Runtime

Kill Chains War Room: Product, Interaction, Content, and Technical Specification

Report summary

Status: Research archive item
Category: Runtime
Length: 6,444 words
Reading time: 30 minutes
Report type: evaluation

Key topics

Runtime
AI
.NET
Privacy
Semantic Systems
Research Archive
Strategy
Audit

Research provenance

Archive status: Research archive item
Canonical report: https://mikekappel.com/reports/runtime/webxr-simulation-product-specification/
Content identity: sha256:ceb37548f1efd349cedf7e52da8ac5f468087a8fb738f99cd2efd7859cd31fc3

For citation, use the report title and canonical URL. Archival presence does not establish authorship or promote report statements into portfolio evidence.

This page renders the archived Markdown as safe, formatted HTML. It is background research and does not become a portfolio claim without evidence review.

Full report

On this page

Executive Concept and Pedagogical Framework

The Kill Chains War Room is a highly interactive, cooperative educational simulation designed to train multidisciplinary teams in the complexities of distributed decision-making, incident response, and threat analysis. Built upon a robust Three.js and WebXR foundation supported by PHP services, the environment provides a synthetic, server-authoritative sandbox where participants investigate and mitigate evolving threats. The architecture strictly enforces a non-operational boundary; the system evaluates user intent and transitions state purely within a simulated context, rendering it mathematically incapable of affecting real-world systems. The simulation synthesizes three distinct threat models into its scenario engine. The first is the military dynamic targeting sequence known as F2T2EA (Find, Fix, Track, Target, Engage, Assess)1. The F2T2EA model is highly serialized, requiring precise intelligence gathering (Find, Fix, Track) before committing to action (Target, Engage) and evaluating the outcome (Assess)3. The second model encompasses traditional cyber intrusion kill chains, focusing on network footholds, lateral movement, and data exfiltration. The third addresses emerging vectors against generative AI applications, reflecting the OWASP Top 10 for Large Language Models (e.g., prompt injection, model inversion, and data poisoning)4. The pedagogical foundation of the War Room is deeply rooted in the concept of "information gap" and cooperative asymmetrical design, a methodology proven effective in serious games and language learning environments to force "negotiation for meaning"5. By intentionally distributing critical telemetry, policy constraints, and intervention controls across different participants, the system mandates cognitive interdependence6. Participants cannot succeed in isolation. The War Room experience mitigates any emphasis on simulated destruction; instead, it rewards rigorous evidence verification, precise cross-functional communication, calibrated confidence, and the execution of safe interruptions under strict time constraints. The overarching objective is to demonstrate that automated systems and complex organizations fail not necessarily from a lack of technical capability, but because evidence, authority, and time are unevenly distributed and poorly synchronized5.

Information Asymmetry and Interdependent Play

The design of the War Room ensures that no single participant possesses a complete operational picture at the onset of the scenario. This deliberate fragmentation of data models the fog of war inherent in real-world incident response. Drawing upon the success of asymmetric collaborative games, the architecture leverages separated interfaces and distinct virtual roles to create a mandatory reliance among users6. This asymmetry functions across several dimensions. One participant may possess deep visibility into source provenance and cryptographic hashes but lacks an understanding of the overall operational urgency or the blast radius of the affected nodes. Another participant monitors high-level system telemetry and load balancers but is blind to the legal and policy limits governing how they can respond. The participant holding the authorization constraints is unable to see the granular evidence necessary to make an informed legal decision, while the incident coordinator views only aggregated summaries and must aggressively probe the team to uncover the underlying raw data. Furthermore, an observer may clearly see the communication patterns and misalignments of the team but is mechanically locked out from directly applying containment controls. This architecture teaches participants a critical lesson in organizational resilience: raw data is useless without context, and context is useless without authority. When the Evidence Analyst identifies an anomaly, they must synthesize that finding and transmit it to the Systems Analyst to determine its impact, who must then coordinate with the Human-Control Officer to verify that an intervention is legally permissible. This friction is not arbitrary; it is the core curriculum. The system provides clear, understandable methods for bridging these information gaps, ensuring that frustration arises from the complexity of the scenario rather than obtuse user interfaces. By forcing users to actively negotiate roles, share representations, and dynamically adapt to incomplete information, the simulation cultivates profound teamwork competencies8.

Participant Role Matrix

The experience accommodates two to six participants. Roles are strictly defined by their access to information, mechanical capabilities within the simulation, and communication responsibilities. The roles never involve designing offensive payloads or selecting real-world targets; all actions are defensive, analytical, or organizational.

1. Evidence Analyst

The Evidence Analyst serves as the primary intelligence gatherer, focusing on the "Find" and "Fix" phases of the F2T2EA chain2. They evaluate the validity, origin, and confidence level of incoming data streams.

Attribute	Specification
Information Visible	Raw system logs, cryptographic hashes, source provenance, historical baseline comparisons, AI prompt inputs, and algorithmic confidence scores.
Information Hidden	Infrastructure dependency graphs, SLA constraints, containment capabilities, and the global mission urgency timer.
Available Controls	"Verify Artifact," "Flag as Anomalous," "Request Context," "Assign Confidence Score," and "Ping Artifact to Team."
Communication Responsibilities	Must broadcast when new evidence contradicts current working assumptions and provide confidence intervals for all identified artifacts.
Typical Decisions	Determining if a log entry represents malicious intent, a benign misconfiguration, or a sophisticated LLM prompt injection attempt.
Failure Modes	Analysis paralysis, confirmation bias, or failing to alert the team when previously verified evidence degrades in reliability.
Accessibility Accommodations	Text-to-speech log parsing, high-contrast log highlighting, and full keyboard-navigable data grids10.
Desktop Interface	Multi-pane data grid with advanced sorting, filtering, and cross-referencing visualization tools.
WebXR Interface	Spatial data node inspection, allowing the analyst to physically pull apart log sequences into floating 3D arrays and manipulate them spatially.
Debrief Contribution	Provides the chronological timeline of when the team acquired specific facts versus when assumptions were made without evidence.

2. Systems Analyst

The Systems Analyst monitors the structural integrity of the simulated environment, identifying the blast radius of anomalies and the potential collateral damage of defensive actions.

Attribute	Specification
Information Visible	Node state, network topology, API dependency graphs, traffic volume, load balancers, and failure propagation pathways.
Information Hidden	Payload contents, legal/policy boundaries, operational Rules of Engagement (ROE), and raw evidence provenance.
Available Controls	"Simulate Load," "Trace Connection," "Flag Bottleneck," "Map Blast Radius."
Communication Responsibilities	Must warn the team when a proposed intervention will cause cascading system failures or when an anomaly demonstrates lateral movement.
Typical Decisions	Identifying the exact operational impact of an ongoing intrusion and predicting the structural cost of a proposed containment action.
Failure Modes	Tunnel vision on maintaining system uptime at the expense of necessary containment, or failing to correlate network spikes with the Evidence Analyst's flagged logs.
Accessibility Accommodations	Sonification of network traffic (pitch/tempo changes based on load), scalable node visualization, and reduced-motion topology maps10.
Desktop Interface	2D topological map with real-time state color-coding and drill-down performance metrics.
WebXR Interface	3D volumetric network graph; the analyst can virtually walk through the topology to inspect lateral movement and node clusters.
Debrief Contribution	Explains the structural impact of the attack and the operational cost incurred by the team's defensive interventions.

3. Human-Control and Policy Officer

This role represents the governance, legal, and ethical boundaries of the organization, ensuring that all actions comply with predefined regulations.

Attribute	Specification
Information Visible	Service Level Agreements (SLAs), legal compliance mandates, Rules of Engagement (ROE), authorization boundaries, and regulatory thresholds.
Information Hidden	Real-time network telemetry, granular evidence strings, and the technical mechanics of the defensive controls.
Available Controls	"Approve Action," "Veto Action," "Request Legal Exception," "Trigger Compliance Alert."
Communication Responsibilities	Must clearly articulate when a proposed action violates policy and outline the necessary criteria required to grant authorization.
Typical Decisions	Deciding whether the collateral damage of shutting down a critical network segment is legally justified by the current threat intelligence.
Failure Modes	Overly rigid adherence to policy leading to catastrophic system compromise, or approving actions without demanding sufficient verified evidence.
Accessibility Accommodations	Screen-reader optimized policy documents, simplified approval/veto toggles with confirmation dialogs, text-scaling for readability.
Desktop Interface	Document-centric dashboard with active scenario matching, clause highlighting, and compliance checklists.
WebXR Interface	A spatial "Authority Gate" where pending interventions materialize as physical objects requiring a digital signature, key turn, or stamp of approval.
Debrief Contribution	Evaluates whether the team operated within authorized boundaries and highlights instances where policy was violated or poorly interpreted.

4. Incident or Mission Coordinator

The Coordinator maintains the macro-level view, synthesizing inputs from all other roles to drive decisive action and manage the global timeline.

Attribute	Specification
Information Visible	Aggregated threat summaries, intervention readiness states, global countdown timers, and team recommendation cards.
Information Hidden	Underlying raw logs, specific system dependencies, and exact policy clause text (must rely entirely on team members for details).
Available Controls	"Call for Vote," "Select Recommendation," "Request Status," "Declare Safe State."
Communication Responsibilities	Directing focus, resolving disputes, enforcing time constraints, and ensuring all voices are heard before a critical decision is locked in.
Typical Decisions	Choosing between competing defensive strategies or deciding when to escalate an incident to a higher authority level.
Failure Modes	Failing to solicit input from a specific analyst, allowing debates to consume the time window, or acting impulsively on unverified summaries.
Accessibility Accommodations	Centralized alert feed, single-switch input for major state transitions, highly visible and customizable timer representations.
Desktop Interface	Kanban-style recommendation board and global status dashboard.
WebXR Interface	A central command table where holographic summaries aggregate, allowing the coordinator to manually orchestrate physical cards representing team input.
Debrief Contribution	Discusses team cohesion, communication bottlenecks, and the rationale behind final strategic choices.

5. Defensive-Control Operator

The Operator translates strategic decisions into tactical, simulated system interventions, managing the "Target" and "Engage" phases of the sequence1.

Attribute	Specification
Information Visible	Available containment tools, segmentation protocols, rollback points, patch deployment mechanisms, and control feedback states.
Information Hidden	The broader mission objective, evidence provenance, and the ethical/policy implications of the tools they wield.
Available Controls	"Deploy Patch," "Sever Connection," "Rollback State," "Initiate Failover," "Isolate Subnet."
Communication Responsibilities	Must communicate the readiness of defensive tools, the time required for deployment, and the subsequent success or failure of an executed control.
Typical Decisions	Determining the most efficient technical sequence to execute a coordinator's broad directive without causing system crashes.
Failure Modes	Prematurely applying a control before authorization is fully granted, or misconfiguring an intervention due to a misunderstanding of the topology.
Accessibility Accommodations	Macro-enabled control execution, clear state-change indicators utilizing multi-modal feedback (color, text, and haptics)10.
Desktop Interface	A simulated terminal or control panel with progressive disclosure of advanced containment tools.
WebXR Interface	A spatial control console featuring physical levers, dials, and staging areas for interventions prior to final execution.
Debrief Contribution	Analyzes the technical efficacy of the chosen interventions and the timeliness of execution.

