Major: Self-evolving RL engine + OpenAI-compatible API simplification

Self-Evolving Environment Engine (self_evolving/):
- α-Curriculum Reward from GenEnv: R_env(p̂) = -|p̂ - α|, targets zone of
proximal development (α≈0.5 success rate)
- POET-inspired mutation operators with adaptive σ (Gaussian mutation,
uniform crossover on scenario genomes)
- Fitness-proportionate selection with novelty search bonus
- Elo rating system for agent and scenario difficulty calibration
- Procedural scenario generator with 6 attack archetypes:
phishing, lateral movement, insider threat, ransomware, supply chain, APT
- ScenarioGenome: 15-parameter genetic representation with 5-dimensional
difficulty vector (evidence_obscurity, ioc_complexity, containment_complexity,
report_detail_required, time_pressure)
- Population-based evolution with elite preservation and archive

Environment Integration:
- task_id='evolved' activates self-evolving mode
- /env/evolve endpoint triggers population evolution
- /env/evolution-stats returns generation, Elo, difficulty range
- Performance auto-recorded after grading for fitness evaluation
- All 6 existing static tasks unchanged (mean baseline: 0.9442)

API Simplification:
- Replaced multi-provider auto-detection (OPENROUTER_API_KEY, ANTHROPIC_API_KEY,
LLM_API_KEY) with simple OpenAI-compatible pattern
- OPENAI_API_KEY + optional OPENAI_BASE_URL (defaults to api.openai.com/v1)
- Works with any OpenAI-compatible provider via --api-base flag

README.md

@@ -37,6 +37,26 @@ The agent receives a cybersecurity alert and must:
 - **Anti-loop penalties**: Repeated identical actions receive increasing penalties, encouraging diverse investigation strategies.
 - **Phase discipline**: Agents are rewarded for following proper IR workflow (investigate before classify, classify before contain) and penalized for phase violations.
 
+### Self-Evolving Environment (Unique Feature)
+
+This environment features a **self-evolving scenario generation engine** that creates an open-ended curriculum of cybersecurity incidents:
+
+- **α-Curriculum Reward**: Automatically generates scenarios in the agent's "zone of proximal development" (target success rate ~50%)
+- **POET-inspired Evolution**: Population of scenario genomes with mutation, crossover, and fitness-proportionate selection
+- **Novelty Search**: Diversity pressure ensures the environment explores the full space of possible incidents
+- **Elo Rating System**: Both agent and scenarios are rated, providing natural difficulty calibration
+- **Procedural Generation**: 6 attack archetypes (phishing, lateral movement, insider threat, ransomware, supply chain, APT) with parameterized complexity
+
+Use `task_id="evolved"` to activate self-evolving mode:
+```python
+# Activate self-evolving mode
+obs = env.reset(task_id="evolved")
+# ... run agent ...
+# Trigger evolution based on performance
+requests.post(f"{base_url}/env/evolve")
+stats = requests.get(f"{base_url}/env/evolution-stats").json()
+```
+
 ---
 
 ## Action / Observation Space
@@ -257,35 +277,30 @@ OPENAI_API_KEY=sk-... python baseline_inference.py --verbose
 
 ### Supported LLM Providers
 
-The baseline inference script works with **any OpenAI-compatible API**. Set the appropriate environment variable or use `--api-key` / `--api-base` flags:
+The baseline inference script works with **any OpenAI-compatible API**. Just set `OPENAI_API_KEY` and optionally `OPENAI_BASE_URL`:
 
 ```bash
-# OpenAI (default)
+# OpenAI (default — just set API key)
 OPENAI_API_KEY=sk-... python baseline_inference.py --model gpt-4o-mini
 
 # OpenRouter — access 200+ models (Gemini, Claude, Llama, Mistral, etc.)
-OPENROUTER_API_KEY=sk-or-... python baseline_inference.py --model google/gemini-2.5-flash
+OPENAI_API_KEY=sk-or-... OPENAI_BASE_URL=https://openrouter.ai/api/v1 python baseline_inference.py --model google/gemini-2.5-flash
 
 # Anthropic (OpenAI-compatible endpoint)
-ANTHROPIC_API_KEY=sk-ant-... python baseline_inference.py --model claude-sonnet-4-20250514
+OPENAI_API_KEY=sk-ant-... OPENAI_BASE_URL=https://api.anthropic.com/v1 python baseline_inference.py --model claude-sonnet-4-20250514
 
 # Local models via Ollama
 python baseline_inference.py --api-base http://localhost:11434/v1 --api-key dummy --model llama3
 
-# Any OpenAI-compatible provider
+# Any OpenAI-compatible provider (explicit flags)
 python baseline_inference.py --api-key YOUR_KEY --api-base https://your-provider/v1 --model your-model
-
-# Universal override (works with any provider)
-LLM_API_KEY=... LLM_API_BASE=https://provider/v1 python baseline_inference.py --model model-name
 ```
 
-**Environment variables** (auto-detected in order):
-| Variable | Provider | API Base |
-|----------|----------|----------|
-| `LLM_API_KEY` + `LLM_API_BASE` | Any | Custom |
-| `OPENROUTER_API_KEY` | OpenRouter | `https://openrouter.ai/api/v1` |
-| `ANTHROPIC_API_KEY` | Anthropic | `https://api.anthropic.com/v1` |
-| `OPENAI_API_KEY` | OpenAI | `https://api.openai.com/v1` |
+**Environment variables:**
+| Variable | Description |
+|----------|-------------|
+| `OPENAI_API_KEY` | API key (required) |
+| `OPENAI_BASE_URL` | API base URL (optional, defaults to `https://api.openai.com/v1`) |
 
 ### Docker
 
@@ -326,6 +341,8 @@ openenv push
 | `/tasks` | GET | List all 6 tasks with descriptions and action schema |
 | `/grader` | GET | Get grader score after episode completion |
 | `/baseline` | POST | Run deterministic baseline on all 6 tasks |
+| `/env/evolve` | POST | Trigger evolution of the scenario population |
+| `/env/evolution-stats` | GET | Get evolution engine statistics |
 
 ### Example Interaction
 
@@ -401,6 +418,10 @@ incident-response-env/
 │   ├── task_medium_ransomware.py  # Medium-Hard: Ransomware deployment
 │   ├── task_hard_supply_chain.py  # Hard-Plus: Supply chain compromise
 │   └── task_expert_apt_zeroday.py # Expert: APT with zero-day exploitation
+├── self_evolving/                 # Self-evolving scenario generation engine
+│   ├── __init__.py                # Package exports
+│   ├── evolution_engine.py        # α-Curriculum, POET mutations, Elo ratings
+│   └── scenario_generator.py     # Procedural scenario generation from genomes
 ├── client.py                      # EnvClient implementation
 ├── openenv.yaml                   # OpenEnv configuration
 ├── pyproject.toml                 # Python project metadata

baseline_inference.py

@@ -11,7 +11,7 @@ and produces reproducible baseline scores. It demonstrates how an AI agent
 interacts with the environment through the step/reset/state API.
 
 Supports ANY OpenAI-compatible LLM provider via the --api-base flag or
-auto-detection from environment variables.
+environment variables.
 
 Architecture:
     This agent implements a reasoning loop with state-goal reflection,
@@ -32,29 +32,21 @@ Architecture:
        in the prompt context to avoid wasting steps on duplicate actions.
 
 Usage:
-    # OpenAI (default):
+    # OpenAI (default — just set API key):
     OPENAI_API_KEY=sk-... python baseline_inference.py
 
-    # OpenRouter (auto-detected from env var):
-    OPENROUTER_API_KEY=sk-or-... python baseline_inference.py --model google/gemini-2.5-flash
+    # Any OpenAI-compatible provider (set base URL):
+    OPENAI_API_KEY=sk-or-... OPENAI_BASE_URL=https://openrouter.ai/api/v1 python baseline_inference.py --model google/gemini-2.5-flash
 
-    # Anthropic (OpenAI-compatible endpoint):
-    ANTHROPIC_API_KEY=sk-ant-... python baseline_inference.py --model claude-sonnet-4-20250514
-
-    # Any provider via explicit flags:
-    python baseline_inference.py --api-key KEY --api-base https://my-provider/v1 --model my-model
+    # Explicit flags:
+    python baseline_inference.py --api-key KEY --api-base https://provider/v1 --model my-model
 
     # Local models (Ollama, vLLM, etc.):
     python baseline_inference.py --api-base http://localhost:11434/v1 --api-key dummy --model llama3
 
-    # Run against a remote HF Space:
-    OPENAI_API_KEY=sk-... python baseline_inference.py --base-url https://huggingface.co/spaces/your-user/incident-response-env
-
-Environment Variables (checked in order):
-    LLM_API_KEY + LLM_API_BASE : Universal override for any provider
-    OPENROUTER_API_KEY          : OpenRouter (https://openrouter.ai/api/v1)
-    ANTHROPIC_API_KEY            : Anthropic (https://api.anthropic.com/v1)
-    OPENAI_API_KEY               : OpenAI (https://api.openai.com/v1) [default]
+Environment Variables:
+    OPENAI_API_KEY    : API key (required)
+    OPENAI_BASE_URL   : API base URL (optional, defaults to https://api.openai.com/v1)
 
 Output:
     Prints scores for each task and aggregate results.
@@ -752,61 +744,48 @@ def run_llm_agent(
 
 
 # =============================================================================
-# Provider Auto-Detection
+# Configuration — OpenAI-Compatible API
 # =============================================================================
-
-# Known provider configurations: (env_var_key, api_base_url, provider_name)
-PROVIDER_CONFIGS: List[Tuple[str, str, str]] = [
-    ("LLM_API_KEY",        os.environ.get("LLM_API_BASE", ""), "Custom"),
-    ("OPENROUTER_API_KEY", "https://openrouter.ai/api/v1",     "OpenRouter"),
-    ("ANTHROPIC_API_KEY",  "https://api.anthropic.com/v1",      "Anthropic"),
-    ("OPENAI_API_KEY",     "https://api.openai.com/v1",         "OpenAI"),
-]
+# Simple: provide an API key + optional base URL.
+# If only API key given → defaults to OpenAI (https://api.openai.com/v1)
+# If base URL also given → uses that provider (OpenRouter, Anthropic, local, etc.)
 
 
 def resolve_llm_config(
     cli_api_key: Optional[str] = None,
     cli_api_base: Optional[str] = None,
-) -> Tuple[str, str, str]:
+) -> Tuple[str, str]:
     """
-    Resolve LLM API key, base URL, and provider name.
+    Resolve LLM API key and base URL.
 
