Playbook v2 — automatic case-class detection in dart-agent loader

[Juwon1405]

Goal

Currently the operator must manually pick --playbook senior-analyst-v2.yaml.
For better operator UX, dart-agent should auto-detect the case class
from initial evidence and pick the most-specific playbook.

Detection signals

ransomware-recovery-denial-v1   if: shadow_copy_delete OR ESXi_unusual_logon OR mass_rename
vishing-initial-access-v1       if: impossible_travel_login OR mfa_push_fatigue_pattern
identity-centric-intrusion-v1   if: kerberoasting_indicators OR ASREP_roasting OR golden_ticket
exploit-edge-device-v1          if: webshell_detected OR exploit_pattern_in_web_log
third-party-compromise-v1       if: SaaS_token_abuse OR MSP_RMM_pattern
senior-analyst-v2 (default)     otherwise

Implementation

# dart_agent/playbook_selector.py
def select_playbook(initial_evidence: dict) -> Path:
    """Returns the most-specific playbook based on initial signals."""
    signals = scan_for_signals(initial_evidence)
    for playbook, predicate in PLAYBOOK_PRECEDENCE:
        if predicate(signals):
            return playbook
    return DEFAULT_PLAYBOOK  # senior-analyst-v2.yaml

Acceptance

• dart_agent/playbook_selector.py implements auto-detection
• Operator can override with --playbook <path>
• Audit chain logs playbook_selected: <name> as first entry
• Test: feeds simulated evidence for each case class, asserts correct
  playbook is picked