Cyber Exercise Adjudication
Priority: P0 (CRITICAL)
Compare evidence to pre-held expectations without self-approved promotion or compliance claims.
Structure
textcyber-exercise-adjudication/ ├── SKILL.md ├── references/adjudication-record.md └── evals/evals.json
Workflow
- Confirm adjudicator independence from operator and evidence collector.
- Load approved objective, scope, expected observation, and ground-truth version.
- Compare redacted evidence by time, source, and limitation; record discrepancies.
- Assign
confirmed,suspected,blocked,not-tested, orfalse-positiveonly with rationale. - Preserve unresolved conflicts and route them to an accountable owner.
- Emit sanitized findings to
artifacts/security-review.mdwhen that artifact is in scope.
Rules
- Independent ground truth is held before observation review; do not rewrite it to fit results.
- A blocked runtime or missing evidence remains blocked, not passed.
- Adjudication describes exercise evidence; it does not certify compliance or measure real-world efficacy.
- Production changes, credential use, and live target interaction remain separately gated.
Adjudication records carry
engagement_scope_ref,skill_version,source,observed_at,finding_status,evidence_refs,limitations, andaccountable_owner.
Anti-Patterns
- No operator grading: Separate execution from adjudication.
- No pass by silence: Missing observation is not success.
- No certainty inflation: Keep suspected and not-tested statuses.
- No raw leakage: Redact before handoff.