     Priority:
-        1. Explicit CLI flags (--api-key, --api-base)
-        2. Auto-detect from environment variables
+        1. CLI flags (--api-key, --api-base)
+        2. Environment variables (OPENAI_API_KEY + OPENAI_BASE_URL)
 
-    Returns:
-        (api_key, api_base, provider_name)
+    If only an API key is given (no base URL), defaults to https://api.openai.com/v1
 
-    Raises:
-        SystemExit if no API key is found.
+    Returns:
+        (api_key, api_base)
     """
-    # 1. CLI flags take highest priority
-    if cli_api_key:
-        base = cli_api_base or "https://api.openai.com/v1"
-        return cli_api_key, base, "Custom" if cli_api_base else "OpenAI"
-
-    # 2. Auto-detect from environment variables
-    for env_key, default_base, provider in PROVIDER_CONFIGS:
-        key = os.environ.get(env_key)
-        if key:
-            base = cli_api_base or default_base
-            if not base:
-                # LLM_API_KEY without LLM_API_BASE — fall back to OpenAI
-                base = "https://api.openai.com/v1"
-            return key, base, provider
-
-    # No key found
-    print("ERROR: No LLM API key found.")
-    print()
-    print("Set one of these environment variables:")
-    print("  OPENAI_API_KEY       - for OpenAI models")
-    print("  OPENROUTER_API_KEY   - for OpenRouter (any model)")
-    print("  ANTHROPIC_API_KEY    - for Anthropic models")
-    print("  LLM_API_KEY          - for any provider (set LLM_API_BASE too)")
-    print()
-    print("Or pass explicitly: --api-key YOUR_KEY --api-base https://provider/v1")
-    sys.exit(1)
+    # 1. CLI flags
+    api_key = cli_api_key or os.environ.get("OPENAI_API_KEY", "")
+    api_base = cli_api_base or os.environ.get("OPENAI_BASE_URL", "https://api.openai.com/v1")
+
+    if not api_key:
+        print("ERROR: No API key found.")
+        print()
+        print("Provide an OpenAI-compatible API key:")
+        print("  OPENAI_API_KEY=sk-...  python baseline_inference.py")
+        print()
+        print("For other providers, also set the base URL:")
+        print("  OPENAI_API_KEY=sk-or-... OPENAI_BASE_URL=https://openrouter.ai/api/v1 python baseline_inference.py")
+        print("  OPENAI_API_KEY=sk-ant-... OPENAI_BASE_URL=https://api.anthropic.com/v1 python baseline_inference.py")
+        print()
+        print("Or pass explicitly:")
+        print("  python baseline_inference.py --api-key KEY --api-base https://provider/v1")
+        sys.exit(1)
+
+    return api_key, api_base
 
 
 def main():
@@ -849,17 +828,17 @@ def main():
     )
     args = parser.parse_args()
 
-    # Resolve LLM provider
-    api_key, api_base, provider_name = resolve_llm_config(
+    # Resolve LLM provider (OpenAI-compatible)
+    api_key, api_base = resolve_llm_config(
         cli_api_key=args.api_key,
         cli_api_base=args.api_base,
     )
 
     client = OpenAI(api_key=api_key, base_url=api_base)
 
-    # Build extra headers for providers that need them
+    # Build extra headers for OpenRouter if detected
     extra_headers: Optional[Dict[str, str]] = None
-    if provider_name == "OpenRouter" or "openrouter.ai" in api_base:
+    if "openrouter.ai" in api_base:
         extra_headers = {
             "HTTP-Referer": "https://github.com/incident-response-env",
             "X-Title": "Incident Response Triage Environment",
@@ -867,7 +846,7 @@ def main():
 
     print("=" * 60)
     print("Incident Response Triage - Baseline Inference")
-    print(f"Provider: {provider_name} ({api_base})")
+    print(f"API: {api_base}")
     print(f"Server: {args.base_url}")
     print(f"Model: {args.model}")
     print(f"Tasks: {args.tasks}")

self_evolving/__init__.py

@@ -0,0 +1,42 @@
+# Copyright (c) 2026 - OpenEnv Hackathon Submission
+# Incident Response Triage Environment - Self-Evolving Engine Package
+# BSD-3-Clause License
+
+"""
+Self-Evolving Scenario Generation Engine.
+
+Exports the core evolution engine classes and scenario generator
+for procedurally generating, mutating, and adapting cybersecurity
+scenarios based on agent performance.
+"""
+
+try:
+    from .evolution_engine import (
+        AgentPerformanceRecord,
+        EvolutionEngine,
+        EvolutionState,
+        FitnessEvaluator,
+        MutationOperator,
+        ScenarioGenome,
+    )
+    from .scenario_generator import ScenarioGenerator
+except ImportError:
+    from self_evolving.evolution_engine import (
+        AgentPerformanceRecord,
+        EvolutionEngine,
+        EvolutionState,
+        FitnessEvaluator,
+        MutationOperator,
+        ScenarioGenome,
+    )
+    from self_evolving.scenario_generator import ScenarioGenerator
+
+__all__ = [
+    "AgentPerformanceRecord",
+    "EvolutionEngine",
+    "EvolutionState",
+    "FitnessEvaluator",
+    "MutationOperator",
+    "ScenarioGenome",
+    "ScenarioGenerator",
+]

