1The framework
Maneuver Calculus is a procedure-level calculus of adversary action, defensive control, and the coverage relation connecting them. It models adversary behaviour as typed, objective-rooted state changes over a persistent world-state, so that a coverage conclusion is something a defender derives — and can audit — rather than something anyone asserts.
1.1The unit of account
The unit of account is the maneuver: one procedure, identified by its observable effect. A maneuver declares its preconditions (the state the world must be in), one core mechanism, and its postconditions (the state the world is left in). The calculus sits one altitude below technique labels: many procedures implement one technique, and the label lives on the technique, never on the maneuver.
A maneuver's identity is its single invariant core plus the objective it serves — not its tradecraft. This objective-rooting is the forgery-resistance anchor of the whole system: decoys can obscure a path, but the true chain still points at the objective.
{P}, mechanism m, postcondition {Q}. It is rooted in the objective it serves and identified by an invariant core — the chokepoint that cannot change without changing the goal. An implementation variant (red) realizes the same core with different, swappable tradecraft.The same anatomy, filled out as a full maneuver record — the branded artifact from our testing. It reads in five zones: identity, the precondition → mechanism → postcondition spine, the defender surface (observables, detection health, the prevent/detect/react grid), a detachable annex (occurrence, attribution, investigation, reconstruction), and a dashed not-yet-modeled zone marking what the calculus is still silent on.
dump-to-disk → userland RPM
◂ used · oc1 → syscall / handle-dup
variant π′ — redline
integrity=system → {admin} ▸ oc2 · lateral SMB
PsExec → reachable ▸ oc3 · ransomware
encrypt → dataState = encrypted
14:20Z · conf 0.9 ──▸ [ oc1 ]
hypothesized step ──▸ obv1 · credentialHeld = {admin}
14:25Z · conf 0.8
Nothing in the not-yet-modeled zone is read as covered — the calculus reports silence there, never a fabricated verdict. The test results measure exactly that discipline.
1.2Invariant core and implementation variant
Every maneuver separates what the adversary cannot change from what they can. The invariant core is the effect that cannot change without changing the goal itself — the chokepoint. An implementation variant is one tradecraft realization of that core: discriminating in telemetry, and freely swappable by the adversary. The calculus types both, because a defence graded against a variant and a defence graded against the core are different claims with different lifetimes.
1.3Robustness
Robustness is the evasion-resistance of a detection, graded L1–L5 on the Summiting the Pyramid scale. The grade is authored — measured empirically, by convergent evolution and mutation survival — but it is not free: where an observable is grounded fixes its role, and the model checks the grade against that role. Grounded in the invariant core, an observable is spanning and should grade high — it fires regardless of variant; grounded in a single implementation, it is discriminating and grades low. A consistency shape flags any grade that disagrees with its grounding.
Robustness is one of two evidence axes. The other is fabricability — injection resistance. A chain that is too clean, high in fabricability and low in robustness, is flagged rather than trusted.
1.4Defensive control and detection health
A defensive control is the defender unit: it sources telemetry, and a
maneuver's mechanism is watched through a detectability. Each detectability
carries a four-valued health — live, degraded, blind,
uncertain — and a dependency logic over what it rests on (required, redundant,
trigger-plus-enrichment, k-of-n). Killing one control ramifies through the dependency graph:
a detectability whose trigger is severed goes blind, one whose enrichment is severed only
degrades, and every coverage conclusion that rested on them moves with them.
blind; the one that only draws enrichment from it — and has its own network-monitor source — merely degrades. Health is four-valued and propagates down the tree, which is why robustness is time-dependent: a grade holds only while the telemetry beneath it does.1.5Coverage
Coverage is the relation between a defensive control and a maneuver. Its constitutive discipline is that coverage MUST be derived — from declared telemetry sourcing, detectability health, and robustness grounding — and MUST NOT be asserted. Where the derivation cannot be made, the calculus is silent: the honest output is "unmodeled — escalate," never an assumed verdict.
That discipline reads as a limitation until it is tested. In the paired-arm tabletop results, it is precisely what separates a responder who discloses a gap from one who fabricates a confident "covered" — see the test results.
1.6Composition and reconstruction
Maneuvers compose. At the type altitude, a completed maneuver's postconditions can satisfy another's preconditions — what a foothold unlocks is first-class and machine-checkable, and chains of unlocking form a directed acyclic graph. At the occurrence altitude, the same structure records what actually happened in an incident, grounded to concrete entities and their states.
Reconstruction runs the calculus backwards: given two observations and the residual between them, it produces a ranked set of maneuver sequences that close the residual — ranked with a forgery-resistance term, so a chain of easily fabricated evidence cannot outrank a chain of robust evidence.
1.7Alignment
The calculus is framework-neutral. Alignment to ATT&CK, D3FEND, Summiting the Pyramid, and DFIQ is by mapping, never by import or subclassing: ATT&CK ids live on the technique altitude, objectives map to tactics, and the procedure altitude below them is where the calculus does its work. Nothing in the model depends on any one framework's taxonomy surviving contact with the next revision.