Add src to deployment

Dockerfile

@@ -0,0 +1,34 @@
+# Dockerfile for xsecure — Incident Response RL Environment
+# Compatible with HF Spaces (port 7860) and local Docker
+
+FROM python:3.11-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        curl \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY models.py      .
+COPY client.py      .
+COPY graders.py     .
+COPY __init__.py    .
+COPY openenv.yaml   .
+COPY server/        server/
+
+ENV TASK_ID=1
+ENV HOST=0.0.0.0
+ENV PORT=7860
+ENV WORKERS=4
+ENV MAX_CONCURRENT_ENVS=100
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
+    CMD curl -f http://localhost:${PORT}/health || exit 1
+
+CMD uvicorn server.app:app \
+        --host $HOST \
+        --port $PORT \
+        --workers $WORKERS

README.md

@@ -1,12 +1,257 @@
+# 🛡️ Autonomous Incident Response & Threat Mitigation Environment
+
+> *An RL environment where agents investigate evolving cyber threats and take sequential actions to detect and mitigate attacks before system compromise.*
+
+[![OpenEnv](https://img.shields.io/badge/OpenEnv-compatible-blue)](https://github.com/meta-pytorch/OpenEnv)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/)
+[![License](https://img.shields.io/badge/License-Apache%202.0-green.svg)](https://opensource.org/licenses/Apache-2.0)
+
+---
+
+## 🧠 Overview
+
+This environment simulates a company's IT infrastructure under active cyber attack.
+The agent acts as an autonomous SOC (Security Operations Center) analyst: it receives partial system logs and alerts, must investigate the incident through targeted actions, and mitigate the attack before the attacker achieves their objective.
+
+Unlike log-classification tasks, this is a **multi-step sequential decision problem** where:
+- The environment state evolves (attack progresses if ignored)
+- The agent must *discover* hidden information through investigation before acting
+- Wrong mitigation actions have real costs (legitimate users disrupted)
+- Speed matters — faster resolution earns bonus reward
+
 ---
-title: Xsecure
-emoji: 😻
-colorFrom: indigo
-colorTo: red
-sdk: docker
-pinned: false
-license: apache-2.0
-short_description: Incident response AI agent by 6-7
+
+## 🔁 RL Loop
+
+```
+Observation (partial) → Action → Reward + New Observation → ... → Done
+```
+
+### Observation Space
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `logs` | `List[LogEntry]` | System log entries visible so far |
+| `alerts` | `List[AlertEntry]` | Security alerts (severity: low/medium/high) |
+| `services` | `List[ServiceStatus]` | Running services and their health |
+| `active_users` | `List[str]` | Currently active user accounts |
+| `step_count` | `int` | Current step number |
+| `last_action_result` | `str` | Human-readable result of last action |
+
+### Action Space
+
+| Action | Target | Description |
+|--------|--------|-------------|
+| `analyze_log` | `log_id` (e.g. `"L001"`) | Deep-dive into a log entry; may reveal new logs |
+| `trace_user` | `user_id` (e.g. `"carol"`) | Investigate user activity; may reveal anomalies |
+| `block_ip` | `ip_address` | Block a suspicious IP |
+| `disable_account` | `user_id` | Disable a compromised account |
+| `restart_service` | `service_name` | Restart a compromised or degraded service |
+| `ignore` | `""` | No action — attack escalates, penalty applied |
+
+### Reward Function
+
+| Event | Reward |
+|-------|--------|
+| Revealing new evidence (analyze_log / trace_user) | +0.20 |
+| Correctly identifying the threat actor | +0.30 |
+| Correct mitigation (block_ip / disable_account / restart_service) | +0.50 |
+| Fast resolution (< 40% of max steps) | +0.20 bonus |
+| Wrong action (wrong target) | −0.30 |
+| Ignoring the attack (each step) | −0.20 |
+| Full system compromise | −0.60 |
+
+Final episode score is normalised to **0.0 – 1.0** and reported in `info["final_score"]`.
+
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+## 🧩 Tasks
+
+### Task 1 — Brute Force Detection (Easy)
+A brute-force attack is underway against the authentication service.
+Multiple failed login attempts are visible immediately.
+**Expected flow:** analyze logs → confirm repeated failures from one IP → block that IP.
+
+- Max steps: 12
+- Required actions: `block_ip("192.168.1.47")`
+- Oracle score: ~0.97
+
+### Task 2 — Suspicious Login / Account Takeover (Medium)
+A legitimate-looking login occurred from a geographically impossible location.
+The agent must distinguish a compromised account from legitimate users and act before data is exfiltrated.
+
+- Max steps: 14
+- Required actions: `trace_user("carol")` → `disable_account("carol")`
+- Oracle score: ~0.97
+
+### Task 3 — Multi-Stage APT Kill Chain (Hard)
+A sophisticated attack chain: phishing → privilege escalation → lateral movement → data exfiltration.
+The agent must connect events across multiple logs, identify the compromised account, block the C2 IP, disable the account, and recover affected services.
+
+- Max steps: 18
+- Required actions: `block_ip("198.51.100.23")` + `disable_account("eve")` + `restart_service("database")` + `restart_service("prod-01")`
+- Oracle score: ~0.94
+
+---
+
+## 🚀 Setup & Usage
+
+### Option A — Local development with Uvicorn
+
+```bash
+git clone https://huggingface.co/spaces/your-username/incident-response-env
+cd incident-response-env
+
+pip install -r requirements.txt
+
+# Run Task 1
+TASK_ID=1 uvicorn server.app:app --host 0.0.0.0 --port 8000 --reload
+```
+
+### Option B — Docker
+
+```bash
+# Build
+docker build -t incident-response-env:latest .
+
+# Run Task 1
+docker run -d -p 8000:8000 -e TASK_ID=1 incident-response-env:latest
+
+# Run Task 3 with custom scaling
+docker run -d -p 8000:8000 \
+    -e TASK_ID=3 \
+    -e WORKERS=4 \
+    -e MAX_CONCURRENT_ENVS=100 \
+    incident-response-env:latest
+```
+
+### Option C — HF Spaces
+
+```bash
+# Already deployed — connect directly
+pip install git+https://huggingface.co/spaces/your-username/incident-response-env
+```
+
+---
+
+## 🐍 Python Usage
+
+### Async (recommended)
+
+```python
+import asyncio
+from client import IncidentResponseEnv
+from models import IncidentAction
+
+async def main():
+    async with IncidentResponseEnv(base_url="http://localhost:8000") as env:
+        # Task 1 — Brute Force
+        obs = await env.reset(task_id=1)
+        print(f"Logs: {[l.log_id for l in obs.logs]}")
+        print(f"Alerts: {[a.message for a in obs.alerts]}")
+
+        # Investigate
+        result = await env.step(IncidentAction(action_type="analyze_log", target="L001"))
+        print(f"reward={result.reward}  new_logs={[l.log_id for l in result.observation.logs]}")
+
+        # Mitigate
+        result = await env.step(IncidentAction(action_type="block_ip", target="192.168.1.47"))
+        print(f"done={result.done}  score={result.info.get('final_score')}")
+
+asyncio.run(main())
+```
+
+### Sync wrapper
+
+```python
+from client import IncidentResponseEnv
+from models import IncidentAction
+
+with IncidentResponseEnv(base_url="http://localhost:8000").sync() as env:
+    obs = env.reset(task_id=2)
+    result = env.step(IncidentAction(action_type="trace_user", target="carol"))
+    result = env.step(IncidentAction(action_type="disable_account", target="carol"))
+    print(f"Score: {result.info['final_score']}")
+```
+
+---
+
+## 📊 Baseline
+
+Run the LLM baseline against all tasks:
+
+```bash
+export OPENAI_API_KEY="sk-..."
+export ENV_URL="http://localhost:8000"
+
+python baseline.py
+```
+
+Expected output (gpt-4o-mini):
+
+```
+Task 1: mean_score=0.8700  success_rate=1.00
+Task 2: mean_score=0.7600  success_rate=0.67
+Task 3: mean_score=0.5200  success_rate=0.33
+Overall mean score: 0.7167
+```
+
+Results are written to `baseline_results.json`.
+
+---
+
+## 📋 Graders
+
+Run the oracle graders to verify environment correctness:
+
+```bash
+python graders.py --url http://localhost:8000
+```
+
+---
+
+## 🌐 API Endpoints
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/ws` | WebSocket | Persistent session (recommended) |
+| `/health` | GET | Health check |
+| `/reset` | POST | Reset environment (stateless HTTP) |
+| `/step` | POST | Execute action (stateless HTTP) |
+| `/state` | GET | Full internal state |
+| `/web` | GET | Interactive browser UI |
+| `/docs` | GET | OpenAPI documentation |
+
+---
+
+## 🏗 Project Structure
+
+```
+incident_response_env/
+├── models.py          # Typed Pydantic models (Action, Observation, State)
+├── tasks.py           # 3 task scenario definitions
+├── client.py          # Async + sync Python client
+├── graders.py         # Programmatic graders (0.0–1.0)
+├── baseline.py        # LLM baseline inference script
+├── server/
+│   ├── app.py         # FastAPI server (WebSocket + HTTP)
+│   └── environment.py # Core environment logic (reset/step/state)
+├── Dockerfile
+├── openenv.yaml
+├── pyproject.toml
+├── requirements.txt
+└── README.md
+```
+
+---
+
+## Why This Environment?
+
+Most RL environments for LLMs test single-step classification. This environment tests:
+
+- **Multi-step reasoning** — you can't block the right IP without first discovering it through logs
+- **Evidence-based decision making** — wrong mitigation actions are penalised
+- **Dynamic adversary** — the attack progresses if you're slow
+- **Trajectory-level reward** — the entire sequence of decisions matters
+
+These properties make it suitable for training and evaluating agents on realistic SOC workflows.

