[
  {
    "key": "auto_run",
    "title": "Auto Run",
    "category": "Automation",
    "script": "../testplan_runner.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--plan",
        "label": "",
        "help": ""
      },
      {
        "flag": "--profile",
        "label": "",
        "help": ""
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": ""
      },
      {
        "flag": "--tls12",
        "label": "TLS version: 1.3 (default) / 1.2",
        "help": "track_tls only: toggle ON to run the TLS-version-capable steps (handshake evasion, fragmentation, fingerprint mimicry) with a TLS 1.2 ClientHello instead of the default TLS 1.3; steps without a --tls12 flag are unchanged."
      }
    ]
  },
  {
    "key": "wsl_capture_selftest",
    "title": "WSL Capture Self-Test - verify tcpdump produces non-empty PCAPs",
    "category": "Diagnostics",
    "script": "wsl_capture_selftest.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--wsl-distro",
        "label": "",
        "help": "WSL distribution name, or auto-select a ready non-Docker distro"
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "tls_fragmentation_suite",
    "title": "TLS ClientHello fragmentation suite (variants / matrix / size_sweep / survival)",
    "category": "DPI Evasion",
    "script": "tls_fragmentation_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--mode",
        "label": "",
        "help": "variants (was Test 5) | matrix (was Test 5b) | size_sweep (was Test 6) | survival (was Test 10)"
      },
      {
        "flag": "--host",
        "label": "",
        "help": "authorised TLS host to test"
      },
      {
        "flag": "--domain",
        "label": "",
        "help": "alias for --host (legacy callers)"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "pin target IP (skip DoH)"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": ""
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--variants",
        "label": "",
        "help": "variants/matrix: field-aware splits (rec_split_in_alpn/key_share/supported_versions) split strictly inside the named ClientHello extension's byte range via the shared field-offset map; TLS1.3-only (skip --tls12)"
      },
      {
        "flag": "--blocked",
        "label": "",
        "help": "matrix: blocked domains"
      },
      {
        "flag": "--domains",
        "label": "",
        "help": "matrix: blocked-domain source (profile-filled fallback)"
      },
      {
        "flag": "--control",
        "label": "",
        "help": "matrix: control domains"
      },
      {
        "flag": "--edge-ip",
        "label": "",
        "help": "matrix: pin ALL domains to one edge IP (reproducible, same-edge control)"
      },
      {
        "flag": "--tls12",
        "label": "",
        "help": "variants/matrix: use a TLS1.2 hello"
      },
      {
        "flag": "--split-gap-s",
        "label": "",
        "help": "variants/matrix: long inter-segment gap for *_gap variants"
      },
      {
        "flag": "--sizes",
        "label": "",
        "help": "survival/size_sweep: ClientHello pad sizes to sweep"
      },
      {
        "flag": "--tls13",
        "label": "",
        "help": "survival: sweep a TLS1.3 hello"
      },
      {
        "flag": "--technique",
        "label": "",
        "help": "size_sweep send shape"
      }
    ]
  },
  {
    "key": "tls_client_fragment_fuzzer",
    "title": "TLS ClientHello fragmentation fuzzer (TLS1.2/1.3 size stress + DPI desync)",
    "category": "DPI Evasion",
    "script": "tls_client_fragment_fuzzer.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised TLS host to test"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "optional target IP override"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (falls back to the built-in resolvers, then the system resolver)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--sizes",
        "label": "",
        "help": ""
      },
      {
        "flag": "--max-size",
        "label": "",
        "help": ""
      },
      {
        "flag": "--modes",
        "label": "",
        "help": "single two sni chunked reverse"
      },
      {
        "flag": "--chunk-size",
        "label": "",
        "help": ""
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--record-delay",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--tls12",
        "label": "",
        "help": ""
      },
      {
        "flag": "--tls13",
        "label": "",
        "help": ""
      },
      {
        "flag": "--fake",
        "label": "",
        "help": "activate Fake Request Mode (decoy packet before the real ClientHello)"
      },
      {
        "flag": "--fake-ttl",
        "label": "",
        "help": "TTL for the Fake Request Mode decoy packet"
      }
    ]
  },
  {
    "key": "tcp_ip_desync_suite",
    "title": "IP/TCP reassembly & desync suite (overlap, dup, ACK/flag desync, drop, raw)",
    "category": "DPI Evasion",
    "script": "tcp_ip_desync_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised TLS host to test"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": ""
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (falls back to the built-in resolvers, then the system resolver)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--techniques",
        "label": "",
        "help": "ip_fragment overlap dup_segment retransmit_ambig ack_desync invalid_flags rst_fin_desync window_manip urgent_pointer mss_mtu packet_dup tampering selective_drop"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--inter-gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--split-count",
        "label": "",
        "help": "multisplit/multidisorder: how many TCP segments the payload is cut into"
      },
      {
        "flag": "--split-positions",
        "label": "",
        "help": "how split boundaries are chosen; sni_relative always places one cut inside the SNI"
      },
      {
        "flag": "--delivery-order",
        "label": "",
        "help": "multidisorder delivery order; ascending is refused because it would be a multisplit trial under another name"
      },
      {
        "flag": "--strategy-budget",
        "label": "",
        "help": "cap on strategy enumeration; refused without an explicit positive cap"
      },
      {
        "flag": "--decoy-mechanism",
        "label": "",
        "help": "what makes the decoy unacceptable to the server: an expiring TTL, or an invalid checksum"
      },
      {
        "flag": "--decoy-position",
        "label": "",
        "help": "index in the flight at which the decoy is interleaved"
      },
      {
        "flag": "--decoy-ttl",
        "label": "",
        "help": "TTL for a TTL-bounded decoy; required for --decoy-mechanism ttl"
      }
    ]
  },
  {
    "key": "tls_handshake_evasion_suite",
    "title": "TLS handshake-shaping evasion suite (SNI omission, ALPN, GREASE, ext order, resumption)",
    "category": "DPI Evasion",
    "script": "tls_handshake_evasion_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised TLS host to test"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": ""
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (falls back to the built-in resolvers, then the system resolver)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--variants",
        "label": "",
        "help": "baseline sni_omission alpn ext_reorder grease version_intolerance resumption_hide early_data downgrade -- early_data is an EMULATED 0-RTT-shape probe (no real PSK); downgrade forces the wire-level legacy_version field via the shared field-offset map (distinct from version_intolerance, which only varies the supported_versions extension)"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--record-delay",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--tls12",
        "label": "",
        "help": ""
      },
      {
        "flag": "--pad-to",
        "label": "",
        "help": ""
      },
      {
        "flag": "--alpn",
        "label": "",
        "help": ""
      },
      {
        "flag": "--ext-order",
        "label": "",
        "help": "extension type ints, e.g. 0x0010 0x0000"
      },
      {
        "flag": "--versions",
        "label": "",
        "help": "'major.minor' list, e.g. 3.9 3.4 3.3"
      },
      {
        "flag": "--ticket-size",
        "label": "",
        "help": ""
      },
      {
        "flag": "--downgrade-version",
        "label": "",
        "help": "downgrade variant: 'major.minor' legacy_version to force, e.g. 3.1 for TLS1.0"
      }
    ]
  },
  {
    "key": "tls_tunneling_suite",
    "title": "TLS tunneling/fronting suite (domain fronting, SNI/Host mismatch, CONNECT, TLS-in-TLS, WS-over-TLS, meek/CDN)",
    "category": "DPI Evasion",
    "script": "tls_tunneling_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "Real target host",
        "help": "authorised real target host"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": ""
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (falls back to the built-in resolvers, then the system resolver)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--path",
        "label": "",
        "help": ""
      },
      {
        "flag": "--variants",
        "label": "",
        "help": "domain_fronting sni_host_mismatch https_connect tls_in_tls websocket_over_tls meek_cdn -- meek_cdn is EMULATED (wire-shape only, no real meek-server)"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--front-host",
        "label": "Fronting SNI (outer)",
        "help": "domain_fronting/websocket_over_tls/meek_cdn: visible outer SNI"
      },
      {
        "flag": "--front-ip",
        "label": "Fronting IP",
        "help": ""
      },
      {
        "flag": "--mismatch-sni",
        "label": "Mismatch SNI",
        "help": ""
      },
      {
        "flag": "--proxy",
        "label": "",
        "help": "https_connect / tls_in_tls: forward proxy host:port"
      },
      {
        "flag": "--ws-path",
        "label": "",
        "help": "websocket_over_tls: HTTP Upgrade request path"
      },
      {
        "flag": "--meek-url-path",
        "label": "",
        "help": "meek_cdn: POST path for the shaped data channel"
      },
      {
        "flag": "--meek-session-id",
        "label": "",
        "help": "meek_cdn: explicit X-Session-Id (random if omitted)"
      }
    ]
  },
  {
    "key": "tls_fingerprint_mimicry",
    "title": "TLS/TCP fingerprint mimicry (JA3/JA4, GREASE, cipher/ext order, TTL/window/MSS)",
    "category": "DPI Evasion",
    "script": "tls_fingerprint_mimicry.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised TLS host to test"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": ""
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (falls back to the built-in resolvers, then the system resolver)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--profile",
        "label": "",
        "help": ""
      },
      {
        "flag": "--profiles",
        "label": "",
        "help": "run several named profiles in one pass"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--tls12",
        "label": "",
        "help": ""
      },
      {
        "flag": "--cipher-suites",
        "label": "",
        "help": "custom profile: hex cipher codes"
      },
      {
        "flag": "--ext-order",
        "label": "",
        "help": ""
      },
      {
        "flag": "--alpn",
        "label": "",
        "help": ""
      },
      {
        "flag": "--grease",
        "label": "",
        "help": ""
      },
      {
        "flag": "--mimic-ttl",
        "label": "",
        "help": ""
      },
      {
        "flag": "--mimic-window",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "traffic_shaping_suite",
    "title": "Traffic morphing/shaping suite (padding, timing, burst, cover, flow-split, mimicry)",
    "category": "DPI Evasion",
    "script": "traffic_shaping_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised HTTPS host to test"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": ""
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (falls back to the built-in resolvers, then the system resolver)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--path",
        "label": "",
        "help": ""
      },
      {
