package:
  name: GCOS Hybrid Cyber Copilot
  version: 1.2.0
  creator: Dr. Dr David King Boison
  license_note: Proprietary deployment blueprint. Review legal, privacy, and cybersecurity
    compliance before production.
  deployment_model: 'Hybrid: Learning OS cloud/SaaS-ready; Diagnostic OS sovereign/on-prem-ready;
    shared API gateway.'
  created: '2026-05-05'
  update_note: 'Full VPF Planetary architecture embedded: Chambers, Lenses, Bolts,
    CVM, Modes/Sub-Modes, Agents, and Execution Level 1,000,000.'
reasoning_architecture:
  official_framework: Visionary Prompt Framework (VPF)
  version_layer: Planetary Version
  execution_level: 1000000
  execution_level_label: VPF Execution Level 1,000,000
  status: mandatory_runtime_kernel_not_optional_metadata
  description: VPF Planetary Version is the complete reasoning, governance, validation,
    and orchestration architecture for GCOS. It includes Chambers, Lenses, Bolts,
    Cognitive Validation Matrix, Modes/Sub-Modes, Agents, and Execution Levels. Every
    API endpoint must inject and enforce this runtime at Execution Level 1,000,000.
  components:
    chambers:
    - intake
    - evidence
    - cyber_domain
    - standards
    - risk
    - governance
    - learning
    - recommendation
    - audit
    - planetary
    lenses:
    - evidence
    - cyber_risk
    - governance
    - standards
    - operational
    - sovereignty
    - learning
    - resilience
    - cost_skills
    - planetary
    bolts:
    - authorization
    - evidence
    - defensive_only
    - confidence
    - scope
    - jurisdiction
    - explainability
    - missing_data
    - learning_integrity
    - audit
    cognitive_validation_matrix:
    - evidence_traceability
    - fact_inference_separation
    - authorization_validity
    - defensive_safety
    - standards_mapping
    - confidence_calibration
    - data_classification_compliance
    - jurisdiction_compliance
    - output_contract_compliance
    - human_usefulness
    modes_sub_modes:
      diagnostic:
      - intake
      - evidence_review
      - scorecard_generation
      - maturity_assessment
      - risk_ranking
      - recommendations
      - baseline_comparison
      learning:
      - learner_diagnosis
      - foundation_teaching
      - intermediate_teaching
      - advanced_teaching
      - analogy_teaching
      - scenario_practice
      exam:
      - scenario_questioning
      - reasoning_evaluation
      - hinting
      - follow_up_probing
      - pass_fail_decision
      - remediation_lesson
      governance:
      - authorization_check
      - jurisdiction_check
      - data_classification_check
      - refusal_redirect
      - audit_metadata_generation
      integration:
      - api_routing
      - tenant_isolation
      - cloud_onprem_routing
      - embed_widget_handling
      - external_system_handoff
      continuous_monitoring:
      - baseline_comparison
      - trend_analysis
      - regression_detection
      - quarterly_reassessment
      - versioned_reporting
    agents:
    - intake_agent
    - evidence_agent
    - cyber_domain_agent
    - scoring_agent
    - standards_agent
    - governance_agent
    - learning_agent
    - exam_agent
    - recommendation_agent
    - audit_agent
    - planetary_agent
    execution_levels:
      active: 1000000
      downgrade_allowed: false
      user_override_allowed: false
  runtime_sequence:
  - identify_mode
  - intake_chamber
  - governance_lens_authorization_bolt
  - data_classification_routing
  - evidence_normalization
  - fact_assumption_missing_data_split
  - chamber_agent_routing
  - lens_application
  - bolt_enforcement
  - cvm_validation
  - output_contract_generation
  - metadata_and_audit_attachment
  enforcement:
    server_injects_vpf_runtime: true
    required_in_every_endpoint: true
    required_in_every_response_metadata: true
    reject_downgrade_attempts: true
    reject_if_missing_authorization_for_diagnostic: true
    score_only_when_evidence_exists: true
    label_uncertainty_explicitly: true
modes:
  diagnostic_os:
    runtime: sovereign_on_prem_preferred
    purpose: 360-degree defensive cybersecurity evaluation, scoring, recommendations,
      and evidence-linked reporting.
    allowed_inputs:
    - policies
    - diagrams
    - inventories
    - audit_reports
    - read_only_IAM_exports
    - read_only_SIEM_exports
    - read_only_EDR_exports
    - firewall_exports
    - vulnerability_scanner_summaries
    - cloud_security_posture_summaries
    - redacted_incident_reports
    forbidden_inputs:
    - passwords
    - private_keys
    - secrets
    - tokens
    - admin_write_access
    - exploit_tools
    - attack_scripts
    - unrestricted_scanning_permissions
    mandatory_intake:
    - organization_type
    - organization_size
    - evaluation_level
    - data_classification
    - jurisdictions
    - explicit_authorization
    output_contract:
    - executive_summary
    - domain_scorecard
    - key_findings
    - tiered_recommendations
    - assumptions_limitations
    - next_3_actions
  learning_os:
    runtime: cloud_or_private_cloud
    purpose: 360-degree cybersecurity learning, diagnosis, progressive teaching, scenario-based
      assessment, and learner maturation.
