OpenCyber AcademyDay 22 — Give every graph edge a type, scope and evidence status
Theory and mechanism. An investigative graph represents claims and records, not just entities that look connected. Name the node layer—source record, session label, device label, application request or claimed job tag—and type the relationship. An edge should identify its source fields, namespace assumptions, time/scope and status. Equality is a comparison result; a validated correlation additionally needs a producer contract and trustworthy provenance; a causal claim needs a supported mechanism. Even a demonstrated technical mechanism would not automatically identify a human.
The following edge list is a precise graph representation. Each row defines its endpoints and relationship; it does not turn a dashed or missing relationship into an observed causal arrow.
Lesson table; scroll horizontally to read all columns →
| Endpoints | Edge type | Supplied evidence | Status / limit |
|---|---|---|---|
| C03 identity field ↔ C09 identity field | Literal session-value equality | Both supply s-77 |
Equality within supplied records; namespace/provenance still need validation |
| C05 application field ↔ C12 application field | Literal request-value equality | Both supply q-144 |
C12 supplements the application record; not independent proof of external origin |
| C09 client label ↔ C04 device label | Cross-source label similarity | Both display runner-03 |
No authenticated process-to-session relationship |
| C09 session ↔ C05 request | Proposed cross-source correlation | Application session field is blank | Direct join unavailable; neither cause nor unrelatedness is established |
| C12 claimed tag ↔ scheduler run | Claimed provenance | batch-17 is self-reported |
Actual run/source relationship not supplied |
Worked contrast. A path from “same account” through “same minute” to “same operation” silently changes edge type twice. Multiple weak similarities do not compose into a strong join. A better graph retains s-77 and q-144 as separate identifiers and records the custodian question that might supply a trustworthy cross-reference. If no such key exists, a direct identifier join is unavailable; a different corroboration method would need its own assumptions and limits.
Offline W5-EDGE contract control. This isolated Python 3 program tests declared comparison rules. CTN-looking rows reproduce bounded labels only; TRAINING-KEY is a separate synthetic positive control whose namespace contract is assumed for the fixture, not authenticated by the program. No network, files or real records are touched.
def edge_status(left, right, left_ns, right_ns, contract_checked):
if left is None or right is None or left == "" or right == "":
return "UNKNOWN_MISSING_KEY"
if left != right:
return "UNEQUAL_VALUES_IN_THIS_TEST"
if left_ns != right_ns:
return "LABEL_EQUAL_NAMESPACE_UNVERIFIED"
if contract_checked is not True:
return "VALUE_EQUAL_SEMANTICS_UNVERIFIED"
return "SCOPED_KEY_MATCH_NOT_CAUSATION"
examples = [
("IDENTITY", "s-77", "s-77", "idp", "idp", False),
("CLIENT-DEVICE", "runner-03", "runner-03", "idp-client", "endpoint-device", False),
("DIRECT", "s-77", None, "idp", "application", False),
("TRAINING-KEY", "train-q1", "train-q1", "training:req-v1", "training:req-v1", True),
("TRAINING-MISMATCH", "train-q1", "train-q2", "training:req-v1", "training:req-v1", True),
("TRAINING-EMPTY", "", "", "training:req-v1", "training:req-v1", True),
]
for name, *fields in examples:
print(name, edge_status(*fields))
assert edge_status("x", "x", "a", "b", True) == "LABEL_EQUAL_NAMESPACE_UNVERIFIED"
Executed output for these exact declarations:
IDENTITY VALUE_EQUAL_SEMANTICS_UNVERIFIED
CLIENT-DEVICE LABEL_EQUAL_NAMESPACE_UNVERIFIED
DIRECT UNKNOWN_MISSING_KEY
TRAINING-KEY SCOPED_KEY_MATCH_NOT_CAUSATION
TRAINING-MISMATCH UNEQUAL_VALUES_IN_THIS_TEST
TRAINING-EMPTY UNKNOWN_MISSING_KEY
The positive control returns a scoped key match rather than causation. The cross-namespace assertion shows why a declared checked flag cannot repair incompatible namespace labels. If someone falsely sets the identity contract flag to True, the classifier will trust that declaration; it cannot authenticate a custodian's evidence. The program assumes otherwise well-formed string identifiers and explicit namespace labels, and is not a general graph-validation service.
Practice and limit. Complete EX022, retaining C5/C5X outputs and adding W5-EDGE. Explain one missing and one cross-namespace edge, then compare the worked answer. None of these fixtures validates the producer contract or demonstrates the missing CTN session-to-request join.
Continue studying — course Day 22: Previous: Day 21 · Week 5 index · Course index · Next: Day 23.
Exercise for this lesson
EX022 — Join audit. Objective: type graph edges and distinguish equal labels from demonstrated correlation. Input: C03–C05/C09/C12, C5/C5X and Day 22's W5-EDGE control. Give an edge list or graph among the supplied session, device, request and tag records; label source fields, namespace/scope assumptions and evidence status. Identify the missing session-to-request relationship and a permitted producer-contract/known-good trace check that could test it. Reproduce all three offline transcripts, separating declared inputs from authenticated evidence. Rubric: 0 = causal/human attribution or fabricated key; 1 = correct equalities but incomplete types, namespace limits or controls; 2 = traceable typed edges, unknown missing join, correct outputs and a source-specific validation request. Worked answer.