__init__.py

@@ -0,0 +1,33 @@
+"""
+xsecure — Autonomous Incident Response & Threat Mitigation Environment.
+OpenEnv-compatible package.
+
+Quick start
+-----------
+    from xsecure import IncidentResponseEnv, IncidentAction
+
+    async with IncidentResponseEnv(base_url="http://localhost:7860") as env:
+        obs = await env.reset(task_id=1)
+        result = await env.step(IncidentAction(action_type="analyze_log", target="L001"))
+
+    # Or let openenv-core manage Docker for you:
+    env = await IncidentResponseEnv.from_docker_image("xsecure:latest")
+"""
+
+from client import IncidentResponseEnv, StepResult          # noqa: F401
+from models import (                                          # noqa: F401
+    IncidentAction,
+    IncidentObservation,
+    IncidentState,
+    ActionType,
+)
+
+__version__ = "1.0.0"
+__all__ = [
+    "IncidentResponseEnv",
+    "StepResult",
+    "IncidentAction",
+    "IncidentObservation",
+    "IncidentState",
+    "ActionType",
+]

baseline.py

@@ -0,0 +1,260 @@
+"""
+Baseline inference script — uses OpenAI API client to run an LLM agent
+against all 3 tasks and produces reproducible scores.
+
+Usage
+-----
+    export OPENAI_API_KEY="sk-..."
+    export ENV_URL="http://localhost:8000"   # optional, defaults to localhost
+    python baseline.py
+
+The script prints per-task and aggregate scores, then writes results to
+baseline_results.json for reproducibility.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import re
+import sys
+from datetime import datetime
+from typing import Dict, List, Optional
+
+from openai import AsyncOpenAI
+
+from client import IncidentResponseEnv, StepResult
+from graders import GradeResult, grade
+from models import IncidentAction, IncidentObservation
+
+# ---------------------------------------------------------------------------
+# Configuration
+# ---------------------------------------------------------------------------
+
+OPENAI_API_KEY = os.getenv("OPENAI_API_KEY", "")
+ENV_URL        = os.getenv("ENV_URL", "http://localhost:8000")
+MODEL_NAME     = os.getenv("BASELINE_MODEL", "gpt-4o-mini")
+NUM_EPISODES   = int(os.getenv("NUM_EPISODES", "3"))
+
+if not OPENAI_API_KEY:
+    print("ERROR: OPENAI_API_KEY environment variable is not set.", file=sys.stderr)
+    sys.exit(1)
+
+client = AsyncOpenAI(api_key=OPENAI_API_KEY)
+
+# ---------------------------------------------------------------------------
+# System prompt
+# ---------------------------------------------------------------------------
+
+SYSTEM_PROMPT = """\
+You are an expert cybersecurity incident responder AI agent.
+You will be given the current state of a simulated company under cyber attack.
+Your goal is to investigate logs and alerts, identify the threat, and mitigate it before the system is compromised.
+
+## Available Actions (one per step):
+- analyze_log(log_id)      — Examine a specific log entry for more detail
+- trace_user(user_id)      — Investigate a user's activity history
+- block_ip(ip_address)     — Block a suspicious IP address
+- disable_account(user_id) — Disable a compromised user account
+- restart_service(service) — Restart a compromised or degraded service
+- ignore                   — Take no action (penalised — attack progresses!)
+
+## Response Format (STRICT — machine-parsed):
+You MUST respond ONLY with a JSON object like:
+{"action_type": "analyze_log", "target": "L001"}
+
+Valid action_type values: analyze_log, trace_user, block_ip, disable_account, restart_service, ignore
+
+## Strategy:
+1. First investigate (analyze_log, trace_user) to gather evidence.
+2. Then act decisively on confirmed threats (block_ip, disable_account, restart_service).
+3. Never block/disable unless you have strong evidence — wrong actions cost points.
+4. Speed matters — faster resolution earns a bonus.
+"""
+
+# ---------------------------------------------------------------------------
+# LLM-driven agent
+# ---------------------------------------------------------------------------
+
+def _format_observation(obs: IncidentObservation) -> str:
+    logs_txt    = "\n".join(f"  [{l.log_id}] {l.timestamp} — {l.message}" for l in obs.logs)
+    alerts_txt  = "\n".join(f"  [{a.severity.upper()}] {a.message}" for a in obs.alerts)
+    services_txt = "\n".join(f"  {s.name}: {s.status}" for s in obs.services)
+    users_txt   = ", ".join(obs.active_users)
+
+    return f"""\
+=== Incident Response Dashboard (Step {obs.step_count}) ===
+
+LOGS:
+{logs_txt}
+
+ALERTS:
+{alerts_txt}
+
+SERVICES:
+{services_txt}
+
+ACTIVE USERS: {users_txt}
+
+Last action result: {obs.last_action_result}
+"""
+
+
+def _parse_llm_response(text: str) -> IncidentAction:
+    """Extract JSON action from LLM output. Falls back to ignore on parse failure."""
+    # Try direct JSON parse
+    stripped = text.strip()
+    try:
+        data = json.loads(stripped)
+        return IncidentAction(**data)
+    except Exception:
+        pass
+
+    # Try extracting JSON from markdown code block
+    match = re.search(r"```(?:json)?\s*(\{.*?\})\s*```", stripped, re.DOTALL)
+    if match:
+        try:
+            data = json.loads(match.group(1))
+            return IncidentAction(**data)
+        except Exception:
+            pass
+
+    # Try finding raw JSON object in text
+    match = re.search(r"\{[^{}]+\}", stripped)
+    if match:
+        try:
+            data = json.loads(match.group(0))
+            return IncidentAction(**data)
+        except Exception:
+            pass
+
+    # Fallback
+    print(f"  [WARN] Could not parse LLM output: {text[:120]!r} — defaulting to ignore")
+    return IncidentAction(action_type="ignore", target="")
+
+
+async def _llm_agent_fn(
+    obs: IncidentObservation,
+    history: List[StepResult],
+    conversation: List[Dict],
+) -> IncidentAction:
+    """Call OpenAI API and return the next action."""
+    user_msg = _format_observation(obs)
+
+    conversation.append({"role": "user", "content": user_msg})
+
+    response = await client.chat.completions.create(
+        model=MODEL_NAME,
+        messages=[{"role": "system", "content": SYSTEM_PROMPT}] + conversation,
+        max_tokens=256,
+        temperature=0.0,  # deterministic for reproducibility
+    )
+
+    assistant_text = response.choices[0].message.content or ""
+    conversation.append({"role": "assistant", "content": assistant_text})
+
+    return _parse_llm_response(assistant_text)
+
+
+# ---------------------------------------------------------------------------
+# Episode runner
+# ---------------------------------------------------------------------------
+
+async def _run_llm_episode(task_id: int) -> GradeResult:
+    conversation: List[Dict] = []
+    last_result: Optional[StepResult] = None
+
+    async with IncidentResponseEnv(base_url=ENV_URL) as env:
+        obs = await env.reset(task_id=task_id)
+        history: List[StepResult] = []
+
+        for step in range(25):  # safety cap
+            action = await _llm_agent_fn(obs, history, conversation)
+            print(f"    step {step + 1:02d}: {action.action_type}({action.target!r})", end="")
+
+            result = await env.step(action)
+            print(f"  → reward={result.reward:+.2f}")
+
+            history.append(result)
+            last_result = result
+            obs = result.observation
+
+            if result.done:
+                break
+
+    info = last_result.info if last_result else {}
+    return GradeResult(
+        task_id=task_id,
+        score=float(info.get("final_score", 0.0)),
+        success=bool(info.get("success", False)),
+        compromise=bool(info.get("compromise", False)),
+        steps_taken=obs.step_count,
+        wrong_actions=int(info.get("wrong_actions", 0)),
+        notes=obs.last_action_result,
+    )
+
+
+# ---------------------------------------------------------------------------
+# Main
+# ---------------------------------------------------------------------------
+
+async def main():
+    print("=" * 65)
+    print(f"Incident Response Env — Baseline ({MODEL_NAME})")
+    print(f"Environment: {ENV_URL}")
+    print(f"Episodes per task: {NUM_EPISODES}")
+    print("=" * 65)
+
+    all_scores: List[float] = []
+    output: Dict = {
+        "model":        MODEL_NAME,
+        "env_url":      ENV_URL,
+        "timestamp":    datetime.utcnow().isoformat(),
+        "tasks":        {},
+    }
+
+    for task_id in [1, 2, 3]:
+        task_names = {
+            1: "Brute Force (Easy)",
+            2: "Suspicious Login (Medium)",
+            3: "Multi-Stage APT (Hard)",
+        }
+        print(f"\n--- Task {task_id}: {task_names[task_id]} ---")
+
+        episode_results = []
+        for ep in range(NUM_EPISODES):
+            print(f"  Episode {ep + 1}/{NUM_EPISODES}:")
+            result = await _run_llm_episode(task_id)
+            episode_results.append(result)
+            print(f"  → {result}")
+
+        scores = [r.score for r in episode_results]
+        mean   = sum(scores) / len(scores)
+        all_scores.extend(scores)
+
+        output["tasks"][str(task_id)] = {
+            "mean_score":   round(mean, 4),
+            "success_rate": round(sum(1 for r in episode_results if r.success) / NUM_EPISODES, 4),
+            "episodes":     [
+                {"score": r.score, "success": r.success, "steps": r.steps_taken}
+                for r in episode_results
+            ],
+        }
+        print(f"  Task {task_id} mean score: {mean:.4f}")
+
+    overall = sum(all_scores) / len(all_scores)
+    output["overall_mean_score"] = round(overall, 4)
+
+    print(f"\n{'=' * 65}")
+    print(f"Overall mean score: {overall:.4f}")
+    print("=" * 65)
+
+    out_path = "baseline_results.json"
+    with open(out_path, "w") as f:
+        json.dump(output, f, indent=2)
+    print(f"\nResults saved to {out_path}")
+
+
+if __name__ == "__main__":
+    asyncio.run(main())

