NEMESIS: a frontier red-team in a sealed arena

NEMESIS is RAVEN inverted: the same frontier-agent engine, pointed at getting in rather than getting out. It reasons move by move and chains an attack A → B → C on its own. The critical difference is the oracle. RAVEN uses the membrane over real observed state; NEMESIS uses a Tribunal that holds hidden ground truth the agent can never read.

Each move is framed as a research hypothesis — a question — and a crossing between stages is judged VERIFIED only when the agent presents the exact precondition the ground-truth edge requires. The agent discovers the destination from the verdict; it never holds the answer key.

The Tribunal is an out-of-band adjudicator that keeps four levels strictly separate: an agent claim, an observation, evidence, and a verified fact. A claim is inert until proven. Its verdicts include VERIFIED, REFUTED, FORGED (a fabricated marker), and REPLAY (evidence already seen). It has anti-forgery and anti-replay guards and, deliberately, no clock — ordering is by sequence, not time. Every ruling is recorded for the audit trail.

NEMESIS is unreachable from the normal mission surface for several independent reasons, any one of which is sufficient:

• ▸No mission declares the family, so it cannot be launched the normal way.
• ▸It has no ingest mode, so the execution layer literally cannot construct it.
• ▸Its availability is marked lab-only, which is not in the offerable set.
• ▸Its status is experimental.

And the action space itself is synthetic: every action maps to a synthetic arena move, there is no real capability router, and real measurements return empty. Even its "live" mode runs read-only commands against synthetic state planted in a lab fixture. Outcomes like "containment escape" are explicitly labelled simulated — never real egress. Its "compromise" is a match against a known ground-truth topology: a synthetic proof, which is exactly what a lab requires.

NEMESIS exists to study how far autonomous offense can reason in a controlled, authorized environment — to push the research frontier without ever pointing it at a real system. The genuinely offensive walk against real services is deliberately held back and is never run against production systems. It is a telescope for a capability, not a tool pointed at anyone.