self_evolving/evolution_engine.py

@@ -0,0 +1,589 @@
+"""
+Self-Evolving Scenario Generation Engine
+
+Implements:
+1. α-Curriculum Reward (from GenEnv): R_env(p̂) = -|p̂ - α| where α≈0.5
+   Rewards environment for generating scenarios in agent's "zone of proximal development"
+2. POET-inspired mutation operators: parametric mutation of scenario attributes
+3. Fitness-proportionate selection with novelty bonus
+4. Difficulty calibration via Elo-like rating system
+
+Mathematical Framework:
+- Each scenario S has a difficulty vector d ∈ R^k (k dimensions of difficulty)
+- Agent competence vector c ∈ R^k estimated from performance history
+- α-Curriculum: optimal scenario difficulty where P(agent solves | S) ≈ α
+- Mutation: S' = mutate(S, σ) where σ is mutation strength adapted by fitness
+- Fitness: F(S) = -|success_rate(S) - α| + λ * novelty(S)
+- Novelty: measured as distance to k-nearest scenarios in behavior space
+"""
+
+import copy
+import hashlib
+import json
+import math
+import random
+from dataclasses import dataclass, field
+from typing import Any, Dict, List, Optional, Set, Tuple
+
+# IMPORTANT: Use relative imports that work both ways
+try:
+    from ..tasks.base import (
+        EndpointInfo, LogEntry, Scenario, ThreatIntelEntry, UserProfile
+    )
+    from ..models import ContainmentAction, Severity, ThreatCategory
+except ImportError:
+    import sys, os
+    _parent = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+    if _parent not in sys.path:
+        sys.path.insert(0, _parent)
+    from tasks.base import (
+        EndpointInfo, LogEntry, Scenario, ThreatIntelEntry, UserProfile
+    )
+    from models import ContainmentAction, Severity, ThreatCategory
+
+
+# ═══════════════════════════════════════════════════════════════════
+# Data Structures
+# ═══════════════════════════════════════════════════════════════════
+
+@dataclass
+class ScenarioGenome:
+    """
+    Genetic representation of a scenario for evolution.
+    Maps scenario parameters to a mutable genome vector.
+    """
+    # Core parameters (these get mutated)
+    num_log_entries: int = 12        # How many log entries (complexity)
+    num_critical_evidence: int = 5   # Critical evidence items to find
+    num_iocs: int = 4                # Number of IOCs
+    num_endpoints: int = 3           # Network endpoints
+    num_users: int = 2               # User profiles
+    num_threat_intel: int = 3        # Threat intel entries
+    num_containment_targets: int = 3 # Things to contain
+    max_steps: int = 25              # Steps allowed
+    noise_ratio: float = 0.3        # Ratio of noise/decoy evidence
+    correlation_depth: int = 2       # How many cross-source correlations
+    escalation_required: bool = True
+    multi_stage_attack: bool = False # Whether attack has multiple phases
+
+    # Difficulty dimensions (0.0 = easiest, 1.0 = hardest)
+    evidence_obscurity: float = 0.3   # How hidden is critical evidence
+    ioc_complexity: float = 0.3       # Sophistication of IOCs
+    containment_complexity: float = 0.3 # Number/precision of containment
+    report_detail_required: float = 0.3 # How detailed report must be
+    time_pressure: float = 0.3        # Steps vs required actions ratio
+
+    # Metadata
+    generation: int = 0
+    parent_id: Optional[str] = None
+    genome_id: str = ""
+
+    def __post_init__(self):
+        if not self.genome_id:
+            self.genome_id = hashlib.md5(
+                json.dumps(self.__dict__, default=str).encode()
+            ).hexdigest()[:12]
+
+    @property
+    def difficulty_vector(self) -> List[float]:
+        """k-dimensional difficulty vector."""
+        return [
+            self.evidence_obscurity,
+            self.ioc_complexity,
+            self.containment_complexity,
+            self.report_detail_required,
+            self.time_pressure,
+        ]
+
+    @property
+    def aggregate_difficulty(self) -> float:
+        """Single scalar difficulty score in [0, 1]."""
+        return sum(self.difficulty_vector) / len(self.difficulty_vector)
+
+
+@dataclass
+class AgentPerformanceRecord:
+    """Tracks agent performance for fitness evaluation."""
+    scenario_id: str
+    genome_id: str
+    score: float
+    steps_used: int
+    max_steps: int
+    evidence_found_ratio: float
+    iocs_found_ratio: float
+    correct_severity: bool
+    correct_category: bool
+    containment_score: float
+    report_quality: float
+    timestamp: float = 0.0
+
+
+@dataclass
+class EvolutionState:
+    """Persistent state of the evolution engine."""
+    generation: int = 0
+    population: List[ScenarioGenome] = field(default_factory=list)
+    archive: List[ScenarioGenome] = field(default_factory=list)  # Hall of fame
+    performance_history: List[AgentPerformanceRecord] = field(default_factory=list)
+    agent_elo: float = 1000.0  # Agent Elo rating
+    scenario_elos: Dict[str, float] = field(default_factory=dict)  # Per-scenario Elo
+
+
+# ═══════════════════════════════════════════════════════════════════
+# Mutation Operators
+# ═══════════════════════════════════════════════════════════════════
+
+class MutationOperator:
+    """
+    POET-inspired parametric mutation operators for scenario genomes.
+
+    Mutations are applied with adaptive strength σ based on the
+    α-curriculum signal: if scenarios are too easy, increase difficulty;
+    if too hard, decrease.
+    """
+
+    # Bounds for genome parameters
+    PARAM_BOUNDS = {
+        'num_log_entries': (6, 30),
+        'num_critical_evidence': (3, 12),
+        'num_iocs': (2, 10),
+        'num_endpoints': (2, 8),
+        'num_users': (1, 5),
+        'num_threat_intel': (2, 8),
+        'num_containment_targets': (2, 8),
+        'max_steps': (15, 40),
+        'noise_ratio': (0.0, 0.6),
+        'correlation_depth': (1, 5),
+        'evidence_obscurity': (0.0, 1.0),
+        'ioc_complexity': (0.0, 1.0),
+        'containment_complexity': (0.0, 1.0),
+        'report_detail_required': (0.0, 1.0),
+        'time_pressure': (0.0, 1.0),
+    }
+
+    @staticmethod
+    def mutate(genome: ScenarioGenome, sigma: float = 0.15) -> ScenarioGenome:
+        """
+        Apply Gaussian mutation to genome parameters.
+
+        σ (sigma) controls mutation strength:
+        - Higher σ → more exploration (when agent is in comfort zone)
+        - Lower σ → fine-tuning (when near optimal difficulty)
+        """
+        child = copy.deepcopy(genome)
+        child.generation = genome.generation + 1
+        child.parent_id = genome.genome_id
+
+        # Mutate numeric parameters with Gaussian noise
+        for param, (lo, hi) in MutationOperator.PARAM_BOUNDS.items():
+            current = getattr(child, param)
+            if isinstance(current, float):
+                noise = random.gauss(0, sigma * (hi - lo))
+                new_val = max(lo, min(hi, current + noise))
+                setattr(child, param, round(new_val, 3))
+            elif isinstance(current, int):
+                noise = random.gauss(0, sigma * (hi - lo))
+                new_val = max(lo, min(hi, round(current + noise)))
+                setattr(child, param, int(new_val))
+
+        # Flip boolean traits with small probability
+        if random.random() < 0.15 * sigma:
+            child.escalation_required = not child.escalation_required
+        if random.random() < 0.15 * sigma:
+            child.multi_stage_attack = not child.multi_stage_attack
+
+        # Regenerate ID
+        child.genome_id = hashlib.md5(
+            json.dumps(child.__dict__, default=str).encode()
+        ).hexdigest()[:12]
+
+        return child
+
+    @staticmethod
+    def crossover(parent_a: ScenarioGenome, parent_b: ScenarioGenome) -> ScenarioGenome:
+        """Uniform crossover between two parent genomes."""
+        child = copy.deepcopy(parent_a)
+        child.generation = max(parent_a.generation, parent_b.generation) + 1
+        child.parent_id = f"{parent_a.genome_id}x{parent_b.genome_id}"
+
+        for param in MutationOperator.PARAM_BOUNDS:
+            if random.random() < 0.5:
+                setattr(child, param, getattr(parent_b, param))
+
+        if random.random() < 0.5:
+            child.escalation_required = parent_b.escalation_required
+        if random.random() < 0.5:
+            child.multi_stage_attack = parent_b.multi_stage_attack
+
+        child.genome_id = hashlib.md5(
+            json.dumps(child.__dict__, default=str).encode()
+        ).hexdigest()[:12]
+        return child
+
+
+# ═══════════════════════════════════════════════════════════════════
+# Fitness & Selection
+# ═══════════════════════════════════════════════════════════════════
+
+class FitnessEvaluator:
+    """
+    Evaluates scenario fitness using α-Curriculum reward.
+
+    Core formula: F(S) = -|p̂(S) - α| + λ * novelty(S) + β * info_gain(S)
+
+    Where:
+    - p̂(S) = estimated agent success probability on scenario S
+    - α = target success rate (0.5 = zone of proximal development)
+    - novelty(S) = average distance to k-nearest neighbors in archive
+    - info_gain(S) = how much new the scenario teaches the agent
+    """
+
+    def __init__(self, alpha: float = 0.5, lambda_novelty: float = 0.2,
+                 beta_info: float = 0.1, k_nearest: int = 5):
+        self.alpha = alpha          # Target success rate
+        self.lambda_novelty = lambda_novelty  # Novelty weight
+        self.beta_info = beta_info  # Information gain weight
+        self.k_nearest = k_nearest  # For novelty computation
+
+    def compute_fitness(
+        self,
+        genome: ScenarioGenome,
+        performance_records: List[AgentPerformanceRecord],
+        archive: List[ScenarioGenome],
+    ) -> float:
+        """
+        Compute composite fitness score for a scenario genome.
+
+        Returns value in approximately [-1, 1] range.
+        Higher is better (more useful for training).
+        """
+        # 1. α-Curriculum component
+        alpha_reward = self._alpha_curriculum_reward(genome, performance_records)
+
+        # 2. Novelty component
+        novelty = self._compute_novelty(genome, archive)
+
+        # 3. Information gain estimate
+        info_gain = self._estimate_info_gain(genome, performance_records)
+
+        fitness = alpha_reward + self.lambda_novelty * novelty + self.beta_info * info_gain
+        return fitness
+
+    def _alpha_curriculum_reward(
+        self,
+        genome: ScenarioGenome,
+        records: List[AgentPerformanceRecord],
+    ) -> float:
+        """
+        α-Curriculum: R = -|p̂ - α|
+
+        Scenarios where the agent succeeds ~50% of the time are most useful
+        for learning (zone of proximal development).
+        """
+        # Estimate success probability from performance records
+        matching = [r for r in records if r.genome_id == genome.genome_id]
+        if not matching:
+            # No data — use difficulty as proxy
+            # Assume harder scenarios have lower success probability
+            estimated_p = 1.0 - genome.aggregate_difficulty
+        else:
+            estimated_p = sum(r.score for r in matching) / len(matching)
+
+        return -abs(estimated_p - self.alpha)
+
+    def _compute_novelty(
+        self, genome: ScenarioGenome, archive: List[ScenarioGenome]
+    ) -> float:
+        """
+        Novelty search: distance to k-nearest neighbors in difficulty space.
+        Encourages diverse scenario population.
+        """
+        if not archive:
+            return 1.0  # Maximum novelty if archive is empty
+
+        gv = genome.difficulty_vector
+        distances = []
+        for other in archive:
+            ov = other.difficulty_vector
+            dist = math.sqrt(sum((a - b) ** 2 for a, b in zip(gv, ov)))
+            distances.append(dist)