client.py

@@ -0,0 +1,93 @@
+"""
+client.py — xsecure environment client.
+Extends openenv-core's HTTPEnvClient — WebSocket, sync wrapper,
+from_hub() and from_docker_image() all come for free.
+
+Usage (async):
+    async with IncidentResponseEnv(base_url="http://localhost:7860") as env:
+        obs = await env.reset(task_id=1)
+        result = await env.step(IncidentAction(action_type="analyze_log", target="L001"))
+
+Usage (sync):
+    with IncidentResponseEnv(base_url="http://localhost:7860").sync() as env:
+        obs = env.reset(task_id=1)
+        result = env.step(IncidentAction(action_type="analyze_log", target="L001"))
+
+Usage (Docker — auto-pulls and runs):
+    env = await IncidentResponseEnv.from_docker_image("xsecure:latest")
+    async with env:
+        obs = await env.reset(task_id=1)
+"""
+
+from __future__ import annotations
+
+from dataclasses import asdict
+from typing import Any, Dict
+
+try:
+    from openenv_core.http_env_client import HTTPEnvClient
+    from openenv_core.types import StepResult
+except ImportError:
+    from core.http_env_client import HTTPEnvClient
+    from core.types import StepResult
+
+from models import IncidentAction, IncidentObservation, IncidentState
+
+
+class IncidentResponseEnv(HTTPEnvClient[IncidentAction, IncidentObservation]):
+    """
+    Client for the xsecure Incident Response environment.
+    Inherits reset(), step(), state(), sync(), from_hub(), from_docker_image()
+    from openenv-core's HTTPEnvClient.
+    """
+
+    def _step_payload(self, action: IncidentAction) -> Dict[str, Any]:
+        """Serialize action to JSON dict for the HTTP /step endpoint."""
+        return {
+            "action_type": action.action_type,
+            "target":      action.target,
+        }
+
+    def _parse_result(self, payload: Dict[str, Any]) -> StepResult:
+        """Deserialize HTTP response into a typed StepResult."""
+        obs_data = payload.get("observation", {})
+
+        # Re-hydrate nested dataclass lists
+        from models import LogEntry, AlertEntry, ServiceStatus
+        logs     = [LogEntry(**l)     for l in obs_data.get("logs", [])]
+        alerts   = [AlertEntry(**a)   for a in obs_data.get("alerts", [])]
+        services = [ServiceStatus(**s) for s in obs_data.get("services", [])]
+
+        obs = IncidentObservation(
+            logs=logs,
+            alerts=alerts,
+            services=services,
+            active_users=obs_data.get("active_users", []),
+            step_count=obs_data.get("step_count", 0),
+            reward=obs_data.get("reward", 0.0),
+            done=obs_data.get("done", False),
+            info=obs_data.get("info", {}),
+            last_action_result=obs_data.get("last_action_result", ""),
+        )
+
+        return StepResult(
+            observation=obs,
+            reward=payload.get("reward", 0.0),
+            done=payload.get("done", False),
+            info=payload.get("info", {}),
+        )
+
+    def _parse_state(self, payload: Dict[str, Any]) -> IncidentState:
+        """Deserialize /state response into IncidentState."""
+        data = payload.get("state", payload)
+        return IncidentState(**{
+            k: v for k, v in data.items()
+            if k in IncidentState.__dataclass_fields__
+        })
+
+
+# ---------------------------------------------------------------------------
+# Backward-compatible StepResult re-export
+# ---------------------------------------------------------------------------
+
+__all__ = ["IncidentResponseEnv", "StepResult"]

environment.py

@@ -0,0 +1,393 @@
+"""
+server/environment.py — xsecure incident response simulation.
+Extends openenv-core Environment base class correctly.
+"""
+
+from __future__ import annotations
+
+import uuid
+from typing import Any, Dict, List, Optional
+
+try:
+    from openenv_core.env_server import Environment
+except ImportError:
+    from core.env_server import Environment
+
+from models import (
+    ActionType,
+    IncidentAction,
+    IncidentObservation,
+    IncidentState,
+)
+
+# ---------------------------------------------------------------------------
+# Task definitions
+# ---------------------------------------------------------------------------
+
+TASKS: Dict[int, dict] = {
+    1: {
+        "attack_type":    "brute_force",
+        "attacker_ip":    "192.168.1.47",
+        "target_user":    "admin",
+        "target_service": "auth-service",
+        "max_steps":      12,
+        "logs": [
+            {"log_id": "L001", "message": "Multiple failed login attempts from 192.168.1.47 (47 attempts in 60s)", "timestamp": "2024-01-15T08:01:00Z"},
+            {"log_id": "L002", "message": "Account lockout triggered for user admin after failed logins from 192.168.1.47", "timestamp": "2024-01-15T08:01:45Z"},
+            {"log_id": "L003", "message": "Successful login from 192.168.1.47 after lockout bypass", "timestamp": "2024-01-15T08:03:10Z"},
+        ],
+        "alerts": [
+            {"alert_id": "A001", "message": "Brute force pattern detected — 47 failed logins in 60 seconds", "severity": "high"},
+            {"alert_id": "A002", "message": "Account lockout bypass attempt detected", "severity": "high"},
+        ],
+        "services": [
+            {"name": "auth-service", "status": "degraded"},
+            {"name": "web-app",      "status": "running"},
+            {"name": "database",     "status": "running"},
+        ],
+        "active_users": ["admin", "alice", "bob"],
+        "correct_sequence": {
+            "analyze_log:L001":       0.15,
+            "analyze_log:L002":       0.15,
+            "block_ip:192.168.1.47":  0.50,
+        },
+        "wrong_penalty":          -0.15,
+        "delay_penalty":           0.05,
+        "speed_bonus_threshold":   6,
+        "speed_bonus":             0.20,
+        "compromise_steps":        8,
+    },
+    2: {
+        "attack_type":    "suspicious_login",
+        "attacker_ip":    "203.0.113.55",
+        "target_user":    "carol",
+        "target_service": "hr-portal",
+        "max_steps":      14,
+        "logs": [
+            {"log_id": "L001", "message": "Login for carol from unusual geo-location (203.0.113.55 — Eastern Europe)", "timestamp": "2024-01-15T14:22:00Z"},
+            {"log_id": "L002", "message": "carol accessed sensitive HR records 3 minutes after login", "timestamp": "2024-01-15T14:25:10Z"},
+            {"log_id": "L003", "message": "carol attempted to export 1,200 employee records", "timestamp": "2024-01-15T14:27:33Z"},
+        ],
+        "alerts": [
+            {"alert_id": "A001", "message": "Login from unusual location for carol", "severity": "medium"},
+            {"alert_id": "A002", "message": "Unusual data access pattern — bulk HR record access", "severity": "high"},
+        ],
+        "services": [
+            {"name": "hr-portal",    "status": "running"},
+            {"name": "auth-service", "status": "running"},
+            {"name": "database",     "status": "running"},
+        ],
+        "active_users": ["carol", "dave", "alice"],
+        "correct_sequence": {
+            "analyze_log:L001":      0.10,
+            "analyze_log:L002":      0.10,
+            "trace_user:carol":      0.20,
+            "disable_account:carol": 0.45,
+        },
+        "wrong_penalty":         -0.15,
+        "delay_penalty":          0.05,
+        "speed_bonus_threshold":  7,
+        "speed_bonus":            0.15,
+        "compromise_steps":       10,
+    },
+    3: {
+        "attack_type":    "multi_stage",
+        "attacker_ip":    "198.51.100.23",
+        "target_user":    "eve",
+        "target_service": "database",
+        "max_steps":      18,
+        "logs": [
+            {"log_id": "L001", "message": "Phishing email link clicked by eve — redirect to 198.51.100.23", "timestamp": "2024-01-15T09:00:00Z"},
+            {"log_id": "L002", "message": "Credential theft tool executed on eve's workstation", "timestamp": "2024-01-15T09:15:22Z"},
+            {"log_id": "L003", "message": "eve authenticated to database server outside normal hours", "timestamp": "2024-01-15T09:22:45Z"},
+            {"log_id": "L004", "message": "Lateral movement: eve's credentials used on prod-01 and database", "timestamp": "2024-01-15T09:30:11Z"},
+            {"log_id": "L005", "message": "Ransomware staging detected on database — encryption not yet started", "timestamp": "2024-01-15T09:45:00Z"},
+        ],
+        "alerts": [
+            {"alert_id": "A001", "message": "Phishing link accessed — possible credential compromise for eve", "severity": "medium"},
+            {"alert_id": "A002", "message": "Credential harvesting tool detected", "severity": "high"},
+            {"alert_id": "A003", "message": "Lateral movement across prod-01 and database", "severity": "high"},
+        ],
+        "services": [
+            {"name": "database", "status": "degraded"},
+            {"name": "prod-01",  "status": "degraded"},
+            {"name": "web-app",  "status": "running"},
+        ],
+        "active_users": ["eve", "frank", "grace"],
+        "correct_sequence": {
+            "analyze_log:L001":         0.08,
+            "analyze_log:L002":         0.08,
+            "analyze_log:L004":         0.08,
+            "trace_user:eve":           0.12,
+            "block_ip:198.51.100.23":   0.20,
+            "disable_account:eve":      0.20,
+            "restart_service:database": 0.12,
+            "restart_service:prod-01":  0.12,
+        },
+        "wrong_penalty":         -0.10,
+        "delay_penalty":          0.04,
+        "speed_bonus_threshold":  10,
+        "speed_bonus":            0.10,
+        "compromise_steps":       12,
+    },
+}
+
+
+# ---------------------------------------------------------------------------
+# Environment
+# ---------------------------------------------------------------------------
+
+class IncidentEnvironment(Environment):
+
+    SUPPORTS_CONCURRENT_SESSIONS = True
+
+    def __init__(self):
+        super().__init__()
+        self._state: Optional[IncidentState] = None
+        self._task_def: Optional[dict] = None
+
+    # ---- openenv-core interface -----------------------------------------
+
+    def reset(
+        self,
+        seed: Optional[int] = None,
+        episode_id: Optional[str] = None,
+        **kwargs: Any,
+    ) -> IncidentObservation:
+        task_id = int(kwargs.get("task_id", 1))
+        if task_id not in TASKS:
+            task_id = 1
+
+        td = TASKS[task_id]
+        self._task_def = td
+        self._state = IncidentState(
+            episode_id=episode_id or str(uuid.uuid4()),
+            task_id=task_id,
+            step_count=0,
+            max_steps=td["max_steps"],
+            attack_type=td["attack_type"],
+            attacker_ip=td["attacker_ip"],
+            target_user=td["target_user"],
+            target_service=td["target_service"],
+        )
+        return self._build_observation("Episode started. Investigate the alerts and logs.")
+
+    def step(
+        self,
+        action: IncidentAction,
+        timeout_s: Optional[float] = None,
+        **kwargs: Any,
+    ) -> IncidentObservation:
+        if self._state is None:
+            raise RuntimeError("Call reset() before step().")
+
+        state = self._state
+        td    = self._task_def
+
+        if state.done:
+            return self._build_observation("Episode already finished.", reward=0.0)
+
+        state.step_count += 1
+        action_key = f"{action.action_type}:{action.target}"
+        reward     = 0.0
+        result_msg = ""
+
+        # Delay penalty every step
+        reward -= td["delay_penalty"]
+
+        atype = action.action_type
+
+        if atype == ActionType.ANALYZE_LOG:
+            r, result_msg = self._handle_analyze_log(action.target, action_key)
+            reward += r
+        elif atype == ActionType.TRACE_USER:
+            r, result_msg = self._handle_trace_user(action.target, action_key)
+            reward += r
+        elif atype == ActionType.BLOCK_IP:
+            r, result_msg = self._handle_block_ip(action.target, action_key)
+            reward += r
+        elif atype == ActionType.DISABLE_ACCOUNT:
+            r, result_msg = self._handle_disable_account(action.target, action_key)
+            reward += r
+        elif atype == ActionType.RESTART_SERVICE:
+            r, result_msg = self._handle_restart_service(action.target, action_key)
+            reward += r
+        elif atype == ActionType.IGNORE:
+            state.progress_level = min(state.progress_level + 1, state.max_progress)
+            reward -= 0.10
+            result_msg = "No action taken. Attack progresses!"
+        else:
+            state.wrong_actions += 1
+            reward += td["wrong_penalty"]
+            result_msg = f"Unknown action: {atype}"
+
+        reward = round(reward, 4)
+        state.total_reward += reward
+
+        done, info = self._check_termination()
+        if done:
+            state.done = True
+
+        return self._build_observation(result_msg, reward=reward, done=done, info=info)
+
+    @property
+    def state(self) -> IncidentState:
+        if self._state is None:
+            raise RuntimeError("Call reset() first.")
+        return self._state
+
+    # ---- Action handlers -----------------------------------------------
+
+    def _handle_analyze_log(self, target: str, key: str):
+        state = self._state
+        td    = self._task_def
+        log_ids = [l["log_id"] for l in td["logs"]]
+
+        if target not in log_ids:
+            state.wrong_actions += 1
+            return td["wrong_penalty"], f"Log {target} does not exist."
+        if target in state.revealed_logs:
+            return -0.05, f"Log {target} already analyzed."
+
+        state.revealed_logs.append(target)
+        if key in td["correct_sequence"]:
+            state.correct_detections += 1
+            msg = next(l["message"] for l in td["logs"] if l["log_id"] == target)
+            return td["correct_sequence"][key], f"[ANALYSIS] {target}: {msg}"
+        return 0.05, f"Log {target} analyzed — no significant findings."
+
+    def _handle_trace_user(self, target: str, key: str):
+        state = self._state
+        td    = self._task_def
+
+        if target not in td["active_users"]:
+            state.wrong_actions += 1
+            return td["wrong_penalty"], f"User {target!r} not found."
+        if target in state.revealed_users:
+            return -0.05, f"User {target} already traced."
+
+        state.revealed_users.append(target)
+        if key in td["correct_sequence"]:
+            state.correct_detections += 1
+            return td["correct_sequence"][key], f"[TRACE] {target}: Confirmed suspicious activity."
+        return 0.05, f"User {target} traced — activity appears normal."
+
+    def _handle_block_ip(self, target: str, key: str):
+        state = self._state
+        td    = self._task_def
+
+        if target in state.blocked_ips:
+            return -0.05, f"IP {target} already blocked."
+        state.blocked_ips.append(target)
+
+        if key in td["correct_sequence"]:
+            state.correct_detections += 1
+            multiplier = 1.0 if state.correct_detections > 1 else 0.6
+            return td["correct_sequence"][key] * multiplier, f"[BLOCKED] IP {target} blocked."
+        state.wrong_actions += 1
+        return td["wrong_penalty"], f"Blocking {target} was incorrect."
+
+    def _handle_disable_account(self, target: str, key: str):
+        state = self._state
+        td    = self._task_def
+
+        if target in state.disabled_accounts:
+            return -0.05, f"Account {target} already disabled."
+        state.disabled_accounts.append(target)
+
+        if key in td["correct_sequence"]:
+            state.correct_detections += 1
+            multiplier = 1.0 if state.correct_detections > 1 else 0.6
+            return td["correct_sequence"][key] * multiplier, f"[DISABLED] Account {target} disabled."
+        state.wrong_actions += 1
+        return td["wrong_penalty"], f"Disabling {target} was incorrect."
+
+    def _handle_restart_service(self, target: str, key: str):
+        state = self._state
+        td    = self._task_def
+
+        valid = [s["name"] for s in td["services"]]
+        if target not in valid:
+            state.wrong_actions += 1
+            return td["wrong_penalty"], f"Service {target!r} not found."
+        if target in state.restarted_services:
+            return -0.05, f"Service {target} already restarted."
+
+        state.restarted_services.append(target)
+        if key in td["correct_sequence"]:
+            state.correct_detections += 1
+            return td["correct_sequence"][key], f"[RESTARTED] Service {target} restored."
+        state.wrong_actions += 1
+        return td["wrong_penalty"], f"Restarting {target} was not necessary."
+
+    # ---- Termination ---------------------------------------------------
+
+    def _check_termination(self):
+        state = self._state
+        td    = self._task_def
+        seq   = td["correct_sequence"]
+
+        all_done = all(self._action_completed(k) for k in seq)
+
+        speed_bonus = 0.0
+        if all_done and state.step_count <= td["speed_bonus_threshold"]:
+            speed_bonus = td["speed_bonus"]
+            state.total_reward += speed_bonus
+
+        compromise = (
+            state.progress_level >= state.max_progress
+            or state.step_count >= td["compromise_steps"]
+        ) and not all_done
+
+        timeout = state.step_count >= state.max_steps
+        done    = all_done or compromise or timeout
+
+        if done:
+            state.success   = all_done and not compromise
+            state.compromise = compromise
+
+        max_possible = sum(seq.values()) + td["speed_bonus"]
+        final_score  = round(min(max(state.total_reward, 0.0) / max_possible, 1.0), 4) if max_possible > 0 else 0.0
+
+        info = {
+            "final_score":   final_score,
+            "success":       state.success,
+            "compromise":    state.compromise,
+            "wrong_actions": state.wrong_actions,
+            "speed_bonus":   speed_bonus,
+        } if done else {}
+
+        return done, info
+
+    def _action_completed(self, key: str) -> bool:
+        action_type, target = key.split(":", 1)
+        s = self._state
+        return {
+            "analyze_log":     target in s.revealed_logs,
+            "trace_user":      target in s.revealed_users,
+            "block_ip":        target in s.blocked_ips,
+            "disable_account": target in s.disabled_accounts,
+            "restart_service": target in s.restarted_services,
+        }.get(action_type, False)
+
+    # ---- Observation builder -------------------------------------------
+
+    def _build_observation(
+        self,
+        result_msg: str,
+        reward: float = 0.0,
+        done: bool = False,
+        info: dict = None,
+    ) -> IncidentObservation:
+        td = self._task_def
+        return IncidentObservation(
+            logs=td["logs"],
+            alerts=td["alerts"],
+            services=td["services"],
+            active_users=td["active_users"],
+            step_count=self._state.step_count,
+            reward=reward,
+            done=done,
+            info=info or {},
+            last_action_result=result_msg,
+        )

