Labyricorn - CyberSim-OS

CyberSim-OS

Labyricorn — Sun, 23 Aug 2026 00:00:00 +0000

CyberSim-OS is an offline-first, browser-native cybersecurity simulation environment designed for ordinary end users. Learners navigate a convincing fictional enterprise desktop, perform routine tasks, investigate legitimate and malicious events (phishing, social engineering, malicious attachments), make meaningful decisions, receive multi-axis behavioral after-action reports, and earn cryptographically verifiable completion certificates.

Initial Phase 1 MVP Release: Desktop Simulation, Behavioral Assessment, and Certificate Verification

Labyricorn — Sun, 23 Aug 2026 00:00:00 +0000

Milestone Overview

The Phase 1 MVP of CyberSim-OS establishes a browser-native, zero-dependency simulation environment designed to assess end-user cybersecurity behavior in a realistic workplace context.

Key Deliverables Implemented

Fictional Desktop Shell & Window Manager:
- Original enterprise Windows-like theme with draggable and minimizable window frames, taskbar, start launcher, real-time clock, and Web Audio synthesized toast alerts.
Core Workplace Application Suite:
- Inlook: Email client with RFC envelope inspector (detects typosquatted sender domains), destination link hover inspection, and SOC incident reporting.
- Navigator: Simulated web browser supporting intranet directories, security policy hubs, and simulated credential-harvesting phishing portals.
- Files & Doc Viewer: Virtual corporate storage and multi-format renderer for financial spreadsheets (.xlsx), security policies (.pdf), and approved vendor lists.
- Security Center: Endpoint threat monitoring dashboard, alert feeds, and incident tracking.
Behavioral Telemetry & Delayed Consequence Engine:
- Granular event logging recording all learner interactions with timestamps and context.
- Delayed consequence scheduler that triggers realistic delayed alerts (e.g. anomalous login notifications following credential submissions) without arcade-like immediate feedback.
7-Axis Behavioral Assessment & After-Action Report:
- Comprehensive scoring rubric measuring Threat Detection, Investigation, Safe Handling, Verification, Incident Reporting, and False Positive Control on a 0–100 scale (80 passing threshold).
- Pedagogical debrief modal providing score breakdowns and constructive feedback.
Cryptographic Certificate Verification:
- SHA-256 scenario fingerprinting using the native Web Crypto API.
- Portable *.cybercert JSON credential export and standalone drag-and-drop offline verifier (verify.html).
Standalone Offline Deployment:
- Bundled Python 3 local server launcher (launcher.py) binding strictly to 127.0.0.1.

Phase 2 MVP: Declarative Scenario Format, Runtime Engine, and Decoupled Architecture

Labyricorn — Mon, 24 Aug 2026 00:00:00 +0000

Milestone Overview

Phase 2 fulfills the primary objective of separating CyberSim OS application code from simulation content. Complete cybersecurity training experiences can now be authored, packaged, and verified without making any modifications to the operating system or simulated workplace applications.

Key Deliverables Implemented

CyberSim Scenario Format v1.0 & Verification Pipeline:
- Built a comprehensive JSON schema validation engine (schema.js) and deep semantic integrity validator (validator.js) that verifies cross-entity referential integrity, event reachability, and category configurations.
- Implemented a secure scenario loader (loader.js) with path-traversal prevention, $ref: file resolution, and HTML sanitization for untrusted web page definitions.
- Added author diagnostics (diagnostics.js) with a real-time developer overlay (?dev=true) displaying structural metrics, event states, and live telemetry.
Deterministic Runtime Engine & Restricted Behavior Vocabulary:
- Created a central scenario state manager (scenario_state.js) with Mulberry32 PRNG seed support, action history logging, and snapshot serialization.
- Built a pure condition tree evaluator (condition_evaluator.js) supporting compound logical operations (all, any, not) and atomic conditions (scenarioStart, elapsedSeconds, actionOccurred, stateEquals, scoreThreshold, findingExists).
- Implemented an event scheduler (event_scheduler.js) and whitelisted action dispatcher (action_dispatcher.js) supporting desktop notifications, application focus/launches, dynamic email delivery, filesystem injection, and Security Center alert creation.
Application & Engine Decoupling:
- Completely removed hard-coded scenario references from main.js, navigator.js, inlook.js, security_center.js, and index.html.
- Web browser security state and phishing detection are now dynamically resolved from organization domain definitions, with form submissions bound declaratively by ID.
- Email header analysis and link handling in Inlook dynamically cross-reference trusted organizational domains.
Data-Driven Scoring & Cryptographic Verifiability:
- Rewrote the behavioral scorer (scorer.js) into a pure data-driven evaluator operating on scenario-declared rubrics, starting points, and feedback conditions.
- Canonicalized SHA-256 fingerprinting (fingerprint.js) over all evaluation-relevant scenario contents.
- Updated certificate generation and offline verifier tools (verify.html) for dynamic scenario and learner metadata.
Scenario Packages & Documentation:
- Migrated the Phase 1 "NexaCore Shift 1" scenario to a standalone declarative package (scenarios/nexacore-orientation/scenario.json).
- Authored an independent healthcare triage scenario (scenarios/quickstart-example/scenario.json) demonstrating multi-scenario support.
- Authored the complete CyberSim Scenario Format v1.0 specification and authoring guide (docs/scenario-format.md).

