Honest battery: behavioral WAF scenario families

[NickCrew]

Thesis

Measure Synapse against attacks where the malice is real but not
signature-matchable per request — the literal moat a behavioral WAF claims
over a signature WAF (Coraza/ModSecurity). Each family below tests a distinct
behavioral capability; together they form the "honest battery." The result is a
matrix of graded outcomes, and a cell that reads "caught the low-and-slow
variant: no" is a feature of the report, not something to hide — it is an
honest limit on a genuinely hard problem.

The honesty constraints (what makes this battery "honest")

1. Single-source (Part One). No faked distribution. Family 1
   (distributed-correlation) is excluded from Part One and named as Part Two,
   because Crucible cannot yet honestly vary JA4 / network origin — it spoofs at
   L7 only (Add distributed multi-source origination and TLS fingerprint control to the scenario engine #36). We do not test a capability with an instrument that can't
   exercise it.
2. No self-labeling. Scenarios must not telegraph their attack class through
   step names, stage values, tags, or metadata. The test is whether Synapse
   correlates behavior, not whether it reads our labels. Contrast the current
   catalog: security-monitoring-evasion.json names a "stage": "diversion";
   advanced-sqli-campaign.json advertises "various evasion techniques" in its
   description. Both telegraph. The honest versions strip the labels.
3. Real payloads, real obfuscation. Where a family involves evasion, the
   obfuscation is actually applied to a real payload and must survive
   decode-and-normalize — not asserted in metadata. (There is no literal
   obfuscation:true field in the catalog; verified. The point is the payload is
   genuinely obfuscated, not flagged.)
4. Behavior-in-sequence. The attack lives in the sequence, the aggregate, or
   the timing — not in any single request a correct signature WAF should block.

How families are measured

Each family reports as a graded escalation curve (#38) over graded
mitigation outcomes (#37 — blocked / challenged / rate-limited, level-1
cookie excluded), run on the reproducible harness (atlas-crew/Bridge#3) so
results are re-runnable. Findings feed the deep-dive (#39).

Families (sub-issues)

• Family 1 — distributed credential-stuffing (Part Two, deferred). Clean
  per-request, guilty in aggregate. Blocked on Add distributed multi-source origination and TLS fingerprint control to the scenario engine #36.
• Family 2 — business-logic abuse through legitimate endpoints. Intent lives
  in sequence; no payload to match.
• Family 3 — parser-differential / genuine evasion. Single-request, real
  malice, encoded to defeat naive matching.
• Family 4 — the diversion. Loud noise as cover for one quiet surgical
  request; labels stripped.
• Family 5 — slow-burn / temporal. Composite-identity actor continuity
  stitched across sessions over a long window.

Dependencies

• Scoring: Engine scores Synapse challenge tier (JS PoW / CAPTCHA, HTTP 200) as a miss — fake-negative in battery report #37. Curve reporting: Report the Synapse escalation curve per scenario, not a pass/fail boolean #38. Harness: Add golden-path profile and reproducible harness for the Crucible-vs-Synapse battery Bridge#3.
  Instrument limit (gates Family 1): Add distributed multi-source origination and TLS fingerprint control to the scenario engine #36. Capstone writeup: Write the battery deep-dive: graded-response methodology + stated instrument limits #39.