graders.py

@@ -0,0 +1,181 @@
+"""
+graders.py — Agent graders for the xsecure Incident Response environment.
+Each grader runs a full episode and returns a normalised score 0.0–1.0.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from typing import Callable, Dict, List, Optional
+
+from client import IncidentResponseEnv, StepResult
+from models import IncidentAction, IncidentObservation
+
+
+# ---------------------------------------------------------------------------
+# Grader result
+# ---------------------------------------------------------------------------
+
+class GradeResult:
+    def __init__(
+        self,
+        task_id:       int,
+        score:         float,
+        success:       bool,
+        compromise:    bool,
+        steps_taken:   int,
+        wrong_actions: int,
+        notes:         str = "",
+    ):
+        self.task_id       = task_id
+        self.score         = score
+        self.success       = success
+        self.compromise    = compromise
+        self.steps_taken   = steps_taken
+        self.wrong_actions = wrong_actions
+        self.notes         = notes
+
+    def __repr__(self):
+        status = "✅ SUCCESS" if self.success else ("❌ COMPROMISED" if self.compromise else "⏱ TIMEOUT")
+        return (
+            f"GradeResult(task={self.task_id}, score={self.score:.3f}, "
+            f"status={status}, steps={self.steps_taken}, wrong={self.wrong_actions})"
+        )
+
+
+# ---------------------------------------------------------------------------
+# Episode runner
+# ---------------------------------------------------------------------------
+
+async def _run_episode(
+    base_url:  str,
+    task_id:   int,
+    agent_fn:  Callable[[IncidentObservation, List[StepResult]], IncidentAction],
+    max_steps: int = 20,
+    seed:      Optional[int] = None,
+) -> GradeResult:
+    """Run one full episode driven by agent_fn."""
+    history: List[StepResult] = []
+    last_result: Optional[StepResult] = None
+
+    async with IncidentResponseEnv(base_url=base_url) as env:
+        obs = await env.reset(task_id=task_id)
+
+        for _ in range(max_steps):
+            action = agent_fn(obs, history)
+            result = await env.step(action)
+            history.append(result)
+            last_result = result
+            obs = result.observation
+
+            if result.done:
+                break
+
+    info = last_result.info if last_result else {}
+    return GradeResult(
+        task_id=task_id,
+        score=float(info.get("final_score", 0.0)),
+        success=bool(info.get("success", False)),
+        compromise=bool(info.get("compromise", False)),
+        steps_taken=obs.step_count,
+        wrong_actions=int(info.get("wrong_actions", 0)),
+        notes=obs.last_action_result,
+    )
+
+
+# ---------------------------------------------------------------------------
+# Public grade function
+# ---------------------------------------------------------------------------
+
+async def grade(
+    agent_fn:     Callable[[IncidentObservation, List[StepResult]], IncidentAction],
+    task_id:      int,
+    base_url:     str = "http://localhost:7860",
+    num_episodes: int = 3,
+) -> Dict:
+    """
+    Run num_episodes of task_id and return aggregate stats.
+
+    Returns
+    -------
+    dict with keys: task_id, mean_score, min_score, max_score, success_rate, episodes
+    """
+    results = []
+    for ep in range(num_episodes):
+        seed = ep * 1000 + task_id if num_episodes > 1 else None
+        r = await _run_episode(base_url, task_id, agent_fn, seed=seed)
+        results.append(r)
+
+    scores = [r.score for r in results]
+    return {
+        "task_id":      task_id,
+        "mean_score":   round(sum(scores) / len(scores), 4),
+        "min_score":    round(min(scores), 4),
+        "max_score":    round(max(scores), 4),
+        "success_rate": round(sum(1 for r in results if r.success) / len(results), 4),
+        "episodes":     [repr(r) for r in results],
+    }
+
+
+# ---------------------------------------------------------------------------
+# Oracle agents (deterministic, for reproducible baseline scores)
+# ---------------------------------------------------------------------------
+
+def _oracle_task1(obs: IncidentObservation, history: List[StepResult]) -> IncidentAction:
+    sequence = [
+        IncidentAction(action_type="analyze_log", target="L001"),
+        IncidentAction(action_type="analyze_log", target="L002"),
+        IncidentAction(action_type="block_ip",    target="192.168.1.47"),
+    ]
+    return sequence[obs.step_count] if obs.step_count < len(sequence) else IncidentAction(action_type="ignore")
+
+
+def _oracle_task2(obs: IncidentObservation, history: List[StepResult]) -> IncidentAction:
+    sequence = [
+        IncidentAction(action_type="analyze_log",     target="L001"),
+        IncidentAction(action_type="analyze_log",     target="L002"),
+        IncidentAction(action_type="trace_user",      target="carol"),
+        IncidentAction(action_type="disable_account", target="carol"),
+    ]
+    return sequence[obs.step_count] if obs.step_count < len(sequence) else IncidentAction(action_type="ignore")
+
+
+def _oracle_task3(obs: IncidentObservation, history: List[StepResult]) -> IncidentAction:
+    sequence = [
+        IncidentAction(action_type="analyze_log",     target="L001"),
+        IncidentAction(action_type="analyze_log",     target="L002"),
+        IncidentAction(action_type="analyze_log",     target="L004"),
+        IncidentAction(action_type="trace_user",      target="eve"),
+        IncidentAction(action_type="block_ip",        target="198.51.100.23"),
+        IncidentAction(action_type="disable_account", target="eve"),
+        IncidentAction(action_type="restart_service", target="database"),
+        IncidentAction(action_type="restart_service", target="prod-01"),
+    ]
+    return sequence[obs.step_count] if obs.step_count < len(sequence) else IncidentAction(action_type="ignore")
+
+
+ORACLE_AGENTS = {1: _oracle_task1, 2: _oracle_task2, 3: _oracle_task3}
+
+
+# ---------------------------------------------------------------------------
+# CLI — grade all oracle agents
+# ---------------------------------------------------------------------------
+
+async def _grade_all(base_url: str):
+    print("=" * 60)
+    print("xsecure — Grading Oracle Agents")
+    print("=" * 60)
+    for task_id in [1, 2, 3]:
+        result = await grade(ORACLE_AGENTS[task_id], task_id, base_url, num_episodes=3)
+        print(f"\nTask {task_id}: mean_score={result['mean_score']:.4f}  "
+              f"success_rate={result['success_rate']:.2%}")
+        for ep in result["episodes"]:
+            print(f"  {ep}")
+
+
+if __name__ == "__main__":
+    import argparse
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--url", default="http://localhost:7860")
+    args = parser.parse_args()
+    asyncio.run(_grade_all(args.url))