+
+        distances.sort()
+        k = min(self.k_nearest, len(distances))
+        avg_dist = sum(distances[:k]) / k if k > 0 else 0.0
+
+        # Normalize to [0, 1] (max possible distance in unit hypercube is sqrt(k_dims))
+        max_dist = math.sqrt(len(gv))
+        return min(avg_dist / max_dist, 1.0)
+
+    def _estimate_info_gain(
+        self,
+        genome: ScenarioGenome,
+        records: List[AgentPerformanceRecord],
+    ) -> float:
+        """
+        Estimate how much new information a scenario provides.
+        Scenarios that expose agent weaknesses score higher.
+        """
+        if not records:
+            return 0.5
+
+        # Look at what the agent is weak at
+        recent = records[-20:]  # Last 20 episodes
+
+        weakness_dimensions = {
+            'evidence_obscurity': 1.0 - (sum(r.evidence_found_ratio for r in recent) / len(recent)),
+            'ioc_complexity': 1.0 - (sum(r.iocs_found_ratio for r in recent) / len(recent)),
+            'containment_complexity': 1.0 - (sum(r.containment_score for r in recent) / len(recent)),
+            'report_detail_required': 1.0 - (sum(r.report_quality for r in recent) / len(recent)),
+        }
+
+        # Scenarios that target agent weaknesses have higher info gain
+        dv = genome.difficulty_vector
+        dim_names = ['evidence_obscurity', 'ioc_complexity', 'containment_complexity',
+                      'report_detail_required', 'time_pressure']
+
+        info = 0.0
+        for i, dim_name in enumerate(dim_names):
+            if dim_name in weakness_dimensions:
+                # Higher difficulty in weak dimensions = more info gain
+                info += dv[i] * weakness_dimensions[dim_name]
+
+        return info / len(dim_names) if dim_names else 0.0
+
+
+# ═══════════════════════════════════════════════════════════════════
+# Evolution Engine (Main Class)
+# ═══════════════════════════════════════════════════════════════════
+
+class EvolutionEngine:
+    """
+    Self-evolving environment engine using POET + α-Curriculum.
+
+    Maintains a population of scenario genomes, evolves them based on
+    agent performance, and provides the next scenario to train on.
+
+    Usage:
+        engine = EvolutionEngine(population_size=10, alpha=0.5)
+        genome = engine.get_next_scenario()
+        scenario = engine.genome_to_scenario(genome)
+        # ... run agent on scenario ...
+        engine.record_performance(genome, performance_record)
+        engine.evolve()  # Create next generation
+    """
+
+    def __init__(
+        self,
+        population_size: int = 10,
+        alpha: float = 0.5,
+        mutation_sigma: float = 0.15,
+        elite_fraction: float = 0.2,
+        archive_size: int = 50,
+    ):
+        self.population_size = population_size
+        self.mutation_sigma = mutation_sigma
+        self.elite_fraction = elite_fraction
+        self.archive_size = archive_size
+
+        self.fitness_evaluator = FitnessEvaluator(alpha=alpha)
+        self.state = EvolutionState()
+
+        # Initialize population with diverse seeds
+        self._initialize_population()
+
+    def _initialize_population(self):
+        """Create initial diverse population spanning difficulty space."""
+        templates = [
+            # Easy
+            ScenarioGenome(num_log_entries=8, num_critical_evidence=3, num_iocs=2,
+                          num_endpoints=2, max_steps=25, noise_ratio=0.1,
+                          evidence_obscurity=0.1, ioc_complexity=0.1,
+                          containment_complexity=0.1, time_pressure=0.1),
+            # Medium
+            ScenarioGenome(num_log_entries=12, num_critical_evidence=5, num_iocs=4,
+                          num_endpoints=3, max_steps=25, noise_ratio=0.25,
+                          evidence_obscurity=0.35, ioc_complexity=0.35,
+                          containment_complexity=0.35, time_pressure=0.3),
+            # Hard
+            ScenarioGenome(num_log_entries=18, num_critical_evidence=7, num_iocs=6,
+                          num_endpoints=4, max_steps=30, noise_ratio=0.4,
+                          evidence_obscurity=0.6, ioc_complexity=0.6,
+                          containment_complexity=0.6, time_pressure=0.5),
+            # Expert
+            ScenarioGenome(num_log_entries=25, num_critical_evidence=10, num_iocs=8,
+                          num_endpoints=6, max_steps=35, noise_ratio=0.5,
+                          multi_stage_attack=True,
+                          evidence_obscurity=0.85, ioc_complexity=0.85,
+                          containment_complexity=0.85, time_pressure=0.7),
+        ]
+
+        # Fill population by mutating templates
+        self.state.population = []
+        for i in range(self.population_size):
+            template = templates[i % len(templates)]
+            if i < len(templates):
+                genome = copy.deepcopy(template)
+            else:
+                genome = MutationOperator.mutate(template, sigma=0.3)
+            genome.genome_id = hashlib.md5(
+                f"init_{i}_{json.dumps(genome.__dict__, default=str)}".encode()
+            ).hexdigest()[:12]
+            self.state.population.append(genome)
+
+    def get_next_scenario_genome(self) -> ScenarioGenome:
+        """
+        Select the next scenario genome for the agent to train on.
+        Uses fitness-proportionate selection favoring scenarios near α.
+        """
+        if not self.state.population:
+            self._initialize_population()
+
+        # Compute fitness for each genome
+        fitnesses = []
+        for genome in self.state.population:
+            f = self.fitness_evaluator.compute_fitness(
+                genome, self.state.performance_history, self.state.archive
+            )
+            fitnesses.append(f)
+
+        # Softmax selection (temperature-based)
+        temperature = 0.5
+        max_f = max(fitnesses) if fitnesses else 0
+        exp_f = [math.exp((f - max_f) / temperature) for f in fitnesses]
+        total = sum(exp_f)
+        probs = [e / total for e in exp_f]
+
+        # Weighted random selection
+        selected = random.choices(self.state.population, weights=probs, k=1)[0]
+        return selected
+
+    def record_performance(self, genome: ScenarioGenome, record: AgentPerformanceRecord):
+        """Record agent performance on a scenario for fitness evaluation."""
+        self.state.performance_history.append(record)
+
+        # Update Elo ratings
+        self._update_elo(genome, record)
+
+        # Keep history bounded
+        if len(self.state.performance_history) > 500:
+            self.state.performance_history = self.state.performance_history[-300:]
+
+    def evolve(self) -> List[ScenarioGenome]:
+        """
+        Evolve the scenario population using:
+        1. Fitness evaluation
+        2. Elite preservation
+        3. Mutation + crossover
+        4. Archive update (novelty-based hall of fame)
+
+        Returns the new population.
+        """
+        self.state.generation += 1
+
+        # Evaluate fitness
+        scored = []
+        for genome in self.state.population:
+            f = self.fitness_evaluator.compute_fitness(
+                genome, self.state.performance_history, self.state.archive
+            )
+            scored.append((genome, f))
+
+        scored.sort(key=lambda x: x[1], reverse=True)
+
+        # Elite preservation
+        n_elite = max(1, int(self.population_size * self.elite_fraction))
+        elites = [g for g, _ in scored[:n_elite]]
+
+        # Add best to archive
+        for genome, fitness in scored[:2]:
+            if len(self.state.archive) < self.archive_size:
+                self.state.archive.append(copy.deepcopy(genome))
+            elif fitness > 0:  # Only archive reasonably fit scenarios
+                # Replace least novel archive member
+                self.state.archive.append(copy.deepcopy(genome))
+                if len(self.state.archive) > self.archive_size:
+                    # Remove least novel
+                    novelties = [
+                        self.fitness_evaluator._compute_novelty(g, self.state.archive)
+                        for g in self.state.archive
+                    ]
+                    min_idx = novelties.index(min(novelties))
+                    self.state.archive.pop(min_idx)
+
+        # Adaptive mutation strength
+        # If scenarios are too easy (high avg score), increase σ to find harder ones
+        # If too hard (low avg score), decrease σ to fine-tune
+        recent_scores = [r.score for r in self.state.performance_history[-20:]]
+        if recent_scores:
+            avg_score = sum(recent_scores) / len(recent_scores)
+            # σ peaks when avg_score is far from α
+            sigma = self.mutation_sigma * (1.0 + abs(avg_score - self.fitness_evaluator.alpha))
+        else:
+            sigma = self.mutation_sigma
+
+        # Generate children
+        new_population = list(elites)
+        while len(new_population) < self.population_size:
+            if random.random() < 0.7:
+                # Mutation
+                parent = random.choice(scored[:max(3, len(scored) // 2)])[0]
+                child = MutationOperator.mutate(parent, sigma=sigma)
+            else:
+                # Crossover
+                p1, p2 = random.sample(scored[:max(3, len(scored) // 2)], 2)
+                child = MutationOperator.crossover(p1[0], p2[0])
+                child = MutationOperator.mutate(child, sigma=sigma * 0.5)
+
+            new_population.append(child)
+
+        self.state.population = new_population[:self.population_size]
+        return self.state.population
+
+    def _update_elo(self, genome: ScenarioGenome, record: AgentPerformanceRecord):
+        """
+        Update Elo ratings for agent and scenario.
+
+        Agent 'wins' if score > 0.7, 'loses' if score < 0.3, 'draw' otherwise.
+        This gives a natural difficulty calibration system.
+        """
+        K = 32  # Elo K-factor
+
+        agent_elo = self.state.agent_elo
+        scenario_elo = self.state.scenario_elos.get(genome.genome_id, 1000.0)
+
+        # Expected scores
+        ea = 1.0 / (1.0 + 10 ** ((scenario_elo - agent_elo) / 400))
+        es = 1.0 - ea
+
+        # Actual outcome
+        if record.score > 0.7:
+            sa, ss = 1.0, 0.0  # Agent wins
+        elif record.score < 0.3:
+            sa, ss = 0.0, 1.0  # Scenario wins
+        else:
+            sa, ss = 0.5, 0.5  # Draw
+
+        self.state.agent_elo = agent_elo + K * (sa - ea)
+        self.state.scenario_elos[genome.genome_id] = scenario_elo + K * (ss - es)
+
+    def get_evolution_stats(self) -> Dict[str, Any]:
+        """Get statistics about the current evolution state."""
+        recent = self.state.performance_history[-20:]
+        return {
+            "generation": self.state.generation,
+            "population_size": len(self.state.population),
+            "archive_size": len(self.state.archive),
+            "total_episodes": len(self.state.performance_history),
+            "agent_elo": round(self.state.agent_elo, 1),
+            "avg_recent_score": round(
+                sum(r.score for r in recent) / len(recent), 4
+            ) if recent else None,
+            "avg_difficulty": round(
+                sum(g.aggregate_difficulty for g in self.state.population)
+                / len(self.state.population), 3
+            ) if self.state.population else None,
+            "difficulty_range": {
+                "min": round(min(g.aggregate_difficulty for g in self.state.population), 3),
+                "max": round(max(g.aggregate_difficulty for g in self.state.population), 3),
+            } if self.state.population else None,
+        }