6. Observer or Recorder

The Observer maintains an immutable record of the session, tracking communication, decision logic, and biases to facilitate the subsequent After Action Review (AAR).

Attribute	Specification
Information Visible	The global timeline, communication channels, state changes, and the visible actions of all other participants.
Information Hidden	Cannot access the private, role-specific detailed views unless explicitly shared by a participant during the session.
Available Controls	"Mark Assumption," "Timestamp Event," "Flag Miscommunication," "Note Team Pivot."
Communication Responsibilities	Remains largely silent during active play to avoid interference, occasionally providing timeline callbacks if explicitly requested by the Coordinator.
Typical Decisions	Deciding which verbal exchanges or silent actions represent critical shifts in the team's mental model.
Failure Modes	Recording only the mechanical actions while failing to capture the underlying assumptions, debates, and unstated biases.
Accessibility Accommodations	Automated transcription integration, speech-to-text note-taking, and macro-based timeline tagging.
Desktop Interface	A chronological ledger with tagging, categorization, and robust annotation capabilities.
WebXR Interface	A floating, persistent timeline board that can be annotated using spatial pointers, voice dictation, or virtual sticky notes.
Debrief Contribution	Leads the debriefing session, presenting the timeline and highlighting critical communication breakdowns and cognitive biases.

Shared Session Flow and Storyboard

A complete session spans 15 to 25 minutes, structured to maximize tension, force collaboration, and deliver immediate pedagogical feedback. The progression models established tabletop exercise (TTX) methodologies advocated by NIST SP 800-84, transitioning from detection through containment to the critical debriefing phase12.

Phase	Duration	User Actions & System State
1\. Lobby & Device Check	0:00 \- 2:00	Participants connect. The system verifies WebXR compatibility, WebRTC/WebSocket stability, and audio hardware. Pre-approved guest aliases are assigned to ensure privacy.
2\. Role Selection	2:00 \- 3:00	Participants self-select or are assigned roles. The system verifies that minimum critical roles (Coordinator, Evidence Analyst) are filled before proceeding.
3\. Safety Notice	3:00 \- 3:30	A mandatory, unskippable notice confirming the synthetic, non-operational nature of the simulation is displayed, establishing the psychological safety of the exercise.
4\. Private Briefing	3:30 \- 4:30	Each role receives private baseline intelligence. The Human-Control Officer receives the ROE; the Systems Analyst views the healthy topology baseline.
5\. Spatial Orientation	4:30 \- 5:00	Participants spawn into the spatial War Room. Avatars calibrate. Audio spatialization (HRTF) is verified, ensuring users can localize teammates15.
6\. First Evidence	5:00 \- 6:00	The scenario injects an anomaly. The Evidence Analyst receives a corrupted log or an LLM prompt injection alert. Other screens show only secondary, ambiguous indicators.
7\. Conflicting Interpretation	6:00 \- 8:00	The Systems Analyst notes a traffic spike that contradicts the Evidence Analyst's initial assessment. The team must verbally reconcile the conflicting data streams.
8\. Team Communication	8:00 \- 10:00	The Coordinator structures the debate, requesting formal structured recommendation cards from both analysts to synthesize a unified hypothesis.
9\. First Intervention	10:00 \- 12:00	The team agrees on a minor containment action. The Defensive-Control Operator stages it; the Policy Officer approves it based on the ROE. Execution occurs.
10\. Invalidated Assumption	12:00 \- 14:00	The initial intervention causes a severe secondary reaction. The F2T2EA model transitions to 'Assess'1. The initial assumption is proven false, forcing a pivot.
11\. Authority Decision	14:00 \- 16:00	A severe threat is identified, requiring an intervention that breaches standard SLAs. The Policy Officer must evaluate an emergency exception and grant authorization.
12\. Final Containment	16:00 \- 18:00	The Coordinator forces a final decision under a countdown timer. The Operator executes the final safe-state mechanism or containment protocol.
13\. Outcome	18:00 \- 18:30	The simulation pauses. The immediate system impact of the final decision is displayed, showing the preserved versus compromised nodes.
14\. Ground-Truth Reveal	18:30 \- 20:00	The true nature of the simulated attack is revealed to all participants, stripping away the information asymmetry and establishing objective reality.
15\. Team Debrief	20:00 \- 24:00	The Observer leads an After Action Review (AAR). The system displays timestamps of when data was available versus when it was acted upon, mapping communication gaps14.
16\. Shareable Result	24:00 \- 25:00	Aggregate team performance metrics are generated. Individual performance remains strictly private. The session formally closes.

Communication System Specification

Because communication is the primary mechanic for resolving information asymmetry, the technical and interaction specifications for information exchange must be robust, accessible, and resilient. The system architecture guarantees high-fidelity, low-latency communication utilizing modern web standards.

Audio and Voice Systems

The primary communication channel utilizes WebRTC data channels for low-latency peer-to-peer audio transmission16. To enhance immersion and reduce cognitive load during overlapping conversations, the system employs the Web Audio API's PannerNode configured with Head-Related Transfer Functions (HRTF) to provide true spatial binaural audio15. This allows participants in the WebXR environment to perceive the precise location of speaking avatars, mimicking real-world acoustics. To maintain session discipline and prevent background noise interference, a global Push-to-Talk (PTT) mechanic is enforced by default. Furthermore, to comply with strict biometric and educational privacy mandates, raw voice data is inherently ephemeral. It is routed through a Secure Real-Time Transport Protocol (SRTP) pipeline and is never retained, transcribed, or recorded on the server by default unless explicit, opt-in consent is provided by all participants.

