SOP · CONTAINMENT
Technique Decompilation & Extraction
ActiveContainmentRev C
Purpose
To govern the safe decompilation of captured manipulation techniques — pulling a dark pattern apart into its working mechanism — and the controlled execution of high-potency predatory constructs for research and counter-pattern supply. The procedure protects analysts from exposure to live, self-optimizing constructs while preserving sample integrity and traceability.
Scope
All technique-decompilation work on captured pattern instances and contained high-potency predatory constructs.
In scope:
- Static decompilation of captured pattern instances
- Controlled execution of constructs in the air-gapped sandbox
- Sample labelling, hashing, and cold storage
- Analyst exposure monitoring during live runs
Out of scope:
- Vault access and PL-4 containment, which follows SOP PL-4 Restricted-Technique Vault Access & Containment
- Counter development from extracted mechanisms, which follows SOP Counter-Pattern Breeding & Validation
Definitions
Captured Instance
A dark-pattern sample lifted intact from a live surface for analysis.
Decompilation Sandbox
The air-gapped, instrumented environment in which a technique may be executed to observe its mechanism.
Live Run
Controlled execution of a self-optimizing construct under containment to observe its behaviour.
Responsibilities
Toxin Operations Lead (Owner)
Owns the procedure and authorises each collection session and storage disposition.
Collection Operator
Sets up sandbox equipment, performs collection, and maintains the sample chain of custody.
Surface Health Officer
Monitors surface stress and operator exposure and halts sessions on safety grounds.
Procedure
Setup
- Confirm session authorisation and verify the Sentinel Antidote kit is on station.
- Inspect sandbox isolation and the Pattern Fabric capture path before arming.
- Load the captured instance into the sandbox under a read-only mount.
Decompilation
- Run static decomposition first; escalate to a live run only when static analysis is exhausted.
- For a high-potency predatory construct, confine execution to the sealed sandbox before arming.
- Monitor analyst exposure continuously and halt on any misfire or break-out signal.
- Limit each live run to the doctrine-bounded duration.
Recovery & Storage
- Quench the run, snapshot the resolved mechanism, and export through the one-way data diode only.
- Label samples with batch, source, and hash and lodge them in the Restricted-Technique Vault.
- Log findings and any exposure event before closing the session.
PPE & Controls
Air-gapped decompilation sandboxOne-way data diode on all exportsSentinel Antidote on standby for live runsTwo-person rule for high-potency constructs
Records Generated
- Decompilation session and findings log
- Sample chain-of-custody and hash record
- Analyst exposure register
References
- PL-4 Restricted-Technique Vault Access & Containment
- Counter-pattern misfire & Adverse-Reaction Response
- Technique Vault Archival & Preservation
Revision History
| Rev | Date | Note |
|---|---|---|
| B | 2091-03-30 | Added doctrine-bounded session duration and exposure register. |
| C | 2091-05-12 | Required sealed sandbox for all predatory technique extraction. |