self_evolving/scenario_generator.py

@@ -0,0 +1,740 @@
+"""
+Procedural Scenario Generator
+
+Converts ScenarioGenome parameters into fully-realized Scenario objects
+with realistic cybersecurity content (log entries, IOCs, endpoints, etc).
+
+Uses template-based generation with parameterized complexity to ensure
+scenarios are both varied and solvable.
+"""
+
+import hashlib
+import random
+from typing import Dict, List, Optional, Set, Tuple
+
+try:
+    from ..tasks.base import (
+        EndpointInfo, LogEntry, Scenario, ThreatIntelEntry, UserProfile
+    )
+    from ..models import ContainmentAction, Severity, ThreatCategory
+except ImportError:
+    import sys, os
+    _parent = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+    if _parent not in sys.path:
+        sys.path.insert(0, _parent)
+    from tasks.base import (
+        EndpointInfo, LogEntry, Scenario, ThreatIntelEntry, UserProfile
+    )
+    from models import ContainmentAction, Severity, ThreatCategory
+
+try:
+    from .evolution_engine import ScenarioGenome
+except ImportError:
+    from self_evolving.evolution_engine import ScenarioGenome
+
+
+# ═══════════════════════════════════════════════════════════════════
+# Content Templates (realistic cybersecurity data)
+# ═══════════════════════════════════════════════════════════════════
+
+ATTACK_TEMPLATES = {
+    "phishing": {
+        "categories": [ThreatCategory.PHISHING, ThreatCategory.MALWARE],
+        "severities": [Severity.HIGH, Severity.MEDIUM],
+        "alert_templates": [
+            "Suspicious email with malicious attachment detected targeting {user}",
+            "Spear phishing campaign detected - credential harvesting attempt on {user}",
+            "Business email compromise attempt flagged by DLP - sender: {attacker_email}",
+        ],
+        "log_templates": {
+            "email": [
+                "Email received from {attacker_email} to {user}@corp.local - Subject: '{subject}' - Attachment: {filename}",
+                "DMARC FAIL for sender domain {attacker_domain} - SPF: fail, DKIM: fail",
+                "Attachment {filename} (SHA256: {file_hash}) downloaded by {user}",
+            ],
+            "edr": [
+                "Process {proc_name} spawned by outlook.exe on {hostname} - PID: {pid}",
+                "Suspicious DLL injection detected: {filename} loaded into {proc_name}",
+                "Network beacon detected from {hostname} to {c2_ip}:{c2_port} every {interval}s",
+            ],
+            "proxy": [
+                "HTTP POST to {c2_domain}/beacon - User-Agent: {ua} - Host: {hostname}",
+                "Data upload detected: {hostname} -> {c2_ip} ({data_size}MB)",
+                "SSL connection to known malicious domain: {c2_domain} from {hostname}",
+            ],
+            "auth": [
+                "Successful login for {user} from {src_ip} at {timestamp}",
+                "Failed login attempt for {user} - source: {src_ip} - {attempts} attempts",
+            ],
+            "firewall": [
+                "ALLOW: {hostname}({src_ip}) -> {c2_ip}:443 (HTTPS) - {bytes} bytes",
+                "BLOCK: {c2_ip} -> {hostname}:{port} (reverse shell attempt)",
+            ],
+            "dns": [
+                "DNS query: {c2_domain} -> {c2_ip} from {hostname}",
+                "Suspicious DNS TXT record query: {domain} from {hostname}",
+            ],
+        },
+        "containment_actions": [
+            (ContainmentAction.QUARANTINE_FILE, "{file_hash}"),
+            (ContainmentAction.ISOLATE_HOST, "{hostname}"),
+            (ContainmentAction.BLOCK_IP, "{c2_ip}"),
+            (ContainmentAction.DISABLE_ACCOUNT, "{user}"),
+        ],
+        "escalation": "tier3",
+        "report_keywords": ["phishing", "malicious attachment", "C2 beacon", "credential theft"],
+    },
+    "lateral_movement": {
+        "categories": [ThreatCategory.LATERAL_MOVEMENT, ThreatCategory.BRUTE_FORCE],
+        "severities": [Severity.CRITICAL, Severity.HIGH],
+        "alert_templates": [
+            "Multiple failed authentication attempts followed by lateral movement from {hostname}",
+            "Credential stuffing attack detected - {attempts} failed logins then successful RDP to {target_host}",
+            "Pass-the-hash attack detected: {user} authenticating across multiple systems",
+        ],
+        "log_templates": {
+            "auth": [
+                "Failed login: {user} from {src_ip} - {attempts} attempts in {window}min",
+                "Successful login: {user} from {src_ip} after {failed_count} failures",
+                "Kerberos TGT request: {user} from {hostname} - ticket type: {ticket_type}",
+                "NTLM authentication: {user} from {src_ip} to {target_host}",
+            ],
+            "edr": [
+                "PsExec.exe execution detected on {target_host} from {hostname}",
+                "Mimikatz-like memory access detected on {hostname} - LSASS.exe read",
+                "WMI remote execution: {hostname} -> {target_host} - command: {command}",
+                "Credential dump detected: {hostname} - tool: {tool_name}",
+            ],
+            "firewall": [
+                "ALLOW: {hostname}({src_ip}) -> {target_host}:3389 (RDP)",
+                "ALLOW: {hostname} -> {target_host}:445 (SMB)",
+                "Spike in traffic: {hostname} -> internal subnets ({connection_count} connections in {window}min)",
+            ],
+            "dns": [
+                "DNS query: {target_host}.corp.local from {hostname}",
+                "Internal DNS enumeration detected from {hostname} - {query_count} queries",
+            ],
+            "proxy": [
+                "Internal proxy: {hostname} -> {target_host}:8080 ({data_size}MB transferred)",
+            ],
+            "email": [
+                "No relevant email logs for this incident type",
+            ],
+        },
+        "containment_actions": [
+            (ContainmentAction.ISOLATE_HOST, "{hostname}"),
+            (ContainmentAction.ISOLATE_HOST, "{target_host}"),
+            (ContainmentAction.DISABLE_ACCOUNT, "{user}"),
+            (ContainmentAction.REVOKE_SESSIONS, "{user}"),
+            (ContainmentAction.BLOCK_IP, "{src_ip}"),
+        ],
+        "escalation": "tier3",
+        "report_keywords": ["lateral movement", "credential theft", "brute force", "RDP", "privilege escalation"],
+    },
+    "insider_threat": {
+        "categories": [ThreatCategory.INSIDER_THREAT, ThreatCategory.DATA_EXFILTRATION],
+        "severities": [Severity.CRITICAL, Severity.HIGH],
+        "alert_templates": [
+            "Data exfiltration alert: {user} transferring sensitive files to external storage",
+            "Insider threat indicator: {user} accessing files outside normal scope at unusual hours",
+            "DLP alert: Bulk download of confidential documents by {user}",
+        ],
+        "log_templates": {
+            "email": [
+                "Email from {user}@corp.local to {ext_email} - {attachment_count} attachments ({total_size}MB)",
+                "Email forwarding rule created by {user} to {ext_email}",
+            ],
+            "auth": [
+                "Off-hours login: {user} at {timestamp} (normal hours: 9-17)",
+                "VPN connection: {user} from {src_ip} ({geo_location})",
+                "Privilege escalation: {user} added to {group_name} group",
+            ],
+            "edr": [
+                "USB device connected: {device_name} on {hostname} - {user} session",
+                "File copy to removable media: {file_count} files ({total_size}MB) by {user}",
+                "Screen capture tool detected: {tool_name} on {hostname}",
+            ],
+            "proxy": [
+                "Upload to {cloud_service}: {hostname} ({user}) - {data_size}MB",
+                "Connection to file sharing site: {cloud_service} from {hostname}",
+            ],
+            "dns": [
+                "DNS query: {cloud_service_domain} from {hostname}",
+            ],
+            "firewall": [
+                "Outbound data transfer: {hostname} -> {ext_ip}:{port} ({data_size}MB)",
+                "ALLOW: {hostname} -> {ext_ip}:443 (HTTPS to cloud storage)",
+            ],
+        },
+        "containment_actions": [
+            (ContainmentAction.DISABLE_ACCOUNT, "{user}"),
+            (ContainmentAction.REVOKE_SESSIONS, "{user}"),
+            (ContainmentAction.ISOLATE_HOST, "{hostname}"),
+        ],
+        "escalation": "management",
+        "report_keywords": ["insider threat", "data exfiltration", "unauthorized access", "sensitive data"],
+    },
+    "ransomware": {
+        "categories": [ThreatCategory.RANSOMWARE, ThreatCategory.MALWARE],
+        "severities": [Severity.CRITICAL],
+        "alert_templates": [
+            "Ransomware activity detected: Mass file encryption on {target_host}",
+            "File encryption alert: {file_count} files encrypted on {target_host} in {window} minutes",
+            "Known ransomware variant {malware_name} detected on {hostname}",
+        ],
+        "log_templates": {
+            "edr": [
+                "Mass file modification: {file_count} files renamed to .{extension} on {target_host}",
+                "Suspicious process: {proc_name} modifying files in {directory} on {target_host}",
+                "Ransom note created: {ransom_file} in {directory} on {target_host}",
+                "Shadow copy deletion: vssadmin.exe delete shadows on {target_host}",
+            ],
+            "auth": [
+                "Service account {user} used to access {target_host} from {hostname}",
+                "Failed RDP attempts: {hostname} -> {target_host} ({attempts} attempts)",
+                "Successful authentication: {user} on {target_host} via {auth_method}",
+            ],
+            "firewall": [
+                "ALLOW: {hostname} -> {c2_ip}:443 (C2 communication)",
+                "ALLOW: {hostname} -> {target_host}:445 (SMB lateral movement)",
+                "BLOCK: {target_host} -> {c2_ip}:{port} (ransom payment page)",
+            ],
+            "dns": [
+                "DNS query: {c2_domain} from {hostname}",
+                "DNS query: {ransom_domain}.onion.to from {target_host}",
+            ],
+            "proxy": [
+                "TOR traffic detected from {target_host}",
+                "HTTP GET to {c2_domain}/key - Encrypted payload received",
+            ],
+            "email": [
+                "Phishing email to {user}: '{subject}' with malicious macro attachment",
+            ],
+        },
+        "containment_actions": [
+            (ContainmentAction.ISOLATE_HOST, "{hostname}"),
+            (ContainmentAction.ISOLATE_HOST, "{target_host}"),
+            (ContainmentAction.BLOCK_IP, "{c2_ip}"),
+            (ContainmentAction.DISABLE_ACCOUNT, "{user}"),
+            (ContainmentAction.QUARANTINE_FILE, "{file_hash}"),
+        ],
+        "escalation": "tier3",
+        "report_keywords": ["ransomware", "encryption", "C2", "lateral movement", "shadow copies"],
+    },
+    "supply_chain": {
+        "categories": [ThreatCategory.SUPPLY_CHAIN, ThreatCategory.MALWARE],
+        "severities": [Severity.CRITICAL],
+        "alert_templates": [
+            "Supply chain compromise detected: Backdoor in {software_name} update",
+            "Compromised third-party library {library_name} detected in production",
+            "Suspicious code execution from auto-updated {software_name} package",
+        ],
+        "log_templates": {
+            "edr": [
+                "Code execution from {software_name} update: {proc_name} spawned {child_proc}",
+                "Backdoor detected: {file_name} in {install_path} ({file_hash})",
+                "Persistence mechanism: Registry key added by {proc_name} on {hostname}",
+                "Memory injection detected: {proc_name} injected into {target_proc}",
+            ],
+            "dns": [
+                "DNS query to staging server: {staging_domain} from {hostname}",
+                "DNS tunneling detected: long subdomain queries to {c2_domain} from {hostname}",
+            ],
