Public Claim Status Matrix
RayleeOps is the public claim-review ledger. It challenges, narrows, queues, blocks, retracts, denies, or routes claims; it does not create evidence or promote proof by presentation.
RayleeOps reviews claims.
RayleeOps does not create evidence.
RayleeOps does not prove runtime operation.
Closed proof routes elsewhere.
Unreviewed does not mean false; it means not reviewed here.
Website rendering is not proof.
How to read the matrix
reviewed / narrowed means the claim survived only inside a narrower wording boundary. queued means review is pending. unreviewed means unresolved on RayleeOps, not disproven. blocked means the claim is not allowed here without a later gate. retracted / denied means the claim failed or was withdrawn. closed elsewhere means the proof surface is outside RayleeOps and must be read there under its own boundary. system surface means the item is routing or architecture context, not proof by itself.
RayleeOps
contested review / claim ledger
HawkinsOps
closed V1 historical proof / legacy reference
HawkinsOperations
governed successor SOC architecture / proof system
Public claims by family
| Claim family | Surface | RayleeOps status | Supported wording | Blocked wording | Current receipt / route | Paired external surface | Next gate |
|---|---|---|---|---|---|---|---|
| Sigma detection library claim | RayleeOps receipt and HawkinsOps case study | reviewed / narrowed | 103-rule Sigma library with count, drift, UUID uniqueness, and strict content validation. | Runtime signal; universal SIEM deployability; current live detection. | The Counter Certified Nothing | HawkinsOps Sigma case study | Link runtime/signal proof artifact before any signal or deployability claim. |
| Wazuh dashboard / remediation claim | RayleeOps receipt and HawkinsOps case study | reviewed / narrowed | Historical primary-endpoint process-creation telemetry restoration and manager-to-indexer delivery validation during the remediation window. | Fleet-wide visibility; current-runtime visibility; production SOC coverage. | The Dashboard Lied Politely | HawkinsOps Wazuh case study | Link current and fleet visibility evidence before either claim is made. |
| Auto-close / automation claim | Registry cross-cutting sub-claim | queued | Headline automation metric is queued for review across benchmark surfaces. | Autonomous SOC; AI-approved disposition; AI-decided disposition; analyst-approved disposition. | Registry queued row | HawkinsOps proof route | Defend the headline with caveats or retract it from RayleeOps-reviewed wording. |
| AI Analyst / AI-assisted work claim | RayleeOps AI Analyst route | reviewed / narrowed | AI-assisted technical work is governed by claim separation, review roles, visible disagreement, and closure authority outside the model. | Autonomous SOC; AI-approved disposition; AI-decided disposition; production AI analyst coverage. | AI Analyst review map | HawkinsOps AI proof route | Keep every AI-assisted claim tied to evidence, status, and blocked wording before external use. |
| HawkinsOps V1 closed proof claim | HawkinsOps public proof surface | closed elsewhere | HawkinsOps is the closed V1 historical proof / legacy reference surface; RayleeOps routes contested review context back to it. | V1 counts as HawkinsOperations successor proof; V1 runtime as current V2 truth. | Registry coverage map | HawkinsOps | Read the HawkinsOps proof boundary directly; do not promote V1 material into successor claims without review. |
| HawkinsOperations successor governance claim | HawkinsOperations public architecture surface | system surface | HawkinsOperations is the governed successor architecture and proof-system surface that separates source, validation, runtime, signal, evidence, and public proof. | Documentation alone as a real control; architecture text as deployment proof. | AI Analyst surface map | HawkinsOperations | Verify status in HawkinsOperations proof records and control matrix before stronger claims. |
| HO-DET-001 / Closed SOC Loop claim | HawkinsOperations proof system | closed elsewhere | RayleeOps may route reviewers to the HawkinsOperations proof system; RayleeOps does not own the proof record or promote the claim. | Runtime-active; signal-observed; evidence-linked public proof; public-safe runtime proof; production-ready. | HawkinsOperations reviewer surface | HawkinsOperations GitHub organization | Read the authoritative HawkinsOperations proof record and current public proof ceiling before any claim reuse. |
| AWS-DET-001 fixture claim | HawkinsOperations fixture/proof context | blocked | RayleeOps can name this as a routed claim family only; it does not claim AWS-live behavior. | AWS-live; cloud deployment; live routing; runtime-active; signal-observed. | HawkinsOperations reviewer surface | HawkinsOperations GitHub organization | Require explicit HawkinsOperations proof status before any public wording beyond route-only context. |
| Runtime / signal / live detection claim | RayleeOps blocked boundary | blocked | RayleeOps can preserve that runtime and signal claims require separate evidence. | Runtime-active; signal-observed; live Splunk firing; current live detection; production SOC. | This matrix | HawkinsOperations proof system | Promote only through the authoritative proof/evidence path; RayleeOps cannot promote it by presentation. |
| Cribl / Wazuh / AWS-live routing claim | RayleeOps blocked boundary | blocked | RayleeOps can state that these routing claims are not claimed here. | Cribl-routed; Wazuh-routed; AWS-live; live pipeline route proof. | This matrix | HawkinsOperations proof system | Require current proof records before any route-active wording appears on a public surface. |
| Public proof / website rendering claim | All public surfaces | retracted / denied | Website pages can route reviewers and render approved wording; RayleeOps records claim status. | Website rendering as proof; public-safe proof by layout; evidence-linked public proof without review. | This matrix | HawkinsOperations proof system and HawkinsOps | Keep public wording below the strongest reviewed evidence boundary for the owning surface. |
| Unreviewed case-study rows | Registry | unreviewed | Unreviewed rows are unresolved on RayleeOps and remain visible for reviewer routing. | Unreviewed as false; unreviewed as approved; hidden backlog as clean status. | Registry unreviewed rows | HawkinsOps | Assign review, narrow wording, route elsewhere, block, deny, or retract. |