[CodeBuildder]

Summary

Phase 1 prepares Argus for OpenAI Build Week by making its incident simulator safe to randomize, easy to replay, and straightforward for judges and contributors to verify.

The central addition is a seeded threat/incident generator. An unseeded request produces a fresh exploratory run; retaining the returned seed reproduces the same threat-template and workload selection for regression tests, demos, and incident investigations.

Closes #90.

Why this change

Argus already had a rich set of simulated Falco, Kyverno, Cilium, and kernel incidents, but the demo path had several reliability gaps:

• randomized runs could not be reproduced;
• request counts and scenarios were not validated;
• generated event timestamps could disagree with their numeric event time;
• responses did not summarize the generated severity or response mix;
• there was no single repository command for full verification or incident generation;
• the active Kubernetes threat script had a malformed shebang;
• UI CSS extraction produced a malformed generated rule and module warnings;
• pre-existing work was not clearly separated from the Build Week extension.

Together, these problems made demonstrations less predictable and eligibility evidence harder to review.

What changed

Reproducible incident generation

POST /simulate-threats now supports:

• count: bounded to 1–100 incidents;
• scenario: validated as mixed, human_approval, or attack_chain;
• seed: an optional integer for deterministic replay.

When no seed is provided, the server generates and returns one. Reusing that seed reproduces the same randomized incident selection without replacing the time-sensitive incident identifiers.

The response now includes:

• effective seed;
• severity distribution;
• action distribution;
• pending approval count;
• attack-chain correlation count;
• representative generated threats.

Test coverage

The new simulation suite verifies:

• deterministic selection with a fixed seed;
• timestamp consistency;
• human-approval scenario behavior;
• invalid count and scenario rejection;
• automatic server-side seed generation.

Repository workflow

The Makefile now provides:

make test
make simulate-threats THREAT_COUNT=10 THREAT_SCENARIO=mixed
make simulate-threats THREAT_COUNT=10 THREAT_SCENARIO=attack_chain THREAT_SEED=20260717

Build Week documentation

BUILD_WEEK.md records:

• what existed before the submission period;
• what is being added during Build Week;
• how randomized exploration differs from deterministic evaluation;
• the human product and architecture decisions made with Codex;
• remaining submission evidence to add before the deadline.

The README and architecture documents now position Argus accurately within the broader Sentinel platform:

• Argus owns security detection and guarded remediation;
• Phoenix owns resilience testing and recovery;
• Sentinel owns cross-agent orchestration;
• Sentinel Platform owns the shared World Model and integration contracts.

Demo and UI quality fixes

• Repairs the malformed shebang in cluster/test-diverse-threats.sh.
• Moves the external font import to a valid CSS position.
• Prevents Tailwind from misinterpreting a Markdown-table regular expression as a CSS candidate.
• Marks the UI package as an ES module, removing Vite/PostCSS module warnings.

User and developer impact

Developers can generate varied incident populations without losing reproducibility. Judges can replay a known scenario from one command, and reviewers can verify the entire backend and frontend through make test.

No production detection behavior changes. This endpoint remains a demo and testing facility backed by the in-memory incident store.

Validation

• make test
  • 76 backend tests passed
  • TypeScript compilation passed
  • Vite production build passed
• bash -n cluster/test-diverse-threats.sh
• git diff --check

Reviewer guide

1. Review validation and seed handling in agent/src/main.py.
2. Review deterministic replay coverage in agent/tests/test_simulation.py.
3. Inspect the generated curl payloads with make -n simulate-threats and a seeded variant.
4. Confirm the prior/new-work boundary in BUILD_WEEK.md.

Out of scope and follow-ups

The following work remains intentionally separate so each Build Week phase stays attributable and reviewable:

• Argus World Model publishing;
• Phoenix randomized customer-journey and resilience scenarios;
• Sentinel supervisor implementation;
• cross-agent causal incident correlation;
• dashboard content and visual polish;
• final judge-mode packaging and demo video.