Phase 2.5: Runtime Localization, Corporate Branding, and Immersive Login

Labyricorn — Mon, 24 Aug 2026 00:00:00 +0000

Milestone Overview

CyberSim Phase 2.5 prepares the simulation platform for organizational deployment and Phase 3 scenario authoring. This milestone introduces a robust localization layer, configuration-driven enterprise branding, an immersive workstation login experience, learner first- and last-name personalization, standalone certificate rendering and printing, and cross-locale offline credential verification while preserving 100% offline execution and strict security boundaries.

Key Deliverables Implemented

CyberSim OS & Scenario Multilingual Localization (I18n):
- Built a standalone, offline-first localization engine (i18n.js) with deterministic fallback behavior (Selected Locale -> Deployment Default Locale -> English -> visible [missing: key] indicators).
- Embedded full English UI catalogs (locales/en.json) and Spanish demonstration catalogs (locales/es.json) for instant offline dictionary availability.
- Decoupled scenario content localization (scenarios/[id]/locales/[lang].json), enabling independent translations of emails, documents, web pages, notifications, and pedagogical feedback without altering scenario schemas or scoring logic.
Deployment Configuration & Corporate Branding:
- Implemented src/config/deployment.json and a dynamic BrandingManager (branding.js) to customize organization identity (name, short name, logo, wallpaper, accent color, and service desk contact) via CSS custom property injection.
- Built automatic fallbacks to default CyberSim enterprise styling when custom branding properties are omitted.
- Preserved simulation safety indicators to maintain clear simulation boundaries.
Immersive Workstation Login & Dynamic Network Discovery:
- Replaced raw scenario loading with an enterprise lockscreen interface (login.js) featuring real-time language switching, strict first- and last-name input validation (required, trimmed, max length 50), and dynamic workplace network selection.
- Added direct verification shortcut links on the login screen to allow verifying completion certificates without logging into a simulation.
- Avoided any credential or password entry requirements on the simulated OS login screen.
- Extended scenario manifest schemas to support supportedLocales declarations and login metadata (networkName, networkDescription, networkIcon).
Learner Full-Name Personalization & Security Boundaries:
- Exposed learner.firstName, learner.lastName, and full learner.name to scenario action dispatchers, simulated workplace applications, and certificate generators.
- Implemented safe template interpolation with HTML entity escaping to prevent cross-site scripting (XSS) or HTML injection from user-provided names.
Deterministic Cryptographic Verification & Print Rendering:
- Canonicalized SHA-256 fingerprinting (fingerprint.js) against the base scenario structure, ensuring that completion certificates issued in one language remain 100% machine-verifiable in any language.
- Updated the standalone offline certificate verifier (verify.html) to render the full official Certificate of Competency upon successful validation, with dedicated print styling and export actions.
Comprehensive Automated Verification & Zero External Dependencies:
- Added an automated Node.js test suite (tests/run_tests.js) covering localization fallback, branding defaults, login validation, template escaping, cross-locale fingerprinting, and offline dependency verification.
- Verified 100% offline compatibility with zero external CDN, font, or API requirements.