{
  "schema": "deg-fixture/0.1",
  "graph_id": "cyber-escalation-b",
  "title": "Vulnerability escalation decision",
  "description": "A security team sees a CVE land in the CISA KEV catalog, combines it with a vendor severity rating and an internal exposure scan, and escalates to sev-1. The graph shows exactly which links are verifiable, which are only reported, and what is honestly missing: nobody independently confirmed the patched build deployed.",
  "layout_seed": 20260608,
  "demonstration": {
    "status": "sanitized",
    "not_live_claim": true,
    "note": "Built around the sanitized gold conformance fixtures (gold-cisa-kev.json, fixture-valid.json). The CVE id, host counts, ticket ids and all internal actors are synthetic. This is a demonstration, not a record of a live incident."
  },
  "honesty": {
    "verifiable": [
      "The KEV listing observation is sealed by a trust receipt that verifies against web/conformance/gold-cisa-kev.json.",
      "The escalation evidence bundle is sealed by a trust receipt that verifies against web/conformance/fixture-valid.json."
    ],
    "reported_only": [
      "The vendor severity rating comes from the vendor advisory text and was not independently rescored.",
      "The 14-host exposure count comes from the operator's internal scanner and was not cross-checked by a second tool.",
      "The incident ticket and the emergency patch rollout are reported by the operator's ticketing system, not independently observed.",
      "The analyst review exists as a ticket comment; there is no signed record of what the analyst actually inspected."
    ],
    "missing": [
      "No independent confirmation that the patched build actually deployed to the 14 exposed hosts.",
      "The planned post-patch verification scan was never run; the node for it is a placeholder marked missing.",
      "No receipt exists for the vendor advisory text as it appeared at read time."
    ],
    "uncertain": [
      "The claim that a public proof-of-concept exploit is circulating rests on a single tracker entry of unknown reliability.",
      "The outcome 'closed as remediated' is asserted by the same team that performed the rollout, with no outside check."
    ]
  },
  "nodes": [
    {
      "id": "cyb:src-kev",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-01T00:00:00Z",
      "type": "Source",
      "label": "CISA KEV catalog",
      "summary": "The Known Exploited Vulnerabilities catalog published by CISA. Public listing of CVEs with confirmed exploitation.",
      "integrity_state": "reported",
      "sensitivity": "public",
      "retention": "demonstration",
      "external_ref": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "limitations": ["Catalog membership signals confirmed exploitation somewhere, not exploitation of this operator."]
    },
    {
      "id": "cyb:src-vendor",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-01T00:00:00Z",
      "type": "Source",
      "label": "Vendor security advisory",
      "summary": "The affected product vendor's advisory feed. Names are synthetic in this demonstration.",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "external_ref": "vsa-2026-0117",
      "limitations": ["Advisory text was read once; no snapshot receipt was taken."]
    },
    {
      "id": "cyb:src-scanner",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-01T00:00:00Z",
      "type": "Source",
      "label": "Internal asset scanner",
      "summary": "The operator's own asset inventory and exposure scanner. Internal system, single vantage point.",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": ["Single scanner vantage point; hosts offline during the sweep are not counted."]
    },
    {
      "id": "cyb:src-poc-tracker",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-01T00:00:00Z",
      "type": "Source",
      "label": "Public exploit tracker",
      "summary": "A community-run tracker of proof-of-concept exploit code. Reliability varies by entry.",
      "integrity_state": "uncertain",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": ["Community-submitted entries; no editorial verification."]
    },
    {
      "id": "cyb:src-ticketing",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-01T00:00:00Z",
      "type": "Source",
      "label": "Internal ticketing system",
      "summary": "The operator's incident ticketing system. Records tickets, comments and closures as entered by staff.",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": ["Records what staff typed, not what happened."]
    },
    {
      "id": "cyb:obs-kev-listing",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:07:00Z",
      "occurred_at": "2026-06-08T13:05:00Z",
      "type": "Observation",
      "label": "CVE-2026-40912 listed in KEV",
      "summary": "The catalog read at 13:05Z shows CVE-2026-40912 added with a known-ransomware-use flag.",
      "integrity_state": "reported",
      "sensitivity": "sanitized",
      "retention": "demonstration",
      "source_ref": "cyb:src-kev",
      "freshness_at_use": { "state": "live", "age_seconds": 120 },
      "limitations": ["CVE id is synthetic; the read pattern mirrors the sanitized gold fixture."]
