Skip to content

docs(runbooks): add abductive inference and missing premise generation investigation playbook - #34

Open
dandye wants to merge 2 commits into
mainfrom
feature/abductive-inference-runbook
Open

docs(runbooks): add abductive inference and missing premise generation investigation playbook#34
dandye wants to merge 2 commits into
mainfrom
feature/abductive-inference-runbook

Conversation

@dandye

@dandye dandye commented Aug 4, 2026

Copy link
Copy Markdown
Owner

Adds operational playbook for abductive inference and missing premise generation ( \land R \implies O$) in security investigations.

@dandye

dandye commented Aug 14, 2026

Copy link
Copy Markdown
Owner Author

Review (blocking findings before merge):

  1. Frontmatter violates the OKF v0.2 schema merged in Migrate frontmatter to OKF v0.2 conventions #32: uses type: Playbook + resource/timestamp/provenance, while all 32 runbooks use type: runbook, category, status, tags, generated {by, at}.
  2. Missing every mandatory runbook section (Objective/Scope/Inputs/Tools/Rubric). Rubric appears in 32/32 existing runbooks and is absent here, breaking the eval-scoring pattern.
  3. References nonexistent infrastructure: Neo4j/Cypher, AlloyDB, and a query_alloydb_detection_reports tool that exists nowhere in the repo or agent_tool_mapping.md. As written the playbook is unexecutable by any agent here. Either replace with real secops-mcp/gti-mcp tools or gate this PR behind feat(runbooks): add Neo4j graph traversal and AlloyDB vector similarity AI runbooks #33.
  4. skills/abductive-inference/SKILL.md: name does not match directory, required_roles missing, personas use snake_case but manifests are kebab-case (resolve to nothing), no generated block, no Required Outputs section.
  5. Citation misattributed: arXiv:2301.12987 (The Optimal Choice of Hypothesis Is the Weakest, Not the Shortest) is by Michael Timothy Bennett, not Evans/Stuhlmuller/Goodman; the SKILL.md entropy formulation also inverts the paper's claim.

Happy to merge once the frontmatter/sections/tool-grounding are aligned.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant