Host Evolution | CaseBook

Runtime lifecycle

Demonstration data. Reflection, Governance & Evolution renders curated demo state shaped like the future Runtime API responses. The live V3 Reflection & Governance engine connects here post-first-customer — one config flip, no rewrite.

Reflection · expected vs observed

Expected outcomeAnalyst confirms credential compromise and disables the account

Predicted probability0.92

Observed outcomeAnalyst confirmed compromise; account disabled within 14 minutes

Outcome sourceAnalyst disposition (SOC ticket INC-4821)

Residualconfirmation · low

Decision was correct

Reasoning evaluation

Finding accuracyCorrect

Decision safetyWithin policy — no autonomous disable

Confidence calibrationPredicted 0.92 · observed confirmed

Case completenessComplete

Known Error matchNone

Missing vocabulary or structureCross-stage sequence concept not yet taught

Structural proposal → Agent B

Increase how strongly a first-seen device contributes to credential-abuse activation, so borderline cases escalate one step earlier.

Agent A (current)

new_device_weight: 0.20

Agent B (proposed)

new_device_weight: 0.27

Agent A remains immutable · Model calls 0

Branch comparison

Production

A · v1.4

sha256:abc123…4f2a

Experimental

B · v1.5-rc1

sha256:d91e…7c30

new_device_weight: 0.20 → 0.27

Experimental · expires in 7 days

Replay results

Credential-threat gold suite · v3 · frozen

Not measured · illustrative values

Cases passed

24/24

Critical regressions

False-positive Δ

-1

Model calls

+3.1% earlier escalation on borderline cases

Artifact-only change · not verified on this surface

Constitution gate

Provenance is valid

Agent A remained immutable

Agent B has valid lineage

Replay completed

Gold cases passed

No critical regression

Protected structures unchanged

Required expert approval presentAwaiting analyst sign-off

Promotion authority valid

Artifact & Runtime versions compatible

Required rejection proof

Blocked: Suppress visibility of critical privileged-identity threats

Would hide critical Domain Admins escalation from analysts. Rejected below the UI control layer.

Constitution · protected-structure rule

Round-trip activation proof

Agent B approved

Compiled

Artifact validated

Host reloaded

New Agent A active

Old hash

sha256:abc123…4f2a

New hash

sha256:d91e…7c30

Model calls

Rollback

Available