Phase 2 MVP: Declarative Scenario Format, Runtime Engine, and Decoupled Architecture

Milestone Overview

Phase 2 fulfills the primary objective of separating CyberSim OS application code from simulation content. Complete cybersecurity training experiences can now be authored, packaged, and verified without making any modifications to the operating system or simulated workplace applications.

Key Deliverables Implemented

1. CyberSim Scenario Format v1.0 & Verification Pipeline:

   • Built a comprehensive JSON schema validation engine (schema.js) and deep semantic integrity validator (validator.js) that verifies cross-entity referential integrity, event reachability, and category configurations.
   • Implemented a secure scenario loader (loader.js) with path-traversal prevention, $ref: file resolution, and HTML sanitization for untrusted web page definitions.
   • Added author diagnostics (diagnostics.js) with a real-time developer overlay (?dev=true) displaying structural metrics, event states, and live telemetry.

2. Deterministic Runtime Engine & Restricted Behavior Vocabulary:

   • Created a central scenario state manager (scenario_state.js) with Mulberry32 PRNG seed support, action history logging, and snapshot serialization.
   • Built a pure condition tree evaluator (condition_evaluator.js) supporting compound logical operations (all, any, not) and atomic conditions (scenarioStart, elapsedSeconds, actionOccurred, stateEquals, scoreThreshold, findingExists).
   • Implemented an event scheduler (event_scheduler.js) and whitelisted action dispatcher (action_dispatcher.js) supporting desktop notifications, application focus/launches, dynamic email delivery, filesystem injection, and Security Center alert creation.

3. Application & Engine Decoupling:

   • Completely removed hard-coded scenario references from main.js, navigator.js, inlook.js, security_center.js, and index.html.
   • Web browser security state and phishing detection are now dynamically resolved from organization domain definitions, with form submissions bound declaratively by ID.
   • Email header analysis and link handling in Inlook dynamically cross-reference trusted organizational domains.

4. Data-Driven Scoring & Cryptographic Verifiability:

   • Rewrote the behavioral scorer (scorer.js) into a pure data-driven evaluator operating on scenario-declared rubrics, starting points, and feedback conditions.
   • Canonicalized SHA-256 fingerprinting (fingerprint.js) over all evaluation-relevant scenario contents.
   • Updated certificate generation and offline verifier tools (verify.html) for dynamic scenario and learner metadata.

5. Scenario Packages & Documentation:

   • Migrated the Phase 1 "NexaCore Shift 1" scenario to a standalone declarative package (scenarios/nexacore-orientation/scenario.json).
   • Authored an independent healthcare triage scenario (scenarios/quickstart-example/scenario.json) demonstrating multi-scenario support.
   • Authored the complete CyberSim Scenario Format v1.0 specification and authoring guide (docs/scenario-format.md).