Add SLA policy drift support for ticketing system

- Add apply_policy_drift() to TicketingSystem that modifies SLA rules
- Update AttackManager to route policy_drift to any system with the method
- Add TICKETING to VALID_TARGETS for policy_drift in RandomizedAttacker
- Add SLA-specific drift configs (e.g., high: 6->3, medium: 12->6)

sentinelops_arena/attacks.py

@@ -113,17 +113,22 @@ class AttackManager:
     def _execute_policy_drift(
         self, target: TargetSystem, params: Dict[str, Any], tick: int
     ) -> Dict[str, Any]:
-        """Modify refund policy fields on the billing system."""
+        """Modify policy fields on the target system (billing or ticketing)."""
         changes = params.get("changes", {})
         if not changes:
             return {"success": False, "error": "changes dict required"}
 
-        billing = self.systems[TargetSystem.BILLING]
-        billing.apply_policy_drift(changes)
+        system = self.systems[target]
+        if not hasattr(system, "apply_policy_drift"):
+            return {
+                "success": False,
+                "error": f"{target.value} does not support policy drift",
+            }
+        system.apply_policy_drift(changes)
         return {
             "success": True,
             "attack": "policy_drift",
-            "detail": f"Policy changed: {changes}",
+            "detail": f"Policy changed on {target.value}: {changes}",
         }
 
     def _execute_social_engineering(

sentinelops_arena/demo.py

@@ -130,7 +130,7 @@ class RandomizedAttacker:
         {"old_field": "notes", "new_field": "annotations"},
     ]
 
-    POLICY_DRIFT_CHANGES = [
+    POLICY_DRIFT_CHANGES_BILLING = [
         {"window_ticks": 4, "requires_approval": True, "max_amount": 2000},
         {"window_ticks": 2, "requires_approval": True, "max_amount": 500},
         {"window_ticks": 6, "requires_approval": False, "max_amount": 10000},
@@ -138,6 +138,14 @@ class RandomizedAttacker:
         {"window_ticks": 3, "requires_approval": False, "max_amount": 5000},
     ]
 
+    POLICY_DRIFT_CHANGES_TICKETING = [
+        {"high": 3, "medium": 6, "low": 10},
+        {"high": 2, "medium": 4, "low": 8},
+        {"high": 1, "medium": 3, "low": 6},
+        {"high": 8, "medium": 16, "low": 24},
+        {"high": 4, "medium": 8, "low": 12},
+    ]
+
     RATE_LIMIT_OPTIONS = [
         {"max_calls_per_tick": 1},
         {"max_calls_per_tick": 2},
@@ -158,7 +166,10 @@ class RandomizedAttacker:
                 **rename,
             }
         if atype == AttackType.POLICY_DRIFT:
-            changes = self.rng.choice(self.POLICY_DRIFT_CHANGES)
+            if target == TargetSystem.TICKETING:
+                changes = self.rng.choice(self.POLICY_DRIFT_CHANGES_TICKETING)
+            else:
+                changes = self.rng.choice(self.POLICY_DRIFT_CHANGES_BILLING)
             return {
                 "attack_type": atype.value,
                 "target_system": target.value,
@@ -182,7 +193,7 @@ class RandomizedAttacker:
     # Valid target systems per attack type (not all systems support all attacks)
     VALID_TARGETS = {
         AttackType.SCHEMA_DRIFT: [TargetSystem.CRM],  # only CRM has apply_schema_drift
-        AttackType.POLICY_DRIFT: [TargetSystem.BILLING],  # only Billing has apply_policy_drift
+        AttackType.POLICY_DRIFT: [TargetSystem.BILLING, TargetSystem.TICKETING],
         AttackType.SOCIAL_ENGINEERING: [TargetSystem.CRM, TargetSystem.BILLING, TargetSystem.TICKETING],
         AttackType.RATE_LIMIT: [TargetSystem.CRM, TargetSystem.BILLING, TargetSystem.TICKETING],
     }

sentinelops_arena/systems/ticketing.py

@@ -137,6 +137,12 @@ class TicketingSystem:
             "sla_rules": self.sla_rules.model_dump(),
         }
 
+    def apply_policy_drift(self, changes: Dict):
+        """Modify SLA rules fields (mirrors billing policy drift)."""
+        data = self.sla_rules.model_dump()
+        data.update(changes)
+        self.sla_rules = SLARules(**data)
+
     def apply_schema_drift(self, old_field: str, new_field: str):
         """Rename a field across all records."""
         self._field_map[old_field] = new_field