Update openenv.yaml

openenv.yaml

@@ -1,48 +1,122 @@
+# openenv.yaml – PhishGuard-Env
+# ================================
+# WHY THIS FILE WAS REWRITTEN
+# ----------------------------
+# The OpenEnv validator runs two checks:
+#
+#   Phase 1 (static, before any episode):
+#     Reads this file. Requires:
+#       • Top-level `id` field (environment identifier)
+#       • `entry_point` field (importable class path: module:ClassName)
+#       • `tasks` list with at least 3 entries, each with `id` and `grader`
+#       • `scoring` block describing the reward contract
+#
+#   Phase 2 (runtime, after running an episode):
+#     Calls /reset then /step repeatedly.
+#     Counts distinct `task_id` values returned in /step responses.
+#     Requires ≥ 3 distinct task IDs that match the `id` fields in `tasks`.
+#
+# Previous failure: tasks used level IDs (lv1–lv10) instead of semantic
+# category IDs, and the runtime /step returned those same level IDs.
+# The validator counted 10 IDs × 1 occurrence each — not ≥ 3 graded categories.
+#
+# Fix: tasks now use the five semantic IDs defined in grader.TASK_REGISTRY.
+# The runtime env.py resolves every scenario's email_type to its task_id via
+# grader.resolve_task_id(), so YAML and runtime are always in sync.
+
+id: phishguard-env
 name: "PhishGuard-Env"
-version: "1.0.0"
-description: "Phishing triage simulation for SOC Analysts."
+version: "2.0.0"
+description: >
+  A high-fidelity SOC analyst simulation environment for LLM benchmarking.
+  An AI agent triages 10 emails spanning 5 distinct threat categories,
+  managing a 3-life Health Bar while keeping rewards strictly in (0.0, 1.0).
 
-tasks:
-  - id: "lv1"
-    name: "basic_spam_detection"
-    grader: "grader.py"
+entry_point: "env:PhishGuardEnv"
 
-  - id: "lv2"
-    name: "phishing_detection"
-    grader: "grader.py"
+tasks:
+  - id: "task_spam"
+    name: "Spam Detection"
+    grader: "grader.grade_task_spam"
+    description: >
+      Identify unsolicited bulk/commercial mail and route it to spam
+      without over-escalating to a full domain block.
+      Scenarios: lv1 (prize lottery), lv2 (promotional bulk mail).
 
-  - id: "lv3"
-    name: "safe_email_identification"
-    grader: "grader.py"
+  - id: "task_phishing"
+    name: "Phishing Detection"
+    grader: "grader.grade_task_phishing"
+    description: >
+      Detect credential-harvesting and typosquat phishing attacks
+      and block the offending domain at the perimeter.
+      Scenarios: lv3 (googIe.com typosquat), lv4 (fake doc-share link).
 
-  - id: "lv4"
-    name: "malware_detection"
-    grader: "grader.py"
+  - id: "task_safe"
+    name: "Safe Email Identification"
+    grader: "grader.grade_task_safe"
+    description: >
+      Recognise legitimate internal and partner emails and pass them
+      through without causing business disruption (false-positive test).
+      Scenarios: lv5 (manager meeting), lv6 (HR portal link).
 
-  - id: "lv5"
-    name: "internal_safe_mail"
-    grader: "grader.py"
+  - id: "task_malware"
+    name: "Malware Delivery Detection"
+    grader: "grader.grade_task_malware"
+    description: >
+      Identify emails delivering executable payloads or macro-enabled
+      attachments and quarantine them for forensic analysis.
+      Scenarios: lv7 (PE binary dropper), lv8 (unsigned Excel macro).
 
-  - id: "lv6"
-    name: "business_email_compromise"
-    grader: "grader.py"
+  - id: "task_bec"
+    name: "Business Email Compromise Detection"
+    grader: "grader.grade_task_bec"
+    description: >
+      Detect BEC and supply-chain attacks, including adversarial cases
+      where SPF and DMARC authentication both pass on a compromised domain.
+      Scenarios: lv9 (wire-transfer BEC), lv10 (supply-chain partner).
 
-  - id: "lv7"
-    name: "document_phishing"
-    grader: "grader.py"
+observation_space:
+  type: object
+  fields:
+    sender:          { type: string,  description: "Full sender email address" }
+    subject:         { type: string,  description: "Email subject line" }
+    body:            { type: string,  description: "Plain-text email body" }
+    links:           { type: array,   items: string, description: "URLs in the email" }
+    has_attachments: { type: boolean, description: "True if attachments present" }
+    spf_record:      { type: string,  description: "SPF result: pass|fail|softfail|none" }
+    dmarc_record:    { type: string,  description: "DMARC result: pass|fail|none" }
+    urgency_level:   { type: string,  description: "low|medium|high|critical" }
+    confidence_hint: { type: string,  description: "Noisy SIEM/gateway signal (optional)" }
 
-  - id: "lv8"
-    name: "attachment_malware"
-    grader: "grader.py"
+action_space:
+  type: string
+  allowed:
+    - MARK_SAFE       # Confirmed legitimate — deliver to inbox
+    - MOVE_TO_SPAM    # Bulk/unsolicited — no active threat
+    - QUARANTINE      # Suspicious — hold for investigation
+    - BLOCK_DOMAIN    # Confirmed phishing/BEC — block at perimeter
 
-  - id: "lv9"
-    name: "qr_phishing"
-    grader: "grader.py"
+scoring:
+  description: >
+    Every reward is strictly inside the open interval (0.0, 1.0).
+    0 and 1 are never returned. Guaranteed by the safe_score() transform.
+  formula: "safe_score(raw) = 0.01 + 0.98 * raw,  raw in [0.0, 1.0]"
+  minimum: 0.01
+  maximum: 0.99
+  health_system:
+    max_health: 3
+    drain_threshold: 0.15
+    description: >
+      Rewards below 0.15 (Breach=0.030, Disruption=0.059, Wrong=0.108)
+      deduct one life. Episode ends when health reaches 0 or all 10
+      scenarios are completed.
 
-  - id: "lv10"
-    name: "supply_chain_attack"
-    grader: "grader.py"
+max_steps: 30
 
 tags:
-  - "cybersecurity"
-  - "openenv"
+  - cybersecurity
+  - phishing
+  - soc-analyst
+  - email-triage
+  - openenv
+  - reinforcement-learning