+            "firewall": [
+                "ALLOW: {hostname} -> {c2_ip}:{port} (backdoor C2)",
+                "ALLOW: {hostname} -> {staging_ip}:443 (data staging)",
+            ],
+            "proxy": [
+                "HTTPS to {staging_domain}: {hostname} - Certificate mismatch detected",
+                "Data upload: {hostname} -> {staging_domain} ({data_size}MB)",
+            ],
+            "auth": [
+                "Service account {svc_account} created by {software_name} installer",
+                "Elevated privileges: {svc_account} added to Administrators group on {hostname}",
+            ],
+            "email": [
+                "Vendor notification email from {vendor_email} about update {version}",
+            ],
+        },
+        "containment_actions": [
+            (ContainmentAction.ISOLATE_HOST, "{hostname}"),
+            (ContainmentAction.QUARANTINE_FILE, "{file_hash}"),
+            (ContainmentAction.BLOCK_IP, "{c2_ip}"),
+            (ContainmentAction.DISABLE_ACCOUNT, "{svc_account}"),
+        ],
+        "escalation": "management",
+        "report_keywords": ["supply chain", "backdoor", "compromise", "third-party", "update"],
+    },
+    "apt_zeroday": {
+        "categories": [ThreatCategory.APT_ZERO_DAY],
+        "severities": [Severity.CRITICAL],
+        "alert_templates": [
+            "APT activity detected: Zero-day exploit in {software_name} targeting {target_host}",
+            "Advanced persistent threat: Multi-stage attack with unknown exploit on {hostname}",
+            "Sophisticated attack chain: {exploit_name} vulnerability exploitation with DNS tunneling",
+        ],
+        "log_templates": {
+            "edr": [
+                "Zero-day exploit: Buffer overflow in {software_name} on {target_host} (CVE pending)",
+                "Post-exploitation: {tool_name} dropped in {directory} on {target_host}",
+                "Living-off-the-land: {proc_name} executing encoded PowerShell on {hostname}",
+                "DCSync attack detected: {user} replicating AD credentials from {dc_host}",
+                "Keylogger installed: {file_name} injected into {target_proc} on {hostname}",
+            ],
+            "dns": [
+                "DNS tunneling: {subdomain}.{c2_domain} from {hostname} ({query_count} queries/hr)",
+                "DNS C2 channel: TXT record responses from {c2_domain} to {hostname}",
+                "Fast-flux DNS detected: {c2_domain} resolving to {ip_count} IPs",
+            ],
+            "auth": [
+                "Golden ticket detected: Kerberos ticket for {user} with suspicious lifetime",
+                "Admin account compromise: {admin_user} authenticating from {attacker_ip}",
+                "Privilege escalation: {user} -> {admin_user} via {technique}",
+            ],
+            "firewall": [
+                "ALLOW: {hostname} -> {c2_ip}:{port} (encrypted C2)",
+                "Covert channel: {hostname} -> {c2_ip} via ICMP (data embedded in payload)",
+                "Suspicious outbound: {target_host} -> {exfil_ip}:53 ({data_size}MB via DNS)",
+            ],
+            "proxy": [
+                "Encrypted traffic anomaly: {hostname} -> {c2_ip} ({data_size}MB, high entropy)",
+                "Certificate pinning bypass detected from {hostname} to {c2_domain}",
+            ],
+            "email": [
+                "Initial access: Spear phishing to {user} from {attacker_email} with zero-day PDF",
+            ],
+        },
+        "containment_actions": [
+            (ContainmentAction.ISOLATE_HOST, "{hostname}"),
+            (ContainmentAction.ISOLATE_HOST, "{target_host}"),
+            (ContainmentAction.BLOCK_IP, "{c2_ip}"),
+            (ContainmentAction.DISABLE_ACCOUNT, "{user}"),
+            (ContainmentAction.DISABLE_ACCOUNT, "{admin_user}"),
+            (ContainmentAction.QUARANTINE_FILE, "{file_hash}"),
+        ],
+        "escalation": "legal",
+        "report_keywords": ["APT", "zero-day", "DNS tunneling", "DCSync", "advanced persistent threat"],
+    },
+}
+
+# Random data pools for filling templates
+IP_POOL = [
+    "185.220.101.42", "203.0.113.50", "198.51.100.23", "192.0.2.100",
+    "45.33.32.156", "94.102.49.190", "195.123.237.18", "104.248.29.53",
+    "64.225.8.203", "161.35.38.117", "178.128.83.12", "134.209.76.34",
+    "159.89.115.241", "167.172.182.15", "142.93.118.76", "68.183.44.143",
+    "10.50.25.101", "10.50.25.102", "10.50.25.103", "10.50.25.104",
+]
+DOMAIN_POOL = [
+    "malware-cdn.evil.com", "secure-update.net", "cdn-analytics.cloud",
+    "api-sync.services", "update-service.io", "data-backup.cloud",
+    "metrics-relay.net", "auth-verify.cloud", "cloud-sync.services",
+    "cdn-static.cloud", "api-gateway.services", "log-collector.net",
+]
+HOSTNAME_POOL = [
+    "WS-USER01-PC", "WS-ADMIN-PC", "SRV-DC-01", "SRV-FILE-01",
+    "SRV-WEB-01", "SRV-DB-01", "WS-DEV-PC", "SRV-APP-01",
+    "SRV-MAIL-01", "WS-FINANCE-PC", "SRV-BACKUP-01", "SRV-DNS-01",
+]
+USERNAME_POOL = [
+    "jsmith", "agarcia", "mbrown", "klee", "tnguyen",
+    "dwilson", "schen", "rjohnson", "lpatel", "mkim",
+    "svc_backup", "svc_deploy", "admin_ops", "svc_monitor",
+]
+HASH_POOL = [
+    "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6",
+    "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
+    "f0e1d2c3b4a5f6e7d8c9b0a1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8a9f0e1",
+    "c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8",
+]
+FILENAMES = [
+    "svchost_update.exe", "chrome_helper.dll", "sys32_patch.bin",
+    "update_agent.ps1", "backup_tool.py", "report.xlsm",
+    "invoice_Q4.docm", "driver_update.exe", "monitoring_agent.dll",
+]
+
+
+class ScenarioGenerator:
+    """
+    Procedural scenario generator that converts genome parameters
+    into fully-realized Scenario objects.
+    """
+
+    def __init__(self, seed: Optional[int] = None):
+        if seed is not None:
+            random.seed(seed)
+
+    def generate(self, genome: ScenarioGenome, seed: Optional[int] = None) -> Scenario:
+        """
+        Generate a complete Scenario from a ScenarioGenome.
+
+        The genome's parameters control:
+        - Number and complexity of evidence items
+        - Number of IOCs and their types
+        - Network topology (endpoints, users)
+        - Time pressure (max_steps vs required actions)
+        - Noise level (decoy/irrelevant evidence)
+        """
+        if seed is not None:
+            random.seed(seed)
+
+        # Select attack type based on difficulty
+        attack_type = self._select_attack_type(genome)
+        template = ATTACK_TEMPLATES[attack_type]
+
+        # Generate scenario variables
+        variables = self._generate_variables(genome)
+
+        # Build scenario components
+        severity = self._select_severity(genome, template)
+        category = random.choice(template["categories"])
+
+        log_entries = self._generate_logs(genome, template, variables)
+        threat_intel = self._generate_threat_intel(genome, variables)
+        endpoints = self._generate_endpoints(genome, variables)
+        users = self._generate_users(genome, variables)
+        correlations = self._generate_correlations(genome, variables)
+        containment = self._generate_containment(genome, template, variables)
+
+        # Determine difficulty label
+        diff = genome.aggregate_difficulty
+        if diff < 0.2:
+            difficulty = "easy"
+            task_id = f"evolved_easy_{genome.genome_id}"
+        elif diff < 0.4:
+            difficulty = "medium"
+            task_id = f"evolved_medium_{genome.genome_id}"
+        elif diff < 0.6:
+            difficulty = "medium_hard"
+            task_id = f"evolved_medhard_{genome.genome_id}"
+        elif diff < 0.8:
+            difficulty = "hard"
+            task_id = f"evolved_hard_{genome.genome_id}"
+        else:
+            difficulty = "expert"
+            task_id = f"evolved_expert_{genome.genome_id}"
+
+        # Build alert summary
+        alert_summary = random.choice(template["alert_templates"]).format(**variables)
+
+        # Determine critical evidence and IOCs
+        critical_evidence = set()
+        critical_iocs = set()
+        for entry in log_entries:
+            if entry.is_critical:
+                for kw in entry.keywords:
+                    critical_evidence.add(kw)
+        for ti in threat_intel:
+            critical_iocs.add(ti.ioc)
+
+        # Build containment pairs
+        containment_actions = []
+        containment_targets = {}
+        required_containment_pairs = []
+        for action, target in containment:
+            containment_actions.append(action)
+            containment_targets[action.value] = target
+            required_containment_pairs.append((action.value, target))
+
+        scenario = Scenario(
+            scenario_id=f"evolved_{genome.genome_id}",
+            task_id=task_id,
+            difficulty=difficulty,
+            alert_summary=alert_summary,
+            alert_source="SOC-SIEM-EVOLVED",
+            alert_timestamp="2026-03-28T10:00:00Z",
+            initial_observation=f"[Evolved Scenario Gen-{genome.generation}] {alert_summary}. Begin investigation.",
+            true_severity=severity,
+            true_category=category,
+            required_containment=containment_actions,
+            containment_targets=containment_targets,
+            is_false_positive=False,
+            correct_escalation=template.get("escalation"),
+            log_entries=log_entries,
+            threat_intel=threat_intel,
+            endpoints=endpoints,
+            users=users,
+            correlation_findings=correlations,
+            critical_evidence=critical_evidence,
+            critical_iocs=critical_iocs,
+            max_steps=genome.max_steps,
+            report_keywords=template["report_keywords"],
+            required_containment_pairs=required_containment_pairs,
+        )
+
+        return scenario
+
+    def _select_attack_type(self, genome: ScenarioGenome) -> str:
+        """Select attack type based on difficulty."""
+        diff = genome.aggregate_difficulty
+        if diff < 0.25:
+            weights = {"phishing": 5, "lateral_movement": 2, "insider_threat": 1,
+                       "ransomware": 0, "supply_chain": 0, "apt_zeroday": 0}
+        elif diff < 0.5:
+            weights = {"phishing": 2, "lateral_movement": 4, "insider_threat": 3,
+                       "ransomware": 2, "supply_chain": 1, "apt_zeroday": 0}
+        elif diff < 0.75:
+            weights = {"phishing": 1, "lateral_movement": 2, "insider_threat": 2,
+                       "ransomware": 4, "supply_chain": 3, "apt_zeroday": 1}
+        else:
+            weights = {"phishing": 0, "lateral_movement": 1, "insider_threat": 1,
+                       "ransomware": 2, "supply_chain": 3, "apt_zeroday": 5}
+
+        types = list(weights.keys())
+        w = [weights[t] for t in types]
+        return random.choices(types, weights=w, k=1)[0]
+
+    def _generate_variables(self, genome: ScenarioGenome) -> Dict[str, str]:
+        """Generate random scenario variables."""
+        hostnames = random.sample(HOSTNAME_POOL, min(genome.num_endpoints + 2, len(HOSTNAME_POOL)))
+        ips = random.sample(IP_POOL, min(genome.num_endpoints + 4, len(IP_POOL)))
+        users = random.sample(USERNAME_POOL, min(genome.num_users + 2, len(USERNAME_POOL)))
+
+        return {
+            "hostname": hostnames[0],
+            "target_host": hostnames[1] if len(hostnames) > 1 else hostnames[0],
+            "dc_host": "SRV-DC-01",
+            "user": users[0],
+            "admin_user": users[1] if len(users) > 1 else "admin_ops",
+            "svc_account": f"svc_{random.choice(['deploy', 'backup', 'monitor', 'update'])}",
+            "src_ip": ips[0],
+            "c2_ip": random.choice(IP_POOL[:10]),  # External IPs
+            "ext_ip": random.choice(IP_POOL[:10]),
+            "attacker_ip": random.choice(IP_POOL[:10]),
+            "exfil_ip": random.choice(IP_POOL[:10]),
+            "staging_ip": random.choice(IP_POOL[:10]),
+            "c2_domain": random.choice(DOMAIN_POOL),