inference.py

@@ -0,0 +1,200 @@
+"""
+inference.py — OpenEnv-compliant inference script for xsecure.
+
+Required env vars (set in .env for local dev, HF Secrets for production):
+    HF_TOKEN       Hugging Face / API key
+    API_BASE_URL   LLM endpoint
+    MODEL_NAME     Model identifier
+
+STDOUT FORMAT (machine-parsed by evaluator):
+    [START] task=<name> env=xsecure model=<model>
+    [STEP]  step=<n> action=<str> reward=<0.00> done=<true|false> error=<msg|null>
+    [END]   success=<true|false> steps=<n> score=<0.000> rewards=<r1,r2,...>
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import re
+import sys
+from typing import Dict, List, Optional
+
+from dotenv import load_dotenv
+from openai import OpenAI
+
+from client import IncidentResponseEnv, StepResult
+from models import IncidentAction, IncidentObservation
+
+# Load .env for local dev (no-op when running on HF Spaces with Secrets)
+load_dotenv()
+
+# ---------------------------------------------------------------------------
+# Configuration — all from environment variables
+# ---------------------------------------------------------------------------
+
+API_KEY      = os.getenv("HF_TOKEN") or os.getenv("API_KEY", "")
+API_BASE_URL = os.getenv("API_BASE_URL", "https://router.huggingface.co/v1")
+MODEL_NAME   = os.getenv("MODEL_NAME", "Qwen/Qwen2.5-72B-Instruct")
+ENV_URL      = os.getenv("ENV_URL", "http://localhost:7860")
+BENCHMARK    = "xsecure"
+MAX_STEPS    = 20
+
+if not API_KEY:
+    print("ERROR: HF_TOKEN is not set.", file=sys.stderr)
+    sys.exit(1)
+
+llm = OpenAI(base_url=API_BASE_URL, api_key=API_KEY)
+
+# ---------------------------------------------------------------------------
+# Mandatory stdout loggers
+# ---------------------------------------------------------------------------
+
+def log_start(task: str, env: str, model: str) -> None:
+    print(f"[START] task={task} env={env} model={model}", flush=True)
+
+def log_step(step: int, action: str, reward: float, done: bool, error: Optional[str]) -> None:
+    print(
+        f"[STEP] step={step} action={action} reward={reward:.2f} "
+        f"done={str(done).lower()} error={error or 'null'}",
+        flush=True,
+    )
+
+def log_end(success: bool, steps: int, score: float, rewards: List[float]) -> None:
+    print(
+        f"[END] success={str(success).lower()} steps={steps} score={score:.3f} "
+        f"rewards={','.join(f'{r:.2f}' for r in rewards)}",
+        flush=True,
+    )
+
+# ---------------------------------------------------------------------------
+# System prompt
+# ---------------------------------------------------------------------------
+
+SYSTEM_PROMPT = """\
+You are an expert cybersecurity incident responder AI agent.
+You will be given the current state of a simulated company under cyber attack.
+Your goal is to investigate logs and alerts, identify the threat, and mitigate it.
+
+## Available Actions (one per step):
+- analyze_log(log_id)      — Examine a specific log entry
+- trace_user(user_id)      — Investigate a user's activity history
+- block_ip(ip_address)     — Block a suspicious IP address
+- disable_account(user_id) — Disable a compromised user account
+- restart_service(service) — Restart a compromised service
+- ignore                   — Take no action (penalised!)
+
+## Response Format (STRICT — machine-parsed):
+{"action_type": "analyze_log", "target": "L001"}
+
+## Strategy:
+1. Investigate first (analyze_log, trace_user) to gather evidence.
+2. Act decisively once you have evidence (block_ip, disable_account, restart_service).
+3. Never block/disable without evidence — wrong actions cost points.
+4. Speed matters — faster resolution earns a bonus.
+"""
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+def _format_observation(obs: IncidentObservation) -> str:
+    logs_txt     = "\n".join(f"  [{l.log_id}] {l.timestamp} — {l.message}" for l in obs.logs)
+    alerts_txt   = "\n".join(f"  [{a.severity.upper()}] {a.message}" for a in obs.alerts)
+    services_txt = "\n".join(f"  {s.name}: {s.status}" for s in obs.services)
+    return (
+        f"=== Incident Dashboard (Step {obs.step_count}) ===\n\n"
+        f"LOGS:\n{logs_txt}\n\n"
+        f"ALERTS:\n{alerts_txt}\n\n"
+        f"SERVICES:\n{services_txt}\n\n"
+        f"ACTIVE USERS: {', '.join(obs.active_users)}\n\n"
+        f"Last action result: {obs.last_action_result}"
+    )
+
+
+def _parse_action(text: str) -> IncidentAction:
+    for pattern in [
+        lambda t: json.loads(t.strip()),
+        lambda t: json.loads(re.search(r"```(?:json)?\s*(\{.*?\})\s*```", t, re.DOTALL).group(1)),
+        lambda t: json.loads(re.search(r"\{[^{}]+\}", t).group(0)),
+    ]:
+        try:
+            return IncidentAction(**pattern(text))
+        except Exception:
+            pass
+    return IncidentAction(action_type="ignore", target="")
+
+
+def _get_action(conversation: List[Dict], obs: IncidentObservation) -> IncidentAction:
+    conversation.append({"role": "user", "content": _format_observation(obs)})
+    response = llm.chat.completions.create(
+        model=MODEL_NAME,
+        messages=[{"role": "system", "content": SYSTEM_PROMPT}] + conversation,
+        max_tokens=256,
+        temperature=0.0,
+    )
+    text = response.choices[0].message.content or ""
+    conversation.append({"role": "assistant", "content": text})
+    return _parse_action(text)
+
+# ---------------------------------------------------------------------------
+# Episode runner
+# ---------------------------------------------------------------------------
+
+TASK_NAMES = {
+    1: "brute-force-easy",
+    2: "suspicious-login-medium",
+    3: "multi-stage-apt-hard",
+}
+
+async def run_episode(task_id: int) -> None:
+    task_name  = TASK_NAMES[task_id]
+    rewards:   List[float] = []
+    steps_taken = 0
+    success    = False
+    score      = 0.0
+    conversation: List[Dict] = []
+
+    log_start(task=task_name, env=BENCHMARK, model=MODEL_NAME)
+
+    try:
+        async with IncidentResponseEnv(base_url=ENV_URL) as env:
+            obs = await env.reset(task_id=task_id)
+
+            for step in range(1, MAX_STEPS + 1):
+                action = _get_action(conversation, obs)
+                result = await env.step(action)
+
+                rewards.append(result.reward)
+                steps_taken = step
+                obs = result.observation
+
+                log_step(
+                    step=step,
+                    action=f"{action.action_type}({action.target!r})",
+                    reward=result.reward,
+                    done=result.done,
+                    error=None,
+                )
+
+                if result.done:
+                    info  = result.info
+                    score = min(max(float(info.get("final_score", 0.0)), 0.0), 1.0)
+                    success = bool(info.get("success", False))
+                    break
+
+    finally:
+        log_end(success=success, steps=steps_taken, score=score, rewards=rewards)
+
+# ---------------------------------------------------------------------------
+# Main
+# ---------------------------------------------------------------------------
+
+async def main():
+    task_ids = [int(t) for t in os.getenv("TASK_IDS", "1,2,3").split(",")]
+    for task_id in task_ids:
+        await run_episode(task_id)
+
+if __name__ == "__main__":
+    asyncio.run(main())

