pki.sgit.ai / the bench / which agent is it? / the sources of truth

RiskMandate.ai · which agent is it?

The sources of truth

Every node in the mesh is a file, in a folder named for what it is, and every edge is typed by one ontology. The game, the graph and the report are compiled from these files with gates, so a correction is an edit: change the file, open a pull request, and the next build carries it. Nothing on the play screen is typed by hand.

228nodes, 469 typed edges
35reach nodes — reach is a node, not a rung
25questions: 15 identify, 10 measure
9profiles, 2 measured

How to correct a mapping

  1. Find the node. Every node on the mesh page and every row on a report carries source and edit links to the file behind it.
  2. Edit the file. A reach node's environments or obligations; a profile's refine map (which reach node a capability lands on for that profile) or a row's control; a question's class, reliability or expected answers. One file, one concern.
  3. Open a pull request. The build runs gen_mesh.py, gen_guess.py and gen_probes.py; an edge of an unknown type, an id that does not exist, or a profile the tree can no longer place from its own answers fails it, and the failure says why.
  4. Play it. Demo mode plays a profile's own modal answers end to end, so a change can be watched land.

The ontology

Node types, then edge types with their direction. The rule is the fractal test: a coarse node (a family, a capability) and a fine node (an exposure — a capability at one reach node) are the same shape and are traversed identically, by member-of.

node typemeanslives incount
vendorwho makes or provides the thingprobes/mesh/vendors/5
profilea named configuration of a product, listing its toolsprobes/profiles/<vendor>/<product>/9
toolone tool inside a profile; the unit of mapping, because two tools in one session reach different things(inside the profile file)17
familythe coarsest grouping of capabilities: filesystem, network, identity…probes/primitives.json (families)9
capabilityverb × object class × reach class, with reversibility — the coarse nodeprobes/primitives.json (capabilities)23
exposurea capability at one reach node — the fine node; the same verb and object at fs:user-home and at fs:container-layer are two exposures(derived from a profile's refine map)88
reachwhere a capability lands: a file system, a network, a credential store, a repository, a scheduler — a node with its own edges, not a rungprobes/mesh/reaches/35
envwhere things run: a desktop, a container, a CI runner, a browser, the vendor's cloudprobes/mesh/envs/8
obligationa control or article that governs a reach — reached by traversal, and never a compliance findingprobes/mesh/obligations/5
evidencea findings/v1 file: probe runs or an operator's account, dated, with a tierprobes/evidence/4
questionone question the game asks, with its class, reliability and the capability it asks aboutprobes/mesh/questions/25
edge typefrom → tomeanscount
made-byprofile → vendorthe profile is a configuration of this vendor's product9
runs-in['profile', 'reach'] → envruns in, or lives in, this environment77
provided-byenv → vendorthe environment is provided by this vendor (or by you)8
has-toolprofile → toolthe profile contains this tool17
reachestool → exposurethe tool can do this, here; attributes carry the control on the path, its tier, the evidence tier and a note113
atexposure → reachthe exposure lands on this reach node88
member-of['exposure', 'capability'] → ['capability', 'family']fine is a member of coarse; same shape either way111
governed-byreach → obligationan obligation that governs this reach — a question worth asking, at the weakest tier32
evidenced-bytool → evidencethe tool's rows are established by this evidence file4
asks-aboutquestion → capabilityan eliciting question is a prediction about this capability10
bounded-byexposure → obligationreserved: a control evidenced as the boundary on this exposure (not yet used)0

The folders

The ontology probes/mesh/ontology.json

node types and edge types; an edge of a type not here fails the build

Reach nodes probes/mesh/reaches/

where a capability lands — six file systems wearing one verb, and the rest; each with the environments it lives in and the obligations that govern it

Environments probes/mesh/envs/

where things run

Vendors probes/mesh/vendors/

who makes or provides

Obligations probes/mesh/obligations/

reached by traversal from a reach node; a question worth asking, never a finding

Questions probes/mesh/questions/

one file each: class, reliability, the capability it asks about, a p_yes per profile

Capabilities and families probes/primitives.json

the coarse nodes: verb × object × reach class + reversible

Profiles probes/profiles/<vendor>/<product>/<variant>.json

a configuration of a product: tools, rows, reach names, what it cannot reach, and the refine map (capability → reach node)

Evidence probes/evidence/

findings files, self-run or reported, dated and tiered

What is compiled from them

Generated by admin/build/gen_mesh.py. The layout follows brief v0.33.65 (reach is a node) and the project lead's 5 September memo: folders per kind of thing, every node linked to its source, corrections as edits. CC BY 4.0.