Directions¶
This tree is the gym: network, logs, actions, eval. Trainers and new exploit families stay out unless they are a wrapper, pack, or probe.
Belief vs oracle (SOC view vs true compromise)
Defense under SLA / false-positive cost
Reward that does not isolate the whole net
Offline logs → online fine-tune
Adaptive Red, leagues
Event time vs fixed ticks
LLM vs RL on the same env
Catalog: netforge questions. Issues: RESEARCH.md.