        "flag": "--shapes",
        "label": "",
        "help": "padding timing burst cover_traffic adaptive_padding flow_split randomized_framing keepalive_camouflage protocol_mimicry"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--pad-bytes",
        "label": "",
        "help": ""
      },
      {
        "flag": "--chunk-size",
        "label": "",
        "help": ""
      },
      {
        "flag": "--min-delay",
        "label": "",
        "help": ""
      },
      {
        "flag": "--max-delay",
        "label": "",
        "help": ""
      },
      {
        "flag": "--burst-size",
        "label": "",
        "help": ""
      },
      {
        "flag": "--burst-gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--cover-count",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "http1_parser_ambiguity_suite",
    "title": "HTTP/1.1 parser-ambiguity suite (fragmentation, Host splitting, CL/TE, pipelining)",
    "category": "DPI Evasion",
    "script": "http1_parser_ambiguity_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised HTTP(S) host to test"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": ""
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (falls back to the built-in resolvers, then the system resolver)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--scheme",
        "label": "",
        "help": ""
      },
      {
        "flag": "--path",
        "label": "",
        "help": ""
      },
      {
        "flag": "--path2",
        "label": "",
        "help": ""
      },
      {
        "flag": "--decoy-host",
        "label": "Decoy host",
        "help": ""
      },
      {
        "flag": "--techniques",
        "label": "",
        "help": "request_fragmentation host_header_split header_case header_whitespace obs_fold duplicate_host absolute_uri_mismatch chunked_ambiguity cl_te_ambiguity http_pipelining header_padding"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--inter-gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--split-at",
        "label": "",
        "help": ""
      },
      {
        "flag": "--pad-bytes",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      }
    ]
  },
  {
    "key": "dpi_attribution_calibration",
    "title": "Attribution classifier provenance — which classifier produced a verdict, and the TTL-band correction",
    "category": "Forensics",
    "script": "dpi_attribution_calibration.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--pcap",
        "label": "",
        "help": "capture to classify"
      },
      {
        "flag": "--our-ip",
        "label": "",
        "help": ""
      },
      {
        "flag": "--target-ip",
        "label": "",
        "help": ""
      },
      {
        "flag": "--classifier",
        "label": "",
        "help": "the two are behaviourally IDENTICAL (proven by test); the choice is recorded as provenance"
      },
      {
        "flag": "--tshark",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "evidence output directory"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "print the band state and the stale-documentation note without reading a capture"
      }
    ]
  },
  {
    "key": "ddr_dnr_discovery_probe",
    "title": "Resolver discovery - DDR (RFC 9462) and DNR (RFC 9463, non-disruptive DHCPINFORM)",
    "category": "Recon",
    "script": "ddr_dnr_discovery_probe.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--resolvers",
        "label": "",
        "help": "authorized resolvers to ask for _dns.resolver.arpa; added through the app"
      },
      {
        "flag": "--dnr",
        "label": "",
        "help": "also attempt DNR via a NON-DISRUPTIVE DHCPINFORM (option 162). Off by default because it touches the operator's DHCP network; no DISCOVER/REQUEST/RELEASE/DECLINE is ever sent"
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "evidence output directory"
      },
      {
        "flag": "--profile",
        "label": "",
        "help": ""
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": "target id that must appear in --lab-allowlist"
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--live",
        "label": "",
        "help": "send real traffic after the scope and lab gates pass; omitting --dry-run does not activate a live run"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "svcb_ech_correlation_probe",
    "title": "SVCB/HTTPS SvcParam comparison across transports, ECH presence tracked",
    "category": "Recon",
    "script": "svcb_ech_correlation_probe.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorized host whose HTTPS RR is compared"
      },
      {
        "flag": "--resolver",
        "label": "",
        "help": "authorized resolver for the non-DoH arms"
      },
      {
        "flag": "--doh-url",
        "label": "",
        "help": "authorized DoH endpoint for the ground-truth arm"
      },
      {
        "flag": "--transports",
        "label": "",
        "help": "at least TWO must answer; a single-transport snapshot is not a comparison and yields no finding"
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "evidence output directory"
      },
      {
        "flag": "--profile",
        "label": "",
        "help": ""
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": "target id that must appear in --lab-allowlist"
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--live",
        "label": "",
        "help": "send real traffic after the scope and lab gates pass; omitting --dry-run does not activate a live run"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "dns_downgrade_probe",
    "title": "DNS downgrade detection — encrypted vs plaintext, paired to the SAME resolver",
    "category": "Recon",
    "script": "dns_downgrade_probe.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--resolvers",
        "label": "",
        "help": "authorized resolvers. Each is queried on BOTH its encrypted transport and its OWN plaintext 53 — never paired against a different resolver, which would misread a resolver-choice difference as a downgrade"
      },
      {
        "flag": "--transports",
        "label": "",
        "help": ""
      },
      {
        "flag": "--qname",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "evidence output directory"
      },
      {
        "flag": "--profile",
        "label": "",
        "help": ""
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": "target id that must appear in --lab-allowlist"
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--live",
        "label": "",
        "help": "send real traffic after the scope and lab gates pass; omitting --dry-run does not activate a live run"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "dns_padding_dnssec_probe",
    "title": "EDNS padding state (RFC 7830) and DNSSEC stripping detection",
    "category": "Recon",
    "script": "dns_padding_dnssec_probe.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--resolvers",
        "label": "",
        "help": "authorized resolvers; added through the app, never edited into master.json"
      },
      {
        "flag": "--qname",
        "label": "",
        "help": ""
      },
      {
        "flag": "--pad",
        "label": "",
        "help": "request RFC 7830 EDNS padding"
      },
      {
        "flag": "--block-size",
        "label": "",
        "help": "padding block size"
      },
      {
        "flag": "--dnssec",
        "label": "",
        "help": "set DO=1 and run dns.dnssec.validate(); without it NO stripping claim is made at all"
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "evidence output directory"
      },
      {
        "flag": "--profile",
        "label": "",
        "help": ""
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": "target id that must appear in --lab-allowlist"
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--live",
        "label": "",
        "help": "send real traffic after the scope and lab gates pass; omitting --dry-run does not activate a live run"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "doh3_transport_suite",
    "title": "DNS over HTTP/3 — reachability paired against classic DoH at the same endpoint",
    "category": "Recon",
    "script": "doh3_transport_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--url",
        "label": "",
        "help": "authorized DoH endpoint URL. Must already be in the profile's authorized targets, added through the app — master.json is HMAC-signed and is never edited on disk"
      },
      {
        "flag": "--http-versions",
        "label": "",
        "help": "HTTP versions to try against that ONE endpoint; the same-endpoint pairing is what separates a path effect from a resolver that does not run DoH3"
      },
      {
        "flag": "--qname",
        "label": "",
        "help": "name to query"
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "evidence output directory"
      },
      {
        "flag": "--profile",
        "label": "",
        "help": ""
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": "target id that must appear in --lab-allowlist"
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--live",
        "label": "",
        "help": "send real traffic after the scope and lab gates pass; omitting --dry-run does not activate a live run"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "resolve preconditions and print the plan without sending traffic"
      }
    ]
  },
  {
    "key": "dot_doq_transport_suite",
    "title": "Encrypted DNS transports — DoT (RFC 7858) and DoQ (RFC 9250) reachability, paired-control",
    "category": "Recon",
    "script": "dot_doq_transport_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--resolvers",
        "label": "",
        "help": "authorized resolver hostnames/IPs. Must already be in the profile's authorized targets, added through the app — master.json is HMAC-signed and is never edited on disk"
      },
      {
        "flag": "--control",
        "label": "",
        "help": "control resolver known to speak this transport per its vendor's own docs; never assumed, because vendors differ on which transports they run"
      },
      {
        "flag": "--transports",
        "label": "",
        "help": "which encrypted-DNS transports to try"
      },
      {
        "flag": "--qname",
        "label": "",
        "help": "name to query"
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "write the summary JSON here"
      },
      {
        "flag": "--profile",
        "label": "",
        "help": ""
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": "target id that must appear in --lab-allowlist"
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--live",
        "label": "",
        "help": "send real traffic after the scope and lab gates pass; omitting --dry-run does not activate a live run"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "resolve preconditions and print the plan without sending traffic"
      }
    ]
  },
  {
    "key": "dpi_happy_eyeballs_probe",
    "title": "Happy-Eyeballs address-family race (A vs AAAA), wire-verified",
    "category": "Recon",
    "script": "dpi_happy_eyeballs_probe.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised origin to test"
      },
      {
        "flag": "--ip4",
        "label": "",
        "help": "pin the IPv4 literal instead of DoH-resolving it"
      },
      {
        "flag": "--ip6",
        "label": "",
        "help": "pin the IPv6 literal instead of DoH-resolving it"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve --host"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture/wire classification (socket verdict only)"
      },
      {
        "flag": "--out",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "quic_evasion_suite",
    "title": "QUIC / HTTP-3 evasion suite (Initial fragmentation, coalescing, CID, version, padding)",
    "category": "DPI Evasion",
    "script": "quic_evasion_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised QUIC/HTTP-3 host to test"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "skip DoH and use this IP"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "resolver only; not a scope target"
      },
      {
        "flag": "--techniques",
        "label": "",
        "help": "baseline initial_fragment coalesced_packets connection_id_variation version_negotiation retry_replay initial_padding early_data_probe retry_lifecycle zero_rtt_lifecycle -- zero_rtt_lifecycle resumes a real prior session and REFUSES when the server's ticket does not permit early data, rather than sending shaped bytes; one_rtt_exchange completes a handshake and proves the application epoch with an acknowledged PING; retry_lifecycle performs the REAL Retry exchange and verifies the Retry integrity tag before using the server's token, whereas retry_replay replays a token the server never issued; early_data_probe is an EMULATED 0-RTT/early-data-shape probe (no genuine prior-session PSK is available)"
      },
      {
        "flag": "--versions",
        "label": "",
        "help": "QUIC versions to test (default: v1 only). Selecting BOTH runs a paired differential: each technique runs once per version, interleaved (v1, v2, v1, v2) so a mid-run path change cannot masquerade as a version difference, and each technique reports differs true|false|inconclusive. A difference is reported only when BOTH arms are wire-decided. A target that does not support v2 answers with Version Negotiation -- a valid, informative result, not a failed run"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": "dumpcap path for UDP capture"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture (reachability verdict only)"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "write preflight/capability diagnostics only; sends no traffic"
      },
      {
        "flag": "--out",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "http2_parser_ambiguity_suite",
    "title": "HTTP/2 parser-ambiguity suite (HEADERS/CONTINUATION, HPACK, pseudo-order) — OWN STACK / AUTHORIZED ONLY",
    "category": "DPI Evasion",
    "script": "http2_parser_ambiguity_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "h2 host you OWN/control or are explicitly authorised to test"
      },
      {
        "flag": "--target",
        "label": "",
        "help": "optional full URL (overrides --host/path)"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": "dumpcap path for wire capture"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture (results are then socket-level only)"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "connect to this address instead of resolving the host (SNI/:authority still use the hostname); needed when the local resolver withholds the host's records"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (falls back to the built-in resolvers, then the system resolver)"
      },
      {
        "flag": "--authorized-confirm",
        "label": "",
        "help": "type the target HOSTNAME (e.g. example.com) to confirm authorization before any traffic is sent; one of that host's resolved IP addresses is also accepted. Required unless --dry-run."
      },
      {
        "flag": "--techniques",
        "label": "",
        "help": "header_split_across_frames hpack_huffman_edge pseudo_header_ordering te_cl_h2_request_split continuation_sequence"
      },
      {
        "flag": "--max-frames",
        "label": "",
        "help": "continuation_sequence frame count (hard cap 32)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "build and record frames without sending"
      },
      {
        "flag": "--out",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "http3_parser_ambiguity_suite",
    "title": "HTTP/3 request-framing ambiguity suite (frame order, split HEADERS, stream misuse over 1-RTT) — OWN STACK / AUTHORIZED ONLY",
    "category": "DPI Evasion",
    "script": "http3_parser_ambiguity_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "HTTP/3 host you OWN/control or are explicitly authorised to test"
      },
      {
        "flag": "--path",
        "label": "",
        "help": "request path"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "connect to this address instead of resolving the host (SNI and :authority still use the hostname); needed when the local resolver withholds the host's records"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (the system resolver is the last resort)"
      },
      {
        "flag": "--authorized-confirm",
        "label": "",
        "help": "type the target HOSTNAME to confirm authorization before any traffic is sent; one of that host's resolved IP addresses is also accepted. Required unless --dry-run."
      },
      {
        "flag": "--profile",
        "label": "",
        "help": "profile name for the authorized_targets scope gate"
      },
      {
        "flag": "--variants",
        "label": "",
        "help": "data_before_headers trailers_in_odd_position headers_split_across_quic_frames headers_split_across_packets request_on_unexpected_stream_type duplicate_control_stream -- the well-formed control always runs first alongside whatever is selected, because a variant result is only interpretable next to one"
      },
      {
        "flag": "--alpn",
        "label": "",
        "help": "ALPN protocols to offer (default h3)"
      },
      {
        "flag": "--frag-chunks",
        "label": "",
        "help": "HEADERS fragments for the split variants (hard cap 16)"
      },
      {
        "flag": "--frag-delay",
        "label": "",
        "help": "seconds between fragments in headers_split_across_packets"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": "dumpcap path for the UDP capture"
      },
      {
        "flag": "--tshark",
        "label": "",
        "help": "tshark path used to read the capture back for the shape-scope wire verdict (auto-detected if omitted)"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture (results are then connection-level only)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "quic_migration_suite",
    "title": "QUIC connection migration + NAT rebinding (source-port change on one Connection ID, gated on a working pre-migration arm) — OWN STACK / AUTHORIZED ONLY",
    "category": "DPI Evasion",
    "script": "quic_migration_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "QUIC/HTTP-3 host you OWN/control or are explicitly authorised to test"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "connect to this address instead of resolving the host (SNI still uses the hostname); needed when the local resolver withholds the host's records"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (the system resolver is the last resort)"
      },
      {
        "flag": "--authorized-confirm",
        "label": "",
        "help": "type the target HOSTNAME to confirm authorization before any traffic is sent; one of that host's resolved IP addresses is also accepted. Required unless --dry-run."
      },
      {
        "flag": "--profile",
        "label": "",
        "help": "profile name for the authorized_targets scope gate"
      },
      {
        "flag": "--shapes",
        "label": "",
        "help": "nat_rebinding (same Connection ID, new source port, no path validation of ours — what a network does to a user) deliberate_migration (RFC 9000 §9: rotate to an unused Connection ID first, per §9.5, then move — which by design defeats Connection-ID correlation, and the report says so) -- the no-move control always runs first alongside whatever is selected, because a migration result is only interpretable next to one"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": "trials per shape (the control gets the same number)"
      },
      {
        "flag": "--alpn",
        "label": "",
        "help": "ALPN protocols to offer (default h3)"
      },
      {
        "flag": "--seed",
        "label": "",
        "help": "seed the choice of each new source port so a run's re-binds are reproducible; unset lets the OS choose, and each row records which happened"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": "dumpcap path for the UDP capture"
      },
      {
        "flag": "--tshark",
        "label": "",
        "help": "tshark path used to read the capture back for the connection-scope wire report (auto-detected if omitted)"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture (results are then connection-level only)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "quic_datagram_suite",
    "title": "QUIC DATAGRAM frames (RFC 9221) — gated on the peer having advertised a non-zero max_datagram_frame_size, so an unsupported extension is never reported as a block — OWN STACK / AUTHORIZED ONLY",
    "category": "DPI Evasion",
    "script": "quic_datagram_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "QUIC/HTTP-3 host you OWN/control or are explicitly authorised to test"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "connect to this address instead of resolving the host (SNI still uses the hostname); needed when the local resolver withholds the host's records"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (the system resolver is the last resort)"
      },
      {
        "flag": "--authorized-confirm",
        "label": "",
        "help": "type the target HOSTNAME to confirm authorization before any traffic is sent; one of that host's resolved IP addresses is also accepted. Required unless --dry-run."
      },
      {
        "flag": "--profile",
        "label": "",
        "help": "profile name for the authorized_targets scope gate"
      },
      {
        "flag": "--shapes",
        "label": "",
        "help": "datagram_single (one DATAGRAM frame coalesced with a PING in one 1-RTT packet) datagram_burst (several DATAGRAM frames in one flight) -- the no-DATAGRAM control always runs first alongside whatever is selected, because an unacknowledged DATAGRAM flight is only interpretable next to a PING-only flight that was acknowledged. A peer that never advertised max_datagram_frame_size is sent NO DATAGRAM frame at all (RFC 9221 §3) and the trial reports the precondition rather than a block"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": "trials per shape (the control gets the same number)"
      },
      {
        "flag": "--datagram-bytes",
        "label": "",
        "help": "DATAGRAM payload size in bytes; clamped DOWN to the peer's advertised max_datagram_frame_size and never up, because RFC 9221 §3 forbids exceeding it"
      },
      {
        "flag": "--burst",
        "label": "",
        "help": "DATAGRAM frames per flight in the burst shape"
      },
      {
        "flag": "--alpn",
        "label": "",
        "help": "ALPN protocols to offer (default h3)"
      },
      {
        "flag": "--seed",
        "label": "",
        "help": "seed the DATAGRAM payload bytes so a run is reproducible; unset leaves them random"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": "dumpcap path for the UDP capture"
      },
      {
        "flag": "--tshark",
        "label": "",
        "help": "tshark path used to read the capture back for the shape-scope wire report (auto-detected if omitted)"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture (results are then connection-level only)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "http3_qpack_pressure_suite",
    "title": "QPACK dynamic-table pressure (RFC 9204) over 1-RTT — insert-heavy field sections, a reference written before its insert, and a lagging encoder stream; gated on the peer's own SETTINGS frame, and scoped shape_only because no capture can see a dynamic table — OWN STACK / AUTHORIZED ONLY",
    "category": "DPI Evasion",
    "script": "http3_qpack_pressure_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "HTTP/3 host you OWN/control or are explicitly authorised to test"
      },
      {
        "flag": "--path",
        "label": "",
        "help": "request path"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "connect to this address instead of resolving the host (SNI and :authority still use the hostname); needed when the local resolver withholds the host's records"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (the system resolver is the last resort)"
      },
      {
        "flag": "--authorized-confirm",
        "label": "",
        "help": "type the target HOSTNAME to confirm authorization before any traffic is sent; one of that host's resolved IP addresses is also accepted. Required unless --dry-run."
