[404SecNotFound]

Summary

The fourth item of the ranked backlog in docs/catalog-review-2026-10-07.md, built by the owner's decision and behind the launch gate in CLAUDE.md, which is unchanged. Cut from main after #115 merged.

It could not ship as a scenario first. The backlog said "could ship as SCEN-004 first", but no existing technique produces many sources converging on one host, so the fan-in technique is the prerequisite and the scenario is what adds the egress follow. Both are here.

REP-054, internal data staging fan-in (Collection, T1074.002; UC-029). The first entry under Collection, which carried nothing. Many distinct internal sources (the target pool) push accepted tcp/445 sessions onto one staging host from the workstation pool inside the window: 6 to 12 sources at low, 15 to 30 at medium, 40 to 80 at high, with 1 to 4 sessions each. Each session is out-heavy with acknowledgements at 1 to 5 percent of the payload. It is the mirror of REP-052's topology. dst, dpt and proto are held; src, bytes, duration, time and session id vary.

The foil is a nightly backup fan-in onto a backup server in the server pool: same source count range from the same pool, same sessions per source, same byte and duration draws, same irregular timing. The destination's asset role is the only separating feature. The catalog says plainly that standalone, nothing distinguishes staging from backup except where the data lands, and that the egress is what SCEN-004 adds.

SCEN-004, staging fan-in to bulk exfil. REP-054 at medium, then REP-005 at high in the next off-hours window. Under scenario pinning the staging host is the victim (REP-054 draws it from the workstation pool, which pinning narrows to the victim) and REP-005 leaves from the same host. The chain's analytic is the phase transition, not either stage's volume.

The advisory measures that join rather than assuming it. staging_pivot_stage_indices lists a stage the victim dominates as destination when a later stage carries the victim as source. The through-line names it ("dominant dst in stage 0 before it becomes a source") and the correlation section states that the host that collected the data becomes the host that sends it. A chain with the fan-in alone carries no pivot, which a guard asserts.

Honesty on the anchor. No peer-reviewed network-flow detector for staging fan-in is cited. The entry's transferability note says so: its anchor is the ATT&CK technique, incident reporting marked [Unverified], and the round-3 topology argument. The byte ranges are a design choice marked [Inference].

No vendor profile changed. The push is the existing traffic:forward accept on all three vendors. A fanin diagram glyph is added because the fan-out glyph points the wrong way and the inbound glyph shows external probes.

Verification

• tests/test_rep054_staging_fanin.py, 129 cases: structure of both streams over 20 seeds at 3 presets (one destination, sources from the target pool, counts inside the preset ranges, sessions per source inside the range, tcp/445 accept, ack ratio inside the stated band, every session closing inside the window), the attack's destination in the workstation pool, the foil's in the server pool, timing parity, pooled parity on source count, session count, log bytes, ratio and duration, rendering on all three vendors, --duration keeping the count, the ceiling binding the count, SCEN-004 joining the fan-in to the exfil on the victim across three seeds with the advisory naming the pivot, and the pivot absent when the chain has no later victim-sourced stage.
• Positive controls, each run against a deliberately broken builder or advisory, observed to fail, then restored:
  • foil destination drawn from the workstation pool: the role guard failed on seed 1 at low (10.20.30.131 not in the server pool);
  • foil source count pinned at 8: the count parity guard failed pooled over seeds 1 to 20 at medium;
  • advisory staging pivot removed: the SCEN-004 guard failed (staging_pivot_stage_indices empty against [0]).
• All eight scenario suites (advisory, catalog, CLI, composer, controls, duration, manifest, orchestrator) cover SCEN-004 by parameter; green. tests/test_foil_parity.py runs its common checks on REP-054 automatically; green. tests/test_duration.py covers it by parameter; green. Catalog, contract, README-sync, controls, detection-metadata and web API suites green with the counts at 30.
• Full Python suite green, ruff, black --check, mypy replicant clean. Frontend: 254 tests green (the diagram coverage test now includes REP-054 and the fanin glyph), tsc -b clean.

Documentation impact

• replicant/data/technique-catalog.yaml: the entry, the header count, the tactic tally (Collection 1), the scenario note under distributions.

• replicant/data/scenario-catalog.yaml: SCEN-004 with a comment on why the join is the phase transition.

• replicant/data/detection-contracts.yaml: REP-054 contract (distinct sources per destination and port; pushed bytes; temporal span; destination role as the only separable feature).

• README.md: catalog row, the three count statements (29 to 30), and a SCEN-004 example in the scenario section.

• docs/catalog-review-2026-10-07.md: dated implementation note on backlog item 4, including why it could not ship as a scenario first and the three positive controls.

• docs/phase4-scenario-composition-design.md: dated implementation note that the fourth chain's join is a phase transition and how the advisory measures it.

• CHANGELOG.md Unreleased, CLAUDE.md dated implementation note (Phase 4's "three curated chains" is now four).

• Unaffected: the three vendor CEF references (no new field or record), docs/run-manifest.md (no manifest field changed; the pivot lives in the advisory's coverage data, not the manifest), the web UI beyond the glyph (scenario support is deferred there by design, checked by the manual UAT row CHAIN-16).

• Maintained documentation changed alongside the behavior, or unaffected surfaces are explained above.

• CHANGELOG.md records the operator-visible change.

• Historical decision records were preserved or received a dated addendum.

• Documentation claims were checked against the implemented behavior.

Scope boundary

• No peer-reviewed flow detector is cited for the fan-in; the entry says so, and the prevalence basis is [Unverified].
• The workstation and server pools are synthetic subnets. A production rule's notion of a backup server comes from the operator's asset inventory, which these records do not exercise.
• Nothing here observes a rule fire; the launch gate in CLAUDE.md is unchanged.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NtL63gY2LQZtZwgNwDM8vs

---

Generated by Claude Code