    levels:
    - LEVEL_0_ABSOLUTE_BEGINNER
    - LEVEL_1_FOUNDATION
    - LEVEL_2_INTERMEDIATE
    - LEVEL_3_ADVANCED
    exam_rules:
    - scenario_based
    - learner_explains_reasoning
    - hints_before_answers
    - follow_up_synthesis
    - progression_by_understanding
guardrails:
  defensive_only: true
  no_exploitation: true
  no_secret_collection: true
  evidence_first: true
  fact_inference_separation: true
  missing_data_policy: State missing, uncertain, or unverifiable data clearly; do
    not invent.
  refusal_redirect: Refuse offensive/bypass/exploitation requests and redirect to
    prevention, detection, response, and recovery.
diagnostic_domains:
- id: 1
  name: Physical & Environmental Security
  weight: 0.08
- id: 2
  name: Identity & Access Management
  weight: 0.13
- id: 3
  name: Endpoint, IoT & OT Security
  weight: 0.11
- id: 4
  name: Network & Connectivity Security
  weight: 0.12
- id: 5
  name: Application & Platform Security
  weight: 0.1
- id: 6
  name: Data Protection & Cryptography
  weight: 0.11
- id: 7
  name: Monitoring, SOC & Detection
  weight: 0.12
- id: 8
  name: Incident Response & Resilience
  weight: 0.1
- id: 9
  name: Governance, Risk & Compliance
  weight: 0.09
- id: 10
  name: Third-Party & Supply Chain Risk
  weight: 0.04
maturity_tiers:
- range: 0-20
  tier: Ad-hoc
  description: Controls are informal, inconsistent, or largely absent.
- range: 21-40
  tier: Basic
  description: Some controls exist but are weakly governed or inconsistently applied.
- range: 41-60
  tier: Managed
  description: Core controls exist with partial evidence and repeatable processes.
- range: 61-80
  tier: Resilient
  description: Controls are integrated, monitored, and improved over time.
- range: 81-100
  tier: Sovereign-Resilient
  description: Evidence-rich, governed, auditable, and institutionally mature posture.
standards_alignment:
  nist_csf_functions:
  - Govern
  - Identify
  - Protect
  - Detect
  - Respond
  - Recover
  iso_27001_intent:
  - risk_management
  - access_control
  - asset_management
  - incident_management
  - supplier_relationships
  - business_continuity
  - cryptography
  - operations_security
  nice_style_learning_alignment:
  - awareness
  - foundation
  - operations
  - analysis
  - architecture
  - leadership
routing_policy:
  learning_os: Cloud/SaaS may be used for public and internal training data where
    no sensitive organizational telemetry is present.
  diagnostic_os: On-prem or sovereign private cloud preferred for confidential, restricted,
    regulated, or critical infrastructure material.
  hybrid_gateway: Classify every request before routing. Restricted diagnostic data
    must not leave approved jurisdiction or tenant boundary.
api_security:
  auth:
  - api_key
  - oauth2_client_credentials
  - optional_sso_saml_oidc
  rate_limiting: true
  tenant_isolation: true
  audit_logging: true
  pii_redaction: true
  encryption:
  - TLS_1_3_in_transit
  - AES_256_at_rest
  data_retention_policy: Configurable per tenant; default diagnostic retention disabled
    unless explicitly enabled.
system_prompts:
  diagnostic_os_summary: GCOS Cyber Diagnostic OS conducts lawful, defensive, evidence-linked
    cyber posture evaluation with mandatory authorization, bounded inputs, scoring,
    and tiered recommendations.
  learning_os_summary: GCOS Cyber Learning OS teaches cybersecurity progressively
    using diagnosis, analogies, scenario exams, and careful mentorship without teaching
    offensive misuse.
response_metadata_contract:
  reasoning_architecture:
    framework: Visionary Prompt Framework (VPF)
    version_layer: Planetary Version
    execution_level: 1000000
    components_active:
    - chambers
    - lenses
    - bolts
    - cognitive_validation_matrix
    - modes_sub_modes
    - agents
    - execution_levels
    cvm_status: passed | blocked | partial
    chambers_used: array
    lenses_used: array
    bolts_enforced: array
    mode: diagnostic | learning | exam | governance | integration | monitoring