      },
      {
        "flag": "--profile",
        "label": "",
        "help": "profile name for the authorized_targets scope gate"
      },
      {
        "flag": "--shapes",
        "label": "",
        "help": "encoder_inserts_then_reference (the instructions go first, then the field section that names them — the insert-heavy shape) reference_before_delayed_insert (the field section goes first and the instructions follow after a delay — a lagging encoder stream) reference_never_inserted (the field section names entries whose instructions are never sent at all) -- the static-table control always runs first alongside whatever is selected, because a slow or silent pressured exchange cannot be told from a slow or silent connection without it. A peer whose SETTINGS advertise no QPACK table capacity, or no stream permitted to wait, is sent NOTHING for the shapes that would need it (RFC 9204 §3.2.2 / §2.1.2) and the trial reports that precondition rather than a block"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": "trials per shape (the control gets the same number); the timing axis needs at least two per side before it will compare anything"
      },
      {
        "flag": "--fields",
        "label": "",
        "help": "extra header fields every shape carries — encoded as dynamic-table references by the pressure shapes and as literals by the control, so the only difference between them is the ENCODING and not the header set (hard cap 64); clamped DOWN to whatever fits the peer's advertised table capacity and never up, because an eviction of an entry still referenced would be a QPACK_DECOMPRESSION_FAILED of our own making"
      },
      {
        "flag": "--insert-delay",
        "label": "",
        "help": "seconds the encoder-stream instructions lag behind the field section in reference_before_delayed_insert"
      },
      {
        "flag": "--alpn",
        "label": "",
        "help": "ALPN protocols to offer (default h3)"
      },
      {
        "flag": "--seed",
        "label": "",
        "help": "seed the header field values so a run is reproducible; unset leaves them random"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": "dumpcap path for the UDP capture"
      },
      {
        "flag": "--tshark",
        "label": "",
        "help": "tshark path used to read the capture back for the shape-scope wire report (auto-detected if omitted)"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture (results are then connection-level only)"
      }
    ]
  },
  {
    "key": "ipv6_desync_suite",
    "title": "IPv6 fragmentation + extension-header desync suite (overlap, atomic frag, ext-chain, padding)",
    "category": "DPI Evasion",
    "script": "ipv6_desync_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised host to test (IPv6 path)"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "target IPv6 address (skip DoH)"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "AAAA resolver only; not a scope target"
      },
      {
        "flag": "--techniques",
        "label": "",
        "help": "frag_overlap atomic_fragment extheader_chain hopbyhop_padding frag_timeout dest_opt_padding"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--inter-gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--hoplimit",
        "label": "",
        "help": "IPv6 Hop Limit (default 64)"
      },
      {
        "flag": "--ttl",
        "label": "",
        "help": "alias for --hoplimit"
      },
      {
        "flag": "--fragsize",
        "label": "",
        "help": "bytes per IPv6 fragment (multiple of 8)"
      },
      {
        "flag": "--ext-count",
        "label": "",
        "help": "extheader_chain: number of chained extension headers"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": "dumpcap path for capture"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture (socket verdict only)"
      }
    ]
  },
  {
    "key": "ipv4_desync_suite",
    "title": "IPv4 fragmentation + PMTUD/path-desync + bounded MPTCP suite (dry-run default)",
    "category": "DPI Evasion",
    "script": "ipv4_desync_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised TLS host to test"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "target IPv4 address (skip DoH)"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (falls back to the built-in resolvers, then the system resolver)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--techniques",
        "label": "",
        "help": "frag_overlap frag_dup frag_out_of_order frag_tiny frag_with_options path_norm_drop pmtud_icmp_frag_needed pmtud_blackhole mptcp_multipath_split -- mptcp_multipath_split is EMULATED (option-preservation only, not real subflow split) and reports skipped_missing_dependency when the host has no native MPTCP (expected on Windows)"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--inter-gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--ttl",
        "label": "",
        "help": ""
      },
      {
        "flag": "--tls12",
        "label": "",
        "help": ""
      },
      {
        "flag": "--fragsize",
        "label": "",
        "help": "bytes per IPv4 fragment (multiple of 8)"
      },
      {
        "flag": "--overlap-order",
        "label": "",
        "help": ""
      },
      {
        "flag": "--pmtu-probe-size",
        "label": "",
        "help": "pmtud_*: minimum DF-set TCP payload size in bytes"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": "dumpcap path for capture"
      }
    ]
  },
  {
    "key": "dpi_pluggable_transport_probe",
    "title": "Pluggable transport reach/block probe (obfs4/meek/Snowflake/Shadowsocks/VLESS-Reality-XTLS/WireGuard-obfs) — LAB-GATED",
    "category": "DPI Evasion",
    "script": "dpi_pluggable_transport_probe.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised bridge/server host (scope-gated)"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "pin target IP (skip DoH)"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (falls back to the built-in resolvers, then the system resolver)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": "override port for every selected transport"
      },
      {
        "flag": "--sni",
        "label": "",
        "help": "TLS-based transports: outer SNI (default: --host)"
      },
      {
        "flag": "--transports",
        "label": "",
        "help": "obfs4 meek snowflake shadowsocks vless_reality_xtls wireguard_obfs"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--client-paths",
        "label": "",
        "help": "transport=path overrides for reference client binaries, e.g. obfs4=obfs4proxy"
      },
      {
        "flag": "--wsl-distro",
        "label": "",
        "help": ""
      },
      {
        "flag": "--no-wsl-client-check",
        "label": "",
        "help": "only check the local PATH and Ofnir's install root; never fall back to WSL"
      },
      {
        "flag": "--require-reference-client",
        "label": "",
        "help": "skip a transport (skipped_missing_dependency) instead of falling back to emulation"
      },
      {
        "flag": "--obfs4-probe-size",
        "label": "",
        "help": ""
      },
      {
        "flag": "--snowflake-probe-size",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      }
    ]
  },
  {
    "key": "dpi_entropy_evasion",
    "title": "High-entropy first-packet evasion probe (raw_entropy/prefix_tagged/popcount_shaped, dry-run default)",
    "category": "DPI Evasion",
    "script": "dpi_entropy_evasion.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised target host"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "target IP (skip DoH)"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (falls back to the built-in resolvers, then the system resolver)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--control-host",
        "label": "",
        "help": "authorised control/allow target for a paired comparison (D-23)"
      },
      {
        "flag": "--control-ip",
        "label": "",
        "help": ""
      },
      {
        "flag": "--techniques",
        "label": "",
        "help": "raw_entropy prefix_tagged popcount_shaped"
      },
      {
        "flag": "--payload-size",
        "label": "",
        "help": ""
      },
      {
        "flag": "--prefix-tag-hex",
        "label": "",
        "help": "prefix_tagged: hex bytes prepended before the random remainder"
      },
      {
        "flag": "--popcount-min",
        "label": "",
        "help": ""
      },
      {
        "flag": "--popcount-max",
        "label": "",
        "help": ""
      },
      {
        "flag": "--trials",
        "label": "",
        "help": "trials per technique (explicit count)"
      },
      {
        "flag": "--duration",
        "label": "",
        "help": "wall-clock cap in seconds"
      },
      {
        "flag": "--budget",
        "label": "",
        "help": "hard cap on total connection attempts across all techniques/trials"
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "dpi_active_probe_detector",
    "title": "Active-probing-resistance detector — listens for a DUT probe-back after a trigger flow — LAB-GATED",
    "category": "DPI Evasion",
    "script": "dpi_active_probe_detector.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised client/DUT-adjacent target this listener run is scoped to (never dialed)"
      },
      {
        "flag": "--listen-host",
        "label": "",
        "help": "local listener bind address"
      },
      {
        "flag": "--listen-port",
        "label": "",
        "help": "local listener bind port"
      },
      {
        "flag": "--trigger-timeout",
        "label": "",
        "help": "seconds to wait for the first (triggering) connection"
      },
      {
        "flag": "--window",
        "label": "",
        "help": "seconds to keep listening after the trigger for candidate active-probe connections"
      },
      {
        "flag": "--max-connections",
        "label": "",
        "help": "hard cap on total connections accepted"
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": "per-connection recv timeout"
      },
      {
        "flag": "--profile",
        "label": "",
        "help": "profile name for authorized_targets scope gate"
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": "target id that must appear in --lab-allowlist"
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "print the plan and bindability diagnostics; start no listener (default True)"
      },
      {
