Summary
Write the capstone analysis document for the honest battery: how Crucible's
scenarios performed against Synapse, and — more importantly — what was actually
measured and what was deliberately not. The doc's credibility comes from stating
its two honesty boundaries as features, not buried caveats. A report that
names what its instrument cannot measure is more trustworthy than one that
implies total coverage.
This is the capstone: it can only be written credibly once the scoring is graded
(#37), the curve is reported (#38), and the run is reproducible (atlas-crew/Bridge#3).
The two honesty boundaries (stated as features)
1. Distributed-correlation exclusion — an instrument limit
The battery does not claim to test Synapse's distributed / multi-source
correlation detection, because the instrument (Crucible) generates single-origin,
L7-only traffic — "many origins" is header spoofing (X-Forwarded-For,
User-Agent), not genuinely distinct network sources or TLS fingerprints
(see #36). State this proudly and precisely: name the class of detection the
instrument cannot exercise, so no reader infers coverage that was never claimed.
This is the inverse of the botnet false-positive — honesty about the instrument's
reach prevents a fake-green at the report level.
2. Graded-response methodology — why "caught/missed" is too crude
A behavioral WAF that escalates Cookie → JS PoW → CAPTCHA → Tarpit → Block does
not have a binary verdict. Document what we measured instead:
Acceptance criteria
Related / blocked by
Summary
Write the capstone analysis document for the honest battery: how Crucible's
scenarios performed against Synapse, and — more importantly — what was actually
measured and what was deliberately not. The doc's credibility comes from stating
its two honesty boundaries as features, not buried caveats. A report that
names what its instrument cannot measure is more trustworthy than one that
implies total coverage.
This is the capstone: it can only be written credibly once the scoring is graded
(#37), the curve is reported (#38), and the run is reproducible (atlas-crew/Bridge#3).
The two honesty boundaries (stated as features)
1. Distributed-correlation exclusion — an instrument limit
The battery does not claim to test Synapse's distributed / multi-source
correlation detection, because the instrument (Crucible) generates single-origin,
L7-only traffic — "many origins" is header spoofing (
X-Forwarded-For,User-Agent), not genuinely distinct network sources or TLS fingerprints(see #36). State this proudly and precisely: name the class of detection the
instrument cannot exercise, so no reader infers coverage that was never claimed.
This is the inverse of the botnet false-positive — honesty about the instrument's
reach prevents a fake-green at the report level.
2. Graded-response methodology — why "caught/missed" is too crude
A behavioral WAF that escalates Cookie → JS PoW → CAPTCHA → Tarpit → Block does
not have a binary verdict. Document what we measured instead:
blocked/challenged/rate-limited(Engine scores Synapse challenge tier (JS PoW / CAPTCHA, HTTP 200) as a miss — fake-negative in battery report #37), with the level-1 tracking cookie explicitly not countedas mitigation (it is pre-detection surveillance; counting it would manufacture
a fake-green).
and after how much activity (Report the Synapse escalation curve per scenario, not a pass/fail boolean #38).
Explain why this graded unit is the honest one for a progressive WAF, and show
the curve as the primary result rather than a pass/fail table.
Acceptance criteria
is wrong for a progressive WAF.
scope, not apologetic caveats.
are re-runnable.
docs/(per repo documentation conventions) with a NAVIGATORentry; no machine-specific or transient content.
Related / blocked by
(reproducible harness). Capstone — depends on all three.