    },
    {
      "id": "cyb:tr-kev",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:08:00Z",
      "type": "TrustReceipt",
      "label": "Trust receipt for the KEV read",
      "summary": "Signed receipt sealing the KEV catalog read. Verifies offline against the published conformance package.",
      "integrity_state": "verifiable",
      "sensitivity": "sanitized",
      "retention": "archival",
      "evidence_ref": "web/conformance/gold-cisa-kev.json",
      "limitations": ["Seals the bytes read at 13:05Z only; says nothing about later catalog edits."]
    },
    {
      "id": "cyb:obs-severity",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:22:00Z",
      "occurred_at": "2026-06-08T13:20:00Z",
      "type": "Observation",
      "label": "Vendor rates severity critical (9.8)",
      "summary": "The vendor advisory assigns a critical score and lists affected builds. Taken at face value.",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "source_ref": "cyb:src-vendor",
      "external_ref": "vsa-2026-0117",
      "limitations": ["Score not independently recomputed.", "No receipt of the advisory text at read time."]
    },
    {
      "id": "cyb:obs-exposure",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:34:00Z",
      "occurred_at": "2026-06-08T13:30:00Z",
      "type": "Observation",
      "label": "14 internet-facing hosts run the affected build",
      "summary": "The internal scanner sweep at 13:30Z matched 14 internet-facing hosts against the vendor's affected-build list. Decision input.",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "source_ref": "cyb:src-scanner",
      "actor_ref": "system:asset-scanner",
      "freshness_at_use": { "state": "live", "age_seconds": 1200 },
      "limitations": ["Single sweep; hosts offline at 13:30Z are not counted.", "Not cross-checked by a second inventory."]
    },
    {
      "id": "cyb:obs-poc",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:40:00Z",
      "occurred_at": "2026-06-08T13:38:00Z",
      "type": "Observation",
      "label": "Public proof-of-concept reported circulating",
      "summary": "One tracker entry claims working exploit code exists. The entry has not been reproduced or corroborated.",
      "integrity_state": "uncertain",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "source_ref": "cyb:src-poc-tracker",
      "limitations": ["Single uncorroborated entry.", "Exploit code was not fetched or executed to confirm."]
    },
    {
      "id": "cyb:bundle-escalation",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:45:00Z",
      "type": "EvidenceBundle",
      "label": "Escalation evidence bundle",
      "summary": "Bundle assembling the KEV read, the vendor severity rating and the exposure count for the escalation decision.",
      "integrity_state": "reported",
      "sensitivity": "sanitized",
      "retention": "archival",
      "actor_ref": "system:evidence-assembler",
      "limitations": ["Bundle assembly order is reported by the assembler log."]
    },
    {
      "id": "cyb:tr-bundle",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:46:00Z",
      "type": "TrustReceipt",
      "label": "Trust receipt for the evidence bundle",
      "summary": "Signed receipt sealing the assembled bundle. Verifies offline against the published conformance package.",
      "integrity_state": "verifiable",
      "sensitivity": "sanitized",
      "retention": "archival",
      "evidence_ref": "web/conformance/fixture-valid.json",
      "limitations": ["Seals the bundle contents; does not vouch for the truth of the reported inputs."]
    },
    {
      "id": "cyb:dec-sev1",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:50:00Z",
      "occurred_at": "2026-06-08T13:50:00Z",
      "type": "DecisionReference",
      "label": "Escalate CVE-2026-40912 to sev-1",
      "summary": "The duty officer escalates to sev-1 based on the bundle: KEV listing plus critical severity plus 14 exposed hosts.",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "actor_ref": "human:sec-ops-duty-officer",
      "limitations": ["Decision rationale reconstructed from the ticket, not captured at decision time."]
    },
    {
      "id": "cyb:act-ticket",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:52:00Z",
      "occurred_at": "2026-06-08T13:52:00Z",
      "type": "ActionReference",
      "label": "Incident ticket INC-4821 opened",
      "summary": "A sev-1 incident ticket is opened in the operator's ticketing system. Existence is reported by that system.",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "source_ref": "cyb:src-ticketing",
      "external_ref": "inc-4821",
      "limitations": ["Reported by the operator's system, not independently observed."]
    },
    {
      "id": "cyb:hand-oncall",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:55:00Z",
      "occurred_at": "2026-06-08T13:55:00Z",
      "type": "AgentHandoff",
      "label": "Handoff to on-call remediation rotation",
      "summary": "The escalation is handed to the on-call rotation with the bundle attached. Handoff logged by the pager system.",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "actor_ref": "system:pager",
      "limitations": ["Pager acknowledgement is logged; what the recipient read is not."]