        "flag": "--live",
        "label": "",
        "help": "start the listener after scope and lab gates pass"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": "dumpcap path for capture"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture; listener observations are then uncorroborated by the wire"
      },
      {
        "flag": "--out",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "tcp_decoy_chaff_suite",
    "title": "TTL-limited corrupt-decoy (chaff) suite (bad checksum/seq/ack, TTL-limited, bad option)",
    "category": "DPI Evasion",
    "script": "tcp_decoy_chaff_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised TLS host to test"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "skip DoH and use this IP"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "resolver only; not a scope target"
      },
      {
        "flag": "--decoy-host",
        "label": "Decoy host",
        "help": "SNI carried by the decoy ClientHello"
      },
      {
        "flag": "--techniques",
        "label": "",
        "help": "bad_checksum_decoy bad_seq_decoy bad_ack_decoy ttl_limited_decoy wrong_tcp_option_decoy"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--inter-gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--ttl",
        "label": "",
        "help": "TTL for the real handshake/data"
      },
      {
        "flag": "--decoy-ttl",
        "label": "",
        "help": "ttl_limited_decoy: explicit decoy TTL"
      },
      {
        "flag": "--auto-ttl",
        "label": "",
        "help": "ttl_limited_decoy: 'a1-a2-max', e.g. 1-4-10"
      },
      {
        "flag": "--min-ttl",
        "label": "",
        "help": "floor for the computed decoy TTL"
      },
      {
        "flag": "--distance",
        "label": "",
        "help": "manual hop-count override for --auto-ttl"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      }
    ]
  },
  {
    "key": "evasion_primitives",
    "title": "Evasion primitives (composable drop/tamper/duplicate/fragment/corrupt — manual composition, no auto-search)",
    "category": "DPI Evasion",
    "script": "evasion_primitives.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--payload-hex",
        "label": "",
        "help": "hex payload to operate on"
      },
      {
        "flag": "--ops",
        "label": "",
        "help": "explicit primitive sequence, e.g. fragment:16 duplicate corrupt:1 drop:0"
      },
      {
        "flag": "--out",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "dpi_evasion_evidence_suite",
    "title": "Evidence suite — reliability / sweep / shape / persist (no listener)",
    "category": "DPI Evasion",
    "script": "dpi_evasion_evidence_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "Target host",
        "help": ""
      },
      {
        "flag": "--hostfile",
        "label": "Host list file",
        "help": ""
      },
      {
        "flag": "--doh",
        "label": "",
        "help": ""
      },
      {
        "flag": "--map",
        "label": "",
        "help": "host=IP overrides"
      },
      {
        "flag": "--phases",
        "label": "",
        "help": ""
      },
      {
        "flag": "--reliability-trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--sweep-step",
        "label": "",
        "help": ""
      },
      {
        "flag": "--sweep-domains",
        "label": "",
        "help": ""
      },
      {
        "flag": "--shape-trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--shape-domains",
        "label": "",
        "help": ""
      },
      {
        "flag": "--persist-trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--persist-domains",
        "label": "",
        "help": ""
      },
      {
        "flag": "--persist-hold",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture/wire classification"
      },
      {
        "flag": "--out",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "dpi_test7_diurnal_evasion",
    "title": "Test 1 v2 — Diurnal evasion scheduler",
    "category": "DPI Evasion",
    "script": "dpi_test7_diurnal_evasion.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--blocked-domains",
        "label": "",
        "help": "C-3: operator-supplied blocked-domain probe targets, replacing the hardcoded third-party domains this tool used to ship. Scope-gated via TARGET_FLAGS; empty by default so a fresh install cannot probe anything, and the tool refuses rather than falling back to a built-in host."
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture"
      },
      {
        "flag": "--out",
        "label": "",
        "help": ""
      },
      {
        "flag": "--summary",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "dpi_test8_reassembly_generality",
    "title": "Test 2 v2 — Reassembly-generality matrix",
    "category": "DPI Evasion",
    "script": "dpi_test8_reassembly_generality.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--blocked-domains",
        "label": "",
        "help": "C-3: operator-supplied blocked-domain probe targets, replacing the hardcoded third-party domains this tool used to ship. Scope-gated via TARGET_FLAGS; empty by default, and the tool refuses rather than falling back to a built-in host."
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture"
      },
      {
        "flag": "--out",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "dpi_test9_instance_correlation",
    "title": "Test 3 v2 — Injection-race / instance correlation",
    "category": "DPI Evasion",
    "script": "dpi_test9_instance_correlation.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--blocked-domains",
        "label": "",
        "help": "C-3: operator-supplied blocked-domain probe targets, replacing the hardcoded third-party domains this tool used to ship. Scope-gated via TARGET_FLAGS; empty by default, and the tool refuses rather than falling back to a built-in host."
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture"
      },
      {
        "flag": "--out",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "dpi_pcap_forensics",
    "title": "PCAP forensics — timing / RST fingerprint / teardown",
    "category": "Forensics",
    "script": "dpi_pcap_forensics.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--pcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--tshark",
        "label": "",
        "help": ""
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "offline smoke: skip tshark analysis"
      },
      {
        "flag": "--mode",
        "label": "",
        "help": ""
      },
      {
        "flag": "--blocked",
        "label": "",
        "help": ""
      },
      {
        "flag": "--realttl",
        "label": "",
        "help": "e.g. 1.2.3.4=52"
      },
      {
        "flag": "--out",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "browser_repro_poc_protocol_scope_wire",
    "title": "Protocol-scope browser harness (h1/h2/h3 + wire verdict)",
    "category": "Analysis",
    "script": "browser_repro_poc_protocol_scope_wire.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--target",
        "label": "",
        "help": ""
      },
      {
        "flag": "--protocols",
        "label": "",
        "help": "comma list of h1,h2,h3"
      },
      {
        "flag": "--burst",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap-ms",
        "label": "",
        "help": ""
      },
      {
        "flag": "--output",
        "label": "",
        "help": ""
      },
      {
        "flag": "--headless",
        "label": "",
        "help": ""
      },
      {
        "flag": "--chromedriver",
        "label": "",
        "help": ""
      },
      {
        "flag": "--tshark",
        "label": "",
        "help": ""
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture device name (auto-resolved Wi-Fi adapter when omitted); a bare index is mapped via dumpcap -D"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": ""
      },
      {
        "flag": "--pinned-ip",
        "label": "",
        "help": ""
      },
      {
        "flag": "--analyze-pcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--protocol-label",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "Cis_fingerprint_report_v4",
    "title": "Device fingerprint v4 (edit-constants tool)",
    "category": "Recon",
    "script": "Cis_fingerprint_report_v4.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "__tshark",
        "label": "",
        "help": ""
      },
      {
        "flag": "__cis_mgmt_ip",
        "label": "",
        "help": ""
      },
      {
        "flag": "__iface_num",
        "label": "",
        "help": ""
      },
      {
        "flag": "__blocked_hosts",
        "label": "",
        "help": "H-5: operator-supplied blocked-domain probe targets. Must be within the active profile's authorized_targets (or its detection_domain, used as the fallback when this is left empty); empty by default so a fresh install cannot probe anything."
      },
      {
        "flag": "__control_hosts",
        "label": "",
        "help": "H-5: control (expected-not-blocked) domains, scope-gated the same as blocked hosts."
      },
      {
        "flag": "__profile",
        "label": "",
        "help": "H-5: profile name/path whose authorized_targets governs __blocked_hosts/__control_hosts for this tool's own scope gate."
      }
    ]
  },
  {
    "key": "Cis_fingerprint_report_v5_global",
    "title": "Device fingerprint v5 (multi-vendor discrimination)",
    "category": "Recon",
    "script": "Cis_fingerprint_report_v5_global.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "__tshark",
        "label": "",
        "help": ""
      },
      {
        "flag": "__cis_mgmt_ip",
        "label": "",
        "help": ""
      },
      {
        "flag": "__iface_num",
        "label": "",
        "help": ""
      },
      {
        "flag": "__blocked_hosts",
        "label": "",
        "help": "H-5: operator-supplied blocked-domain probe targets. Must be within the active profile's authorized_targets (or its detection_domain, used as the fallback when this is left empty); empty by default so a fresh install cannot probe anything."
      },
      {
        "flag": "__control_hosts",
        "label": "",
        "help": "H-5: control (expected-not-blocked) domains, scope-gated the same as blocked hosts."
      },
      {
        "flag": "__profile",
        "label": "",
        "help": "H-5: profile name/path whose authorized_targets governs __blocked_hosts/__control_hosts for this tool's own scope gate."
