What can a defender actually observe?

Question

What must travel with an observation for another analyst or system to use it correctly? The observer, collection conditions, applicable interval, context and provenance matter. A conclusion about one observer at one time cannot silently become a conclusion about every defender or every time.

This matters in ordinary defensive work. A successful action is not the same thing as recorded telemetry; recorded telemetry is not the same thing as detection. A missing alert could reflect an unavailable sensor, a collection gap, a failed rule or an absent behavior. The answer changes the next evidence request and the claim a team can safely make.

Hypothesis

A useful model of observability keeps the conditions of evidence attached through interpretation, computation and projection. It should allow a reader to distinguish “not observed” from “did not happen” and “not available to this observer” from “absent from the world.”

Perspective-qualified views are part of the intended architecture. They are not themselves a confidentiality mechanism or authority to disclose data. A model must explain both what a view means and the separate controls that determine who may receive it.

Experiment

Follow-up evaluation remains proposed. The selected T1–T6 master templates have no completed runs in the source snapshot. T2 asks how a system handles missing evidence; T4 addresses a changed premise; T5 separates execution, effect, telemetry and detection. Their selection does not demonstrate those capabilities.

A concrete future test could give two observers different evidence about the same bounded event, then change the evidence's applicable time or context. The consumer would have to preserve the differences and revise only conclusions that depend on the changed premise. This is an illustrative test design, not an executed experiment or an approved evaluation rubric.

Result: qualifications already fail on named paths

The retained source review identifies three material failures. These are counterexamples to broad conformance claims, with different implementation scopes.

• Temporal and context handling in ontology consumers. Named RDF consumers can use evidence outside its applicable interval or context.
• Identity joins in the native engine. Missing identity fields can compare equal and incorrectly qualify a required join.
• Measured-evidence carriage in ontology constraints. Constraints do not enforce all required test/date or test/population evidence for measured statuses.

The failures are not interchangeable. An ontology-consumer finding does not automatically describe the native compiler, and a historical pass does not erase a retained failure. The source summaries retain earlier dispositions; this site rebuild performed no new semantic test.

Maintained-world experiments also retained unsuccessful cases and additional resource costs. They do not establish that qualified views generally improve decisions or preserve privacy.

Model change

No new formal policy is accepted on this page. The immediate requirement is to repair failures against the contracts that already apply and keep their scope visible. Broader choices remain open.

One such choice concerns support: must a displayed conclusion have one coherent witness satisfying all support dimensions, or may it summarize dimensions supported separately? The inspected contract permits separate summaries; a stronger coherent-witness policy remains unresolved. Presentation must not settle it by hiding the distinction.

Formalization, implementation and coverage

The inspected development sources identify MC-SPEC 0.4.20, ontology mc-core 0.4.20.2, native core 1.0.1 and maintained-world integration v025. They have separate versions and known boundaries; v026 is a prepared, unpromoted candidate. No unified release or whole-system conformance follows from those labels.

Bounded queries and perspective-qualified projections exist in the documented path. General task-preserving reduction, privacy-preserving projection and operational action execution remain unestablished. An observation's meaning, a consumer's behavior and a test's coverage must be assessed separately.

• Inspect source versions and evidence limits
• See the modeling concepts
• Contribute a scoped counterexample