Echoes Between Runs

Echoes Between Runs is a deterministic, browser-only incident simulator for exploring how discoveries can persist between fictional agent runs and where defensive controls interrupt the chain. It is a teaching model, not a historical reconstruction, exploit trainer, or predictor of real compromise.

The bundled “The Stuck Agent” scenario presents six synchronized beats across a timeline, fictional infrastructure view, and activity feed. A guided comparison replays the same seed while changing only note visibility, then offers closed local defensive-control experiments, learning checks, and a portable JSON report.

Development

npm install
npm run dev

Use npm test, npm run typecheck, npm run lint, and npm run build for the repository gates.

Architecture

• src/simulation/ contains authored scenario data and pure deterministic transition rules.
• src/ui/ renders synchronized views, comparison metrics, controls, and learning checks.
• src/report/ serializes paired runs into a local JSON report.

Simulation state stays in the browser. There is no backend, account system, database, cloud persistence, analytics integration, or runtime dependency on an LLM.

Safety and provenance

The simulator is closed by design. It contains no networking, credential validation, arbitrary URL loading, command execution, vulnerability implementation, or connection to real infrastructure. All actors, credentials, services, packages, identities, organizations, nodes, and transitions are fictional bundled data.

Events display one of four provenance labels:

• sourced for the supplied chronology represented by a beat;
• simulated for authored rule-based transitions;
• inferred for conclusions illustrated by the model;
• mixed when a beat combines classifications and exposes event-level provenance.

The baseline/defended comparison demonstrates that run-scoped notes remove one modeled cross-run inheritance edge. It does not claim universal prevention.

Report export

The export button creates a JSON file locally in the browser. It contains the seed, configuration, ordered fictional event log, provenance, final infrastructure state, metrics, paired differences, assumptions, and limitations. It does not upload or submit data.

Limitations

• The authored rules do not reproduce real vulnerabilities or private agent reasoning.
• Simulated steps and time do not predict real compromise, detection, or containment timelines.
• The project is not a cyber range, scanner, credential validator, or autonomous red-team tool.
• Only the bundled scenario and local fictional fixtures are supported.

License

Released under the MIT License.