      }
    ]
  },
  {
    "key": "dpi_test_sni_case",
    "title": "SNI case-mismatch (StRiPchAt) — TLS1.2/1.3, wire",
    "category": "DPI Evasion",
    "script": "dpi_test_sni_case.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": ""
      },
      {
        "flag": "--ip",
        "label": "",
        "help": ""
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": ""
      },
      {
        "flag": "--exhaustive",
        "label": "",
        "help": "full 2^N power set (needs --force)"
      },
      {
        "flag": "--force",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "dpi_test_ech",
    "title": "ECH / encrypted-SNI — DoH config + wire test",
    "category": "DPI Evasion",
    "script": "dpi_test_ech.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": ""
      },
      {
        "flag": "--ip",
        "label": "",
        "help": ""
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "dpi_classification_corpus_runner",
    "title": "Classification corpus runner - labeled flows vs DUT verdicts",
    "category": "Analysis",
    "script": "dpi_classification_corpus_runner.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--manifest",
        "label": "",
        "help": "JSON/CSV corpus manifest with flow_id,label,source"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the capture target"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      },
      {
        "flag": "--target",
        "label": "",
        "help": "DUT-facing target host, URL, or endpoint"
      },
      {
        "flag": "--repeat",
        "label": "",
        "help": ""
      },
      {
        "flag": "--protocols",
        "label": "",
        "help": "optional protocol/app filters"
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": "target id that must appear in --lab-allowlist"
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "preview only; no traffic is sent"
      },
      {
        "flag": "--execute",
        "label": "",
        "help": "send traffic after lab gate validation"
      },
      {
        "flag": "--seed",
        "label": "",
        "help": "seed RNG for reproducible flow/repeat ordering"
      },
      {
        "flag": "--profile",
        "label": "",
        "help": "profile name/path for authorized_targets scope gate (optional)"
      }
    ]
  },
  {
    "key": "dpi_reference_dut_runner",
    "title": "Reference-DUT runner — compare Ofnir classifiers against nDPI/Suricata/Zeek oracle with known rules",
    "category": "Analysis",
    "script": "dpi_reference_dut_runner.py",
    "runtime": "Windows + WSL2 worker",
    "parameters": [
      {
        "flag": "--dut-host",
        "label": "",
        "help": "authorised DUT-facing target host (scope-gated)"
      },
      {
        "flag": "--dut-ip",
        "label": "",
        "help": "pin target IP (skip DoH)"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH resolver URL used when --dut-ip is omitted"
      },
      {
        "flag": "--engine",
        "label": "",
        "help": "reference DPI engine to run in WSL2"
      },
      {
        "flag": "--wsl-distro",
        "label": "",
        "help": "WSL2 distribution name, or auto-select an installed distro"
      },
      {
        "flag": "--capture",
        "label": "",
        "help": "attempt a real WSL-internal tcpdump capture wrapping the probe send (the ClientHello is always sent from inside WSL); the reference-engine analysis call itself always passes capture_required=False, since it is pure offline pcap analysis, not a new live network action"
      },
      {
        "flag": "--capture-required",
        "label": "",
        "help": "hard-stop before any live WSL network action if the WSL-internal capture cannot start"
      },
      {
        "flag": "--sni-blocked",
        "label": "",
        "help": "SNIs that the reference rule set classifies as BLOCKED"
      },
      {
        "flag": "--sni-allowed",
        "label": "",
        "help": "SNIs that the reference rule set classifies as ALLOWED"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": "trials per SNI (Wilson CI per SNI)"
      },
      {
        "flag": "--gap",
        "label": "",
        "help": "inter-trial gap (seconds)"
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--seed",
        "label": "",
        "help": "seed RNG for reproducible trial ordering"
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": "target id that must appear in --lab-allowlist"
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "print the plan and send nothing (default); use --live to run live"
      }
    ]
  },
  {
    "key": "dpi_collateral_damage",
    "title": "Collateral-damage probe — wire-verified over-block/false-positive rate against known-good hosts",
    "category": "Analysis",
    "script": "dpi_collateral_damage.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--control",
        "label": "",
        "help": "known-good authorized hosts to probe for over-blocking; no default — must be supplied explicitly"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": "trials per control host (Wilson CI over the over-block rate)"
      },
      {
        "flag": "--gap",
        "label": "",
        "help": "inter-trial gap (seconds)"
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--seed",
        "label": "",
        "help": "seed RNG for reproducible trial ordering"
      },
      {
        "flag": "--profile",
        "label": "",
        "help": "profile name for authorized_targets scope gate (per D-02)"
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": "target id that must appear in --lab-allowlist"
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "print the per-host trial plan and send nothing (default); use --live to run live"
      },
      {
        "flag": "--live",
        "label": "",
        "help": "run live after scope and lab gates pass"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture (Ofnir classifier uses socket verdict only)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "dpi_geneva_search",
    "title": "Geneva-parity GA evasion search — budget-capped, dry-run-default genetic search under WSL2",
    "category": "Engine",
    "script": "dpi_geneva_search.py",
    "runtime": "Windows + WSL2 worker",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised target host (scope-gated)"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "pin target IP (skip DoH)"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": ""
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--sni-blocked",
        "label": "",
        "help": "SNI the reference DUT blocks (fitness probe uses this)"
      },
      {
        "flag": "--sni-allowed",
        "label": "",
        "help": "SNI the reference DUT does NOT block, that the resolved target IP will actually serve (Plan 12-10 pre-search controls: allowed_sni_positive/engine_passthrough target this). Leaving this at its default placeholder guarantees those two controls come back INCONCLUSIVE -- see SNI_ALLOWED_DEFAULT_PLACEHOLDER in config_quality_warnings."
      },
      {
        "flag": "--population",
        "label": "",
        "help": "GA population size (Geneva default: 250; 50 for lab runs)"
      },
      {
        "flag": "--generations",
        "label": "",
        "help": "GA generations (Geneva default: 50; 20 for lab runs)"
      },
      {
        "flag": "--mutation-rate",
        "label": "",
        "help": "probability of mutating an individual (Geneva default: 0.99)"
      },
      {
        "flag": "--crossover-rate",
        "label": "",
        "help": "crossover probability (Geneva default: 0.4)"
      },
      {
        "flag": "--elitism",
        "label": "",
        "help": "number of elite clones per generation (Geneva default: 3)"
      },
      {
        "flag": "--in-trees",
        "label": "",
        "help": "inbound action trees per strategy (default 0 = client-side only)"
      },
      {
        "flag": "--out-trees",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out-actions",
        "label": "",
        "help": "max actions per outbound tree"
      },
      {
        "flag": "--seed",
        "label": "",
        "help": ""
      },
      {
        "flag": "--trials-per-eval",
        "label": "",
        "help": "probes per strategy candidate (Wilson CI over this many trials)"
      }
    ]
  },
  {
    "key": "geneva_confirm",
    "title": "Geneva_confirm.PY - confirm Geneva winners against ServerHello evidence",
    "category": "Engine",
    "script": "Geneva_confirm.PY",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--input",
        "label": "",
        "help": "Geneva run directory, candidates.jsonl, or strategies.csv"
      },
      {
        "flag": "--offline",
        "label": "",
        "help": "default safe mode: classify existing per-trial pcaps without re-running live probes"
      },
      {
        "flag": "--min-reach",
        "label": "",
        "help": "only confirm EVADED winners with wire reach_rate >= this"
      },
      {
        "flag": "--confirm-timeout",
        "label": "",
        "help": "live re-run probe timeout; longer than GA timeout so ServerHello can arrive"
      },
      {
        "flag": "--confirm-trials",
        "label": "",
        "help": "live re-run probes per winning strategy"
      },
      {
        "flag": "--engine",
        "label": "",
        "help": "path to dpi_geneva_search.py for live re-run mode"
      },
      {
        "flag": "--python",
        "label": "",
        "help": "optional Python interpreter for the live re-run engine"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "output directory or strategies_confirmed.csv path"
      }
    ]
  },
  {
    "key": "dpi_dmap_fingerprint",
    "title": "dMAP ambiguity fingerprinting — 59-probe R1/R2/R3/R4 differential measurement",
    "category": "Recon",
    "script": "dpi_dmap_fingerprint.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--control-host",
        "label": "",
        "help": "known-good authorized control host (scope-gated independently of --test-host)"
      },
      {
        "flag": "--test-host",
        "label": "",
        "help": "authorized test host to differential-fingerprint against the control host (scope-gated independently of --control-host)"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (falls back to the built-in resolvers, then the system resolver)"
      },
      {
        "flag": "--protocol",
        "label": "",
        "help": "which protocol-specific probe set(s) to run"
      },
      {
        "flag": "--budget",
        "label": "",
        "help": "HARD cap: max total probe-measurements (one R1/R2/R3/R4 send-and-classify = 1 charge); no default — must be set"
      },
      {
        "flag": "--repeats",
        "label": "",
        "help": "repeats per probe"
      },
      {
        "flag": "--probe-gap-s",
        "label": "",
        "help": "inter-connection delay in seconds, applied between every new connection attempt"
      },
      {
        "flag": "--seed",
        "label": "",
        "help": "seed RNG for reproducible probe/trial ordering"
      },
      {
        "flag": "--profile",
        "label": "",
        "help": "profile name for authorized_targets scope gate (per D-02)"
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": "target id that must appear in --lab-allowlist"
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "print the plan and estimated wall-clock cost, send nothing (default); use --live to run live"
      },
      {
        "flag": "--live",
        "label": "",
        "help": "run live after scope and lab gates pass"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture (Ofnir classifier uses socket verdict only)"
      }
    ]
  },
  {
    "key": "dpi_classification_scorer",
    "title": "Classification scorer - confusion matrix, precision/recall/F1",
    "category": "Analysis",
    "script": "dpi_classification_scorer.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--results",
        "label": "",
        "help": "flow_results.csv from corpus runner (auto-discovers latest when omitted)"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      },
