# PhishGuard-Env – OpenEnv Manifest
# Each task must declare a grader so the validator can verify scoring.
# Pattern mirrors FocusAI's openenv.yaml with per-difficulty graders + aggregate.
id: phishguard-env
name: "PhishGuard-Env — SOC Analyst Phishing Triage"
description: >
  A real-world RL environment where an AI agent acts as a SOC analyst
  triaging phishing, malware, BEC, spam, and safe emails.
  The agent must classify each email using a four-action triage system.
  Rewards are graded continuously in (0.0, 1.0).
  Scenario order is fixed via seed=42 for reproducibility.

entry_point: env:app

tasks:
  - id: easy
    name: easy_triage
    grader: "grader:grade_easy"
    description: >
      Basic triage — high confidence signals, clear threat indicators.
      Covers SPAM detection, basic PHISH blocking, and SAFE email verification.
      Scoring: 52% perfect triage + 35% completion. Target score: 0.80–0.99.

  - id: medium
    name: medium_triage
    grader: "grader:grade_medium"
    description: >
      Intermediate triage — mixed signals, some ambiguity.
      Covers MALWARE quarantine, HR safe emails, BEC wire fraud, shared-doc phishing.
      Scoring: 35% perfect + 27% on-time + 14% completion. Target score: 0.70–0.80.

  - id: hard
    name: hard_triage
    grader: "grader:grade_hard"
    description: >
      Advanced triage — low confidence signals, sophisticated attacks.
      Covers macro malware, QR-code phishing, BEC domain compromise.
      Scoring: 25% perfect + 18% on-time + 10% completion + 3% zero-breach bonus.
      Target score: 0.50–0.60.

  - id: performance
    name: aggregate_performance
    grader: "grader:grade_performance"
    description: >
      Cross-difficulty aggregate grader for leaderboard ranking.
      Provides a single unified score across all difficulty levels.
      Scoring: 38% perfect + 23% on-time + 9% completion + 3% zero-breach bonus.

observation_space:
  type: object
  fields:
    sender: string
    subject: string
    body: string
    links: list
    has_attachments: boolean
    spf_record: "string — pass | softfail | fail"
    dmarc_record: "string — pass | fail | none"
    urgency_level: "string — low | medium | high | critical"
    confidence_hint: string

action_space:
  type: string
  allowed_actions:
    - MARK_SAFE
    - MOVE_TO_SPAM
    - QUARANTINE
    - BLOCK_DOMAIN

reward:
  type: continuous
  range: [0.02, 0.95]
  description: >
    All rewards strictly inside open interval (0, 1).
    R_PERFECT=0.95, R_BREACH=0.02. Health drains on reward < 0.15.

scoring:
  description: >
    Each task's final score is STRICTLY inside the open interval (0, 1).
    Grader weights are calibrated for difficulty-progressive scoring:
      easy   → target 0.80–0.99  (max raw 0.87)
      medium → target 0.70–0.80  (max raw 0.76)
      hard   → target 0.50–0.60  (max raw 0.56)
    safe_score(raw) = 0.01 + 0.98 * clamp(raw, 0.0, 1.0)
  formula: "safe_score(raw) = 0.01 + 0.98 * clamp(raw, 0.0, 1.0)"

tags:
  - cybersecurity
  - openenv
  - phishing
  - soc