    },
    {
      "id": "cyb:rev-analyst",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T14:25:00Z",
      "occurred_at": "2026-06-08T14:25:00Z",
      "type": "Review",
      "label": "Analyst confirmed exploitability applies",
      "summary": "The on-call analyst reviewed the escalation and confirmed the exploited configuration matches the exposed hosts.",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "actor_ref": "human:on-call-analyst",
      "limitations": ["Recorded as a ticket comment; no signed statement of what was inspected."]
    },
    {
      "id": "cyb:act-patch",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T14:40:00Z",
      "occurred_at": "2026-06-08T14:40:00Z",
      "type": "ActionReference",
      "label": "Emergency patch rollout ordered",
      "summary": "An emergency rollout of the vendor's fixed build is ordered for the 14 exposed hosts, authorized by the analyst review.",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "actor_ref": "human:on-call-analyst",
      "limitations": ["The order is logged; execution on each host is not covered by this node."]
    },
    {
      "id": "cyb:out-remediated",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T18:30:00Z",
      "occurred_at": "2026-06-08T18:30:00Z",
      "type": "Outcome",
      "label": "Ticket closed as remediated",
      "summary": "The ticket is closed with a note that the patched build deployed to all 14 hosts. Asserted by the rollout team itself.",
      "integrity_state": "uncertain",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "source_ref": "cyb:src-ticketing",
      "limitations": ["Self-reported by the team that performed the rollout.", "No independent deployment check exists."]
    },
    {
      "id": "cyb:obs-postpatch-scan",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-09T09:00:00Z",
      "type": "Observation",
      "label": "Post-patch verification scan (not performed)",
      "summary": "Placeholder for the independent scan that would confirm the patched build is running. The scan was never run.",
      "integrity_state": "missing",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "source_ref": "cyb:src-scanner",
      "freshness_at_use": { "state": "unavailable" },
      "limitations": ["This record marks an absence: no verification scan exists for the patched hosts."]
    }
  ],
  "edges": [
    {
      "id": "cyb:e-obs-kev-src",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:07:00Z",
      "type": "OBSERVED_FROM",
      "from": "cyb:obs-kev-listing",
      "to": "cyb:src-kev",
      "integrity_state": "reported",
      "sensitivity": "sanitized",
      "retention": "demonstration",
      "limitations": []
    },
    {
      "id": "cyb:e-obs-sev-src",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:22:00Z",
      "type": "OBSERVED_FROM",
      "from": "cyb:obs-severity",
      "to": "cyb:src-vendor",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": ["No snapshot of the advisory was kept."]
    },
    {
      "id": "cyb:e-obs-exp-src",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:34:00Z",
      "type": "OBSERVED_FROM",
      "from": "cyb:obs-exposure",
      "to": "cyb:src-scanner",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": []
    },
    {
      "id": "cyb:e-obs-poc-src",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:40:00Z",
      "type": "OBSERVED_FROM",
      "from": "cyb:obs-poc",
      "to": "cyb:src-poc-tracker",
      "integrity_state": "uncertain",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": ["Single uncorroborated tracker entry."]
    },
    {
      "id": "cyb:e-seal-kev",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:08:00Z",
      "type": "SEALED_AS",
      "from": "cyb:obs-kev-listing",
      "to": "cyb:tr-kev",
      "integrity_state": "reported",
      "sensitivity": "sanitized",
      "retention": "archival",
      "limitations": []
    },
    {
      "id": "cyb:e-seal-bundle",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:46:00Z",
      "type": "SEALED_AS",
      "from": "cyb:bundle-escalation",
      "to": "cyb:tr-bundle",
      "integrity_state": "reported",
      "sensitivity": "sanitized",
      "retention": "archival",
      "limitations": []
    },
    {
      "id": "cyb:e-bundle-from-kev",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:45:00Z",
      "type": "DERIVED_FROM",
      "from": "cyb:bundle-escalation",
      "to": "cyb:obs-kev-listing",
      "integrity_state": "reported",
      "sensitivity": "sanitized",
      "retention": "demonstration",
      "limitations": []
    },
    {
      "id": "cyb:e-bundle-from-sev",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:45:00Z",
      "type": "DERIVED_FROM",
      "from": "cyb:bundle-escalation",
      "to": "cyb:obs-severity",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": []
    },
    {
      "id": "cyb:e-bundle-from-exp",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:45:00Z",
      "type": "DERIVED_FROM",
      "from": "cyb:bundle-escalation",
      "to": "cyb:obs-exposure",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": []
    },
    {
      "id": "cyb:e-poc-supports-bundle",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:45:00Z",
      "type": "SUPPORTS",
      "from": "cyb:obs-poc",
      "to": "cyb:bundle-escalation",
      "integrity_state": "uncertain",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": ["Supporting weight is low: the PoC claim is uncorroborated."]