Non-Voice Parity and Accessibility

Adhering to W3C XR Accessibility User Requirements (XAUR)10, the system provides full learning parity for participants who cannot or choose not to use voice communication.

Text Chat & Captions: A pervasive text log captures typed communication. If Voice-to-Text is enabled via explicit consent, live captions appear above avatars and in the central log.
Text-Only Mode: Participants operating in environments where voice is restricted can seamlessly integrate into the team.
Structured Recommendation Cards: Participants can populate pre-formatted digital cards (e.g., "I observe \[X\] with \[High/Medium/Low\] confidence. I recommend we do \[Y\]"). These cards are transmitted directly to the Coordinator's interface.
Quick Evidence Pings: A spatial raycast tool in WebXR or a point-and-click interface on Desktop allows users to highlight a specific data node. This triggers a visual flare and a notification in the shared feed, instantly drawing the team's attention to an artifact.

Advanced Communication Actions

'Request Source' Action: A mechanical button allowing any user to challenge a stated fact, forcing the original claimant's interface to link and display the underlying simulated evidence to the challenger.
'Challenge Assumption' Action: A unique flag used by the Observer or Coordinator to halt rapid consensus, forcing the team to verbally defend their current hypothesis before proceeding.
Urgency Flag: Overrides standard notification hierarchies to flash a visual warning on all screens, used only when a participant identifies an immediate, catastrophic threshold.
Facilitator Broadcast: An omniscient text and audio channel allowing the human facilitator to issue "Voice of God" instructions, pacing cues, or scenario injects without occupying a physical avatar in the room.

Collaborative Decision and Authority Mechanics

Decisions within the War Room are not instantaneous. They are governed by distinct authorization mechanics that reflect the friction of real-world governance, incident response frameworks, and military targeting cycles1. The simulation explicitly does not portray faster action as automatically superior; many scenarios are designed to heavily penalize hasty interventions and reward deliberate verification.

1. Single-Role Authority: Utilized for role-specific, low-impact tactical tasks that do not alter the global state of the simulation. For example, the Evidence Analyst independently classifying a log line as anomalous requires no secondary approval.

2. Majority Vote: Employed by the Coordinator to break deadlocks on ambiguous threat intelligence. A holographic or UI-based prompt appears to the team, requiring a simple majority to proceed with a working hypothesis or minor intervention.

3. Consensus Requirement: Reserved for highly destructive or irreversible simulated actions, such as severing external network transit or wiping a database node. All active participants must explicitly lock in their agreement. Any disagreement pauses the execution timer until the dispute is resolved or the Coordinator abandons the action.

4. Two-Person Authorization: Used for specific defensive deployments that carry significant operational or legal risk. The Defensive-Control Operator must physically stage the intervention in their console, but the action cannot be executed until the Human-Control and Policy Officer applies their digital signature, verifying compliance with the ROE.

Edge Case Handling

Disagreement and Abstention: If a consensus vote fails, the Coordinator is notified of the dissenting parties. Participants may explicitly abstain, removing their requirement from a consensus tally but logging their lack of confidence.
Missing or Disconnected Participant: If a participant's connection drops, the system utilizes WebRTC to WebSocket fallback protocols19. If reconnection fails, the Coordinator may execute an override protocol to temporarily absorb the disconnected player's voting authority, ensuring the session does not hard-lock.
Expired Decision Window: If a decision mechanism times out before authorization is reached, the simulated threat progresses along its kill chain automatically. The system logs a "Failure to Act," providing a critical teaching moment for the debrief.
Conflicted Authority: If the Coordinator demands an action that the Policy Officer legally vetoes based on the ROE, the system strictly enforces the veto. The Coordinator must find an alternative, compliant path.
Facilitator Pause and Emergency Safe State: In scenarios of cascading failure or overwhelming cognitive load, any two participants can concurrently trigger an "Emergency Safe State," freezing the simulation. The Facilitator also retains a global pause capability to intervene for pedagogical realignment14.

Spatial War Room Environment Specification

The WebXR/Three.js environment is modeled as an abstract, low-poly command center. To minimize cognitive overload and maximize rendering performance, the design avoids skeuomorphic, decorative control panels. Every visible element serves a direct functional purpose tied to the simulation state. The rendering pipeline is highly optimized, utilizing techniques like frustum culling, draw-call batching, and instanced meshes to maintain the stringent 72-90 FPS requirements of immersive WebXR20.

Area	Purpose	Visual Treatment	Interactions & Accessibility
Central Chain Table	Global view of the F2T2EA or cyber intrusion phase.	Holographic, multi-segmented timeline dominating the room's center.	Desktop: 2D interactive progress bar. WebXR: Grab and rotate segments. A11y: High-contrast text, screen-reader sequence output.
Evidence Wall	Display of raw anomalies, logs, and prompt injections.	Monolithic grid of data blocks.	Only visible to Evidence Analyst and Coordinator. Blocks can be highlighted or linked to cards.
Source-Provenance Panel	Validation of data origins and cryptographic hashes.	Cryptographic tree structure.	Reduced Motion: Trees snap to grid rather than floating smoothly to prevent vestibular discomfort10.
Authority Gate	The physical manifestation of ROE approvals.	A digital turnstile or stamping station.	WebXR: Physical stamping or key-turning gesture. A11y: Single-click approval macro for mobility impairments.
Control Console	Staging and execution of defenses.	Interlocking geometric nodes representing system states.	Operated exclusively by the Defensive Operator. Avoids flashing lights; uses solid color shifts (green/red/blue) with distinct geometric shapes for colorblind accessibility.
Communications Map	Visualization of team data flow.	Node-link diagram tracking who has shared what.	Visible to Observer. Links pulse when data is transmitted via recommendation cards.
Confidence Display	Aggregated certainty metric.	A large, central gauge fluctuating between 0% and 100%.	Fluctuates dynamically based on the Evidence Analyst's input and verified team assumptions.
Shared Timeline	Immutable chronological record.	A continuous ribbon wrapping the upper perimeter.	Tags drop onto the ribbon when actions occur; selectable for review.
Debrief Theater	Post-simulation review space.	The room dynamically dims, and a central screen lowers.	Replays timestamps and decision nodes during the AAR phase.
Observer Balcony	Vantage point for the Recorder.	An elevated platform providing an unobstructed view of the table and all avatars.	Allows spatial annotation dropping and global visibility of public elements.

