HawkinsOperationsDetection Engineering SOC

Reviewer route

Four routes. One proof ceiling.

Each route reads the same system from a different angle. The underlying proof state is the same.

CONTROLLED_TEST_VALIDATEDRENDERING_ONLY

Public inspection layer

source truthseparate
runtime truthseparate
signal truthseparate
evidence truthseparate
public proofseparate

Reviewer intake

Pick your starting route

Four bounded routes into the governed proof system. Each card is a starting action — none promotes a stronger claim than the public ceiling allows.

01

Inspect the proof system

Open the proof ledger, then the HO-DET-001 record. Confirm the public ceiling holds at CONTROLLED_TEST_VALIDATED.

Open →

02

Review artifacts

Open the artifact vault. Each recent governed work item routes to a public-safe reviewer review page.

Open →

03

Trace HO-DET-001

Walk the source → validation → proof receipts for the flagship detection. Stronger wording requires a separate promotion gate.

Open →

04

Open the GitHub org

Inspect the upstream repos. Website rendering is not proof; the repos hold the receipts.

Open ↗

Direct routes

Phase 2 reviewer layers

Four direct entries into the Phase 2 cockpit layers. Each opens a bounded reviewer surface — none promotes a stronger claim than the public ceiling allows.

VALIDATION

Validation registry

Controlled-test packages, fixture counts, and blocked runtime / signal / public-safe states.

Open →

PROOF / VERIFIER

Proof / verifier

Proof Pack 001 manifest, included / excluded items, and verifier routes.

Open →

PLATFORM

Platform contracts

SOAR packet, AutoSOC ledger, factory controller, and blocked authority footers.

Open →

AI GOVERNANCE

AI governance boundary

Offline LLM support is support-only labor; human review remains authority.

Open →

Inspection paths

Choose the route that fits the review window

Validation reviewer · 5 min

Validation registry

Confirm controlled-test packages, fixture counts, and the blocked runtime / signal / public-safe states.

01Open the validation02Filter by family.03Inspect a package
Cares about
What is validated? How many fixtures? What is blocked?
Do not infer
Do not infer runtime deployment or fleet coverage from a passing controlled-test validation.
Validation registry →
Proof / verifier reviewer · 10 min

Proof / verifier

Trace Proof Pack 001, the included / excluded manifest, verifier routes, and the proof status index.

srcvalproofrenderSOURCE → VALIDATION → PROOF · RENDER ≠ AUTHORITY
Cares about
What is in the pack? What is excluded? What do the verifiers check?
Do not infer
Do not infer public-safe runtime proof from a released reviewer package.
Proof Pack 001 →
Platform / SOAR reviewer · 10 min

Platform contracts

Inspect SOAR packet, AutoSOC ledger, Detection Factory Controller, and the GPU / LLM support boundaries.

CASE PACKET FLOWfixturesverifierCI gateceilingCEILING HELD UNLESS STRONGER EVIDENCE PROMOTED
Cares about
What contracts exist? What authority is blocked on each?
Do not infer
Do not infer live Torq / SOAR, response automation, or case closure from a contract blueprint.
Platform contracts →
AI governance reviewer · Deep

AI governance boundary

Trace where AI is allowed as labor and where evidence and human review authorize claims.

AI LABORHUMAN AUTHORITYdraftsscaffoldssummarieshuman reviewauthorizes claimsAI authority · SUPPORT_ONLY
Cares about
What can AI do here? What can AI not do? Where is the authority gate?
Do not infer
Do not infer AI-approved disposition or analyst-approved disposition from any AI-assisted artifact.
LLM boundary →

Governed work · Snapshot as of 2026-05-18

Recent governed work · snapshot

Hand-maintained static snapshot of recent governed work. Each card opens a public-safe reviewer review page.

SNAPSHOT · 2026-05-18
Snapshot scope: governed labor and reviewed merges. Hand-maintained. Not auto-updated. Does not claim runtime-active, signal-observed, or public-safe runtime proof — those wordings remain blocked by the claim firewall.Open the org ↗

Repository routes

External review links

Open route

GitHub organization

Organization front door for HawkinsOperations.

Inspect pathOpen route

Proof repo

Proof records and promotion-state documentation.

Inspect pathOpen route

Detection repo

Detection source candidates. Source does not prove runtime.

Inspect pathOpen route

Cyber Kill Chain map

Reviewer navigation across lifecycle stage, ATT&CK mapping, validation, and proof boundary.

Inspect pathOpen route

Control matrix

Current control routing when available.

Inspect pathOpen route

Repository authority map

Repo plane separation and authority boundaries.

Inspect path

Precision boundary

What this surface does not assert

The reviewer route does not author proof. Blocked terms below remain blocked unless a separate evidence-backed promotion changes their state.

WORDINGSCANNERCEILINGBLOCKEDCLAIM · CI/CDDETERMINISTIC GATE
runtime-activesignal-observedpublic-safe runtime proofproduction-readyproduction/customer/SOCaaS deploymentSOCaaS-readyFortiSIEM integration provenfleet-widelive Splunk firedSplunk-proven Runtime Signal 001Cribl-routedWazuh-routedAWS-liveautonomous SOCAI-approved dispositionanalyst-approved dispositionpublic-safe