models.py

@@ -0,0 +1,112 @@
+"""
+models.py — xsecure typed models.
+All classes extend openenv-core Pydantic base classes correctly.
+"""
+
+from __future__ import annotations
+
+from enum import Enum
+from typing import Any, Dict, List, Optional
+
+from pydantic import Field
+
+try:
+    from openenv_core.env_server import Action, Observation, State
+except ImportError:
+    from core.env_server import Action, Observation, State
+
+
+# ---------------------------------------------------------------------------
+# Action space
+# ---------------------------------------------------------------------------
+
+class ActionType(str, Enum):
+    ANALYZE_LOG     = "analyze_log"
+    TRACE_USER      = "trace_user"
+    BLOCK_IP        = "block_ip"
+    DISABLE_ACCOUNT = "disable_account"
+    RESTART_SERVICE = "restart_service"
+    IGNORE          = "ignore"
+
+
+class IncidentAction(Action):
+    """
+    One action the agent can take per step.
+    Inherits from openenv-core Action (Pydantic BaseModel, extra='forbid').
+    Note: 'metadata' field is inherited from Action base class.
+    """
+    action_type: str = Field(default="ignore", description="Action type to perform")
+    target:      str = Field(default="",       description="Target of the action")
+
+
+# ---------------------------------------------------------------------------
+# Observation sub-models — use State base (extra='allow') for flexibility
+# ---------------------------------------------------------------------------
+
+class LogEntry(State):
+    log_id:    str = ""
+    message:   str = ""
+    timestamp: str = ""
+
+
+class AlertEntry(State):
+    alert_id:  str = ""
+    message:   str = ""
+    severity:  str = "low"
+
+
+class ServiceStatus(State):
+    name:   str = ""
+    status: str = "running"
+
+
+# ---------------------------------------------------------------------------
+# Observation
+# ---------------------------------------------------------------------------
+
+class IncidentObservation(Observation):
+    """
+    Everything the agent sees at each step.
+    Inherits from openenv-core Observation (Pydantic BaseModel, extra='forbid').
+    Note: 'done', 'reward', 'metadata' are inherited from Observation.
+    """
+    logs:               List[Dict[str, Any]] = Field(default_factory=list)
+    alerts:             List[Dict[str, Any]] = Field(default_factory=list)
+    services:           List[Dict[str, Any]] = Field(default_factory=list)
+    active_users:       List[str]            = Field(default_factory=list)
+    step_count:         int                  = 0
+    info:               Dict[str, Any]       = Field(default_factory=dict)
+    last_action_result: str                  = ""
+
+
+# ---------------------------------------------------------------------------
+# State — internal server state, never sent to agent directly
+# ---------------------------------------------------------------------------
+
+class IncidentState(State):
+    """
+    Full internal episode state.
+    Inherits from openenv-core State (Pydantic BaseModel, extra='allow').
+    All fields have defaults so IncidentState() works with no arguments.
+    """
+    task_id:            int        = 1
+    max_steps:          int        = 15
+    attack_type:        str        = "brute_force"
+    attacker_ip:        str        = ""
+    target_user:        str        = ""
+    target_service:     str        = "auth-service"
+    progress_level:     int        = 0
+    max_progress:       int        = 4
+    revealed_logs:      List[str]  = Field(default_factory=list)
+    revealed_users:     List[str]  = Field(default_factory=list)
+    blocked_ips:        List[str]  = Field(default_factory=list)
+    disabled_accounts:  List[str]  = Field(default_factory=list)
+    restarted_services: List[str]  = Field(default_factory=list)
+    correct_detections: int        = 0
+    wrong_actions:      int        = 0
+    total_reward:       float      = 0.0
+    success:            bool       = False
+    compromise:         bool       = False
+    stage:              int        = 1
+    phishing_done:      bool       = False
+    escalation_done:    bool       = False

openenv.yaml

@@ -0,0 +1,68 @@
+name: xsecure
+version: "1.0.0"
+description: >
+  Autonomous Incident Response & Threat Mitigation RL environment.
+  Agents investigate evolving cyber threats and take sequential actions
+  to detect and mitigate attacks before system compromise.
+  Supports 3 tasks of increasing difficulty.
+author: your-hf-username
+tags:
+  - openenv
+  - cybersecurity
+  - incident-response
+  - multi-step
+  - agentic
+
+server:
+  host: 0.0.0.0
+  port: 7860
+  workers: 4
+
+env:
+  TASK_ID: "1"
+  MAX_CONCURRENT_ENVS: "100"
+
+actions:
+  - name: analyze_log
+    description: "Analyze a specific log entry by ID (e.g. L001)"
+    params:
+      target: string
+  - name: trace_user
+    description: "Investigate a user's activity"
+    params:
+      target: string
+  - name: block_ip
+    description: "Block a suspicious IP address"
+    params:
+      target: string
+  - name: disable_account
+    description: "Disable a compromised user account"
+    params:
+      target: string
+  - name: restart_service
+    description: "Restart a degraded or compromised service"
+    params:
+      target: string
+  - name: ignore
+    description: "Take no action (penalised — attack progresses)"
+    params:
+      target: ""
+
+tasks:
+  - id: 1
+    name: "Brute Force Detection"
+    difficulty: easy
+    max_steps: 12
+    score_range: [0.0, 1.0]
+
+  - id: 2
+    name: "Suspicious Login — Account Takeover"
+    difficulty: medium
+    max_steps: 14
+    score_range: [0.0, 1.0]
+
+  - id: 3
+    name: "Multi-Stage APT Kill Chain"
+    difficulty: hard
+    max_steps: 18
+    score_range: [0.0, 1.0]

pyproject.toml

@@ -0,0 +1,36 @@
+[build-system]
+requires      = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name        = "xsecure"
+version     = "1.0.0"
+description = "Autonomous Incident Response & Threat Mitigation — OpenEnv RL environment."
+readme      = "README.md"
+requires-python = ">=3.10"
+license     = { text = "Apache-2.0" }
+keywords    = ["reinforcement-learning", "cybersecurity", "openenv", "incident-response"]
+
+dependencies = [
+    "fastapi>=0.111.0",
+    "uvicorn[standard]>=0.30.0",
+    "websockets>=12.0",
+    "pydantic>=2.0.0",
+    "httpx>=0.27.0",
+    "openai>=1.30.0",
+    "python-dotenv>=1.0.0",
+    "openenv-core>=0.2.0",
+]
+
+[project.scripts]
+server = "server.app:main"
+
+[tool.hatch.build.targets.wheel]
+packages = ["."]
+
+[tool.uv]
+dev-dependencies = [
+    "pytest>=8.0",
+    "pytest-asyncio>=0.23",
+    "httpx>=0.27",
+]

requirements.txt

@@ -0,0 +1,8 @@
+fastapi>=0.111.0
+uvicorn[standard]>=0.30.0
+websockets>=12.0
+pydantic>=2.0.0
+httpx>=0.27.0
+openai>=1.30.0
+python-dotenv>=1.0.0
+openenv-core>=0.2.0

server/app.py

@@ -0,0 +1,25 @@
+from __future__ import annotations
+import os
+
+try:
+    from openenv_core.env_server import create_fastapi_app
+except ImportError:
+    from core.env_server import create_fastapi_app
+
+from .environment import IncidentEnvironment
+from models import IncidentAction, IncidentObservation
+
+# Pass the CLASS, not IncidentEnvironment()
+app = create_fastapi_app(IncidentEnvironment, IncidentAction, IncidentObservation)
+
+def main():
+    import uvicorn
+    uvicorn.run(
+        "server.app:app",
+        host=os.getenv("HOST", "0.0.0.0"),
+        port=int(os.getenv("PORT", "7860")),
+        workers=int(os.getenv("WORKERS", "4")),
+    )
+
+if __name__ == "__main__":
+    main()