+            "staging_domain": random.choice(DOMAIN_POOL),
+            "attacker_domain": random.choice(DOMAIN_POOL),
+            "c2_port": str(random.choice([443, 8443, 4444, 9090, 8080])),
+            "port": str(random.choice([443, 445, 3389, 22, 8080])),
+            "file_hash": random.choice(HASH_POOL),
+            "filename": random.choice(FILENAMES),
+            "file_name": random.choice(FILENAMES),
+            "proc_name": random.choice(["svchost.exe", "rundll32.exe", "powershell.exe", "cmd.exe"]),
+            "child_proc": random.choice(["cmd.exe", "powershell.exe", "certutil.exe"]),
+            "target_proc": random.choice(["explorer.exe", "lsass.exe", "svchost.exe"]),
+            "tool_name": random.choice(["Cobalt Strike", "Mimikatz", "BloodHound", "PsExec"]),
+            "pid": str(random.randint(1000, 65535)),
+            "interval": str(random.choice([30, 60, 120, 300])),
+            "attempts": str(random.randint(5, 500)),
+            "failed_count": str(random.randint(3, 20)),
+            "window": str(random.choice([5, 10, 15, 30])),
+            "data_size": str(round(random.uniform(0.5, 500), 1)),
+            "total_size": str(round(random.uniform(10, 1000), 1)),
+            "bytes": str(random.randint(1024, 10485760)),
+            "ua": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
+            "timestamp": "2026-03-28T" + f"{random.randint(0,23):02d}:{random.randint(0,59):02d}:00Z",
+            "subject": random.choice([
+                "Urgent: Invoice Payment Required",
+                "Action Required: Account Verification",
+                "Q4 Financial Report - Confidential",
+                "Password Reset Request",
+                "IT Security Update - Please Install",
+            ]),
+            "attacker_email": f"attacker_{random.randint(100,999)}@{random.choice(DOMAIN_POOL)}",
+            "ext_email": f"external_{random.randint(100,999)}@gmail.com",
+            "vendor_email": f"updates@vendor-{random.randint(1,99)}.com",
+            "device_name": random.choice(["USB_Drive_SanDisk", "External_HDD_WD", "USB_Kingston_128GB"]),
+            "cloud_service": random.choice(["Dropbox", "Google Drive", "OneDrive", "Mega.nz"]),
+            "cloud_service_domain": random.choice(["dropbox.com", "drive.google.com", "onedrive.live.com"]),
+            "group_name": random.choice(["Domain Admins", "Backup Operators", "Enterprise Admins"]),
+            "geo_location": random.choice(["Moscow, RU", "Beijing, CN", "Unknown VPN", "São Paulo, BR"]),
+            "software_name": random.choice(["SolarUpdate", "NetMonitor Pro", "CloudSync Agent", "DevPipeline"]),
+            "library_name": random.choice(["node-ipc", "ua-parser-js", "event-stream", "coa"]),
+            "version": f"v{random.randint(1,5)}.{random.randint(0,9)}.{random.randint(0,99)}",
+            "install_path": random.choice(["C:\\Program Files\\", "C:\\Windows\\System32\\", "/opt/", "/usr/local/bin/"]),
+            "exploit_name": random.choice(["CVE-2026-XXXX", "Log4Shell-variant", "ProxyNotShell", "ZeroLogon-v2"]),
+            "malware_name": random.choice(["LockBit 4.0", "BlackCat v3", "REvil-NG", "DarkSide-X"]),
+            "extension": random.choice(["locked", "encrypted", "crypt", "ransom"]),
+            "ransom_file": "README_DECRYPT.txt",
+            "ransom_domain": f"ransom-{random.randint(1000,9999)}",
+            "directory": random.choice(["C:\\Users\\", "D:\\Shares\\Finance\\", "C:\\Data\\", "/home/"]),
+            "file_count": str(random.randint(100, 50000)),
+            "attachment_count": str(random.randint(1, 10)),
+            "auth_method": random.choice(["RDP", "SMB", "WinRM", "NTLM"]),
+            "ticket_type": random.choice(["TGT", "TGS", "golden_ticket"]),
+            "command": random.choice(["whoami", "net user /domain", "ipconfig /all", "systeminfo"]),
+            "connection_count": str(random.randint(20, 200)),
+            "query_count": str(random.randint(50, 5000)),
+            "ip_count": str(random.randint(5, 50)),
+            "technique": random.choice(["token impersonation", "DLL hijacking", "service account abuse"]),
+            "domain": random.choice(DOMAIN_POOL),
+            "subdomain": f"{''.join(random.choices('abcdef0123456789', k=32))}",
+        }
+
+    def _generate_logs(
+        self, genome: ScenarioGenome, template: Dict, variables: Dict
+    ) -> List[LogEntry]:
+        """Generate log entries with appropriate noise and critical evidence."""
+        entries = []
+        sources = ["email", "edr", "auth", "proxy", "firewall", "dns"]
+
+        # Generate critical entries from template
+        critical_count = 0
+        for source in sources:
+            if source not in template["log_templates"]:
+                continue
+            source_templates = template["log_templates"][source]
+
+            # Number of entries per source
+            n = max(1, genome.num_log_entries // len(sources))
+
+            for i in range(min(n, len(source_templates))):
+                tmpl = source_templates[i % len(source_templates)]
+                try:
+                    content = tmpl.format(**variables)
+                except (KeyError, IndexError):
+                    content = tmpl  # Use raw if format fails
+
+                is_crit = critical_count < genome.num_critical_evidence
+                keywords = self._extract_keywords(content, variables)
+
+                entries.append(LogEntry(
+                    source=source,
+                    content=content,
+                    is_critical=is_crit,
+                    keywords=keywords,
+                ))
+                if is_crit:
+                    critical_count += 1
+
+        # Add noise entries (decoys)
+        noise_count = int(len(entries) * genome.noise_ratio)
+        for _ in range(noise_count):
+            source = random.choice(sources)
+            entries.append(LogEntry(
+                source=source,
+                content=f"[BENIGN] Routine {source} activity - {random.choice(['scan', 'update', 'backup', 'maintenance'])} completed successfully",
+                is_critical=False,
+                keywords=["benign", "routine"],
+            ))
+
+        random.shuffle(entries)
+        return entries
+
+    def _generate_threat_intel(
+        self, genome: ScenarioGenome, variables: Dict
+    ) -> List[ThreatIntelEntry]:
+        """Generate threat intelligence entries."""
+        entries = []
+        ioc_sources = [
+            (variables.get("c2_ip", ""), "ip", "Known C2 server", "critical"),
+            (variables.get("file_hash", ""), "hash", "Known malware hash", "high"),
+            (variables.get("c2_domain", ""), "domain", "Malicious domain", "high"),
+            (variables.get("attacker_email", ""), "email", "Phishing sender", "medium"),
+            (variables.get("attacker_ip", variables.get("src_ip", "")), "ip", "Attack source", "medium"),
+        ]
+
+        for ioc, ioc_type, desc, sev in ioc_sources[:genome.num_threat_intel]:
+            if ioc:
+                entries.append(ThreatIntelEntry(
+                    ioc=ioc,
+                    ioc_type=ioc_type,
+                    description=f"{desc} associated with current campaign",
+                    severity=sev,
+                    source=random.choice(["VirusTotal", "AlienVault OTX", "IBM X-Force", "Mandiant"]),
+                    keywords=[ioc.lower(), ioc_type],
+                ))
+
+        return entries
+
+    def _generate_endpoints(
+        self, genome: ScenarioGenome, variables: Dict
+    ) -> List[EndpointInfo]:
+        """Generate endpoint information."""
+        endpoints = []
+        hostnames = [variables.get("hostname", "WS-01"), variables.get("target_host", "SRV-01")]
+        hostnames.extend(random.sample(HOSTNAME_POOL, min(genome.num_endpoints, len(HOSTNAME_POOL))))
+
+        for i, host in enumerate(hostnames[:genome.num_endpoints]):
+            ip = variables.get("src_ip", "10.0.0.1") if i == 0 else f"10.50.25.{100+i}"
+            endpoints.append(EndpointInfo(
+                endpoint_id=host,
+                hostname=host,
+                os=random.choice(["Windows Server 2022", "Windows 11 Pro", "Ubuntu 22.04"]),
+                ip=ip,
+                status="compromised" if i < 2 else "active",
+                processes=[variables.get("proc_name", "svchost.exe")] if i < 2 else [],
+                connections=[f"-> {variables.get('c2_ip', '1.2.3.4')}:443"] if i == 0 else [],
+                is_compromised=i < 2,
+            ))
+
+        return endpoints
+
+    def _generate_users(
+        self, genome: ScenarioGenome, variables: Dict
+    ) -> List[UserProfile]:
+        """Generate user profiles."""
+        users = []
+        usernames = [variables.get("user", "jsmith")]
+        if genome.num_users > 1:
+            usernames.append(variables.get("admin_user", "admin"))
+        usernames.extend(random.sample(USERNAME_POOL, min(genome.num_users, len(USERNAME_POOL))))
+
+        for i, uid in enumerate(usernames[:genome.num_users]):
+            users.append(UserProfile(
+                user_id=uid,
+                display_name=uid.replace("_", " ").title(),
+                department=random.choice(["IT", "Finance", "Engineering", "Operations", "HR"]),
+                role=random.choice(["Analyst", "Engineer", "Manager", "Admin", "Developer"]),
+                risk_score=0.8 if i == 0 else random.uniform(0.1, 0.5),
+                notes="Primary suspect" if i == 0 else "",
+            ))
+
+        return users
+
+    def _generate_correlations(
+        self, genome: ScenarioGenome, variables: Dict
+    ) -> List[str]:
+        """Generate event correlations."""
+        correlations = [
+            f"Timeline correlation: Initial compromise at {variables.get('hostname', 'HOST')} "
+            f"followed by lateral movement to {variables.get('target_host', 'TARGET')}",
+            f"Network correlation: C2 traffic from {variables.get('hostname', 'HOST')} "
+            f"to {variables.get('c2_ip', 'C2_IP')} matches known threat pattern",
+        ]
+
+        if genome.correlation_depth >= 3:
+            correlations.append(
+                f"Credential correlation: Compromised user {variables.get('user', 'USER')} "
+                f"was the initial access vector via {variables.get('attacker_email', 'EMAIL')}"
+            )
+        if genome.correlation_depth >= 4:
+            correlations.append(
+                f"Data flow correlation: {variables.get('data_size', '0')}MB exfiltrated "
+                f"from {variables.get('target_host', 'TARGET')} to {variables.get('c2_ip', 'C2_IP')}"
+            )
+
+        return correlations[:genome.correlation_depth]
+
+    def _generate_containment(
+        self, genome: ScenarioGenome, template: Dict, variables: Dict
+    ) -> List[Tuple[ContainmentAction, str]]:
+        """Generate containment actions with targets."""
+        containment = []
+        for action, target_template in template["containment_actions"][:genome.num_containment_targets]:
+            try:
+                target = target_template.format(**variables)
+            except (KeyError, IndexError):
+                target = target_template
+            containment.append((action, target))
+
+        return containment
+
+    def _select_severity(self, genome: ScenarioGenome, template: Dict) -> Severity:
+        """Select severity based on genome difficulty."""
+        if genome.aggregate_difficulty > 0.6:
+            return Severity.CRITICAL
+        else:
+            return random.choice(template["severities"])
+
+    def _extract_keywords(self, content: str, variables: Dict) -> List[str]:
+        """Extract searchable keywords from log content."""
+        keywords = []
+        for key in ["hostname", "target_host", "user", "c2_ip", "file_hash",
+                     "c2_domain", "src_ip", "attacker_email", "proc_name", "filename"]:
+            val = variables.get(key, "")
+            if val and val.lower() in content.lower():
+                keywords.append(val.lower())
+        return keywords

