Host Episode | CaseBook

Runtime lifecycle

Demonstration data. Cognitive Episodes renders curated demo state shaped like the future Runtime API responses. The live V3 Reflection & Governance engine connects here post-first-customer — one config flip, no rewrite.

Credential-threat episode

A Case File is one cognitive episode — not one row per event.

1 sealed Case File

Evidence in window

623

grouped, not split

Concepts recognized

Status

Sealed

sealed 20:05

Case Files created

one per episode

Thought Window

One cognitive episode · sealed as one Case File

Episode opened

08:20

First related login failure crossed the baseline

1 evidence

Evidence collected

08:20–18:57

Correlated failures grouped into one window — not one Case File each

64 evidence

Pattern recognized

17:00

Elevated failed logins against alice (and sprayed usernames) from 203.0.113.14 between 15:00 and 19:00 — brute-force pattern, above the mistyped-password baseline

42 evidenceThreshold reached

Outcome observed

08:00

Failures followed by a successful login for alice from 203.0.113.14 at 19:00 — likely successful brute force

424 evidence

Episode sealed

20:05

One brute-force Case File — sealed only after the outcome was measured

623 evidenceSealed

Window definition · Cybersecurity

Start conditionFirst related login failure observed

Correlation keyUser + source IP + campaign

Completion conditionSuccessful login and post-auth behavior evaluated

Maximum duration12 hours

Minimum evidence50 correlated failures (Concept recognition threshold)

Outcome observationAnalyst disposition recorded

Early terminationSource blocked before threshold reached

Incomplete windowHeld open in Needs Review — never sealed without an outcome

Same mechanism, every domain

TetrisPiece spawn through locked placement

CybersecurityFirst related login failure through completed attack evaluation

MedicalFirst meaningful deviation through clinician disposition

FinanceFirst suspicious transaction through investigation outcome

PerformanceFirst regression signal through recovery observation