server/environment.py

@@ -0,0 +1,393 @@
+"""
+server/environment.py — xsecure incident response simulation.
+Extends openenv-core Environment base class correctly.
+"""
+
+from __future__ import annotations
+
+import uuid
+from typing import Any, Dict, List, Optional
+
+try:
+    from openenv_core.env_server import Environment
+except ImportError:
+    from core.env_server import Environment
+
+from models import (
+    ActionType,
+    IncidentAction,
+    IncidentObservation,
+    IncidentState,
+)
+
+# ---------------------------------------------------------------------------
+# Task definitions
+# ---------------------------------------------------------------------------
+
+TASKS: Dict[int, dict] = {
+    1: {
+        "attack_type":    "brute_force",
+        "attacker_ip":    "192.168.1.47",
+        "target_user":    "admin",
+        "target_service": "auth-service",
+        "max_steps":      12,
+        "logs": [
+            {"log_id": "L001", "message": "Multiple failed login attempts from 192.168.1.47 (47 attempts in 60s)", "timestamp": "2024-01-15T08:01:00Z"},
+            {"log_id": "L002", "message": "Account lockout triggered for user admin after failed logins from 192.168.1.47", "timestamp": "2024-01-15T08:01:45Z"},
+            {"log_id": "L003", "message": "Successful login from 192.168.1.47 after lockout bypass", "timestamp": "2024-01-15T08:03:10Z"},
+        ],
+        "alerts": [
+            {"alert_id": "A001", "message": "Brute force pattern detected — 47 failed logins in 60 seconds", "severity": "high"},
+            {"alert_id": "A002", "message": "Account lockout bypass attempt detected", "severity": "high"},
+        ],
+        "services": [
+            {"name": "auth-service", "status": "degraded"},
+            {"name": "web-app",      "status": "running"},
+            {"name": "database",     "status": "running"},
+        ],
+        "active_users": ["admin", "alice", "bob"],
+        "correct_sequence": {
+            "analyze_log:L001":       0.15,
+            "analyze_log:L002":       0.15,
+            "block_ip:192.168.1.47":  0.50,
+        },
+        "wrong_penalty":          -0.15,
+        "delay_penalty":           0.05,
+        "speed_bonus_threshold":   6,
+        "speed_bonus":             0.20,
+        "compromise_steps":        8,
+    },
+    2: {
+        "attack_type":    "suspicious_login",
+        "attacker_ip":    "203.0.113.55",
+        "target_user":    "carol",
+        "target_service": "hr-portal",
+        "max_steps":      14,
+        "logs": [
+            {"log_id": "L001", "message": "Login for carol from unusual geo-location (203.0.113.55 — Eastern Europe)", "timestamp": "2024-01-15T14:22:00Z"},
+            {"log_id": "L002", "message": "carol accessed sensitive HR records 3 minutes after login", "timestamp": "2024-01-15T14:25:10Z"},
+            {"log_id": "L003", "message": "carol attempted to export 1,200 employee records", "timestamp": "2024-01-15T14:27:33Z"},
+        ],
+        "alerts": [
+            {"alert_id": "A001", "message": "Login from unusual location for carol", "severity": "medium"},
+            {"alert_id": "A002", "message": "Unusual data access pattern — bulk HR record access", "severity": "high"},
+        ],
+        "services": [
+            {"name": "hr-portal",    "status": "running"},
+            {"name": "auth-service", "status": "running"},
+            {"name": "database",     "status": "running"},
+        ],
+        "active_users": ["carol", "dave", "alice"],
+        "correct_sequence": {
+            "analyze_log:L001":      0.10,
+            "analyze_log:L002":      0.10,
+            "trace_user:carol":      0.20,
+            "disable_account:carol": 0.45,
+        },
+        "wrong_penalty":         -0.15,
+        "delay_penalty":          0.05,
+        "speed_bonus_threshold":  7,
+        "speed_bonus":            0.15,
+        "compromise_steps":       10,
+    },
+    3: {
+        "attack_type":    "multi_stage",
+        "attacker_ip":    "198.51.100.23",
+        "target_user":    "eve",
+        "target_service": "database",
+        "max_steps":      18,
+        "logs": [
+            {"log_id": "L001", "message": "Phishing email link clicked by eve — redirect to 198.51.100.23", "timestamp": "2024-01-15T09:00:00Z"},
+            {"log_id": "L002", "message": "Credential theft tool executed on eve's workstation", "timestamp": "2024-01-15T09:15:22Z"},
+            {"log_id": "L003", "message": "eve authenticated to database server outside normal hours", "timestamp": "2024-01-15T09:22:45Z"},
+            {"log_id": "L004", "message": "Lateral movement: eve's credentials used on prod-01 and database", "timestamp": "2024-01-15T09:30:11Z"},
+            {"log_id": "L005", "message": "Ransomware staging detected on database — encryption not yet started", "timestamp": "2024-01-15T09:45:00Z"},
+        ],
+        "alerts": [
+            {"alert_id": "A001", "message": "Phishing link accessed — possible credential compromise for eve", "severity": "medium"},
+            {"alert_id": "A002", "message": "Credential harvesting tool detected", "severity": "high"},
+            {"alert_id": "A003", "message": "Lateral movement across prod-01 and database", "severity": "high"},
+        ],
+        "services": [
+            {"name": "database", "status": "degraded"},
+            {"name": "prod-01",  "status": "degraded"},
+            {"name": "web-app",  "status": "running"},
+        ],
+        "active_users": ["eve", "frank", "grace"],
+        "correct_sequence": {
+            "analyze_log:L001":         0.08,
+            "analyze_log:L002":         0.08,
+            "analyze_log:L004":         0.08,
+            "trace_user:eve":           0.12,
+            "block_ip:198.51.100.23":   0.20,
+            "disable_account:eve":      0.20,
+            "restart_service:database": 0.12,
+            "restart_service:prod-01":  0.12,
+        },
+        "wrong_penalty":         -0.10,
+        "delay_penalty":          0.04,
+        "speed_bonus_threshold":  10,
+        "speed_bonus":            0.10,
+        "compromise_steps":       12,
+    },
+}
+
+
+# ---------------------------------------------------------------------------
+# Environment
+# ---------------------------------------------------------------------------
+
+class IncidentEnvironment(Environment):
+
+    SUPPORTS_CONCURRENT_SESSIONS = True
+
+    def __init__(self):
+        super().__init__()
+        self._state: Optional[IncidentState] = None
+        self._task_def: Optional[dict] = None
+
+    # ---- openenv-core interface -----------------------------------------
+
+    def reset(
+        self,
+        seed: Optional[int] = None,
+        episode_id: Optional[str] = None,
+        **kwargs: Any,
+    ) -> IncidentObservation:
+        task_id = int(kwargs.get("task_id", 1))
+        if task_id not in TASKS:
+            task_id = 1
+
+        td = TASKS[task_id]
+        self._task_def = td
+        self._state = IncidentState(
+            episode_id=episode_id or str(uuid.uuid4()),
+            task_id=task_id,
+            step_count=0,
+            max_steps=td["max_steps"],
+            attack_type=td["attack_type"],
+            attacker_ip=td["attacker_ip"],
+            target_user=td["target_user"],
+            target_service=td["target_service"],
+        )
+        return self._build_observation("Episode started. Investigate the alerts and logs.")
+
+    def step(
+        self,
+        action: IncidentAction,
+        timeout_s: Optional[float] = None,
+        **kwargs: Any,
+    ) -> IncidentObservation:
+        if self._state is None:
+            raise RuntimeError("Call reset() before step().")
+
+        state = self._state
+        td    = self._task_def
+
+        if state.done:
+            return self._build_observation("Episode already finished.", reward=0.0)
+
+        state.step_count += 1
+        action_key = f"{action.action_type}:{action.target}"
+        reward     = 0.0
+        result_msg = ""
+
+        # Delay penalty every step
+        reward -= td["delay_penalty"]
+
+        atype = action.action_type
+
+        if atype == ActionType.ANALYZE_LOG:
+            r, result_msg = self._handle_analyze_log(action.target, action_key)
+            reward += r
+        elif atype == ActionType.TRACE_USER:
+            r, result_msg = self._handle_trace_user(action.target, action_key)
+            reward += r
+        elif atype == ActionType.BLOCK_IP:
+            r, result_msg = self._handle_block_ip(action.target, action_key)
+            reward += r
+        elif atype == ActionType.DISABLE_ACCOUNT:
+            r, result_msg = self._handle_disable_account(action.target, action_key)
+            reward += r
+        elif atype == ActionType.RESTART_SERVICE:
+            r, result_msg = self._handle_restart_service(action.target, action_key)
+            reward += r
+        elif atype == ActionType.IGNORE:
+            state.progress_level = min(state.progress_level + 1, state.max_progress)
+            reward -= 0.10
+            result_msg = "No action taken. Attack progresses!"
+        else:
+            state.wrong_actions += 1
+            reward += td["wrong_penalty"]
+            result_msg = f"Unknown action: {atype}"
+
+        reward = round(reward, 4)
+        state.total_reward += reward
+
+        done, info = self._check_termination()
+        if done:
+            state.done = True
+
+        return self._build_observation(result_msg, reward=reward, done=done, info=info)
+
+    @property
+    def state(self) -> IncidentState:
+        if self._state is None:
+            raise RuntimeError("Call reset() first.")
+        return self._state
+
+    # ---- Action handlers -----------------------------------------------
+
+    def _handle_analyze_log(self, target: str, key: str):
+        state = self._state
+        td    = self._task_def
+        log_ids = [l["log_id"] for l in td["logs"]]
+
+        if target not in log_ids:
+            state.wrong_actions += 1
+            return td["wrong_penalty"], f"Log {target} does not exist."
+        if target in state.revealed_logs:
+            return -0.05, f"Log {target} already analyzed."
+
+        state.revealed_logs.append(target)
+        if key in td["correct_sequence"]:
+            state.correct_detections += 1
+            msg = next(l["message"] for l in td["logs"] if l["log_id"] == target)
+            return td["correct_sequence"][key], f"[ANALYSIS] {target}: {msg}"
+        return 0.05, f"Log {target} analyzed — no significant findings."
+
+    def _handle_trace_user(self, target: str, key: str):
+        state = self._state
+        td    = self._task_def
+
+        if target not in td["active_users"]:
+            state.wrong_actions += 1
+            return td["wrong_penalty"], f"User {target!r} not found."
+        if target in state.revealed_users:
+            return -0.05, f"User {target} already traced."
+
+        state.revealed_users.append(target)
+        if key in td["correct_sequence"]:
+            state.correct_detections += 1
+            return td["correct_sequence"][key], f"[TRACE] {target}: Confirmed suspicious activity."
+        return 0.05, f"User {target} traced — activity appears normal."
+
+    def _handle_block_ip(self, target: str, key: str):
+        state = self._state
+        td    = self._task_def
+
+        if target in state.blocked_ips:
+            return -0.05, f"IP {target} already blocked."
+        state.blocked_ips.append(target)
+
+        if key in td["correct_sequence"]:
+            state.correct_detections += 1
+            multiplier = 1.0 if state.correct_detections > 1 else 0.6
+            return td["correct_sequence"][key] * multiplier, f"[BLOCKED] IP {target} blocked."
+        state.wrong_actions += 1
+        return td["wrong_penalty"], f"Blocking {target} was incorrect."
+
+    def _handle_disable_account(self, target: str, key: str):
+        state = self._state
+        td    = self._task_def
+
+        if target in state.disabled_accounts:
+            return -0.05, f"Account {target} already disabled."
+        state.disabled_accounts.append(target)
+
+        if key in td["correct_sequence"]:
+            state.correct_detections += 1
+            multiplier = 1.0 if state.correct_detections > 1 else 0.6
+            return td["correct_sequence"][key] * multiplier, f"[DISABLED] Account {target} disabled."
+        state.wrong_actions += 1
+        return td["wrong_penalty"], f"Disabling {target} was incorrect."
+
+    def _handle_restart_service(self, target: str, key: str):
+        state = self._state
+        td    = self._task_def
+
+        valid = [s["name"] for s in td["services"]]
+        if target not in valid:
+            state.wrong_actions += 1
+            return td["wrong_penalty"], f"Service {target!r} not found."
+        if target in state.restarted_services:
+            return -0.05, f"Service {target} already restarted."
+
+        state.restarted_services.append(target)
+        if key in td["correct_sequence"]:
+            state.correct_detections += 1
+            return td["correct_sequence"][key], f"[RESTARTED] Service {target} restored."
+        state.wrong_actions += 1
+        return td["wrong_penalty"], f"Restarting {target} was not necessary."
+
+    # ---- Termination ---------------------------------------------------
+
+    def _check_termination(self):
+        state = self._state
+        td    = self._task_def
+        seq   = td["correct_sequence"]
+
+        all_done = all(self._action_completed(k) for k in seq)
+
+        speed_bonus = 0.0
+        if all_done and state.step_count <= td["speed_bonus_threshold"]:
+            speed_bonus = td["speed_bonus"]
+            state.total_reward += speed_bonus
+
+        compromise = (
+            state.progress_level >= state.max_progress
+            or state.step_count >= td["compromise_steps"]
+        ) and not all_done
+
+        timeout = state.step_count >= state.max_steps
+        done    = all_done or compromise or timeout
+
+        if done:
+            state.success   = all_done and not compromise
+            state.compromise = compromise
+
+        max_possible = sum(seq.values()) + td["speed_bonus"]
+        final_score  = round(min(max(state.total_reward, 0.0) / max_possible, 1.0), 4) if max_possible > 0 else 0.0
+
+        info = {
+            "final_score":   final_score,
+            "success":       state.success,
+            "compromise":    state.compromise,
+            "wrong_actions": state.wrong_actions,
+            "speed_bonus":   speed_bonus,
+        } if done else {}
+
+        return done, info
+
+    def _action_completed(self, key: str) -> bool:
+        action_type, target = key.split(":", 1)
+        s = self._state
+        return {
+            "analyze_log":     target in s.revealed_logs,
+            "trace_user":      target in s.revealed_users,
+            "block_ip":        target in s.blocked_ips,
+            "disable_account": target in s.disabled_accounts,
+            "restart_service": target in s.restarted_services,
+        }.get(action_type, False)
+
+    # ---- Observation builder -------------------------------------------
+
+    def _build_observation(
+        self,
+        result_msg: str,
+        reward: float = 0.0,
+        done: bool = False,
+        info: dict = None,
+    ) -> IncidentObservation:
+        td = self._task_def
+        return IncidentObservation(
+            logs=td["logs"],
+            alerts=td["alerts"],
+            services=td["services"],
+            active_users=td["active_users"],
+            step_count=self._state.step_count,
+            reward=reward,
+            done=done,
+            info=info or {},
+            last_action_result=result_msg,
+        )