    },
    {
      "id": "cyb:e-bundle-supports-dec",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:50:00Z",
      "type": "SUPPORTS",
      "from": "cyb:bundle-escalation",
      "to": "cyb:dec-sev1",
      "integrity_state": "reported",
      "sensitivity": "sanitized",
      "retention": "demonstration",
      "limitations": []
    },
    {
      "id": "cyb:e-kev-used-by-dec",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:50:00Z",
      "type": "USED_BY",
      "from": "cyb:obs-kev-listing",
      "to": "cyb:dec-sev1",
      "integrity_state": "reported",
      "sensitivity": "sanitized",
      "retention": "demonstration",
      "limitations": []
    },
    {
      "id": "cyb:e-exp-used-by-dec",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:50:00Z",
      "type": "USED_BY",
      "from": "cyb:obs-exposure",
      "to": "cyb:dec-sev1",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": ["The decision took the 14-host count at face value."]
    },
    {
      "id": "cyb:e-dec-triggered-ticket",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:52:00Z",
      "type": "TRIGGERED",
      "from": "cyb:dec-sev1",
      "to": "cyb:act-ticket",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": ["Causal link asserted by the ticketing system timestamp order."]
    },
    {
      "id": "cyb:e-dec-delegated-oncall",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T13:55:00Z",
      "type": "DELEGATED_TO",
      "from": "cyb:dec-sev1",
      "to": "cyb:hand-oncall",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": []
    },
    {
      "id": "cyb:e-dec-reviewed",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T14:25:00Z",
      "type": "REVIEWED_BY",
      "from": "cyb:dec-sev1",
      "to": "cyb:rev-analyst",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": []
    },
    {
      "id": "cyb:e-ticket-reviewed",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T14:25:00Z",
      "type": "REVIEWED_BY",
      "from": "cyb:act-ticket",
      "to": "cyb:rev-analyst",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": []
    },
    {
      "id": "cyb:e-sev-supports-review",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T14:25:00Z",
      "type": "SUPPORTS",
      "from": "cyb:obs-severity",
      "to": "cyb:rev-analyst",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": []
    },
    {
      "id": "cyb:e-review-checked-receipt",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T14:25:00Z",
      "type": "VERIFIED_BY",
      "from": "cyb:rev-analyst",
      "to": "cyb:tr-kev",
      "integrity_state": "reported",
      "sensitivity": "sanitized",
      "retention": "demonstration",
      "limitations": ["The analyst states the receipt was checked; the check itself left no log."]
    },
    {
      "id": "cyb:e-review-authorized-patch",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T14:40:00Z",
      "type": "AUTHORIZED",
      "from": "cyb:rev-analyst",
      "to": "cyb:act-patch",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": ["Authorization recorded as a ticket comment."]
    },
    {
      "id": "cyb:e-oncall-triggered-patch",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T14:40:00Z",
      "type": "TRIGGERED",
      "from": "cyb:hand-oncall",
      "to": "cyb:act-patch",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": []
    },
    {
      "id": "cyb:e-exp-used-by-patch",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T14:40:00Z",
      "type": "USED_BY",
      "from": "cyb:obs-exposure",
      "to": "cyb:act-patch",
      "integrity_state": "reported",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": ["The rollout target list is the unverified 14-host scan result."]
    },
    {
      "id": "cyb:e-patch-resulted-out",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-08T18:30:00Z",
      "type": "RESULTED_IN",
      "from": "cyb:act-patch",
      "to": "cyb:out-remediated",
      "integrity_state": "uncertain",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": ["Result asserted by the rollout team; no independent deployment check."]
    },
    {
      "id": "cyb:e-missing-scan-src",
      "schema_version": "deg/0.1",
      "created_at": "2026-06-09T09:00:00Z",
      "type": "OBSERVED_FROM",
      "from": "cyb:obs-postpatch-scan",
      "to": "cyb:src-scanner",
      "integrity_state": "missing",
      "sensitivity": "synthetic",
      "retention": "demonstration",
      "limitations": ["Edge marks where the verification scan would have come from; it never ran."]
    }
  ]
}