State and Realtime Requirements

The architecture must support robust, low-latency multi-user synchronization while remaining secure and entirely synthetic. To achieve this, the system relies on a hybrid network topology. WebRTC data channels manage high-frequency, ephemeral data such as avatar kinematics and spatial audio, aiming for motion-to-photon latency under 20ms23. Conversely, WebSockets handle authoritative state synchronization, ensuring reliable delivery of simulation events19.

Server-Authoritative Semantic Events: The browser client acts purely as a dumb terminal that renders state and captures user intent. All state transitions (e.g., "Deploy Patch") are validated by the backend PHP services. The server evaluates the command against the current operational state, policy gates, and role permissions before broadcasting the updated state.
Monotonic Event Sequence: All authoritative events are assigned a monotonic sequence number. This ensures deterministic state reconstruction and prevents race conditions if multiple users act simultaneously27.
Snapshot and Reconnect Behavior: To support unstable network conditions, the server maintains the current game state as a composite snapshot utilizing a ghost snapshot or delta-sync system28. A reconnecting client downloads the latest snapshot, followed by any subsequent delta events, ensuring seamless recovery within seconds without replaying the entire session history.
Idempotent Commands: Network volatility requires that client commands be idempotent. If a client transmits an "Approve Exception" command multiple times due to a dropped acknowledgment, the server processes the state change only once30.
Role-Based Event Visibility: The server selectively filters outbound payloads. The Evidence Analyst's client never receives the network topology payload, eliminating the possibility of client-side cheating or accidental data leakage through browser developer tools.
Deterministic Replay: Because the system relies on an append-only event store (Event Sourcing), any session can be perfectly replayed forward or backward for the Debrief Theater or asynchronous spectator viewing27.
Late Join and Participant Handoff: The architecture allows a user to drop into an active session, receive the latest state snapshot, and assume a vacant role instantly without disrupting the ongoing simulation.

Facilitator Dashboard

For facilitated classroom or corporate training environments, a human facilitator operates a dedicated 2D dashboard outside the WebXR environment. This interface acts as the orchestration engine for the scenario, aligning with NIST guidelines for tabletop exercise facilitation12.

Session Controls: Start, Pause, Resume, and End. Pausing halts the global countdown and freezes all avatar interactions, allowing for immediate pedagogical intervention.
Participant Management: Role assignment, late-join approval, and connection status monitoring. The facilitator possesses a "Disable Disruptive Participant" toggle, instantly revoking a user's interaction privileges if necessary.
Scenario Injector: The facilitator selects from a strict list of predefined scenario events (injects)33. Crucially, the interface is hardcoded to reject arbitrary scripts, external URLs, or live target data. The simulation must remain a closed, synthetic loop to guarantee safety.
Omniscient Visibility: The dashboard reveals the current evidence visibility across all roles, active decision timers, and the global confidence metric.
Pedagogical Interventions:
Reveal Hint: Sends a subtle visual pulse to a critical, overlooked piece of evidence.
Extend Time: Silently adds minutes to the global countdown if the pedagogical value of continued debate outweighs the stress of the timer.
Mark Teaching Moment: Drops an invisible bookmark on the session timeline for immediate recall during the debrief phase.
Rollback: Utilizing the event-sourced architecture, the facilitator can rewind the entire room state to a prior checkpoint, allowing the team to attempt a different decision path and observe alternate consequences14.

Spectator and Livestream Mode

To support educational esports, classroom demonstrations, and creator-hosted events, the system features a dedicated public-viewing mode designed to maximize engagement while rigorously protecting participant privacy.

Delayed Spectator Stream: All spectator data is intentionally delayed (e.g., by 30 to 60 seconds) to prevent real-time stream sniping or external interference with the active participants.
Omniscient Commentator View: Provides a comprehensive overview of the spatial room, highlighting the information asymmetry by visually indicating which player holds which data at any given moment.
Privacy Filtering: The spectator mode rigorously strips all private participant information. IP locations, exact device telemetry, private team chat, and raw voice feeds are never exposed to the public stream. Participant aliases are strictly enforced to comply with SOPPA and FERPA34.
Spoiler-Controlled Evidence: Spectators see only what the participants have actively uncovered or shared, preventing the audience from knowing the ground truth before the participants discover it, thus maintaining narrative tension.
Audience Interaction: Spectators can participate in non-authoritative polls (e.g., "Should the team sever the connection?"). These polls appear as ambient metrics in the commentator view but do not alter the authoritative server state.
Post-Event Replay: Generates a shareable event page containing the deterministic replay file, allowing asynchronous viewing and analysis.

Viral Event Formats

The platform supports repeatable, structured event formats designed to foster competition based on communication, analytical rigor, and verification, rather than simulated destruction or APM (Actions Per Minute).