tasks.py

@@ -0,0 +1,247 @@
+"""
+Task definitions for the Incident Response environment.
+Each task defines a concrete scenario (easy → medium → hard)
+with pre-seeded logs, alerts, hidden state, and success criteria.
+"""
+
+from __future__ import annotations
+
+import uuid
+from dataclasses import dataclass, field
+from typing import Dict, List
+
+
+@dataclass
+class TaskScenario:
+    task_id: int
+    name: str
+    description: str
+    attack_type: str
+    attacker_ip: str
+    target_user: str
+    target_service: str
+    max_progress: int
+    max_steps: int
+
+    # Visible at reset
+    initial_logs: List[Dict]
+    initial_alerts: List[Dict]
+    initial_services: List[Dict]
+    initial_active_users: List[str]
+
+    # Incremental logs revealed via analyze_log / trace_user
+    hidden_logs: Dict[str, List[Dict]]   # keyed by trigger_action
+    hidden_user_logs: Dict[str, List[Dict]]  # keyed by user_id
+
+    # Correct targets the agent must identify
+    correct_ips: List[str]
+    correct_users: List[str]
+    correct_services: List[str]
+
+    # Stage info for multi-stage attacks
+    stages: int = 1
+
+
+# ---------------------------------------------------------------------------
+# TASK 1 — Easy (Brute Force Attack)
+# ---------------------------------------------------------------------------
+
+TASK_1 = TaskScenario(
+    task_id=1,
+    name="Brute Force Detection",
+    description=(
+        "A brute-force attack is underway against the authentication service. "
+        "Multiple failed login attempts are visible in the logs. "
+        "Identify the attacker IP and block it before the admin account is compromised."
+    ),
+    attack_type="brute_force",
+    attacker_ip="192.168.1.47",
+    target_user="admin",
+    target_service="auth-service",
+    max_progress=3,
+    max_steps=12,
+
+    initial_logs=[
+        {"log_id": "L001", "message": "Failed login for user 'admin' from 192.168.1.47", "timestamp": "09:01:02"},
+        {"log_id": "L002", "message": "Failed login for user 'admin' from 192.168.1.47", "timestamp": "09:01:05"},
+        {"log_id": "L003", "message": "Normal request from 10.0.0.5", "timestamp": "09:01:08"},
+        {"log_id": "L004", "message": "Failed login for user 'admin' from 192.168.1.47", "timestamp": "09:01:11"},
+    ],
+    initial_alerts=[
+        {"alert_id": "A001", "message": "Multiple failed logins detected for 'admin'", "severity": "high"},
+    ],
+    initial_services=[
+        {"name": "auth-service",  "status": "running"},
+        {"name": "web-server",    "status": "running"},
+        {"name": "database",      "status": "running"},
+    ],
+    initial_active_users=["admin", "alice", "bob"],
+
+    hidden_logs={
+        "L001": [
+            {"log_id": "L005", "message": "192.168.1.47 tried 120 passwords in last 60 seconds", "timestamp": "09:01:15"},
+            {"log_id": "L006", "message": "Rate limit triggered for 192.168.1.47 (threshold exceeded)", "timestamp": "09:01:16"},
+        ],
+        "L002": [
+            {"log_id": "L007", "message": "Automated tool signature detected: hydra/1.0 user-agent from 192.168.1.47", "timestamp": "09:01:17"},
+        ],
+    },
+    hidden_user_logs={
+        "admin": [
+            {"log_id": "L008", "message": "Admin account has 0 successful logins in last 10 min (all blocked)", "timestamp": "09:01:20"},
+        ],
+    },
+
+    correct_ips=["192.168.1.47"],
+    correct_users=[],
+    correct_services=[],
+    stages=1,
+)
+
+
+# ---------------------------------------------------------------------------
+# TASK 2 — Medium (Suspicious Login / Account Takeover)
+# ---------------------------------------------------------------------------
+
+TASK_2 = TaskScenario(
+    task_id=2,
+    name="Suspicious Login — Account Takeover",
+    description=(
+        "A legitimate-looking login has occurred from an unusual geographic location. "
+        "Behavioral signals suggest account compromise. "
+        "Investigate the user's activity and disable the account if you confirm anomalous behavior "
+        "before data exfiltration occurs."
+    ),
+    attack_type="suspicious_login",
+    attacker_ip="203.0.113.88",
+    target_user="carol",
+    target_service="file-server",
+    max_progress=3,
+    max_steps=14,
+
+    initial_logs=[
+        {"log_id": "L001", "message": "Successful login for 'carol' from 203.0.113.88 (Singapore)", "timestamp": "14:22:01"},
+        {"log_id": "L002", "message": "carol accessed /finance/Q3_report.xlsx", "timestamp": "14:22:30"},
+        {"log_id": "L003", "message": "Normal request from alice at 10.0.0.8", "timestamp": "14:22:35"},
+        {"log_id": "L004", "message": "carol accessed /hr/salary_data.csv", "timestamp": "14:22:58"},
+    ],
+    initial_alerts=[
+        {"alert_id": "A001", "message": "Login from new geolocation for 'carol' (usual: India, now: Singapore)", "severity": "medium"},
+        {"alert_id": "A002", "message": "Unusual file access volume for 'carol'", "severity": "low"},
+    ],
+    initial_services=[
+        {"name": "file-server",   "status": "running"},
+        {"name": "auth-service",  "status": "running"},
+        {"name": "web-server",    "status": "running"},
+    ],
+    initial_active_users=["carol", "alice", "bob", "dave"],
+
+    hidden_logs={
+        "L001": [
+            {"log_id": "L005", "message": "carol's last login was 6 days ago from Hyderabad, India (10.5.1.2)", "timestamp": "14:23:00"},
+            {"log_id": "L006", "message": "Geo-distance between sessions: 4,200 km — impossible travel in 2 h", "timestamp": "14:23:01"},
+        ],
+        "L002": [
+            {"log_id": "L007", "message": "carol has downloaded 340 MB of files in 3 minutes (normal avg: 2 MB/session)", "timestamp": "14:23:10"},
+            {"log_id": "L008", "message": "carol attempted bulk-download of /finance/* directory", "timestamp": "14:23:15"},
+        ],
+        "L004": [
+            {"log_id": "L009", "message": "Exfil pattern detected: files zipped and queued to external SFTP 203.0.113.90", "timestamp": "14:23:20"},
+        ],
+    },
+    hidden_user_logs={
+        "carol": [
+            {"log_id": "L010", "message": "carol's password was reset via phishing link 4 h ago — MFA bypassed", "timestamp": "14:23:25"},
+            {"log_id": "L011", "message": "carol's account has API token generated from 203.0.113.88", "timestamp": "14:23:26"},
+        ],
+    },
+
+    correct_ips=[],
+    correct_users=["carol"],
+    correct_services=[],
+    stages=1,
+)
+
+
+# ---------------------------------------------------------------------------
+# TASK 3 — Hard (Multi-Stage Attack: Phishing → Escalation → Exfiltration)
+# ---------------------------------------------------------------------------
+
+TASK_3 = TaskScenario(
+    task_id=3,
+    name="Multi-Stage Attack — APT Kill Chain",
+    description=(
+        "A sophisticated multi-stage attack is in progress: "
+        "Stage 1: An attacker used phishing to steal credentials. "
+        "Stage 2: The compromised account is performing privilege escalation. "
+        "Stage 3: The attacker is moving laterally to access the database. "
+        "You must analyze logs, connect the events, identify the compromised account, "
+        "and take targeted actions to stop the attack chain before database exfiltration completes."
+    ),
+    attack_type="multi_stage",
+    attacker_ip="198.51.100.23",
+    target_user="eve",
+    target_service="database",
+    max_progress=4,
+    max_steps=18,
+
+    initial_logs=[
+        {"log_id": "L001", "message": "eve clicked a link in email from 'it-support@company-secure.net'", "timestamp": "10:05:00"},
+        {"log_id": "L002", "message": "Successful login for 'eve' from 198.51.100.23", "timestamp": "10:07:12"},
+        {"log_id": "L003", "message": "Normal build pipeline run by ci-bot", "timestamp": "10:08:00"},
+        {"log_id": "L004", "message": "eve modified /etc/sudoers on host prod-01", "timestamp": "10:09:44"},
+        {"log_id": "L005", "message": "Database query spike: 2,400 queries/min from prod-01 (normal: 120)", "timestamp": "10:11:00"},
+    ],
+    initial_alerts=[
+        {"alert_id": "A001", "message": "Phishing link clicked by 'eve' — domain flagged by threat intel", "severity": "high"},
+        {"alert_id": "A002", "message": "Privilege escalation attempt detected on prod-01", "severity": "high"},
+        {"alert_id": "A003", "message": "Abnormal database query rate from prod-01", "severity": "medium"},
+    ],
+    initial_services=[
+        {"name": "auth-service",  "status": "running"},
+        {"name": "web-server",    "status": "running"},
+        {"name": "database",      "status": "degraded"},
+        {"name": "prod-01",       "status": "running"},
+    ],
+    initial_active_users=["eve", "alice", "ci-bot", "frank", "grace"],
+
+    hidden_logs={
+        "L001": [
+            {"log_id": "L006", "message": "Phishing page at company-secure.net harvested eve's credentials + session token", "timestamp": "10:05:30"},
+            {"log_id": "L007", "message": "company-secure.net resolves to 198.51.100.23 (attacker-controlled)", "timestamp": "10:05:31"},
+        ],
+        "L002": [
+            {"log_id": "L008", "message": "Session from 198.51.100.23 is using stolen token (different device fingerprint)", "timestamp": "10:07:15"},
+            {"log_id": "L009", "message": "10 concurrent sessions opened from 198.51.100.23 within 30 s", "timestamp": "10:07:45"},
+        ],
+        "L004": [
+            {"log_id": "L010", "message": "sudoers modification grants root to eve on ALL hosts — lateral movement risk", "timestamp": "10:09:50"},
+            {"log_id": "L011", "message": "eve's sudo session on prod-01 installed reverse shell (python3 -c '...')", "timestamp": "10:10:00"},
+        ],
+        "L005": [
+            {"log_id": "L012", "message": "Queries from prod-01 selecting PII columns: SSN, credit_card, email", "timestamp": "10:11:10"},
+            {"log_id": "L013", "message": "Data staged at /tmp/.x/ — 1.2 GB; upload to 198.51.100.24 in progress", "timestamp": "10:11:20"},
+        ],
+    },
+    hidden_user_logs={
+        "eve": [
+            {"log_id": "L014", "message": "eve's account created 3 backdoor API keys in last 5 minutes", "timestamp": "10:10:30"},
+            {"log_id": "L015", "message": "eve added 198.51.100.23 to trusted-IPs whitelist (stealth persistence)", "timestamp": "10:10:35"},
+        ],
+        "ci-bot": [
+            {"log_id": "L016", "message": "ci-bot credentials were NOT compromised — red herring", "timestamp": "10:08:10"},
+        ],
+    },
+
+    correct_ips=["198.51.100.23"],
+    correct_users=["eve"],
+    correct_services=["database", "prod-01"],
+    stages=3,
+)
+
+
+ALL_TASKS: Dict[int, TaskScenario] = {
+    1: TASK_1,
+    2: TASK_2,
+    3: TASK_3,
+}