappings and documentation navigation are published. Production permission enforcement, native execution adapters, channel readiness and complete service validation remain separate work. The operational readiness notes are dated to the 13 October audit.
This release publishes static documentation and adds navigation links. It does not enable execution, ingest the catalogue into HILLY, or create client approvals. No target was contacted, paid model call made or offensive test run. Client assessments remain NOT ASSESSED.
Machine-readable references: scenario and vector catalogue · resource IDs and hashes · publication record. These records are available for a later runtime integration; publication alone does not prove agent awareness.