COPS Network Segmentation Workbench
Compare firewall and workload policy intent with flow, DNS and bounded laboratory reachability evidence.
Maturity: experimental. Offline correction playback is available. Laboratory isolation, host installation and production integrations remain unverified.
Usage
From the repository, inspect the package metadata, run its fixture playback, and validate its package contract:
python3 -m cops info network-segmentation-workbench
python3 -m cops demo network-segmentation-workbench
python3 -m cops check network-segmentation-workbench
From an exported package, run python3 scripts/demo.py. Inspect supplied input
with python3 scripts/assess.py --input examples/input.json --as-of 2026-10-15T12:00:00Z.
Create a strict native report with python3 scripts/report.py --input examples/input.json --as-of 2026-10-15T12:00:00Z --report-id report-demo --engagement-id eng-demo --scenario-id COPS-DEMO --result-id res-demo --target fixture:network-demo. The caller must supply those context identifiers;
the wrapper does not invent engagement or target provenance.
Design
The package uses the bounded COPS artifact assessment engine and content-free
SHA-256 evidence references. An immutable copy of its runtime is included in
vendor/runtime; update it using the repository runtime synchronization script.
The assessment does not establish production exploitability or compliance.
Data Contract
| Artifact | Purpose | Producer | Consumer | Validation |
|---|---|---|---|---|
examples/input.json | Supplied artifact envelope | Authorized collector | Assessment engine | Type and byte bounds |
examples/correction-cases.json | Correction acceptance cases | Synthetic fixture author | Demo and package checks | Expected codes and content hashes |
| Assessment result | Findings, coverage and limitations | Engine | Reviewer or report exporter | Native Finding contract and SHA-256 |
| Assessment report | Strict imported-evidence report | scripts/report.py | Native report exporter | cops.assessment-report/v1 semantic validation |
See the runnable playbook, verification, and walkthrough.
Typed policy and observation inputs
Run python3 scripts/assess.py --input examples/typed-input.json --as-of 2026-10-15T12:00:00Z for corrected first-match firewall, additive NetworkPolicy,
explicit flow and TTL-bound DNS examples. scripts/demo.py also checks their
vulnerable and insufficient counterparts. These synthetic snapshots establish
parser behavior; HTTP authorization denials do not establish network enforcement.