1. Weekly Break-the-Chain Live: A syndicated weekly event where a new, highly complex LLM prompt-injection scenario is released globally. Teams compete for the most efficient, policy-compliant resolution.

2. Educator vs. Creator Challenge: Livestreamed exhibitions matching cybersecurity educators against prominent tech creators, highlighting different theoretical and practical approaches to crisis management.

3. AI-Security Incident Room: Focused entirely on emerging generative AI threats, such as data poisoning or model inversion, teaching participants the specific nuances of defending AI pipelines4.

4. Evidence-Verification Tournament: A high-speed, bracketed competition heavily weighting the Evidence Analyst and Coordinator roles, challenging teams to parse massive logs and verify hashes under extreme time constraints.

5. Human-Control Decision Lab: Scenarios heavily weighted toward ethical, legal, and compliance gray areas, prioritizing the Human-Control and Policy Officer's ability to navigate complex ROE without paralyzing the team.

6. Newcomer Guided Session: A slowed-down, facilitator-heavy format designed for onboarding students or corporate trainees with zero prior cybersecurity experience, utilizing frequent pauses and hints.

7. Expert Commentary Replay: Asynchronous events where recorded sessions of top-tier teams are played back while industry experts annotate and analyze their decision-making logic and communication efficiency.

8. Cross-School Cooperative Event: Pairs students from different educational institutions into a single War Room, forcing them to establish communication protocols, resolve terminology differences, and build trust with strangers instantly.

Team Scoring and Analytics

At the conclusion of the session, the system calculates a comprehensive performance matrix. To preserve psychological safety and encourage risk-taking, individual performance metrics remain entirely private. Only aggregate, team-level dimensions are exportable and shareable.

Evidence Sharing: Frequency and accuracy of data successfully moved from private views to the shared Coordinator view.
Source Verification: The team's reliance on primary provenance versus acting on unverified assumptions.
Communication Clarity: Measured by the ratio of structured recommendation cards utilized versus unstructured text chat or pings.
Assumption Correction: A critical multiplier awarded when the team successfully pivots their strategy after an initial assumption is invalidated by new evidence.
Appropriate Authority: Adherence to the defined decision mechanics (e.g., penalties for attempting to bypass the Policy Officer).
Intervention Timing: The efficiency of execution relative to the F2T2EA countdown.
Functional Preservation: The degree to which the team contained the threat without causing unnecessary collateral damage to the simulated infrastructure.
Recovery: The speed at which the team restored healthy operational state after the threat was neutralized.
Confidence Calibration: How accurately the team's stated confidence levels matched the actual ground-truth of the scenario.
Debrief Quality: A facilitator-awarded metric based on the team's self-reflection, identification of biases, and engagement during the After Action Review (AAR)35.

Analytics Plan

The system tracks metrics essential for continuous improvement of the simulation's pedagogical value, aligning with NIST SP 800-84 evaluation indicators37:

Mean Time to Detect (MTTD): Time from anomaly injection to the Evidence Analyst's initial flag.
Mean Time to Contain (MTTC): Time from the flag to the Defensive Operator's executed control.
Friction Points: Identifying specific scenario injects that consistently cause consensus deadlocks across multiple user cohorts.

Privacy, Safety, and Moderation Plan

Given the educational target audience, the architecture mandates rigorous adherence to privacy frameworks, specifically the Illinois Student Online Personal Protection Act (SOPPA)34, COPPA, and FERPA.

Data Minimization and Retention: The system operates on a zero-retention default for biometric and communication data. Voice streams are ephemeral. Event logs used for replay are scrubbed of Personally Identifiable Information (PII) and automatically purged after a configurable retention window to comply with data deletion mandates38. Data Privacy Agreements (DPAs) govern all backend storage38.
Alias Enforcement and Minor-Safe Defaults: All users are assigned system-generated or pre-approved guest aliases. Direct messaging between unlinked accounts is disabled to prevent harassment.
Small-Cohort Suppression: To prevent deanonymization through behavioral metadata, aggregate analytics are suppressed if the participant cohort falls below a statistical threshold, aligning with educational privacy best practices34.
Moderation and Access: Rooms are access-controlled via localized, single-use invite links. Facilitators hold absolute authority to block, mute, or remove participants.
Strict Synthetics: The system enforces a fundamental safety boundary: no arbitrary file uploads are permitted, no real-target substitutions are allowed, and no live external-system integrations (e.g., webhooks to real infrastructure) are possible. The simulation is entirely hermetic.

MVP versus Advanced Infrastructure

Minimum Viable Product (MVP)

The MVP prioritizes broad accessibility and core pedagogical mechanics over high-end graphics.

Networking: Relies exclusively on WebSockets for both state synchronization and communication logic, accepting slightly higher latency in exchange for firewall-friendly traversal and simpler deployment19.
Audio: Standard stereo audio channels without HRTF processing. Text-chat serves as the primary communication backbone.
Rendering: Basic Three.js implementation relying on standard WebGL. Frustum culling and aggressive level-of-detail (LOD) management are utilized to manage draw calls and maintain performance on lower-end hardware20.

Advanced Infrastructure (Post-MVP)

Networking: Implements a hybrid model. WebSockets handle the low-frequency, highly reliable Event Sourced state19. WebRTC data channels are introduced for peer-to-peer, low-latency transmission of avatar kinematics and transient interactions, falling back to WebSockets seamlessly if UDP traffic is blocked19.
Audio: Full Web Audio API integration using the PannerNode and generalized HRTF models for true spatial binaural audio, drastically improving immersion and reducing cognitive load during complex multi-user debates15.
Rendering: Transitions to WebGPU (where supported) utilizing BatchedMesh, multi-draw indirect extensions, and Instanced Rendering to drastically reduce CPU draw-call overhead22. Advanced depth-sensing occlusion is integrated for immersive AR users, allowing virtual command tables to occlude naturally behind real-world physical desks43.

