# AEGIS — Chaos Security Engineering

- **Document ID:** ARCH-48
- **Phase:** E.3 — Adversarial/Defensive Teams
- **Status:** Draft for review (post four-reviewer discipline)
- **Version:** 0.1
- **Date:** 2026-07-10
- **Owner:** Chief Security Architect

---

## 1. Purpose

Codify systematic failure injection into AEGIS's security-critical paths. Chaos verifies that fail-secure, graceful-degradation, and safe-mode claims are real, not aspirational. Implements the security-mechanism-4-question spec (mandate #3) — every mechanism's failure is exercised.

## 2. Scope

Scenarios include:
- **Kernel Emergency Mode entry** — triggered synthetically; verify graceful drain + fail-secure.
- **Watchdog silence** — one watchdog stops publishing; verify quorum + alarm.
- **Audit substrate slow-down** — Layer-A ring writes slow; verify Kernel fails-closed on mediated ops per D-03-3.
- **KMS unavailability** — signing key temporarily unreachable; verify graceful degrade + short-lived cache expiry.
- **NATS control-bus partition** — verify revocation TTL fallback + capability cache shrinkage.
- **Kafka broker outage** — ingest backpressure verification.
- **Storage engine circuit-breaker** — read-only degradation path.
- **AI provider outage** — L3 → L2 fallback; L2 → L1 fallback.
- **Plugin runaway** — verify kill-switch time (M-PLG-02 target ≤ 60s).
- **Recovery backup-target tampering** — canary detection.
- **Ceremony workstation network fail-mid-signing** — verify safe abort.

## 3. Discipline

- **Documented expected behavior per scenario.** Actual vs. expected reconciled.
- **Blast-radius bounded.** Chaos runs on canary tenants or dedicated test tenants; production only during scheduled game days with kill switches.
- **Signed chaos plan.** Ceremony-controlled changes; drift monitor.
- **Automated where safe.** Continuous chaos on narrow scenarios; scheduled game-days for cross-system.

## 4. Security-Mechanism 4-Question Spec (mandate #3)

Each scenario answers:
- **What if the mechanism fails?** Precise expected system behavior.
- **Can another mechanism compensate?** Named compensating control.
- **Can operators detect the failure?** Alarm/metric identified.
- **Can attackers hide the failure?** Attack path analyzed; if yes, additional detection needed.

## 5. Cadence

- **Continuous narrow chaos** on canary tenants (per-week rotation).
- **Monthly game day** for a cross-system scenario.
- **Quarterly full DR + chaos** combined.

## 6. Assumption (hypothesis)

- **H-1.** *Documented failure modes match actual behavior under injection.*
   - Evidence: initial pilot.
   - Validation: monthly game-day results.
   - Confidence: Medium initially, rising over time.
   - Expiration: annually.
   - Review Date: monthly.

## 7. Trust Score Contribution

Chaos outcomes contribute to `Verification`, `Health`, `Recovery Status`, and `Threat Activity` dimensions.

## 8. Independent Architecture Review

- **F-1.** *Blast radius risk.* Kill-switches + canary-only + Ops rollback drills.
- **F-2.** *Scenarios out of date.* Consistency checker + owner review.

## 9. Adversarial Architect Review

- **A-1.** *Insider disables a chaos scenario.* Signed plan + Auditor + drift monitor.
- **A-2.** *Attacker times attack for game day to hide in noise.* Game days clearly signaled; SEV-2+ during game days routes to shadow on-call as well.

## 10. Operational Reliability Review

- **O-1.** Game-day facilitation documented.
- **O-2.** Post-game retrospective template.
- **O-3.** Blast-radius controls hardened.

## 11. Self-Critique

- **S-1.** *Chaos in production is unavoidable if we want realism.* Canary tenants + kill-switch + rollback compensate for v0-GA; graduated production chaos post-v1.
- **S-2.** *Expected-behavior definitions may drift from code.* Consistency checker links scenarios to ARCH-* claims.

## 12. First-Target Analysis and Redesign

**Target:** the chaos plan (list of scenarios). If pruned quietly, whole failure classes go untested. Response: plan signed + ceremony-controlled + drift monitor + external audit annually samples plan coverage.

## 13. Future Risks / Known Limitations / Out-of-Scope / Retirement

- **Future Risks.** Chaos may miss cascading multi-failure scenarios; game-day design must evolve.
- **Known Limitations.** Production chaos limited in v0-GA to canary tenants.
- **Out-of-Scope.** Destructive chaos in production.
- **Retirement Conditions.** Never — chaos is a permanent discipline.

## 14. Decisions

### D-48-1. Continuous narrow + monthly game day + quarterly DR-combined chaos

- **Reason.** Balanced verification without unacceptable blast radius.

## 15. Change Log

- **0.1 (2026-07-10)** — Initial draft.