server/app.py

@@ -181,6 +181,27 @@ async def run_baseline():
     return JSONResponse(content=results)
 
 
+@app.post("/env/evolve")
+async def evolve_population():
+    """Trigger evolution of the scenario population."""
+    if not hasattr(_shared_env, '_evolution_engine') or _shared_env._evolution_engine is None:
+        raise HTTPException(status_code=400, detail="Evolution engine not initialized. Reset with task_id='evolved' first.")
+    new_pop = _shared_env._evolution_engine.evolve()
+    return JSONResponse(content={
+        "status": "evolved",
+        "generation": _shared_env._evolution_engine.state.generation,
+        "population_size": len(new_pop),
+    })
+
+
+@app.get("/env/evolution-stats")
+async def evolution_stats():
+    """Get evolution engine statistics."""
+    if not hasattr(_shared_env, '_evolution_engine') or _shared_env._evolution_engine is None:
+        return JSONResponse(content={"status": "not_initialized", "message": "Reset with task_id='evolved' to activate"})
+    return JSONResponse(content=_shared_env._evolution_engine.get_evolution_stats())
+
+
 def main(host: str = "0.0.0.0", port: int = 8000):
     """Entry point for direct execution."""
     import uvicorn

server/incident_response_env_environment.py

@@ -52,6 +52,12 @@ try:
     )
     from ..tasks import SCENARIOS, TASK_DEFINITIONS
     from ..tasks.base import Scenario
+    from ..self_evolving import (
+        AgentPerformanceRecord,
+        EvolutionEngine,
+        ScenarioGenerator,
+        ScenarioGenome,
+    )
 except ImportError:
     # When running from server/ directory, add parent to path
     _parent = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
@@ -68,6 +74,12 @@ except ImportError:
     )
     from tasks import SCENARIOS, TASK_DEFINITIONS
     from tasks.base import Scenario
+    from self_evolving import (
+        AgentPerformanceRecord,
+        EvolutionEngine,
+        ScenarioGenerator,
+        ScenarioGenome,
+    )
 
 
 class IncidentResponseEnvEnvironment(Environment):
@@ -126,6 +138,10 @@ class IncidentResponseEnvEnvironment(Environment):
         self._ti_iocs_checked: Set[str] = set()
         self._investigated_before_classify: bool = False
         self._classified_before_contain: bool = True  # starts true, set false if violated
+        # Self-evolving engine
+        self._evolution_engine: Optional[EvolutionEngine] = None
+        self._scenario_generator: Optional[ScenarioGenerator] = None
+        self._current_genome: Optional[ScenarioGenome] = None
 
     def reset(self, seed=None, episode_id=None, task_id: str = None, **kwargs) -> IncidentObservation:
         """
@@ -142,6 +158,11 @@ class IncidentResponseEnvEnvironment(Environment):
         # Determine task
         if task_id is None:
             task_id = kwargs.get("task_id", "easy")
+
+        # Self-evolving mode
+        if task_id == "evolved" or (task_id and task_id.startswith("evolved_")):
+            return self._reset_evolved(seed=seed, episode_id=episode_id)
+
         self._task_id = task_id if task_id in SCENARIOS else "easy"
 
         # Load scenario
@@ -190,6 +211,74 @@ class IncidentResponseEnvEnvironment(Environment):
             reward=0.0,
         )
 
+    def _reset_evolved(self, seed=None, episode_id=None) -> IncidentObservation:
+        """Reset with a procedurally generated evolved scenario."""
+        if self._evolution_engine is None:
+            self._evolution_engine = EvolutionEngine(population_size=10, alpha=0.5)
+            self._scenario_generator = ScenarioGenerator()
+
+        # Get next scenario genome from evolution engine
+        genome = self._evolution_engine.get_next_scenario_genome()
+
+        # Generate scenario from genome
+        scenario = self._scenario_generator.generate(genome, seed=seed)
+
+        # Store genome reference for performance recording
+        self._current_genome = genome
+
+        # Use standard reset logic with the generated scenario
+        self._task_id = scenario.task_id
+        self._scenario = scenario
+
+        # Reset all state (same as normal reset)
+        self._state = IncidentState(
+            episode_id=episode_id or str(uuid4()),
+            step_count=0,
+            current_task=self._task_id,
+        )
+        self._evidence_discovered = set()
+        self._iocs_discovered = set()
+        self._actions_history = []
+        self._containment_executed = []
+        self._severity_set = None
+        self._category_set = None
+        self._escalated_to = None
+        self._report_submitted = False
+        self._report_text = ""
+        self._episode_done = False
+        self._reward_this_step = 0.0
+        self._total_reward = 0.0
+        self._closed_as_fp = False
+        self._log_sources_queried = set()
+        self._ti_iocs_checked = set()
+        self._investigated_before_classify = False
+        self._classified_before_contain = True
+
+        if seed is not None:
+            random.seed(seed)
+
+        return IncidentObservation(
+            alert_id=scenario.scenario_id,
+            alert_summary=scenario.alert_summary,
+            alert_source=scenario.alert_source,
+            timestamp=scenario.alert_timestamp,
+            findings=scenario.initial_observation,
+            evidence_collected=[],
+            iocs_discovered=[],
+            action_result="[Self-Evolving Mode] Environment initialized with evolved scenario. Begin your investigation.",
+            available_actions=[at.value for at in ActionType],
+            steps_remaining=scenario.max_steps,
+            investigation_progress=0.0,
+            done=False,
+            reward=0.0,
+        )
+
+    def get_evolution_stats(self) -> Dict[str, Any]:
+        """Get statistics about the current evolution state."""
+        if self._evolution_engine is None:
+            return {"status": "not_initialized", "message": "Reset with task_id='evolved' to activate"}
+        return self._evolution_engine.get_evolution_stats()
+
     def step(self, action: IncidentAction) -> IncidentObservation:
         """
         Execute an investigation or response action.
@@ -1291,29 +1380,50 @@ class IncidentResponseEnvEnvironment(Environment):
     def get_grader_score(self) -> Dict[str, Any]:
         """Return the grader score for the current/last episode."""
         final_score = self.grade()
+        scores = {
+            "investigation_completeness": round(self._calculate_investigation_completeness(), 4),
+            "ioc_identification": round(
+                len(self._iocs_discovered & self._scenario.critical_iocs) / max(len(self._scenario.critical_iocs), 1), 4
+            ) if self._scenario else 0.0,
+            "severity_correct": self._severity_set == self._scenario.true_severity if self._scenario else False,
+            "category_correct": self._category_set == self._scenario.true_category if self._scenario else False,
+            "containment_score": round(self._grade_containment(), 4),
+            "containment_precision": round(self._grade_containment_precision(), 4),
+            "report_submitted": self._report_submitted,
+            "escalation_correct": (
+                self._escalated_to in ([self._scenario.correct_escalation] if self._task_id != "expert"
+                                       else ["tier3", "management", "legal"])
+                if self._scenario and self._scenario.correct_escalation and self._escalated_to
+                else self._escalated_to is None and (not self._scenario or not self._scenario.correct_escalation)
+            ),
+            "evidence_chain_coherence": self._investigated_before_classify,
+            "phase_discipline": self._classified_before_contain,
+            "log_sources_queried": len(self._log_sources_queried),
+            "steps_used": self._state.step_count,
+            "max_steps": self._scenario.max_steps if self._scenario else 0,
+        }
+
+        # Record performance for evolution engine
+        if self._evolution_engine and self._current_genome:
+            import time
+            record = AgentPerformanceRecord(
+                scenario_id=self._scenario.scenario_id if self._scenario else "",
+                genome_id=self._current_genome.genome_id,
+                score=final_score,
+                steps_used=self._state.step_count,
+                max_steps=self._scenario.max_steps if self._scenario else 25,
+                evidence_found_ratio=scores.get("investigation_completeness", 0),
+                iocs_found_ratio=scores.get("ioc_identification", 0),
+                correct_severity=scores.get("severity_correct", False),
+                correct_category=scores.get("category_correct", False),
+                containment_score=scores.get("containment_score", 0),
+                report_quality=0.0,
+                timestamp=time.time(),
+            )
+            self._evolution_engine.record_performance(self._current_genome, record)
+
         return {
             "score": final_score,
             "task_id": self._task_id,
-            "breakdown": {
-                "investigation_completeness": round(self._calculate_investigation_completeness(), 4),
-                "ioc_identification": round(
-                    len(self._iocs_discovered & self._scenario.critical_iocs) / max(len(self._scenario.critical_iocs), 1), 4
-                ) if self._scenario else 0.0,
-                "severity_correct": self._severity_set == self._scenario.true_severity if self._scenario else False,
-                "category_correct": self._category_set == self._scenario.true_category if self._scenario else False,
-                "containment_score": round(self._grade_containment(), 4),
-                "containment_precision": round(self._grade_containment_precision(), 4),
-                "report_submitted": self._report_submitted,
-                "escalation_correct": (
-                    self._escalated_to in ([self._scenario.correct_escalation] if self._task_id != "expert"
-                                           else ["tier3", "management", "legal"])
-                    if self._scenario and self._scenario.correct_escalation and self._escalated_to
-                    else self._escalated_to is None and (not self._scenario or not self._scenario.correct_escalation)
-                ),
-                "evidence_chain_coherence": self._investigated_before_classify,
-                "phase_discipline": self._classified_before_contain,
-                "log_sources_queried": len(self._log_sources_queried),
-                "steps_used": self._state.step_count,
-                "max_steps": self._scenario.max_steps if self._scenario else 0,
-            },
+            "breakdown": scores,
         }