Load and Failure Scenarios

Network Interruption: If a client's WebSocket connection drops, the UI gracefully grays out, pausing local input to prevent desynchronization. Upon reconnection, the client requests a state reconciliation delta from the server, instantly catching up to the current room state44.
Server Crash: The Event Sourced backend allows for the immediate spinning up of a redundant instance. Because all prior semantic events are stored immutably, the new server rebuilds the exact state matrix in milliseconds and accepts reconnecting clients without data loss.
Client Lag (Spectator/Device): WebXR clients experiencing thermal throttling or heavy WebGL draw-call limitations will automatically downscale viewport resolution and disable post-processing effects to maintain the mandatory framerate threshold required to prevent simulator sickness46.

Acceptance Criteria

To be considered complete and ready for deployment, the Kill Chains War Room must satisfy the following technical and product criteria:

1. Product Integrity: A full 6-role session can be completed from lobby orientation to final debrief within 25 minutes without encountering narrative dead-ends or logic loops.

2. State Synchronization: The server maintains authoritative state across all clients with an average reconciliation latency of under 100ms on standard broadband connections. Deterministic replay functionality flawlessly recreates the session from the event log.

3. Interaction Fidelity: Spatial audio successfully differentiates speaker locations in 3D space. Information asymmetry is strictly enforced; payload filtering ensures no client receives hidden information via network inspection.

4. Accessibility & Privacy Compliance: The system functions entirely without voice communication (via text and structured cards). The platform passes simulated SOPPA compliance audits, proving zero retention of PII or raw voice data34.

5. Safety & Security: Code audits mathematically verify that the application cannot execute network calls to arbitrary external IP addresses, nor can it accept executable payloads from users. The simulation remains perfectly hermetic.

Works cited

1. Accelerating the Acquisition Kill Chain \- National Contract Management Association (NCMA), https://ncmahq.org/Web/Shared\_Content/CM-Magazine/CM-Magazine-August-2021/Accelerating-the-Acquisition-Kill-Chain.aspx

2. C-UAS Kill Chain (F2T2EA) \- The Lightning Press SMARTbooks, https://www.thelightningpress.com/c-uas-kill-chain-f2t2ea/

3. Kill chain (military) \- Wikipedia, https://en.wikipedia.org/wiki/Kill\_chain\_(military)

4. LLMRisks Archive \- OWASP Gen AI Security Project, https://genai.owasp.org/llm-top-10/

5. Lighting the fuse for interaction and negotiation: The potential of information-gap digital puzzle games for language learning \- ERIC, https://files.eric.ed.gov/fulltext/EJ1477915.pdf

6. Teamwork assessment in cooperative video games: Evaluating patterns, associations, and validity by Yvonne Farah A thesis submit \- Department of Industrial and Manufacturing Systems Engineering \- Iowa State University, https://www.imse.iastate.edu/files/2024/07/Farah\_iastate\_0097M\_21091.pdf

7. A Dynamic Targeting Solution to Respond to Destructive Leaders \> Air University (AU) \> Wild Blue Yonder, https://www.airuniversity.af.edu/Wild-Blue-Yonder/Article-Display/Article/3669361/a-dynamic-targeting-solution-to-respond-to-destructive-leaders/

8. Leveraging Asymmetries in Multiplayer Games: Investigating Design Elements of Interdependent Play | Request PDF \- ResearchGate, https://www.researchgate.net/publication/309030688\_Leveraging\_Asymmetries\_in\_Multiplayer\_Games\_Investigating\_Design\_Elements\_of\_Interdependent\_Play

9. To Asymmetry and Beyond\!: Improving Social Connectedness by Increasing Designed Interdependence in Cooperative Play \- ResearchGate, https://www.researchgate.net/publication/332748230\_To\_Asymmetry\_and\_Beyond\_Improving\_Social\_Connectedness\_by\_Increasing\_Designed\_Interdependence\_in\_Cooperative\_Play

10. XR Accessibility User Requirements \- W3C, https://www.w3.org/TR/xaur/

11. Introduction to XR Accessibility \- TetraLogical, https://tetralogical.com/blog/2024/09/11/introduction-to-xr-accessibility/

12. Cybersecurity Tabletop Exercises | 2026 How-To Guide \- QuickStart, https://www.quickstart.com/blog/cyber-security/cybersecurity-tabletop-exercise-guide-2026/

13. NIST SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-84.pdf

14. How to Run an Effective Cybersecurity Tabletop Exercise \- N-able, https://www.n-able.com/blog/how-to-run-an-effective-cybersecurity-tabletop-exercise

15. Web audio spatialization basics \- Web APIs \- MDN Web Docs \- Mozilla, https://developer.mozilla.org/en-US/docs/Web/API/Web\_Audio\_API/Web\_audio\_spatialization\_basics

16. Experimental Evaluation of Interactive Edge/Cloud Virtual Reality Gaming over Wi-Fi using Unity Render Streaming \- arXiv, https://arxiv.org/html/2402.00540v2

17. A systematic review on WebRTC for potential applications and challenges beyond audio video streaming \- ResearchGate, https://www.researchgate.net/publication/386077344\_A\_systematic\_review\_on\_WebRTC\_for\_potential\_applications\_and\_challenges\_beyond\_audio\_video\_streaming

18. Spatial Audio for WebXR: Perceptual Evaluation of Sound Localization Technologies on the Browser \- Luca Turchet, http://www.lucaturchet.it/PUBLIC\_DOWNLOADS/publications/conferences/Spatial\_Audio\_for\_WebXR-Perceptual\_Evaluation\_of\_Sound\_Localization\_Technologies\_on\_the\_Browser.pdf

