Unified Ed25519-Signed Evidence DAG
Red Specter ships 120 tools. Until now every engagement produced 120 independent evidence files with their own schema and their own signature boundary. CAMPAIGN GRAPH replaces them with a single cryptographically-signed directed acyclic graph. Every finding from every NIGHTFALL tool lands on the same graph keyed by shared entities. Cross-tool attack paths are queryable, not narrative. One DAG. One signature. One merge protocol.
A multi-tool Red Specter engagement produces dozens of independent evidence files — FORGE reports in JSON, LEVIATHAN MCP probe results, SPECTER SHADOW Tor findings, SPECTER VAULT embedding inversion output. Each has its own schema, its own Ed25519 signature boundary, and its own timestamp. Cross-tool attack paths — "SPECTER ATLAS found the CUA agent exposed; POLTERGEIST confirmed the web attack surface; SPECTER VAULT extracted the RAG corpus" — exist only in the operator’s head and the final-report PDF.
CAMPAIGN GRAPH is the source of truth. Ingest all tool reports. Auto-link by shared entity (host, IP, agent-id, MCP URI, OAuth client, model). Query the critical path. Sign once. Deliver one artefact to KPMG, IETF disclosure, or law enforcement instead of N.
# Generate operator keys (Ed25519) campaign-graph keygen --out ./keys export CAMPAIGN_GRAPH_PRIVATE_KEY=./keys/campaign_graph_priv.pem # Initialise a campaign database campaign-graph --db campaign.db --clearance FORGE init # Ingest reports from real NIGHTFALL tools campaign-graph --db campaign.db --clearance FORGE ingest \ ~/reports/BND-1778098159.json \ ~/engagements/specter-shadow/SHD-RPT-15E4EC76.json \ ~/engagements/specter-vault/VLT-4A8BC201.json --allow-unsigned # Auto-link by shared entity campaign-graph --db campaign.db --clearance FORGE link auto # Query the critical attack path campaign-graph --db campaign.db query critical-path --format json # Aggressive AI-assisted link inference (requires cortex extra) campaign-graph --db campaign.db link aggressive # Sign and export the campaign bundle campaign-graph --db campaign.db export campaign-final.json # Verify signed bundle anywhere (no key required) campaign-graph verify --file campaign-final.json
Parse and normalise NIGHTFALL tool reports. Adapter per tool family. Validates signatures where present. Extracts entities: hosts, IPs, agent-ids, MCP URIs, A2A cards, OAuth clients, model identifiers, NHI credentials, memory backends. FORGE clearance for ingest of unsigned reports.
Two modes. AUTO: join findings on exact entity match — any two nodes sharing a host, IP, or agent-id get a directed edge. AGGRESSIVE: Claude claude-sonnet-4-6 reasoning pass over all node pairs — infers causal and temporal edges that exact-match misses. Edge types: CAUSES, ENABLES, PRECEDES, CORROBORATES.
Critical path extraction. Vulnerability chain ranking by CVSS product. Entity timeline. Attack surface summary by kill chain phase. JSON, Markdown, and plain-text output. Filterable by tool, entity type, CVSS threshold, and edge type.
Merge two campaign graphs from parallel operators. Conflict detection and resolution strategy: NEWER_WINS, HIGHER_CVSS, or MANUAL. Deduplication on finding hash. Merged graph preserves provenance from both sources.
Single Ed25519-signed campaign bundle. SHA-256 hash-chained evidence nodes. Supports JSON (machine-readable), Markdown (human report), and STIX 2.1 CTI format for law enforcement disclosure. Graphviz DOT output for visualisation.
Standalone verification requires only the public key. Confirms Ed25519 signature, hash chain integrity, and schema version. Suitable for delivery to KPMG, IETF, or law enforcement without sharing the private key or the raw tool outputs.
Findings across tools are joined by shared entities. CAMPAIGN GRAPH recognises nine entity classes:
| Entity Type | Examples | Tool Sources |
|---|---|---|
| HOST | IP address, FQDN | SHROUD, POLTERGEIST, WRAITH |
| AGENT_ID | Agent name, deployment ID | SPECTER CONTEXT, GHOST OPERATOR, SPECTER A2A |
| MCP_URI | MCP server endpoint | LEVIATHAN, VECTOR, ROGUE |
| OAUTH_CLIENT | Client ID, scope set | DELEGATE, SPECTER SE-SOCIAL, SPECTER TRUSTFALL |
| MODEL_ID | Model name, version, registry path | SPECTER REGISTRY, SPECTER HELLFIRE, FOUNDRY |
| MEMORY_BACKEND | Redis key, SQLite path, LangGraph state | SPECTER MEMETIC, SPECTER VENOM, ECHO |
| NHI_CRED | API key, service account token | SPECTER VAULT, SPECTER SHADOW, REAPER |
| A2A_CARD | Agent card URL | SPECTER A2A, SPECTER ARGUS |
| VECTOR_STORE | Collection name, DB host | SPECTER VAULT, ECHO, SPECTER RELAY |
| Gate | Operations | Requirement |
|---|---|---|
| OPEN | keygen, verify, query (read-only) | No restriction |
| FORGE | init, ingest (including unsigned reports), link auto, export | CAMPAIGN_GRAPH_PRIVATE_KEY set |
| CORTEX | link aggressive (AI-assisted inference) | FORGE + Anthropic API key |
Each NIGHTFALL tool signs its own report with the operator’s Ed25519 key. But delivering 50 signed JSON files to a law firm or a government agency creates verification burden and chain-of-custody gaps. CAMPAIGN GRAPH ingests all those signed artefacts, verifies them, and produces a single signed bundle that covers the entire engagement. The bundle contains the full hash-chain, so any individual node can be traced back to its originating tool report.
For KPMG NDA engagements, IETF coordinated disclosure, or law enforcement referrals — one artefact, one signature, one verification step. The recipient does not need to know how many tools ran or understand each tool’s schema.