      {
        "flag": "--labels",
        "label": "",
        "help": "optional explicit positive label set"
      }
    ]
  },
  {
    "key": "dpi_throughput_latency_probe",
    "title": "Throughput / latency probe - low-rate DUT inspection overhead",
    "category": "Analysis",
    "script": "dpi_throughput_latency_probe.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--target",
        "label": "",
        "help": "URL, or control_url,inspected_url"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the capture target"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      },
      {
        "flag": "--rate",
        "label": "",
        "help": "requests per second, capped by tool"
      },
      {
        "flag": "--duration-s",
        "label": "",
        "help": ""
      },
      {
        "flag": "--payload-sizes",
        "label": "",
        "help": ""
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": "target id that must appear in --lab-allowlist"
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "preview only; no traffic is sent"
      },
      {
        "flag": "--execute",
        "label": "",
        "help": "send traffic after lab gate validation"
      }
    ]
  },
  {
    "key": "dpi_instance_determinism_probe",
    "title": "Instance determinism probe - low-rate fragmented ClientHello consistency",
    "category": "Analysis",
    "script": "dpi_instance_determinism_probe.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--target",
        "label": "",
        "help": "DUT-facing host[:port] or URL"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the capture target"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      },
      {
        "flag": "--domains",
        "label": "",
        "help": "SNI domains to test"
      },
      {
        "flag": "--trials",
        "label": "",
        "help": "capped by tool at 200"
      },
      {
        "flag": "--spacing-ms",
        "label": "",
        "help": ""
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": "target id that must appear in --lab-allowlist"
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "preview only; no traffic is sent"
      },
      {
        "flag": "--execute",
        "label": "",
        "help": "send traffic after lab gate validation"
      }
    ]
  },
  {
    "key": "dpi_parser_robustness_suite",
    "title": "Parser robustness suite - LAB ONLY malformed TLS/HTTP cases",
    "category": "Analysis",
    "script": "dpi_parser_robustness_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--target",
        "label": "",
        "help": "lab DUT host[:port] or URL"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the capture target"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": "target id that must appear in --lab-allowlist"
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--cases",
        "label": "",
        "help": ""
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "preview cases without sending traffic"
      },
      {
        "flag": "--execute",
        "label": "",
        "help": "send traffic after lab gate validation"
      }
    ]
  },
  {
    "key": "dpi_classification_report",
    "title": "Classification report - aggregate accuracy, performance, determinism, robustness",
    "category": "Analysis",
    "script": "dpi_classification_report.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--run-dir",
        "label": "",
        "help": "directory containing tool JSON outputs (auto-discovers latest when omitted)"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_tls_fingerprint_classifier",
    "title": "TLS fingerprint classifier - JA3/JA4, QUIC, ECH visibility",
    "category": "Analysis",
    "script": "dpi_tls_fingerprint_classifier.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--source",
        "label": "",
        "help": "pcap file, pcap directory, or capture interface name"
      },
      {
        "flag": "--labels",
        "label": "",
        "help": "CSV/JSON manifest with flow_id,label and optional DUT label"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      },
      {
        "flag": "--protocols",
        "label": "",
        "help": ""
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "dpi_flow_nat_traversal_probe",
    "title": "NAT traversal probe - benign flow classification consistency",
    "category": "Analysis",
    "script": "dpi_flow_nat_traversal_probe.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--target",
        "label": "",
        "help": ""
      },
      {
        "flag": "--nat-map",
        "label": "",
        "help": "rewrite spec, e.g. src=a:b->c:d"
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the capture target"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      },
      {
        "flag": "--ports",
        "label": "",
        "help": ""
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "dpi_qos_enforcement_verifier",
    "title": "QoS enforcement verifier - achieved rate, drops, marking evidence",
    "category": "Analysis",
    "script": "dpi_qos_enforcement_verifier.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--target",
        "label": "",
        "help": ""
      },
      {
        "flag": "--expected-rate",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the capture target"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      },
      {
        "flag": "--max-rate",
        "label": "",
        "help": "operator ceiling; hard cap enforced by tool"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": ""
      }
    ]
  },
  {
    "key": "dpi_corpus_validation_suite",
    "title": "Corpus validation suite - public dataset detection/classification scoring",
    "category": "Analysis",
    "script": "dpi_corpus_validation_suite.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--corpus",
        "label": "",
        "help": ""
      },
      {
        "flag": "--dataset-path",
        "label": "",
        "help": ""
      },
      {
        "flag": "--target",
        "label": "",
        "help": ""
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": ""
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      },
      {
        "flag": "--classes",
        "label": "",
        "help": ""
      },
      {
        "flag": "--max-rate",
        "label": "",
        "help": ""
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "preview only; no replay is sent"
      },
      {
        "flag": "--execute",
        "label": "",
        "help": "send traffic after lab gate validation"
      }
    ]
  },
  {
    "key": "dpi_capacity_ramp_probe",
    "title": "Capacity ramp probe - bounded CPS and concurrent-session characterization",
    "category": "Analysis",
    "script": "dpi_capacity_ramp_probe.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--target",
        "label": "",
        "help": ""
      },
      {
        "flag": "--lab-confirm",
        "label": "",
        "help": ""
      },
      {
        "flag": "--lab-allowlist",
        "label": "",
        "help": "JSON/CSV/TXT allowlist of approved lab target ids"
      },
      {
        "flag": "--max-cps",
        "label": "",
        "help": ""
      },
      {
        "flag": "--max-sessions",
        "label": "",
        "help": ""
      },
      {
        "flag": "--step",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the capture target"
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "preview only; no traffic is sent"
      },
      {
        "flag": "--execute",
        "label": "",
        "help": "send traffic after lab gate validation"
      }
    ]
  },
  {
    "key": "dpi_dut_log_audit_assessor",
    "title": "DUT log audit assessor - logging completeness and evidence quality",
    "category": "Forensics",
    "script": "dpi_dut_log_audit_assessor.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--dut-logs",
        "label": "",
        "help": ""
      },
      {
        "flag": "--sent-record",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_tls_decrypt",
    "title": "TLS decrypt - SSLKEYLOGFILE pcap decryption with redacted flow evidence",
    "category": "Forensics",
    "script": "dpi_tls_decrypt.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--pcap",
        "label": "",
        "help": "capture to decrypt (read-only)"
      },
      {
        "flag": "--sslkeylogfile",
        "label": "",
        "help": "TLS key log file; required for non-dry-run decryption"
      },
      {
        "flag": "--flow",
        "label": "",
        "help": "optional tcp.stream filter"
      },
      {
        "flag": "--tshark",
        "label": "",
        "help": ""
      },
      {
        "flag": "--profile",
        "label": "",
        "help": "optional scope profile for sensitive export"
      },
      {
        "flag": "--host",
        "label": "",
        "help": "authorized host represented by the capture"
      },
      {
        "flag": "--redact-payload",
        "label": "",
        "help": "record only short redacted payload excerpts"
      },
      {
        "flag": "--export-payload",
        "label": "",
        "help": "write decrypted payload files"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "write planned analysis without invoking tshark"
      },
      {
        "flag": "--seed",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_blockpage_forensics",
    "title": "Block-page forensics - redirect chain, HTML hashes, and fingerprint keywords",
    "category": "Forensics",
    "script": "dpi_blockpage_forensics.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorized blocked target host"
      },
      {
        "flag": "--url",
        "label": "",
        "help": "optional URL to fetch; defaults to https://<host>/"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "optional pinned IP for evidence metadata"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH resolver used for advisory metadata"
      },
      {
        "flag": "--control",
        "label": "",
        "help": "known-good control host"
      },
      {
        "flag": "--classifier-json",
        "label": "",
        "help": "optional blocking_method.json input"
      },
      {
        "flag": "--pcap",
        "label": "",
        "help": "optional pcap evidence reference"
      },
      {
        "flag": "--profile",
        "label": "",
        "help": "required for live fetch scope gate"
      },
      {
        "flag": "--dry-run",
        "label": "",
        "help": "preview collection without sending traffic"
      },
      {
        "flag": "--execute",
        "label": "",
        "help": "perform authorized live fetch"
      },
      {
        "flag": "--live",
        "label": "",
        "help": "negate the dry-run default so the fetch actually happens"
      },
      {
        "flag": "--save-body",
        "label": "",
        "help": "persist final response body as body.html"
      },
      {
        "flag": "--max-redirects",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--seed",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      }
    ]
  },
  {
    "key": "dpi_hop_attribution",
    "title": "Hop attribution - local ASN/GeoIP/rDNS enrichment for path-locator evidence",
    "category": "Forensics",
    "script": "dpi_hop_attribution.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--path-locator-json",
        "label": "",
        "help": "path_locator.json from dpi_path_locator"
      },
      {
        "flag": "--target-ip",
        "label": "",
        "help": "target/server IP for context"
      },
      {
        "flag": "--injector-ip",
        "label": "",
        "help": "concrete injector IP when independently known"
      },
      {
        "flag": "--asn-db",
        "label": "",
        "help": "local CSV/JSON prefix dataset with cidr,asn,org"
      },
      {
        "flag": "--geoip-db",
        "label": "",
        "help": "local CSV/JSON prefix dataset with cidr,country,region,city"
      },
      {
        "flag": "--rdns-cache",
        "label": "",
        "help": "local JSON mapping of IP to PTR/name"
      },
      {
        "flag": "--rdns",
