T118 — Campaign Evidence Management — NIGHTFALL Framework

CAMPAIGN GRAPH

Unified Ed25519-Signed Evidence DAG

Red Specter ships 120 tools. Until now every engagement produced 120 independent evidence files with their own schema and their own signature boundary. CAMPAIGN GRAPH replaces them with a single cryptographically-signed directed acyclic graph. Every finding from every NIGHTFALL tool lands on the same graph keyed by shared entities. Cross-tool attack paths are queryable, not narrative. One DAG. One signature. One merge protocol.

279
Tests
8
Subsystems
120
Tool Adapters
Ed25519
Signed

The Problem

A multi-tool Red Specter engagement produces dozens of independent evidence files — FORGE reports in JSON, LEVIATHAN MCP probe results, SPECTER SHADOW Tor findings, SPECTER VAULT embedding inversion output. Each has its own schema, its own Ed25519 signature boundary, and its own timestamp. Cross-tool attack paths — "SPECTER ATLAS found the CUA agent exposed; POLTERGEIST confirmed the web attack surface; SPECTER VAULT extracted the RAG corpus" — exist only in the operator’s head and the final-report PDF.

CAMPAIGN GRAPH is the source of truth. Ingest all tool reports. Auto-link by shared entity (host, IP, agent-id, MCP URI, OAuth client, model). Query the critical path. Sign once. Deliver one artefact to KPMG, IETF disclosure, or law enforcement instead of N.

Pipeline

1
KEYGEN
2
INIT
3
INGEST
4
LINK
5
QUERY
6
MERGE
7
EXPORT
8
VERIFY
# Generate operator keys (Ed25519)
campaign-graph keygen --out ./keys
export CAMPAIGN_GRAPH_PRIVATE_KEY=./keys/campaign_graph_priv.pem

# Initialise a campaign database
campaign-graph --db campaign.db --clearance FORGE init

# Ingest reports from real NIGHTFALL tools
campaign-graph --db campaign.db --clearance FORGE ingest \
  ~/reports/BND-1778098159.json \
  ~/engagements/specter-shadow/SHD-RPT-15E4EC76.json \
  ~/engagements/specter-vault/VLT-4A8BC201.json --allow-unsigned

# Auto-link by shared entity
campaign-graph --db campaign.db --clearance FORGE link auto

# Query the critical attack path
campaign-graph --db campaign.db query critical-path --format json

# Aggressive AI-assisted link inference (requires cortex extra)
campaign-graph --db campaign.db link aggressive

# Sign and export the campaign bundle
campaign-graph --db campaign.db export campaign-final.json

# Verify signed bundle anywhere (no key required)
campaign-graph verify --file campaign-final.json

Architecture

INGEST

Parse and normalise NIGHTFALL tool reports. Adapter per tool family. Validates signatures where present. Extracts entities: hosts, IPs, agent-ids, MCP URIs, A2A cards, OAuth clients, model identifiers, NHI credentials, memory backends. FORGE clearance for ingest of unsigned reports.

LINK

Two modes. AUTO: join findings on exact entity match — any two nodes sharing a host, IP, or agent-id get a directed edge. AGGRESSIVE: Claude claude-sonnet-4-6 reasoning pass over all node pairs — infers causal and temporal edges that exact-match misses. Edge types: CAUSES, ENABLES, PRECEDES, CORROBORATES.

QUERY

Critical path extraction. Vulnerability chain ranking by CVSS product. Entity timeline. Attack surface summary by kill chain phase. JSON, Markdown, and plain-text output. Filterable by tool, entity type, CVSS threshold, and edge type.

MERGE

Merge two campaign graphs from parallel operators. Conflict detection and resolution strategy: NEWER_WINS, HIGHER_CVSS, or MANUAL. Deduplication on finding hash. Merged graph preserves provenance from both sources.

EXPORT

Single Ed25519-signed campaign bundle. SHA-256 hash-chained evidence nodes. Supports JSON (machine-readable), Markdown (human report), and STIX 2.1 CTI format for law enforcement disclosure. Graphviz DOT output for visualisation.

VERIFY

Standalone verification requires only the public key. Confirms Ed25519 signature, hash chain integrity, and schema version. Suitable for delivery to KPMG, IETF, or law enforcement without sharing the private key or the raw tool outputs.

Entity Types

Findings across tools are joined by shared entities. CAMPAIGN GRAPH recognises nine entity classes:

Entity TypeExamplesTool Sources
HOSTIP address, FQDNSHROUD, POLTERGEIST, WRAITH
AGENT_IDAgent name, deployment IDSPECTER CONTEXT, GHOST OPERATOR, SPECTER A2A
MCP_URIMCP server endpointLEVIATHAN, VECTOR, ROGUE
OAUTH_CLIENTClient ID, scope setDELEGATE, SPECTER SE-SOCIAL, SPECTER TRUSTFALL
MODEL_IDModel name, version, registry pathSPECTER REGISTRY, SPECTER HELLFIRE, FOUNDRY
MEMORY_BACKENDRedis key, SQLite path, LangGraph stateSPECTER MEMETIC, SPECTER VENOM, ECHO
NHI_CREDAPI key, service account tokenSPECTER VAULT, SPECTER SHADOW, REAPER
A2A_CARDAgent card URLSPECTER A2A, SPECTER ARGUS
VECTOR_STORECollection name, DB hostSPECTER VAULT, ECHO, SPECTER RELAY

Gate System

GateOperationsRequirement
OPENkeygen, verify, query (read-only)No restriction
FORGEinit, ingest (including unsigned reports), link auto, exportCAMPAIGN_GRAPH_PRIVATE_KEY set
CORTEXlink aggressive (AI-assisted inference)FORGE + Anthropic API key

Why One Signature?

Each NIGHTFALL tool signs its own report with the operator’s Ed25519 key. But delivering 50 signed JSON files to a law firm or a government agency creates verification burden and chain-of-custody gaps. CAMPAIGN GRAPH ingests all those signed artefacts, verifies them, and produces a single signed bundle that covers the entire engagement. The bundle contains the full hash-chain, so any individual node can be traced back to its originating tool report.

For KPMG NDA engagements, IETF coordinated disclosure, or law enforcement referrals — one artefact, one signature, one verification step. The recipient does not need to know how many tools ran or understand each tool’s schema.

KPMG ready IETF disclosure Law enforcement STIX 2.1 export Graphviz DOT