19. Hybrid WebRTC-WebSocket Communication and Adaptive State Synchronization for Scalable Real-Time 3D Collaborative Whiteboard \- ResearchGate, https://www.researchgate.net/publication/394065151\_Hybrid\_WebRTC-WebSocket\_Communication\_and\_Adaptive\_State\_Synchronization\_for\_Scalable\_Real-Time\_3D\_Collaborative\_Whiteboard

20. How can I optimise my THREE.JS rendering? \- Questions, https://discourse.threejs.org/t/how-can-i-optimise-my-three-js-rendering/42251

21. 100 Three.js Tips That Actually Improve Performance (2026) \- Utsubo, https://www.utsubo.com/blog/threejs-best-practices-100-tips

22. Draw Calls: The Silent Killer | Three.js Roadmap, https://threejsroadmap.com/blog/draw-calls-the-silent-killer

23. Experimental evaluation of interactive Edge/Cloud Virtual Reality gaming over Wi-Fi using unity render streaming \- Repositori UPF, https://repositori.upf.edu/bitstreams/544f3186-1499-4c04-bddd-691a0074a9da/download

24. Edge Rendering Architecture for multiuser XR Experiences and E2E Performance Assessment \- arXiv, https://arxiv.org/html/2406.07087v1

25. Bringing People Together in Virtual Spaces with Live 3D Collaboration \- Medium, https://medium.com/@archanapatukuri/bringing-people-together-in-virtual-spaces-with-live-3d-collaboration-6a1a255d02dc

26. Seeing Through the Robot's Eyes: Adaptive Point Cloud Streaming for Immersive Teleoperation \- C3Lab, https://c3lab.poliba.it/images/4/44/Euroxr-25.pdf

27. INTELLECTUM: A Hybrid AR-VR Metaverse Framework for Smart Cities \- MDPI, https://www.mdpi.com/2571-5577/9/3/61

28. How would a game-state snapshot system be implemented for networked real-time games?, https://gamedev.stackexchange.com/questions/87553/how-would-a-game-state-snapshot-system-be-implemented-for-networked-real-time-ga

29. Ghost snapshots and synchronization | Netcode for Entities | 1.3.2 \- Unity \- Manual, https://docs.unity3d.com/Packages/com.unity.netcode@1.3/manual/ghost-snapshots.html

30. What is event sourcing? Meaning, Examples, Use Cases, https://www.devopsschool.nl/event-sourcing/

31. What is Integrity? Meaning, Architecture, Examples, Use Cases, and, http://devsecopsschool.com/blog/integrity/

32. Tabletop Exercise \- Glossary | CSRC \- NIST Computer Security Resource Center, https://csrc.nist.gov/glossary/term/tabletop\_exercise

33. Research and Practice of Delivering Tabletop Exercises \- arXiv, https://arxiv.org/html/2404.10206v1

34. Student Online Personal Protection Act (SOPPA) | College of Education | Illinois State, https://education.illinoisstate.edu/about/lab-schools/policies/soppa/

35. wg-vulnerability-disclosures/docs/TTX/Tabletop-Exercise-Framework.md at main \- GitHub, https://github.com/ossf/wg-vulnerability-disclosures/blob/main/docs/TTX/Tabletop-Exercise-Framework.md

36. Debriefing Methods in Simulation-Based Education \- JournalAgent, https://pdf.journalagent.com/jern/pdfs/JERN\_18\_3\_341\_346.pdf

37. Incident Response Plan Testing For Cloud Security \- Wiz, https://www.wiz.io/academy/detection-and-response/incident-response-plan-testing

38. All About SOPPA: What Illinois Schools Must Know About Student Data Protections, https://www.cybernut.com/blog/all-about-soppa-what-illinois-schools-must-know-about-student-data-protections

39. (105 ILCS 85/) Student Online Personal Protection Act. \- ILGA.gov, https://www.ilga.gov/Legislation/ILCS/Articles?ActID=3806\&ChapterID=17\&Print=True

40. Building a WebRTC App with WebSockets, STUN, and TURN (Fallback): A Complete Guide | by Anant K. | Medium, https://medium.com/@anantkm1998/building-a-webrtc-app-with-websockets-stun-and-turn-fallback-a-complete-guide-1b2082604937

41. WEBGL\_multi\_draw extension \- Feature requests \- Babylon.js Forum, https://forum.babylonjs.com/t/webgl-multi-draw-extension/47345

42. Indirect draws in WebGPU and why they're so powerful \- Tiger's Place, https://tigerabrodi.blog/indirect-draws-in-webgpu-and-why-they-re-so-powerful

43. Depth occlusion | Meta Horizon OS Developers, https://developers.meta.com/horizon/documentation/web/iwsdk-guide-depth-sensing/

44. How does Multiplayer Game sync their state? Part-1 \- GitHub Gist, https://gist.github.com/qingwei91/535fa1f6b73062a46d716b741637aa8d

45. How to implement synchronization of browser-based online games when users refresh their browser \- Stack Overflow, https://stackoverflow.com/questions/66639964/how-to-implement-synchronization-of-browser-based-online-games-when-users-refres

46. WebXR Performance Optimization Workflow | Meta Horizon OS Developers, https://developers.meta.com/horizon/documentation/web/webxr-perf-workflow/

47. Building Efficient Three.js Scenes: Optimize Performance While Maintaining Quality, https://tympanus.net/codrops/2025/02/11/building-efficient-three-js-scenes-optimize-performance-while-maintaining-quality/