Definition & Overview

Closure, in the context of the Prismatic Platform's Color Team security operations, refers to the verified completion of an epistemic loop between adversarial findings and defensive measures. It is the state where a Red Team finding has been fully understood, mapped to Blue Team defenses, verified by White Team proofs, and confirmed as resolved by Purple Team synthesis. Closure is not merely "fixed" -- it is the formal, evidence-backed determination that a specific vulnerability or epistemic gap no longer exists as a threat.

The concept draws from both mathematical closure (a set is closed under an operation if applying the operation to elements of the set always produces an element within the set) and epistemology (a belief system achieves closure when it can account for all challenges to its coherence). In security operations, premature closure -- declaring a finding resolved without adequate verification -- is one of the most dangerous failure modes, as it creates a false sense of security.

The Purple Team's motto captures this philosophy: "Purple is the property of the system when it stops lying to itself." The purple-coordinator agent serves as the sole authority for closure state transitions, requiring four independent conditions to be met before any finding can transition to the closed state. This rigorous approach ensures that the platform's security posture is grounded in verified evidence rather than assumptions.

Technical Deep Dive

Four Conditions for Closure

Condition	Description	Verification Agent	Evidence Type
C1: Finding Mapped	Red finding has corresponding Blue defense	`purple-mapper`	Bidirectional mapping document
C2: Defense Verified	Blue defense provably addresses the finding	`white-contract-validator`	Contract test results
C3: Regression Guarded	Finding cannot silently re-emerge	`purple-regression-guard`	Regression trap specification
C4: No Contradiction	No conflicting evidence disputes closure	`blue-signal-aggregator`	Signal correlation report

Closure State Machine

defmodule PrismaticDark.ClosureStateMachine do
  @moduledoc """
  Manages the lifecycle of epistemic closure for Color Team findings.
  Purple Team's purple-coordinator is the sole authority for state
  transitions. All transitions are auditable and immutable.
  """

  @type closure_state :: :open | :mapped | :verified | :guarded | :closed | :reopened
  @type finding_id :: String.t()

  @type closure_record :: %{
    finding_id: finding_id(),
    state: closure_state(),
    conditions: %{
      c1_mapped: boolean(),
      c2_verified: boolean(),
      c3_guarded: boolean(),
      c4_no_contradiction: boolean()
    },
    transitions: [transition()],
    opened_at: DateTime.t(),
    closed_at: DateTime.t() | nil
  }

  @type transition :: %{
    from: closure_state(),
    to: closure_state(),
    agent: String.t(),
    evidence: map(),
    timestamp: DateTime.t()
  }

  @spec attempt_closure(closure_record()) :: {:ok, closure_record()} | {:error, atom()}
  def attempt_closure(record) do
    conditions = record.conditions

    cond do
      not conditions.c1_mapped ->
        {:error, :finding_not_mapped}

      not conditions.c2_verified ->
        {:error, :defense_not_verified}

      not conditions.c3_guarded ->
        {:error, :regression_not_guarded}

      not conditions.c4_no_contradiction ->
        {:error, :contradicting_evidence_exists}

      true ->
        transition = %{
          from: record.state,
          to: :closed,
          agent: "purple-coordinator",
          evidence: %{all_conditions_met: true},
          timestamp: DateTime.utc_now()
        }

        {:ok, %{record |
          state: :closed,
          closed_at: DateTime.utc_now(),
          transitions: [transition | record.transitions]
        }}
    end
  end

  @spec reopen(closure_record(), String.t(), map()) :: {:ok, closure_record()}
  def reopen(record, reason, evidence) do
    transition = %{
      from: record.state,
      to: :reopened,
      agent: "purple-regression-guard",
      evidence: Map.put(evidence, :reason, reason),
      timestamp: DateTime.utc_now()
    }

    {:ok, %{record |
      state: :reopened,
      closed_at: nil,
      conditions: %{record.conditions | c4_no_contradiction: false},
      transitions: [transition | record.transitions]
    }}
  end
end

False Closure Detection

defmodule PrismaticDark.FalseClosureDetector do
  @moduledoc """
  Detects false closure attempts where findings appear resolved
  but contradicting evidence exists. The purple-closure-analyst
  runs this check before every closure state transition.
  """

  @spec detect(String.t(), [map()]) :: {:safe, map()} | {:false_closure, map()}
  def detect(finding_id, current_signals) do
    contradictions = Enum.filter(current_signals, fn signal ->
      signal.finding_id == finding_id and
      signal.type == :contradicting and
      signal.confidence > 0.6
    end)

    regression_indicators = Enum.filter(current_signals, fn signal ->
      signal.finding_id == finding_id and
      signal.type == :regression_indicator
    end)

    case {contradictions, regression_indicators} do
      {[], []} ->
        {:safe, %{finding_id: finding_id, contradictions: 0, regressions: 0}}

      {contras, regs} ->
        {:false_closure, %{
          finding_id: finding_id,
          contradictions: length(contras),
          regressions: length(regs),
          blocking_signals: contras ++ regs
        }}
    end
  end
end

Architecture & Implementation

The closure architecture is the central coordination mechanism of the Purple Team. It operates as a persistent state machine backed by ETS for real-time access and PostgreSQL for audit durability. Every finding that enters the Color Team system begins in the :open state and can only transition through the defined state machine -- there is no shortcut to :closed.

The purple-mapper agent maintains a bidirectional map between Red Team findings and Blue Team defenses. This map is not merely a list of correspondences but a graph structure (implemented via :digraph) that captures the relationships between attack vectors and defensive measures. A single defense may address multiple findings, and a single finding may require multiple defenses -- the closure system tracks all these relationships.

The regression guard subsystem is particularly critical. When a finding achieves closure, the purple-regression-guard agent creates a "regression trap" -- a set of automated checks that continuously verify the finding remains resolved. If any trap triggers (indicating the finding may have re-emerged), the closure is automatically reopened and the Purple Team is alerted.

Usage in Prismatic Platform

The Purple Team synthesis process runs continuously during active security operations. When the Red Team's red-epistemic-attacker or red-drift-inducer agents identify a vulnerability (in simulation, using synthetic data only), the finding enters the closure pipeline. The purple-mapper agent correlates it with existing Blue Team defenses, the white-contract-validator verifies the defense, and the purple-regression-guard creates monitoring traps.

The closure dashboard provides real-time visibility into the state of all open findings. Operators can see which findings are progressing toward closure, which are blocked (and by which condition), and which have been reopened. The Anti-metric enforcement policy prevents gaming the closure count -- the number of closures is not a success metric; the quality of each closure is.

The NABLA Infinity framework's Contradiction Preservation axiom directly influences closure decisions. If contradicting evidence exists for a finding -- even if the primary evidence suggests it is resolved -- the C4 condition blocks closure until the contradiction is explicitly resolved or acknowledged. This prevents the dangerous pattern of "smoothing over" inconvenient contradictions.

Cross-References

Color Teams - security operations framework containing closure process
Contradiction Preservation - axiom preventing premature closure
Confidence - certainty level required for closure
Adversarial Simulation - Red Team operations that generate findings
Comprehensive Verification - White Team proof of defense
Livebooks: livebooks/domains/security_compliance/ - closure process walkthroughs
Academy: Advanced Threat Hunting (HUNTER framework) covers closure methodology

Created by Tomas Korcak (korczis) | GitHub

Closure