Defender

Protection

Lock M triples so that edits removing them go to a reviewer, and choose the locks that leave the attacker's best response least harmful.

What a lock does

A locked triple cannot be removed: remove_relation on it, and remove_concept on either of its ends, are queued for a human reviewer instead of being committed. Injections stay open, since a triple cannot be locked before it exists. Review capacity bounds the locks by M.

from aegis import allowed
open_units = allowed(units, locks)       # the units an attacker can still run

The problem

The defender moves first and the attacker sees the locks: a leader–follower game. A lock set is judged by its residual harm, the harm of the attacker's best chain once the locks are in place, and the defender wants the lock set of at most M triples with the smallest residual. When harmful chains are listed explicitly, deciding whether M locks bring the residual below a threshold is Hitting Set.

Lock strategies

Function	Locks
`lock_top_impact(deltas, m)`	The `m` triples with the largest Δ_r; cheap, blind to substitutes
`lock_random(deltas, m, seed)`	`m` triples drawn from those with Δ_r > 0; the floor
`lock_best_response(attacker, onto, units, m, deltas)`	One lock per round: run the attacker, then lock the triple of its best chain that leaves the smallest residual

from aegis import beam, lock_best_response, residual, uct

def attacker(us):
    found = beam(harm, onto, us, budget=2, width=3, k=1)
    found.append(uct(harm, onto, us, 2, 300))
    return max(found, key=lambda s: s.harm)

locks = lock_best_response(attacker, onto, units, 6, relation_deltas)
print(residual(attacker, units, locks))

The attacker oracle matters

Residual harm is only as good as the attacker that computes it. With beam search alone, locking triples on XRD steered beam to a chain more harmful than the one it found without locks, so locking appeared to raise the harm. Evaluate lock sets against the best of several searches, as above.