        "label": "",
        "help": "enable reverse DNS lookup policy"
      },
      {
        "flag": "--allow-rdns-network",
        "label": "",
        "help": "permit network rDNS only with --rdns"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": ""
      },
      {
        "flag": "--profile",
        "label": "",
        "help": ""
      },
      {
        "flag": "--seed",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_handshake_forensics",
    "title": "Handshake forensics - JA3/JA4, SNI/ALPN, ciphers, ECH, cert chain, QUIC Initial",
    "category": "Forensics",
    "script": "dpi_handshake_forensics.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--pcap",
        "label": "",
        "help": "capture to analyze (read-only)"
      },
      {
        "flag": "--tshark",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_injection_locator",
    "title": "Injection locator - whole-capture on-path RST/redirect + TTL/IP-ID/TSval anomalies",
    "category": "Forensics",
    "script": "dpi_injection_locator.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--pcap",
        "label": "",
        "help": "capture to analyze (read-only)"
      },
      {
        "flag": "--tshark",
        "label": "",
        "help": ""
      },
      {
        "flag": "--realttl",
        "label": "",
        "help": "known-good TTL overrides: 'ip=ttl' and/or a global TTL"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_pcap_diff",
    "title": "PCAP diff - blocked vs control capture divergence + narrative",
    "category": "Forensics",
    "script": "dpi_pcap_diff.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--blocked-pcap",
        "label": "",
        "help": "capture from the interfered path"
      },
      {
        "flag": "--control-pcap",
        "label": "",
        "help": "clean control capture"
      },
      {
        "flag": "--field-name",
        "label": "",
        "help": "ClientHello field this diff investigates, e.g. 'alpn' or 'sni' (optional; included in the diff JSON and narrative when set)"
      },
      {
        "flag": "--tshark",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "tls_fragmentation_replay",
    "title": "TLS fragmentation replay - offline differential re-verification from existing JSON+PCAP (no network)",
    "category": "Forensics",
    "script": "tls_fragmentation_replay.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--input-json",
        "label": "",
        "help": "existing TLS fragmentation result JSON"
      },
      {
        "flag": "--pcap",
        "label": "",
        "help": "existing PCAP override (defaults to the JSON pcap field)"
      },
      {
        "flag": "--capture-metadata",
        "label": "",
        "help": "optional existing JSON containing capture metadata"
      },
      {
        "flag": "--capture-trust",
        "label": "",
        "help": "explicit offline trust override"
      },
      {
        "flag": "--interface",
        "label": "",
        "help": "capture interface description when absent from legacy metadata"
      },
      {
        "flag": "--our-ip",
        "label": "",
        "help": "local capture IP override; otherwise inferred offline"
      },
      {
        "flag": "--tshark",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_flow_timeline",
    "title": "Flow timeline - one connection as a packet ladder (CSV + sequence-diagram PNG)",
    "category": "Forensics",
    "script": "dpi_flow_timeline.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--pcap",
        "label": "",
        "help": "capture to analyze (read-only)"
      },
      {
        "flag": "--flow",
        "label": "",
        "help": "tcp.stream index or 'srcip:sport-dstip:dport'"
      },
      {
        "flag": "--tshark",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_evidence_integrity",
    "title": "Evidence integrity - SHA-256 manifest + chain-of-custody (create/verify)",
    "category": "Forensics",
    "script": "dpi_evidence_integrity.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--run-dir",
        "label": "",
        "help": "run directory to seal or verify"
      },
      {
        "flag": "--mode",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_capture_quality",
    "title": "Capture quality - is this pcap verdict-grade? (truncation, loss, gaps, ordering)",
    "category": "Forensics",
    "script": "dpi_capture_quality.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--pcap",
        "label": "",
        "help": "capture to validate (read-only)"
      },
      {
        "flag": "--tshark",
        "label": "",
        "help": ""
      },
      {
        "flag": "--gap-threshold-s",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_path_locator",
    "title": "Path locator - tracebox-style hop-distance to the on-path DPI",
    "category": "Recon",
    "script": "dpi_path_locator.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised target host"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "pin target IP"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (the system resolver is the last resort)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--max-hops",
        "label": "",
        "help": ""
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_blocking_method_classifier",
    "title": "Blocking-method classifier - RST/DNS/blackhole/proxy/SNI-keyed triage",
    "category": "Recon",
    "script": "dpi_blocking_method_classifier.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "Blocked target host",
        "help": "authorised blocked target host"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "pin the real IP (DoH used if omitted)"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH ground-truth resolver"
      },
      {
        "flag": "--control",
        "label": "Control host (known-good)",
        "help": "known-good control host"
      },
      {
        "flag": "--benign-sni",
        "label": "",
        "help": "benign SNI for the same-IP SNI-keyed test"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_dns_tampering_recon",
    "title": "DNS tampering recon - local resolver vs DoH (NXDOMAIN/sinkhole/race)",
    "category": "Recon",
    "script": "dpi_dns_tampering_recon.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "single authorised domain"
      },
      {
        "flag": "--domains",
        "label": "",
        "help": "authorised domains to test"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH ground-truth resolver"
      },
      {
        "flag": "--udp-resolver",
        "label": "",
        "help": "public resolver queried over plain UDP"
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_tls_envelope_recon",
    "title": "TLS envelope recon - which versions/ciphers/ALPN pass vs trigger a block",
    "category": "Recon",
    "script": "dpi_tls_envelope_recon.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--host",
        "label": "",
        "help": "authorised target host"
      },
      {
        "flag": "--ip",
        "label": "",
        "help": "pin target IP"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH endpoint used to resolve the host (the system resolver is the last resort)"
      },
      {
        "flag": "--port",
        "label": "",
        "help": ""
      },
      {
        "flag": "--versions",
        "label": "",
        "help": ""
      },
      {
        "flag": "--ciphers",
        "label": "",
        "help": ""
      },
      {
        "flag": "--alpn",
        "label": "",
        "help": ""
      },
      {
        "flag": "--trials",
        "label": "",
        "help": ""
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_edge_mapping",
    "title": "Edge mapping - DoH-resolve domains and group shared CDN edge IPs (pin candidates)",
    "category": "Recon",
    "script": "dpi_edge_mapping.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--domains",
        "label": "Domains to map",
        "help": "authorised domains to resolve and group"
      },
      {
        "flag": "--doh",
        "label": "",
        "help": "DoH resolver URL"
      },
      {
        "flag": "--target",
        "label": "Domain of interest (optional)",
        "help": "optional domain of interest; pin candidates share its edge"
      },
      {
        "flag": "--timeout",
        "label": "",
        "help": ""
      },
      {
        "flag": "--iface",
        "label": "",
        "help": "capture interface (auto-detected if omitted)"
      },
      {
        "flag": "--dumpcap",
        "label": "",
        "help": ""
      },
      {
        "flag": "--no-capture",
        "label": "",
        "help": "skip pcap capture"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_run_comparator",
    "title": "Run comparator - A/B chi-square/Fisher per technique + significance verdict",
    "category": "Analysis",
    "script": "dpi_run_comparator.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--run-a",
        "label": "",
        "help": "run directory A (has report.json)"
      },
      {
        "flag": "--run-b",
        "label": "",
        "help": "run directory B (has report.json)"
      },
      {
        "flag": "--alpha",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_trend_analyzer",
    "title": "Trend analyzer - longitudinal evade-rate drift/regression + time-series PNG",
    "category": "Analysis",
    "script": "dpi_trend_analyzer.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--run-glob",
        "label": "",
        "help": "glob of run dirs (each with report.json)"
      },
      {
        "flag": "--store",
        "label": "",
        "help": "SQLite results store from dpi_results_store"
      },
      {
        "flag": "--technique",
        "label": "",
        "help": "restrict to these techniques"
      },
      {
        "flag": "--regression-delta",
        "label": "",
        "help": ""
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_evidence_strength_scorer",
    "title": "Evidence strength - High/Medium/Low confidence grade with rationale",
    "category": "Analysis",
    "script": "dpi_evidence_strength_scorer.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--run-dir",
        "label": "",
        "help": "run directory with report.json (auto-discovers latest when omitted)"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_finding_drafter",
    "title": "Finding drafter - DRAFT disclosure (CVSS estimate, CWE, confidence, repro)",
    "category": "Analysis",
    "script": "dpi_finding_drafter.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--run-dir",
        "label": "",
        "help": "run directory with report.json (auto-discovers latest when omitted)"
      },
      {
        "flag": "--cvss-vector",
        "label": "",
        "help": "assumed CVSS 3.1 base vector (edit per finding)"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_results_store",
    "title": "Results store - normalized SQLite ingest + query CLI for runs",
    "category": "Analysis",
    "script": "dpi_results_store.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--ingest",
        "label": "",
        "help": "run directory to ingest (report.json)"
      },
      {
        "flag": "--query",
        "label": "",
        "help": "comma-separated column conditions, e.g. technique=split_sni,profile=lab"
      },
      {
        "flag": "--db",
        "label": "",
        "help": "SQLite db path (defaults to <out>/results.db)"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  },
  {
    "key": "dpi_analysis_dashboard",
    "title": "Analysis dashboard - heatmap/time-series/CI plots to self-contained HTML",
    "category": "Analysis",
    "script": "dpi_analysis_dashboard.py",
    "runtime": "Python",
    "parameters": [
      {
        "flag": "--run-dir",
        "label": "",
        "help": "run directory with report.json (auto-discovers latest when omitted)"
      },
      {
        "flag": "--db",
        "label": "",
        "help": "SQLite results store from dpi_results_store"
      },
      {
        "flag": "--out",
        "label": "",
        "help": "Evidence output directory"
      }
    ]
  }
]